[deploy] Migrate ingress from nginx to traefik

[imnasnainaec]

Kubernetes support for ingress-nginx is expiring, so both qa and prod are being migrated.

This is a simple change for most projects, but because we use ingress-nginx in our local kubernetes deployments (dev, nuc, and laptop installer), we need to make sure the required change in qa/prod interferes with the local settings.

Current usage in The Combine

• traefik
• nginx
• ingress

Required helm updates (from Greg M in LTOps)

Added middleware for Traefik:

# Sets the maximum request body to 250MB
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: maxrequestbody-limit
spec:
  buffering:
    maxRequestBodyBytes: 262144000

maxrequestbody-limit above and below can be changed as desired.

Added helm config lines:

traefik.ingress.kubernetes.io/router.middlewares: thecombine-maxrequestbody-limit@kubernetescrd

traefik.ingress.kubernetes.io/router.tls: "true"

Updated helm value:

• ingressClass: change nginx to traefik

Todo

Untangle the qa/prod vs local ingress settings, possibly adding some conditional statements in deploy/helm/thecombine/ charts.

Less urgent follow-up:
Should we also migrate the local kubernetes cluster from nginx to traefik?

[imnasnainaec]

Required QA/prod updates according to DeepWiki:

Files that need to change

1. deploy/scripts/setup_files/profiles/prod.yaml and staging.yaml

Both profiles currently have no ingressClass set, so they inherit the default nginx from thecombine/values.yaml. 1

You need to add ingressClass: traefik under charts.thecombine in both files. 2 3

For prod.yaml specifically, the cert-proxy-server section also needs ingressClass: traefik, since it runs on the prod server and handles HTTP01 ACME challenges for NUC certificates. The ingress-nuc.yaml template already has the conditional logic for traefik, so only the value needs to be set. 4 5

2. deploy/helm/thecombine/templates/ingress-combine.yaml — body size limit (non-trivial)

The template already conditionally skips the nginx annotation when ingressClass != "nginx", so the nginx-specific annotation won't bleed into traefik deployments. 6

However, the 250m upload body size limit has no direct traefik ingress annotation equivalent. For traefik, this requires:

• A new Middleware resource (kind: Middleware) with buffering.maxRequestBodyBytes: 262144000
• A traefik.ingress.kubernetes.io/router.middlewares: <namespace>-<middleware-name>@kubernetescrd annotation added conditionally in ingress-combine.yaml

This is the most complex change — it requires a new Helm template file for the middleware, not just an annotation swap.

3. deploy/ansible/group_vars/server/main.yml

Change ingress_namespace: ingress-nginx to ingress_namespace: traefik (or kube-system if using k3s's built-in traefik). 7

The NUC and laptop (host_vars/localhost/main.yml) equivalents stay unchanged. 8

4. deploy/scripts/setup_files/cluster_config.yaml

The development cluster type (which documents the QA/prod setup steps) currently installs nginx-ingress-controller. 9

If QA/prod run on k3s (which ships traefik by default), you'd add a new cluster type — e.g., server — that installs only cert-manager + otel, omitting nginx-ingress-controller. If they run on a non-k3s distribution, a traefik helm chart entry would also need to be added here.

---

What does NOT need to change

File	Reason
profiles/nuc.yaml, nuc_qa.yaml, desktop.yaml, dev.yaml	Stay on nginx; dev.yaml even explicitly sets ingressClass: nginx
thecombine/values.yaml default ingressClass: nginx	NUC/desktop inherit this default correctly
cert-proxy-server/values.yaml default ingressClass: nginx	NUC cert proxy stays on nginx
group_vars/nuc/main.yml	Stays on ingress-nginx

---

Summary of risk

The straightforward changes are the profile files and group_vars/server/main.yml. The body size middleware for traefik is the only genuinely complex piece — it requires a new Kubernetes Middleware resource template in the thecombine helm chart, which has no equivalent single-annotation solution in traefik's ingress model.

Citations

File: deploy/helm/thecombine/values.yaml (L63-63)

ingressClass: nginx

File: deploy/scripts/setup_files/profiles/prod.yaml (L8-10)

charts:
  thecombine:
    # Disable AWS Login - only run released images from

File: deploy/scripts/setup_files/profiles/prod.yaml (L41-54)

  cert-proxy-server:
    aws-login:
      enabled: false
    global:
      awsS3Location: prod.thecombine.app
      pullSecretName: None
    combineCertProxyList:
      - hostname: nuc1.thecombine.app
        bucket: prod.thecombine.app
      - hostname: nuc2.thecombine.app
        bucket: prod.thecombine.app
      - hostname: nuc3.thecombine.app
        bucket: prod.thecombine.app
      - hostname: local.thecombine.app

File: deploy/scripts/setup_files/profiles/staging.yaml (L8-10)

charts:
  thecombine:
    # Frontend configuration items:

File: deploy/helm/cert-proxy-server/templates/ingress-nuc.yaml (L9-13)

{{- if eq $.Values.ingressClass "nginx" }}
    nginx.ingress.kubernetes.io/proxy-body-size: "250m"
{{- else if eq $.Values.ingressClass "traefik" }}
    traefik.ingress.kubernetes.io/router.entrypoints: web
{{- end }}

File: deploy/helm/thecombine/templates/ingress-combine.yaml (L7-9)

{{- if eq .Values.ingressClass "nginx" }}
    nginx.ingress.kubernetes.io/proxy-body-size: "250m"
{{- end }}

File: deploy/ansible/group_vars/server/main.yml (L27-27)

ingress_namespace: ingress-nginx

File: deploy/ansible/host_vars/localhost/main.yml (L26-26)

ingress_namespace: ingress-nginx

File: deploy/scripts/setup_files/cluster_config.yaml (L5-8)

  development:
    - cert-manager
    - nginx-ingress-controller
    - otel