How to presistence plugins with k8s & helm values yaml

Traefik Traefik v3 (latest)
1

My values yaml

additionalArguments:
 - "--certificatesresolvers.httpresolver.acme.email=admin@example.com"
 - "--certificatesresolvers.httpresolver.acme.storage=/data/acme.json"
 - "--certificatesresolvers.httpresolver.acme.httpchallenge.entrypoint=web"
 - "--certificatesresolvers.httpresolver.acme.httpchallenge=true"

 - "--experimental.plugins.bandwidthlimiter.modulename=github.com/hhftechnology/bandwidthlimiter"
 - "--experimental.plugins.bandwidthlimiter.version=v1.0.1"

persistence:
  enabled: true
  name: data
  path: /data
  size: 2Gi
  storageClass: ""
deployment:
  initContainers:
    - name: volume-permissions
      image: busybox:latest
      command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json;"]
      volumeMounts:
        - mountPath: /data
          name: data
podSecurityContext:
  fsGroup: 65532
  fsGroupChangePolicy: "OnRootMismatch"

But got error

2025-11-06T05:39:46Z ERR Plugins are disabled because an error has occurred. error="unable to create plugins manager: unable to create directory /plugins-storage/sources: mkdir plugins-storage: read-only file system" plugins=["bandwidthlimiter"]
2

The error seems clear:

What’s your OS, how do you run Traefik?

3

helm values yaml

Setup Traefik on Kubernetes | Traefik | v3.5

4
  • Ubuntu24.04
  • k3s v1.33.5+k3s1 (fab4a5c3)
  • helm v3.19.0

My helm values yaml and install cmd

helm install traefik traefik/traefik --namespace traefik --values traefik-values.yaml

traefik-values.yaml

# Configure Network Ports and EntryPoints
# EntryPoints are the network listeners for incoming traffic.
image:
  tag: "v3.5.4"

ports:
  web:
    port: 80
    redirections:
      entryPoint:
        to: websecure
        scheme: https
        permanent: true
  websecure:
    port: 443

  tcp:
    port: 30000
    exposedPort: 30000
    protocol: TCP
  udp:
    port: 40000
    exposedPort: 40000
    protocol: UDP

api:
  dashboard: true
  insecure: false

providers:
  kubernetesIngress:
     enabled: false
  kubernetesGateway:
     enabled: false
  kubernetesCRD:
    enabled: true
ingressClass:
  enabled: false
gatewayClass:
  enabled: false

logs:
  general:
    level: INFO
  access:
    enabled: true

metrics:
  prometheus:
    enabled: true

additionalArguments:
 - "--certificatesresolvers.httpresolver.acme.email=admin@example.com"
 - "--certificatesresolvers.httpresolver.acme.storage=/data/acme.json"
 - "--certificatesresolvers.httpresolver.acme.httpchallenge.entrypoint=web"
 - "--certificatesresolvers.httpresolver.acme.httpchallenge=true"
 - "--experimental.plugins.bandwidthlimiter.modulename=github.com/hhftechnology/bandwidthlimiter"
 - "--experimental.plugins.bandwidthlimiter.version=v1.0.1"

persistence:
  enabled: true
  name: data
  path: /data
  size: 2Gi
  #accessMode: ReadWriteMany
  storageClass: ""
deployment:
  initContainers:
    - name: volume-permissions
      image: busybox:latest
      command: ["sh", "-c", "touch /data/acme.json; chmod -v 600 /data/acme.json;"]
      volumeMounts:
        - mountPath: /data
          name: data
podSecurityContext:
  fsGroup: 65532
  fsGroupChangePolicy: "OnRootMismatch"