traefik · darkweaver87 · Jul 31, 2026
diff --git a/traefik/VALUES.md b/traefik/VALUES.md
@@ -144,6 +144,7 @@ Kubernetes: `>=1.25.0-0`
 | hub.apimanagement.admission.secretName | string | `"hub-agent-cert"` | Certificate name of the WebHook admission server. Default: "hub-agent-cert". |
 | hub.apimanagement.admission.selfManagedCertificate | bool | `false` | By default, this chart handles directly the tls certificate required for the admission webhook. It's possible to disable this behavior and handle it outside of the chart. See EXAMPLES.md for more details. |
 | hub.apimanagement.enabled | bool | `false` | Set to true in order to enable API Management. Requires a valid license token. |
+| hub.apimanagement.openApi.refreshInterval | string | `""` | Interval to refresh the OpenAPI specification, as a Go duration. When empty, the provider default (`0`, disabled) applies. |
 | hub.apimanagement.openApi.validateRequestMethodAndPath | bool | `false` | When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification |
 | hub.enabled | bool | `true` when `hub.token` is set | Install Traefik Hub. Without `hub.token`, it runs in proxy mode: a drop-in Traefik Proxy, which requires Traefik Hub >= v3.21.0-ea. |
 | hub.hardened | bool | `false` | Use the hardened image variant. It appends `-hardened` to the tag and defaults the image to `registry.traefik.io/traefik-hub`. Requires `hub.enabled` and Traefik Hub >= v3.21.0-ea. |

diff --git a/traefik/templates/_podtemplate.tpl b/traefik/templates/_podtemplate.tpl
@@ -861,6 +861,9 @@
               {{- if .openApi.validateRequestMethodAndPath }}
           - "--hub.apiManagement.openApi.validateRequestMethodAndPath=true"
               {{- end }}
+              {{- with .openApi.refreshInterval }}
+          - "--hub.apiManagement.openApi.refreshInterval={{ . }}"
+              {{- end }}
              {{- end }}
             {{- end }}
             {{- with .aigateway }}

diff --git a/traefik/templates/requirements.yaml b/traefik/templates/requirements.yaml
@@ -214,6 +214,10 @@
     {{ fail "ERROR: hub.hardened is only available for Traefik Hub >= v3.21.0-ea, set image.tag accordingly." }}
   {{- end }}
 
+  {{- if and $.Values.hub.apimanagement.openApi.refreshInterval (semverCompare "<v3.21.0-0" $hubVersion) }}
+    {{ fail "ERROR: hub.apimanagement.openApi.refreshInterval is only available for Traefik Hub >= v3.21.0." }}
+  {{- end }}
+
   {{- if semverCompare "<v3.20.0-ea.7" $hubVersion }}
     {{- range $childName, $childConfig := $.Values.hub.providers.multicluster.children }}
       {{- if or (($childConfig.serversTransport).forwardingTimeouts).readTimeout (($childConfig.serversTransport).forwardingTimeouts).writeTimeout }}

diff --git a/traefik/tests/hub-apigateway-config_test.yaml b/traefik/tests/hub-apigateway-config_test.yaml
@@ -139,6 +139,30 @@ tests:
       - contains:
           path: spec.template.spec.containers[0].args
           content: "--hub.apiManagement.openApi.validateRequestMethodAndPath=true"
+  - it: should set the OpenAPI refresh interval
+    set:
+      image:
+        registry: ghcr.io
+        repository: traefik/traefik-hub
+        tag: v3.21.0-ea.1
+      hub:
+        apimanagement:
+          enabled: true
+          openApi:
+            refreshInterval: "5m"
+    asserts:
+      - contains:
+          path: spec.template.spec.containers[0].args
+          content: "--hub.apiManagement.openApi.refreshInterval=5m"
+  - it: should not set the OpenAPI refresh interval by default
+    set:
+      hub:
+        apimanagement:
+          enabled: true
+    asserts:
+      - notContains:
+          path: spec.template.spec.containers[0].args
+          content: "--hub.apiManagement.openApi.refreshInterval="
   - it: api management and ai gateway should not be enabled by default
     asserts:
       - notContains:

diff --git a/traefik/tests/requirements-config_test.yaml b/traefik/tests/requirements-config_test.yaml
@@ -735,6 +735,35 @@ tests:
             enabled: true
     asserts:
       - notFailedTemplate: {}
+  - it: should fail when using apiManagement openApi refreshInterval on Traefik Hub < v3.21.0
+    set:
+      image:
+        registry: "ghcr.io"
+        repository: "traefik/traefik-hub"
+        tag: v3.20.7
+      hub:
+        token: "xxx"
+        apimanagement:
+          enabled: true
+          openApi:
+            refreshInterval: "5m"
+    asserts:
+      - failedTemplate:
+          errorMessage: "ERROR: hub.apimanagement.openApi.refreshInterval is only available for Traefik Hub >= v3.21.0."
+  - it: should pass when using apiManagement openApi refreshInterval on Traefik Hub >= v3.21.0
+    set:
+      image:
+        registry: "ghcr.io"
+        repository: "traefik/traefik-hub"
+        tag: v3.21.0-ea.1
+      hub:
+        token: "xxx"
+        apimanagement:
+          enabled: true
+          openApi:
+            refreshInterval: "5m"
+    asserts:
+      - notFailedTemplate: {}
   - it: should fail when using pluginRegistry sources with unused plugin
     set:
       image:

diff --git a/traefik/values.schema.json b/traefik/values.schema.json
@@ -760,6 +760,10 @@
                         "openApi": {
                             "type": "object",
                             "properties": {
+                                "refreshInterval": {
+                                    "description": "Interval to refresh the OpenAPI specification, as a Go duration. When empty, the provider default (`0`, disabled) applies.",
+                                    "type": "string"
+                                },
                                 "validateRequestMethodAndPath": {
                                     "description": "When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification",
                                     "type": "boolean"

diff --git a/traefik/values.yaml b/traefik/values.yaml
@@ -1316,6 +1316,8 @@ hub:  # @schema additionalProperties: false
     openApi:
       # -- When set to true, it will only accept paths and methods that are explicitly defined in its OpenAPI specification
       validateRequestMethodAndPath: false
+      # -- Interval to refresh the OpenAPI specification, as a Go duration. When empty, the provider default (`0`, disabled) applies.
+      refreshInterval: ""
 
   mcpgateway:
     # -- Set to true in order to enable AI MCP Gateway. Requires a valid license token.