feat: ✨ add an experimental Traefik chart (simplification proposal)

[darkweaver87]

What

Adds a new, fully isolated experimental/ chart — a from-scratch redesign of the Traefik Helm chart, offered as a simplification proposal. It is unreleased, unsupported, fenced behind a loud "do NOT use in production" banner, and ships its own CI workflow. Nothing in the stable traefik/ chart changes.

Why

The stable chart's biggest maintenance cost is mirroring every Traefik and Kubernetes field by hand — and a large share of that is community PRs adding a single PodSpec/Service field that only the author uses. Exposing the real PodSpec and Traefik config verbatim removes that whole class of change: values.yaml drops from ~1570 to ~254 lines, and neither a new Traefik option nor a niche Kubernetes field needs a chart change anymore.

Issues this explores

• Improve deployment: configuration #1789 (improve deployment:) — the workload is a real PodSpec under deployment.spec.template.spec.*; no split or bespoke fields to learn.
• Improve ports: configuration #1476 (improve ports:) — entryPoints are verbatim traefik.entryPoints, and the Service surface is a name-keyed service.* map, decoupled from them.
• Provide possibility to install as statefulset #1247 (install as StatefulSet) — possibly: the presence-based controller model (deployment / daemonset) extends naturally to a statefulset key; not implemented yet, but the architecture makes it a small addition.

Design — a deliberate departure

This intentionally reverses the current scope boundary ("avoid values that expose static/dynamic Traefik configuration verbatim"). That trade-off is the proposal, so it's the thing to debate. It also looks quite different from what most Helm charts do — but even if it doesn't land as-is, it may inspire ideas for the stable chart or others.

• Verbatim traefik: block — Traefik static config passes through unchanged; no curated key per field.
• Real PodSpec — workload tuning via deployment.spec.template.spec.* (container merged by name), not bespoke values.
• Presence enables / null disables — no enabled: flags; this deliberately mirrors Traefik's own config, where a feature is on by the presence of its key (api: {}, metrics.prometheus: {}). Name-keyed maps for Services/Secrets/IngressRoutes.
• Schema-validated — a generated values.schema.json wires the chart surface to the upstream Kubernetes OpenAPI (editor autocomplete + install-time rejection). The traefik: block stays open for now; wiring an official Traefik static-config schema there is a planned follow-up, ideally with the Traefik Proxy/Hub teams, once a version-pinned public schema exists.
• Guardrails — a fail-fast validation layer with actionable messages, derived RBAC, a relaxed version guard (warn on minor/patch, fail on major), and hardened security defaults.

Scope of this PR

Experimental chart + EXAMPLES.md only — no migration tooling and no release.

Safety / isolation

• Lives entirely under experimental/ with a dedicated CI workflow: lint, 213 unit tests, schema-regeneration no-op check + transform unit tests, render of every example, and a CRD drift check.
• CRDs are a mirror of the stable chart's, kept honest by the CI crds-sync check.
• No release or version bump for the stable chart.

Feedback wanted

This only proves itself in real use — please install it and push your actual config through it. The call for feedback and the full design rationale live in the chart's README.md so they persist beyond this PR.

[darkweaver87]

😱 39,000 lines?! Don't panic — grab a towel 🏖️

Yes, it's big — and that's expected: this is a full rewrite / change of paradigm, not an incremental tweak. But before you slam that Close PR button, here's where those lines actually come from:

Category	+lines	%	🫠 Should you read it?
🤖 values.schema.json	22,834	58.0%	Nope — a robot wrote it (make schema)
📋 CRDs (crds/)	8,487	21.5%	Nope — copy-pasted from the stable chart, untouched
📖 EXAMPLES.md	2,721	6.9%	Only if you like recipes 🍳
✅ tests	2,678	6.8%	The 213 little guardians keeping us honest
✨ templates (the real chart!)	1,642	4.2%	👈 THIS. This is the PR.
🔧 hack/ tooling	426	1.1%	Schema builder + CRD-sync watchdog 🐶
⚙️ chart config	322	0.8%	Chart.yaml & friends
📝 README / VALUES.md	151	0.4%	Words about words
🎬 demo / CI	127	0.3%	The fun part
🧮 Total	39,388

TL;DR: ~80% (≈31,400 lines) is robot-generated schema 🤖 + verbatim CRD copies 📋 that nobody reviews by hand. The chart you actually review is ~1,640 lines of templates ✨ — roughly 4%. That's smaller than the legacy values.yaml alone (1,570 → 254 lines, by the way 📉).

Deep breath. You've got this. 💪

[aikido-pr-checks]

GitHub Action actions/checkout persist Git credentials in workflow - medium severity
actions/checkout v2 and above persist the default GITHUB_TOKEN in the repository's local git config when persist-credentials is not set to false, during the workflow run. Subsequent workflow steps or third-party actions can read this token from git configuration, increasing the risk of credential theft or misuse within the pipeline. In order to limit the attack surface when external actions are compromised, ensure persist-credentials is set to false.

Show fix

Remediation: Set persist-credentials: false on actions/checkout steps that do not need to push commits back to the repository. Only keep persist-credentials: true when the workflow explicitly performs authenticated git push operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}