chore(release): 🚀 publish 41.4.0

traefik/Changelog.md

@@ -1,5 +1,63 @@
 # Change Log
 
+## 41.4.0  ![AppVersion: v3.7.12](https://img.shields.io/static/v1?label=AppVersion&message=v3.7.12&color=success&logo=) ![Kubernetes: >=1.25.0-0](https://img.shields.io/static/v1?label=Kubernetes&message=%3E%3D1.25.0-0&color=informational&logo=kubernetes) ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
+
+**Release date:** 2026-08-27
+
+* fix: :bug: hub/proxy mapping
+* fix(rbac): restore secretResourceNames for namespaced role
+* feat: deprecate `underscoreHeadersStrategy` value
+* feat: add `aliasHeadersStrategy` value
+* feat(hub): :sparkles: support apiManagement OpenAPI refresh interval
+* feat(deps): update traefik docker tag to v3.7.12
+* feat(deps): update ghcr.io/traefik/traefik-hub docker tag to v3.20.12
+* chore(release): 🚀 publish 41.4.0
+
+### Default value changes
+
+```diff
+diff --git a/traefik/values.yaml b/traefik/values.yaml
+index 54a55eb..6bef216 100644
+--- a/traefik/values.yaml
++++ b/traefik/values.yaml
+@@ -1044,9 +1044,13 @@ ports:
+       middlewares: []  # @schema type: [array, null]
+       # -- (bool) See [upstream documentation](https://doc.traefik.io/traefik/security/request-path/#path-sanitization)
+       sanitizePath:  # @schema type:[boolean, null]
+-      # -- Defines how request headers with underscores in their names are handled (v3.7.6+).
++      # -- Defines how request headers with non-alphanumeric characters in their names are handled (v3.7.12+).
++      # See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#aliasheadersstrategy)
++      aliasHeadersStrategy:  # @schema enum:[keep, delete, reject, null]; type:[string, null]
++      # -- Defines how request headers with underscores in their names are handled (v3.7.6-v3.7.11).
++      # Replaced by the aliasHeadersStrategy option for Traefik v3.7.12+.
+       # See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#underscoreheadersstrategy)
+-      underscoreHeadersStrategy:  # @schema enum:[keep, delete, reject, null]; type:[string, null]
++      underscoreHeadersStrategy:  # @schema deprecated; enum:[keep, delete, reject, null]; type:[string, null]
+       tls:
+         # -- See [upstream documentation](https://doc.traefik.io/traefik/reference/install-configuration/entrypoints/#opt-http-tls)
+         # @default -- true
+@@ -1207,6 +1211,8 @@ rbac:  # @schema additionalProperties: false
+   # -- Enable user-facing roles
+   # https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
+   aggregateTo: []
++  # -- List of Kubernetes secrets that are accessible for Traefik when `rbac.namespaced` is true. If empty, then access is granted to every secret. Ignored when `rbac.namespaced` is false (ClusterRole), since Kubernetes RBAC does not support `resourceNames` on cluster-scoped list/watch rules.
++  secretResourceNames: []
+
+ # -- The service account the pods will use to interact with the Kubernetes API
+ serviceAccount:  # @schema additionalProperties: false
+@@ -1327,6 +1333,9 @@ hub:  # @schema additionalProperties: false
+     openApi:
+       # -- When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification
+       validateRequestMethodAndPath: false
++      # -- Interval to refresh the OpenAPI specification, as a Go duration. Must be at least `1m`.
++      # @default -- `1m` when unset
++      refreshInterval: ""
+
+   mcpgateway:
+     # -- Set to true in order to enable AI MCP Gateway. Requires a valid license token.
+```
+
+
 ## 41.3.0  ![AppVersion: v3.7.11](https://img.shields.io/static/v1?label=AppVersion&message=v3.7.11&color=success&logo=) ![Kubernetes: >=1.25.0-0](https://img.shields.io/static/v1?label=Kubernetes&message=%3E%3D1.25.0-0&color=informational&logo=kubernetes) ![Helm: v3](https://img.shields.io/static/v1?label=Helm&message=v3&color=informational&logo=helm)
 
 **Release date:** 2026-08-19

traefik/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: traefik
 description: A Traefik based Kubernetes ingress controller
 type: application
-version: 41.3.0
+version: 41.4.0
 # renovate: image=traefik
 appVersion: v3.7.12
 kubeVersion: '>=1.25.0-0'
@@ -27,9 +27,17 @@ annotations:
   traefik.io/hub-min-version: v3.19.3
   traefik.io/hub-max-version: v3.20.12
   artifacthub.io/changes: |
+    - kind: fixed
+      description: "fix: hub/proxy mapping"
+    - kind: fixed
+      description: "fix(rbac): restore secretResourceNames for namespaced role"
     - kind: added
-      description: "feat: add new options for traefik v3.7.11"
+      description: "feat: deprecate `underscoreHeadersStrategy` value"
     - kind: added
-      description: "feat(deps): ✨ update traefik-hub to v3.20.11"
+      description: "feat: add `aliasHeadersStrategy` value"
     - kind: added
-      description: "feat(deps): update traefik to v3.7.11 and traefik-hub to v3.20.10"
+      description: "feat(hub): support apiManagement OpenAPI refresh interval"
+    - kind: added
+      description: "feat(deps): update traefik docker tag to v3.7.12"
+    - kind: added
+      description: "feat(deps): update ghcr.io/traefik/traefik-hub docker tag to v3.20.12"

traefik/VALUES.md

@@ -1,6 +1,6 @@
 # traefik
 
-![Version: 41.3.0](https://img.shields.io/badge/Version-41.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v3.7.12](https://img.shields.io/badge/AppVersion-v3.7.12-informational?style=flat-square)
+![Version: 41.4.0](https://img.shields.io/badge/Version-41.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v3.7.12](https://img.shields.io/badge/AppVersion-v3.7.12-informational?style=flat-square)
 
 A Traefik based Kubernetes ingress controller