switch to traefik as ingress controller and drop nginx helm chart config

[ibrokethecloud]

Problem:

Nginx Ingress is going to be deprecated. As a result Harvester needs to switch to the inbuilt traefik ingress controller available with rke2.

Solution:

The PR introduces the following changes

• removes the rke2-ingress-nginx helm chart config
• adds a new 99-traefik.yaml as part of install to all nodes to define ingress to switch to traefik

Related Issue(s):

harvester/harvester#10067

Test plan:

Additional documentation or context

[Copilot]

Pull request overview

This PR migrates Harvester’s RKE2 ingress setup away from the bundled nginx ingress chart configuration and toward using the built-in Traefik ingress controller available in RKE2.

Changes:

• Removed the HelmChartConfig customization for rke2-ingress-nginx from the rancherd bootstrap resources.
• Added an RKE2 config snippet template that selects traefik as the ingress controller.
• Updated the COS install stage generation to write /etc/rancher/rke2/config.yaml.d/99-traefik.yaml on nodes during initialization.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
pkg/config/templates/rke2-99-traefik.yaml	New RKE2 config snippet selecting Traefik as the ingress controller.
pkg/config/templates/rancherd-10-harvester.yaml	Removes nginx ingress HelmChartConfig overrides previously applied during bootstrap.
pkg/config/cos.go	Ensures the new Traefik ingress config snippet is rendered and written into RKE2 config drop-in directory.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[w13915984028]

this object needs an update per code:

https://github.com/harvester/harvester/pull/10074/changes#diff-faf5885b01cd2302527c43c77cc6a6b02c336feeb90a3f3d854306c337ad203aR42-R44

[w13915984028]

LGTM, thanks.

BTW, CI failed, it looks relying on controller PR harvester/harvester#10074 to test together.

[w13915984028]

need a similar helmchartconfig to enable the log of traefik

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: rke2-traefik
  namespace: kube-system
spec:
  valuesContent: |-
    logs:
      access:
        enabled: true
        format: json
    # Optional: Additional global logs
    log:
      level: INFO

it logs like

{"ClientAddr":"192.168.122.1:47986","ClientHost":"192.168.122.1","ClientPort":"47986","ClientUsername":"-","DownstreamContentSize":189,"DownstreamStatus":200,"Duration":2511685,"OriginContentSize":189,"OriginDuration":2435420,"OriginStatus":200,"Overhead":76265,"RequestAddr":"192.168.122.131","RequestContentSize":0,"RequestCount":66,"RequestHost":"192.168.122.131","RequestMethod":"GET","RequestPath":"/v1/harvester/kubevirt.io.virtualmachineinstancemigrations?pagesize=100000\u0026exclude=metadata.managedFields","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"websecure-cattle-system-rancher-expose@kubernetes","ServiceAddr":"10.52.0.12:80","ServiceName":"cattle-system-rancher-80@kubernetes","ServiceURL":"http://10.52.0.12:80","StartLocal":"2026-05-08T09:33:17.129831151Z","StartUTC":"2026-05-08T09:33:17.129831151Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-05-08T09:33:17Z"}

this is available on nginx by default

traefik doesn't log them without this helmchartconfig

[ibrokethecloud]

i can include it in another PR and also add it in the upgrade path too

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request