v42.0.0 (2026-10-15)

There are 3 breaking changes in this release

Upgrade Notes

Kubernetes v1.30+: The chart now requires Kubernetes v1.30 or higher (#2030).
Traefik Hub Secret RBAC: Write verbs on Secrets (create, update, delete) are no longer granted cluster-wide.
- A Role now grants them in the release namespace only, where Traefik Hub writes its Secrets (#2028)
Transparency logs witnesses: (#2018):
- hub.transparencyLogs.witnessGroup.witnesses now defaults to null and threshold must be at least 1.
- Setting threshold, timeout or failOpen without any witness now fails.

Note

With hub.token, the chart now deploys a cluster-scoped ValidatingAdmissionPolicy that only allows Traefik Hub to write Opaque and kubernetes.io/tls Secrets.
Set hub.restrictSecretTypes: false if the installer cannot create cluster-scoped resources.

💥 BREAKING CHANGES

fix(tlogs)!: empty witness config #2018 by @LBF38
feat(chart)!: require Kubernetes v1.30 or higher #2030 by @mloiseleur
fix(rbac)!: 🐛 scope Traefik Hub secret write permissions to release namespace #2028 by @mloiseleur

🚀 Features

feat(hub): 🚀 support traefik hub v3.20.16 and v3.21.3 #2032 by @mloiseleur
feat(hub): restrict Secret types written by Traefik Hub #2031 by @mloiseleur

🐛 Bug fixes

fix(examples): fix outdated value schema used in additionalServices example #2023 by @jnoordsij

📦 Others

chore(deps): update github actions #2024 by @renovate-with-github-actions[bot]
chore(deps): update quay.io/helmpack/chart-testing docker tag to v3.15.0 #2025 by @renovate-with-github-actions[bot]
docs(agents): document Traefik Hub version bump #2033 by @mloiseleur
docs(examples): add Traefik Hub Gateway with the Traefik MCP server as a sidecar #2007 by @emilevauge
chore(release): 🚀 publish 42.0.0 #2034 by @mloiseleur

👌 Traefik version support

Traefik Proxy: v3.6.0 -> v3.7.14 (default)
Traefik Hub: v3.19.3 -> v3.21.3

traefik/traefik-helm-chart v42.0.0 on GitHub