=== 적용 전 — 앱이 보는 것 ===
"x-forwarded-host" : [ "app1.hyeonworks.com" ]
"x-forwarded-port" : [ "80" ]
"x-forwarded-proto" : [ "http" ]
"x-forwarded-server" : [ "traefik-59b7647586-t8fc7" ]
"x-real-ip" : [ "10.42.0.1" ]
(x-forwarded-for 가 없다. x-real-ip 는 flannel 게이트웨이다)

=== 저장소의 설정 전문 ===
apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    ports:
      web:
        forwardedHeaders:
          # Requests arriving from these sources keep their existing
          # X-Forwarded-* values instead of having them rewritten.
          #
          # 10.42.0.0/16 is the pod CIDR. It is required because the traefik
          # Service uses externalTrafficPolicy: Cluster, so svclb SNATs the
          # traffic and Traefik sees a pod-network address rather than the
          # host nginx address.
          #
          # The node/host range is deliberately absent. Because svclb SNATs,
          # the host nginx address never reaches Traefik — measured, not assumed.
          # Trusting a range that cannot appear only widens the surface.
          #
          # Trusting the whole pod CIDR still means any pod in the cluster could
          # forge these headers, which is why echo-network-policy.yaml restricts
          # who may reach the application at all.
          trustedIPs:
            - 10.42.0.0/16
      websecure:

=== 적용한다 (파일 주석이 적어 둔 두 줄) ===
helmchartconfig.helm.cattle.io/traefik created
Waiting for deployment "traefik" rollout to finish: 1 old replicas are pending termination...
Waiting for deployment "traefik" rollout to finish: 1 old replicas are pending termination...
deployment "traefik" successfully rolled out