hack/update: add automated Traefik addon update script and workflow

.github/workflows/update-traefik-version.yml

@@ -0,0 +1,47 @@
+name: "update-traefik-version"
+on:
+  workflow_dispatch:
+  schedule:
+    # 1st of every month at 8:00 UTC
+    - cron: "0 8 1 * *"
+env:
+  GOPROXY: https://proxy.golang.org
+permissions:
+  contents: read
+
+jobs:
+  bump-traefik-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+        timeout-minutes: 1
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16
+        timeout-minutes: 2
+        with:
+          go-version-file: 'go.mod'
+      - name: Bump Traefik version
+        id: bumpTraefik
+        timeout-minutes: 1
+        run: |
+          out=$(make update-traefik-version)
+          echo "OLD_VERSION=$(echo "$out" | jq -r .old_version)" >> "$GITHUB_OUTPUT"
+          echo "NEW_VERSION=$(echo "$out" | jq -r .new_version)" >> "$GITHUB_OUTPUT"
+      - name: Create PR
+        if: ${{ steps.bumpTraefik.outputs.OLD_VERSION != steps.bumpTraefik.outputs.NEW_VERSION }}
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
+        timeout-minutes: 1
+        with:
+          token: ${{ secrets.MINIKUBE_BOT_PAT }}
+          commit-message: 'Addon Traefik: Update Traefik helm chart from ${{ steps.bumpTraefik.outputs.OLD_VERSION }} to ${{ steps.bumpTraefik.outputs.NEW_VERSION }}'
+          committer: minikube-bot <20374350+minikube-bot@users.noreply.github.com>
+          author: minikube-bot <20374350+minikube-bot@users.noreply.github.com>
+          branch: auto_bump_traefik_version
+          push-to-fork: minikube-bot/minikube
+          base: master
+          delete-branch: true
+          title: 'Addon Traefik: Update Traefik helm chart from ${{ steps.bumpTraefik.outputs.OLD_VERSION }} to ${{ steps.bumpTraefik.outputs.NEW_VERSION }}'
+          labels: ok-to-test
+          body: |
+            The [Traefik](https://github.com/traefik/traefik-helm-chart) project released a new helm chart version.
+
+            This PR was auto-generated by `make update-traefik-version` using [update-traefik-version.yml](https://github.com/kubernetes/minikube/tree/master/.github/workflows/update-traefik-version.yml) CI Workflow.

Makefile

@@ -1044,6 +1044,10 @@ update-volcano-version:
 update-kong-version:
 	cd hack && go run update/kong_version/kong_version.go
 
+.PHONY: update-traefik-version
+update-traefik-version:
+	cd hack && go run update/traefik_version/traefik_version.go
+
 .PHONY: update-kong-ingress-controller-version
 update-kong-ingress-controller-version:
 	cd hack && go run update/kong_ingress_controller_version/kong_ingress_controller_version.go

hack/update/get_version/get_version.go

@@ -78,6 +78,7 @@ var dependencies = map[string]dependency{
 	"registry":                {addonsFile, `registry:(.*)@`},
 	"runc":                    {"deploy/iso/minikube-iso/package/runc-master/runc-master.mk", `RUNC_MASTER_VERSION = (.*)`},
 	"debian":                  {dockerfile, `debian:bookworm-(.*)-slim`},
+	"traefik":                 {addonsFile, `Version:\s*"(.*)", // traefik-version`},
 	"volcano":                 {addonsFile, `volcanosh/vc-webhook-manager:(.*)@`},
 	"yakd":                    {addonsFile, `manusa/yakd:(.*)@`},
 }

hack/update/traefik_version/traefik_version.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2026 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"k8s.io/klog/v2"
+	"k8s.io/minikube/hack/update"
+)
+
+var schema = map[string]update.Item{
+	"pkg/minikube/assets/addons.go": {
+		Replace: map[string]string{
+			`Version:\s*".*", // traefik-version`: `Version: "{{.Version}}", // traefik-version`,
+		},
+	},
+}
+
+type Data struct {
+	Version string
+}
+
+type Output struct {
+	OldVersion string `json:"old_version"`
+	NewVersion string `json:"new_version"`
+}
+
+func main() {
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Minute)
+	defer cancel()
+
+	addonsPath := filepath.Join(update.FSRoot, "pkg/minikube/assets/addons.go")
+	content, err := os.ReadFile(addonsPath)
+	if err != nil {
+		klog.Fatalf("Unable to read %s: %v", addonsPath, err)
+	}
+
+	re := regexp.MustCompile(`Version:\s*"(.*)", // traefik-version`)
+	matches := re.FindSubmatch(content)
+	oldVersion := ""
+	if len(matches) > 1 {
+		oldVersion = string(matches[1])
+	}
+
+	ghc := update.GHClient()
+	release, _, err := ghc.Repositories.GetLatestRelease(ctx, "traefik", "traefik-helm-chart")
+	if err != nil {
+		klog.Fatalf("Unable to get latest Traefik helm chart version: %v", err)
+	}
+
+	newVersion := strings.TrimPrefix(release.GetTagName(), "v")
+
+	if oldVersion != newVersion {
+		data := Data{Version: newVersion}
+		if err := update.Apply(schema, data); err != nil {
+			klog.Fatalf("unable to apply update: %v", err)
+		}
+	}
+
+	out := Output{
+		OldVersion: oldVersion,
+		NewVersion: newVersion,
+	}
+
+	if err := json.NewEncoder(os.Stdout).Encode(out); err != nil {
+		klog.Fatalf("Unable to encode JSON output: %v", err)
+	}
+}

pkg/addons/helm.go

@@ -43,6 +43,9 @@ func installHelmChart(ctx context.Context, chart *assets.HelmChart) *exec.Cmd {
 	if chart.Namespace != "" {
 		args = append(args, "--namespace", chart.Namespace)
 	}
+	if chart.Version != "" {
+		args = append(args, "--version", chart.Version)
+	}
 
 	if chart.Values != nil {
 		for _, value := range chart.Values {

pkg/minikube/assets/addons.go

@@ -37,6 +37,7 @@ import (
 type HelmChart struct {
 	Name       string
 	Repo       string
+	Version    string
 	Namespace  string
 	Values     []string
 	ValueFiles []string
@@ -798,8 +799,9 @@ var Addons = map[string]*Addon{
 		// - https://doc.traefik.io/traefik/setup/kubernetes/
 		// - https://github.com/traefik/traefik-helm-chart/blob/master/traefik/VALUES.md
 		&HelmChart{
-			Name: "traefik",
-			Repo: "oci://ghcr.io/traefik/helm/traefik",
+			Name:    "traefik",
+			Repo:    "oci://ghcr.io/traefik/helm/traefik",
+			Version: "41.1.1", // traefik-version
 			// TODO: Use traefik namespace (requires support in addons infra)
 			Namespace: "kube-system",
 			Values: []string{