From 1d81410cd884e3efeb89554ed7291099f5b3bdfc Mon Sep 17 00:00:00 2001
From: mr-forust <vzlomdsisma@gmail.com>
Date: Mon, 28 Sep 2026 13:36:46 +0200
Subject: [PATCH] fix(traefik): persist plugin storage on a PVC

Mount traefik-plugins PVC at /plugins-storage instead of the chart default emptyDir, so the crowdsec-bouncer download survives node reboots. Without this Traefik starts before the network is ready, the download from plugins.traefik.io times out, plugins get disabled and every route behind the middleware returns 404/503 until a manual restart.
---
 traefik/k8s/plugins-pvc.yaml    | 11 +++++++++++
 traefik/k8s/traefik-values.yaml |  7 +++++++
 2 files changed, 18 insertions(+)
 create mode 100644 traefik/k8s/plugins-pvc.yaml

diff --git a/traefik/k8s/plugins-pvc.yaml b/traefik/k8s/plugins-pvc.yaml
new file mode 100644
index 0000000..7bf0f50
--- /dev/null
+++ b/traefik/k8s/plugins-pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: traefik-plugins
+  namespace: traefik
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 256Mi
diff --git a/traefik/k8s/traefik-values.yaml b/traefik/k8s/traefik-values.yaml
index 566e8a8..fc3c070 100644
--- a/traefik/k8s/traefik-values.yaml
+++ b/traefik/k8s/traefik-values.yaml
@@ -28,6 +28,13 @@ updateStrategy:
 
 deployment:
   enabled: true
+  additionalVolumes:
+    - name: plugins
+      persistentVolumeClaim:
+        claimName: traefik-plugins
+additionalVolumeMounts:
+  - name: plugins
+    mountPath: /plugins-storage
 
 providers:
   kubernetesIngress: