feat(plugins): support ConfigMap inline local plugins alongside hostPath

EXAMPLES.md

@@ -586,6 +586,62 @@ experimental:
 >[!IMPORTANT]
 > When using ``hostPath`` volumes, the plugin source code must be available on every node where Traefik pods might be scheduled.
 
+### Using Inline Plugin
+
+For testing or production deployments, embed plugin source directly in values.yaml:
+
+```yaml
+experimental:
+  localPlugins:
+    helloworld-plugin:
+      moduleName: github.com/example/helloworldplugin
+      mountPath: /plugins-local/src/github.com/example/helloworldplugin
+      inlinePlugin:
+        go.mod: |
+          module github.com/example/helloworldplugin
+
+          go 1.23
+        .traefik.yml: |
+          displayName: Hello World Plugin
+          type: middleware
+
+          import: github.com/example/helloworldplugin
+
+          summary: |
+            This is a simple plugin that prints "Hello, World!" to the response.
+
+          testData:
+            message: "Hello, World!"
+        main.go: |
+          package helloworldplugin
+
+          import (
+            "context"
+            "net/http"
+          )
+
+          type Config struct{}
+
+          func CreateConfig() *Config {
+            return &Config{}
+          }
+
+          type HelloWorld struct {
+            next http.Handler
+          }
+
+          func New(ctx context.Context, next http.Handler, config *Config, name string) (http.Handler, error) {
+            return &HelloWorld{next: next}, nil
+          }
+
+          func (h *HelloWorld) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
+            rw.Write([]byte("Hello, World!"))
+            h.next.ServeHTTP(rw, req)
+          }
+```
+
+> **Advantages**: No need for plugins on every node, better for containerized environments, supports up to 1MB of plugin code.
+
 ## Use Traefik native Let's Encrypt integration, without cert-manager
 
 In Traefik Proxy, ACME certificates are stored in a JSON file.

traefik/templates/_helpers.tpl

@@ -261,6 +261,10 @@ Hash: {{ sha1sum ($cert.Cert | b64enc) }}
     {{- end -}}
 {{- end -}}
 
+{{- define "traefik.localPluginCmName" -}}
+{{ include "traefik.fullname" .context }}-local-plugin-{{ .pluginName | replace "." "-" }}
+{{- end -}}
+
 {{- define "traefik.hasPluginsVolume" -}}
     {{- $found := false -}}
     {{- range . -}}

traefik/templates/_podtemplate.tpl

@@ -943,8 +943,15 @@
         {{- end }}
         {{- range $localPluginName, $localPlugin := .Values.experimental.localPlugins }}
         - name: {{ $localPluginName | replace "." "-" }}
+          {{- if $localPlugin.hostPath }}
           hostPath:
             path: {{ $localPlugin.hostPath | quote }}
+          {{- else if $localPlugin.inlinePlugin }}
+          configMap:
+            name: {{ include "traefik.localPluginCmName" (dict "context" $ "pluginName" $localPluginName) }}
+          {{- else }}
+            {{- fail (printf "ERROR: local plugin %s must specify either hostPath or inlinePlugin!" $localPluginName) }}
+          {{- end }}
         {{- end }}
         {{- if and (gt (len .Values.experimental.plugins) 0) (ne (include "traefik.hasPluginsVolume" .Values.deployment.additionalVolumes) "true") }}
         - name: plugins

traefik/templates/local-plugins-cm.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.experimental.localPlugins }}
+{{- range $localPluginName, $localPlugin := .Values.experimental.localPlugins }}
+{{- if $localPlugin.inlinePlugin }}
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "traefik.localPluginCmName" (dict "context" $ "pluginName" $localPluginName) }}
+  namespace: {{ template "traefik.namespace" $ }}
+  labels:
+    {{- include "traefik.labels" $ | nindent 4 }}
+data:
+  {{- range $fileName, $fileContent := $localPlugin.inlinePlugin }}
+  {{ $fileName }}: |
+    {{- $fileContent | nindent 4 }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}