Upgrade Traefik from chart 24.0.0 (v2.10) to chart 37.1.2 (v3.5.3)

[amdove]

Summary

Upgrade the default Traefik ingress controller from Helm chart 24.0.0 (Traefik v2.10) to chart 37.1.2 (Traefik v3.5.3).

Why this is needed

Traefik v2.x is EOL. Chart 24.0.0 ships Traefik v2.10, which uses the traefik.containo.us CRD API group that was completely removed in Traefik v3. While Kubernetes 1.36 does not itself remove any API that v2.10 depends on, running an EOL ingress controller on K8s 1.36 is unsupported — no security patches or compatibility fixes will be issued for v2.x going forward.

This upgrade is a prerequisite for the planned Kubernetes 1.36 upgrade across all workload clusters.

Relevant links:

• Traefik v2 → v3 migration guide: https://doc.traefik.io/traefik/migrate/v2-to-v3/
• Traefik v2 → v3 detailed config changes: https://doc.traefik.io/traefik/migrate/v2-to-v3-details/
• Traefik release deprecation policy: https://doc.traefik.io/traefik/deprecation/releases/
• Traefik Helm chart releases: https://github.com/traefik/traefik-helm-chart/releases

Backward compatibility

Chart 37.1.2 / Traefik v3.5.3 supports Kubernetes 1.22+. This means it can be deployed in place on clusters currently running K8s 1.31 through 1.35 — the Traefik upgrade can be performed independently of and prior to the Kubernetes 1.36 upgrade.

Breaking changes in the upgrade

This is a major version bump (v2 → v3) with required migration steps:

1. CRD API group rename — All traefik.containo.us resources (IngressRoute, Middleware, TLSOption, etc.) must be re-applied under the new traefik.io API group before or as part of the upgrade.
2. RBAC updates — ClusterRole/ClusterRoleBinding objects referencing traefik.containo.us must be updated.
3. New CRD versions — traefik.io/v1alpha1 is replaced by traefik.io/v1 in v3.

The migration must be coordinated carefully to avoid ingress downtime. See the migration guide above for the full procedure.

Acceptance criteria

• Default Traefik chart version updated to 37.1.2 in workload.go (or equivalent config)
• CRD migration documented and tested
• Verified working on a staging cluster before rolling to production
• Existing IngressRoute/Middleware resources confirmed functional after upgrade