Update Helm release traefik to v42

[renovate]

This PR contains the following updates:

Package	Update	Change
traefik (source)	major	41.7.1 → 42.0.0

---

Release Notes

traefik/traefik-helm-chart (traefik)

v42.0.0

Compare Source

There are 3 breaking changes in this release

Upgrade Notes

1. Kubernetes v1.30+: The chart now requires Kubernetes v1.30 or higher (#​2030).
2. Traefik Hub Secret RBAC: Write verbs on Secrets (create, update, delete) are no longer granted cluster-wide.
   • A Role now grants them in the release namespace only, where Traefik Hub writes its Secrets (#​2028)
3. Transparency logs witnesses: (#​2018):
   • hub.transparencyLogs.witnessGroup.witnesses now defaults to null and threshold must be at least 1.
   • Setting threshold, timeout or failOpen without any witness now fails.

[!NOTE]
With hub.token, the chart now deploys a cluster-scoped ValidatingAdmissionPolicy that only allows Traefik Hub to write Opaque and kubernetes.io/tls Secrets.
Set hub.restrictSecretTypes: false if the installer cannot create cluster-scoped resources.

💥 BREAKING CHANGES

• fix(tlogs)!: empty witness config #​2018 by @​LBF38
• feat(chart)!: require Kubernetes v1.30 or higher #​2030 by @​mloiseleur
• fix(rbac)!: 🐛 scope Traefik Hub secret write permissions to release namespace #​2028 by @​mloiseleur

🚀 Features

• feat(hub): 🚀 support traefik hub v3.20.16 and v3.21.3 #​2032 by @​mloiseleur
• feat(hub): restrict Secret types written by Traefik Hub #​2031 by @​mloiseleur

🐛 Bug fixes

• fix(examples): fix outdated value schema used in additionalServices example #​2023 by @​jnoordsij

📦 Others

• chore(deps): update github actions #​2024 by @​renovate-with-github-actions[bot]
• chore(deps): update quay.io/helmpack/chart-testing docker tag to v3.15.0 #​2025 by @​renovate-with-github-actions[bot]
• docs(agents): document Traefik Hub version bump #​2033 by @​mloiseleur
• docs(examples): add Traefik Hub Gateway with the Traefik MCP server as a sidecar #​2007 by @​emilevauge
• chore(release): 🚀 publish 42.0.0 #​2034 by @​mloiseleur

👌 Traefik version support

• Traefik Proxy: v3.6.0 -> v3.7.14 (default)
• Traefik Hub: v3.19.3 -> v3.21.3

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Argo CD Diff Preview

Summary:

Modified (1):
± sandbox-oci-external-secrets (+3|-3)

sandbox-oci-external-secrets (applications/appset-ops-tools.yaml)

Deployment: external-secrets/sandbox-oci-external-secrets

         - --metrics-addr=:8080
         - --loglevel=info
         - --zap-time-encoding=epoch
-        image: ghcr.io/external-secrets/external-secrets:v2.13.0
+        image: ghcr.io/external-secrets/external-secrets:v2.12.0
         imagePullPolicy: IfNotPresent
         name: external-secrets
         ports:

Deployment: external-secrets/sandbox-oci-external-secrets-cert-controller

         - --loglevel=info
         - --zap-time-encoding=epoch
         - --enable-partial-cache=true
-        image: ghcr.io/external-secrets/external-secrets:v2.13.0
+        image: ghcr.io/external-secrets/external-secrets:v2.12.0
         imagePullPolicy: IfNotPresent
         name: cert-controller
         ports:

Deployment: external-secrets/sandbox-oci-external-secrets-webhook

         - --healthz-addr=:8081
         - --loglevel=info
         - --zap-time-encoding=epoch
-        image: ghcr.io/external-secrets/external-secrets:v2.13.0
+        image: ghcr.io/external-secrets/external-secrets:v2.12.0
         imagePullPolicy: IfNotPresent
         name: webhook
         ports:

Stats:
[Applications: 34], [Full Run: 1m13s], [Rendering: 23s], [Cluster: 18s], [Argo CD: 32s]