fix(service)!: align syntax with upstream

Author: parkerfath

EXAMPLES.md

@@ -341,7 +341,8 @@ Or a [global IP on Ingress](https://cloud.google.com/kubernetes-engine/docs/tuto
 
 ```yaml
 service:
-  type: NodePort
+  spec:
+    type: NodePort
 extraObjects:
   - apiVersion: networking.k8s.io/v1
     kind: Ingress
@@ -364,7 +365,8 @@ ports:
   websecure:
     appProtocol: HTTPS # Hint for Google L7 load balancer
 service:
-  type: ClusterIP
+  spec:
+    type: ClusterIP
 extraObjects:
 - apiVersion: gateway.networking.k8s.io/v1beta1
   kind: Gateway
@@ -552,13 +554,13 @@ PROXY protocol is a protocol for sending client connection information, such as
 ```yaml
 service:
   enabled: true
-  type: LoadBalancer
   annotations:
     # This will tell DigitalOcean to enable the proxy protocol.
     # Note that only REGIONAL type loadbalancers are supported.
     # service.beta.kubernetes.io/do-loadbalancer-type: "REGIONAL"
     service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"
   spec:
+    type: LoadBalancer
     # This is the default and should stay as cluster to keep the DO health checks working.
     externalTrafficPolicy: Cluster
 
@@ -1751,7 +1753,8 @@ gatewayClass:
 service:
   additionalServices:
     external:
-      type: LoadBalancer
+      spec:
+        type: LoadBalancer
 
 providers:
   kubernetesGateway:
@@ -1789,3 +1792,11 @@ spec:
     #         kind: Secret
     #         name: some-tls-cert
 ```
+
+## Set externalTrafficPolicy Local for Traefik Service
+
+```yaml
+service:
+  spec:
+    externalTrafficPolicy: Local
+```

traefik/VALUES.md

@@ -455,17 +455,14 @@ Kubernetes: `>=1.25.0-0`
 | readinessProbe.timeoutSeconds | int | `2` | The number of seconds to wait for a probe response before considering it as failed. |
 | resources | object | `{}` | [Resources](https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/) for `traefik` container. |
 | securityContext | object | See _values.yaml_ | [SecurityContext](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/pod-v1/#security-context-1) |
-| service.additionalServices | object | `{}` |  |
+| service.additionalServices | object | `{}` | Can be used to create multiple Service. See EXAMPLES.md for more details. |
 | service.annotations | object | `{}` | Additional annotations applied to both TCP and UDP services (e.g. for cloud provider specific config) |
 | service.annotationsTCP | object | `{}` | Additional annotations for TCP service only |
 | service.annotationsUDP | object | `{}` | Additional annotations for UDP service only |
 | service.enabled | bool | `true` |  |
-| service.externalIPs | list | `[]` |  |
 | service.labels | object | `{}` | Additional service labels (e.g. for filtering Service by custom labels) |
-| service.loadBalancerSourceRanges | list | `[]` |  |
 | service.single | bool | `true` |  |
-| service.spec | object | `{}` | Cannot contain type, selector or ports entries. |
-| service.type | string | `"LoadBalancer"` |  |
+| service.spec | object | `{"type":"LoadBalancer"}` | Additional entries here will be added to the Service [spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#servicespec-v1-core). Cannot contain selector or ports entries. |
 | serviceAccount | object | `{"name":""}` | The service account the pods will use to interact with the Kubernetes API |
 | serviceAccountAnnotations | object | `{}` | Additional serviceAccount annotations (e.g. for oidc authentication) |
 | startupProbe | object | `{}` | Define [Startup Probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-startup-probes) |

traefik/templates/_service.tpl

@@ -15,38 +15,16 @@
   labels:
   {{- include "traefik.labels" .root | nindent 4 -}}
   {{- with .service.labels }}
-  {{- toYaml . | nindent 4 }}
+    {{- toYaml . | nindent 4 }}
   {{- end }}
 {{- end }}
 
 {{- define "traefik.service-spec" -}}
-  {{- $type := default "LoadBalancer" .service.type }}
-  type: {{ $type }}
-  {{- with .service.loadBalancerClass }}
-  loadBalancerClass: {{ . }}
-  {{- end}}
   {{- with .service.spec }}
-  {{- toYaml . | nindent 2 }}
+    {{- toYaml . | nindent 2 }}
   {{- end }}
   selector:
     {{- include "traefik.labelselector" .root | nindent 4 }}
-  {{- if eq $type "LoadBalancer" }}
-  {{- with .service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-  {{- toYaml . | nindent 2 }}
-  {{- end -}}
-  {{- end -}}
-  {{- with .service.externalIPs }}
-  externalIPs:
-  {{- toYaml . | nindent 2 }}
-  {{- end -}}
-  {{- with .service.ipFamilyPolicy }}
-  ipFamilyPolicy: {{ . }}
-  {{- end }}
-  {{- with .service.ipFamilies }}
-  ipFamilies:
-  {{- toYaml . | nindent 2 }}
-  {{- end -}}
 {{- end }}
 
 {{- define "traefik.service-ports" }}

traefik/tests/service-config-custom_test.yaml

@@ -22,7 +22,8 @@ tests:
       service:
         additionalServices:
           internal:
-            type: LoadBalancer
+            spec:
+              type: LoadBalancer
     asserts:
       - equal:
           path: spec.type
@@ -221,4 +222,3 @@ tests:
           apiVersion: v1
           name: RELEASE-NAME-traefik-internal
         documentIndex: 1
-

traefik/tests/service-config-multiple_test.yaml

@@ -168,7 +168,8 @@ tests:
     set:
       service:
         single: false
-        ipFamilyPolicy: PreferDualStack
+        spec:
+          ipFamilyPolicy: PreferDualStack
       ports:
         udp:
           port: 3000
@@ -205,8 +206,9 @@ tests:
     set:
       service:
         single: false
-        ipFamilies:
-          - IPv6
+        spec:
+          ipFamilies:
+            - IPv6
       ports:
         udp:
           port: 3000

traefik/tests/service-config_test.yaml

@@ -33,7 +33,8 @@ tests:
   - it: should be a custom type when specified via values
     set:
       service:
-        type: NodePort
+        spec:
+          type: NodePort
     asserts:
       - equal:
           path: spec.type
@@ -182,7 +183,8 @@ tests:
   - it: should have custom ipFamilyPolicy when specified via values
     set:
       service:
-        ipFamilyPolicy: PreferDualStack
+        spec:
+          ipFamilyPolicy: PreferDualStack
       ports:
         udp:
           port: 3000
@@ -205,8 +207,9 @@ tests:
   - it: should have custom ipFamilies when specified via values
     set:
       service:
-        ipFamilies:
-          - IPv6
+        spec:
+          ipFamilies:
+            - IPv6
       ports:
         udp:
           port: 3000
@@ -250,13 +253,13 @@ tests:
               enabled: true
     documentIndex: 0
     asserts:
-    - contains:
-        path: spec.ports
-        content:
-          port: 443
-          name: websecure-http3
-          targetPort: websecure-http3
-          protocol: UDP
+      - contains:
+          path: spec.ports
+          content:
+            port: 443
+            name: websecure-http3
+            targetPort: websecure-http3
+            protocol: UDP
   - it: should be possible to advertise a different http3 UDP port
     set:
       ports:
@@ -269,13 +272,13 @@ tests:
               enabled: true
     documentIndex: 0
     asserts:
-    - contains:
-        path: spec.ports
-        content:
-          port: 4443
-          name: websecure-http3
-          targetPort: websecure-http3
-          protocol: UDP
+      - contains:
+          path: spec.ports
+          content:
+            port: 4443
+            name: websecure-http3
+            targetPort: websecure-http3
+            protocol: UDP
   - it: should split TCP and UDP Service on http3 when single is false
     set:
       ports:
@@ -285,24 +288,24 @@ tests:
       service:
         single: false
     asserts:
-    - hasDocuments:
-        count: 2
-    - contains:
-        path: spec.ports
-        content:
-          port: 443
-          name: websecure
-          targetPort: websecure
-          protocol: TCP
-      documentIndex: 0
-    - contains:
-        path: spec.ports
-        content:
-          port: 443
-          name: websecure-http3
-          targetPort: websecure-http3
-          protocol: UDP
-      documentIndex: 1
+      - hasDocuments:
+          count: 2
+      - contains:
+          path: spec.ports
+          content:
+            port: 443
+            name: websecure
+            targetPort: websecure
+            protocol: TCP
+        documentIndex: 0
+      - contains:
+          path: spec.ports
+          content:
+            port: 443
+            name: websecure-http3
+            targetPort: websecure-http3
+            protocol: UDP
+        documentIndex: 1
   - it: should use advertisedPort with splitted TCP and UDP Service on http3 when single is false
     set:
       ports:
@@ -313,24 +316,24 @@ tests:
       service:
         single: false
     asserts:
-    - hasDocuments:
-        count: 2
-    - contains:
-        path: spec.ports
-        content:
-          port: 443
-          name: websecure
-          targetPort: websecure
-          protocol: TCP
-      documentIndex: 0
-    - contains:
-        path: spec.ports
-        content:
-          port: 4443
-          name: websecure-http3
-          targetPort: websecure-http3
-          protocol: UDP
-      documentIndex: 1
+      - hasDocuments:
+          count: 2
+      - contains:
+          path: spec.ports
+          content:
+            port: 443
+            name: websecure
+            targetPort: websecure
+            protocol: TCP
+        documentIndex: 0
+      - contains:
+          path: spec.ports
+          content:
+            port: 4443
+            name: websecure-http3
+            targetPort: websecure-http3
+            protocol: UDP
+        documentIndex: 1
 
   - it: should not be possible to use http3 without enabling tls
     set:

traefik/values.schema.json

@@ -2530,6 +2530,7 @@
             "type": "object",
             "properties": {
                 "additionalServices": {
+                    "description": "Can be used to create multiple Service. See EXAMPLES.md for more details.",
                     "type": "object"
                 },
                 "annotations": {
@@ -2547,25 +2548,21 @@
                 "enabled": {
                     "type": "boolean"
                 },
-                "externalIPs": {
-                    "type": "array"
-                },
                 "labels": {
                     "description": "Additional service labels (e.g. for filtering Service by custom labels)",
                     "type": "object"
                 },
-                "loadBalancerSourceRanges": {
-                    "type": "array"
-                },
                 "single": {
                     "type": "boolean"
                 },
                 "spec": {
-                    "description": "Additional entries here will be added to the service spec.",
-                    "type": "object"
-                },
-                "type": {
-                    "type": "string"
+                    "description": "Additional entries here will be added to the Service [spec](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.35/#servicespec-v1-core). Cannot contain selector or ports entries.",
+                    "type": "object",
+                    "properties": {
+                        "type": {
+                            "type": "string"
+                        }
+                    }
                 }
             }
         },