From 3948350ac2a359ada0d6427f669d9a832c9a9315 Mon Sep 17 00:00:00 2001
From: Andrew Stoltz <1578013+astoltz@users.noreply.github.com>
Date: Thu, 18 Jun 2026 16:26:47 -0500
Subject: [PATCH] platform: align GX10 Traefik source policy with live chart

---
 gx10/platform/traefik-helmchart.yaml          | 84 +++++--------------
 .../FleetManifestLintTests.cs                 |  2 +-
 2 files changed, 20 insertions(+), 66 deletions(-)

diff --git a/gx10/platform/traefik-helmchart.yaml b/gx10/platform/traefik-helmchart.yaml
index 8b28b30..a26f34a 100644
--- a/gx10/platform/traefik-helmchart.yaml
+++ b/gx10/platform/traefik-helmchart.yaml
@@ -10,74 +10,28 @@ spec:
   targetNamespace: traefik-system
   createNamespace: true
   valuesContent: |
-    deployment:
-      replicas: 1
-    additionalArguments:
-      - "--api.dashboard=true"
-      - "--log.level=INFO"
-      - "--providers.kubernetescrd"
-      - "--providers.kubernetesingress"
-      - "--providers.kubernetescrd.allowEmptyServices=true"
-      - "--providers.kubernetesingress.allowEmptyServices=true"
-      - "--providers.kubernetesingress.ingressendpoint.publishedservice=traefik-system/traefik"
-    ingressRoute:
-      dashboard:
-        enabled: false
-    rbac:
-      enabled: true
     service:
       type: LoadBalancer
       spec:
         externalTrafficPolicy: Local
       annotations:
-        metallb.io/loadBalancerIPs: "10.0.57.202"
-        metallb.io/address-pool: "prod-pool"
-    ports:
-      web:
-        port: 8000
-        exposedPort: 80
-        protocol: TCP
-      websecure:
-        port: 8443
-        exposedPort: 443
-        protocol: TCP
-        tls:
+        metallb.universe.tf/address-pool: prod-pool
+        metallb.universe.tf/loadBalancerIPs: 10.0.57.202
+    ingressClass:
+      enabled: true
+      isDefaultClass: false
+    providers:
+      kubernetesCRD:
+        enabled: true
+        allowEmptyServices: true
+      kubernetesIngress:
+        enabled: true
+        allowEmptyServices: true
+        publishedService:
           enabled: true
-      irc:
-        port: 6667
-        exposedPort: 6667
-        protocol: TCP
-        expose:
-          default: true
-      irctls:
-        port: 6697
-        exposedPort: 6697
-        protocol: TCP
-        expose:
-          default: true
-      traefik:
-        port: 8080
-        exposedPort: 8080
-        protocol: TCP
-        expose:
-          default: false
-      metrics:
-        port: 9100
-        exposedPort: 9100
-        protocol: TCP
-        expose:
-          default: false
-    metrics:
-      prometheus:
-        entryPoint: metrics
-    resources:
-      requests:
-        cpu: "100m"
-        memory: "128Mi"
-      limits:
-        cpu: "500m"
-        memory: "256Mi"
-    tolerations:
-      - key: "node-role.kubernetes.io/control-plane"
-        operator: "Exists"
-        effect: "NoSchedule"
+    ingressRoute:
+      dashboard:
+        enabled: false
+    logs:
+      general:
+        level: INFO
diff --git a/tests/bluejay-infra-lint/FleetManifestLintTests.cs b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
index 264a5f6..81ab175 100644
--- a/tests/bluejay-infra-lint/FleetManifestLintTests.cs
+++ b/tests/bluejay-infra-lint/FleetManifestLintTests.cs
@@ -255,7 +255,7 @@ public sealed class FleetManifestLintTests
         var path = Path.Combine(Inventory.BluejayRoot, "gx10", "platform", "traefik-helmchart.yaml");
         var manifest = File.ReadAllText(path);
 
-        manifest.Should().Contain("metallb.io/loadBalancerIPs: \"10.0.57.202\"");
+        manifest.Should().Contain("metallb.universe.tf/loadBalancerIPs: 10.0.57.202");
         manifest.Should().Contain("spec:\n        externalTrafficPolicy: Local");
     }