DevFW-CICD/ingress-nginx-helm
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Start migration of helm chart (#5159)

Browse source
This commit is contained in:
Manuel Alejandro de Brito Fontes 2020-02-24 16:25:57 -03:00 • committed by GitHub
parent 7e65b90c4b
commit 624cb5f048
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
67 changed files with 2977 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

71
charts/ingress-nginx/templates/NOTES.txt Normal file
View file

@ -0,0 +1,71 @@
The nginx-ingress controller has been installed.
{{- if contains "NodePort" .Values.controller.service.type }}
Get the application URL by running these commands:
{{- if (not (empty .Values.controller.service.nodePorts.http)) }}
export HTTP_NODE_PORT={{ .Values.controller.service.nodePorts.http }}
{{- else }}
export HTTP_NODE_PORT=$(kubectl --namespace {{ .Release.Namespace }} get services -o jsonpath="{.spec.ports[0].nodePort}" {{ template "nginx-ingress.controller.fullname" . }})
{{- end }}
{{- if (not (empty .Values.controller.service.nodePorts.https)) }}
export HTTPS_NODE_PORT={{ .Values.controller.service.nodePorts.https }}
{{- else }}
export HTTPS_NODE_PORT=$(kubectl --namespace {{ .Release.Namespace }} get services -o jsonpath="{.spec.ports[1].nodePort}" {{ template "nginx-ingress.controller.fullname" . }})
{{- end }}
export NODE_IP=$(kubectl --namespace {{ .Release.Namespace }} get nodes -o jsonpath="{.items[0].status.addresses[1].address}")
echo "Visit http://$NODE_IP:$HTTP_NODE_PORT to access your application via HTTP."
echo "Visit https://$NODE_IP:$HTTPS_NODE_PORT to access your application via HTTPS."
{{- else if contains "LoadBalancer" .Values.controller.service.type }}
It may take a few minutes for the LoadBalancer IP to be available.
You can watch the status by running 'kubectl --namespace {{ .Release.Namespace }} get services -o wide -w {{ template "nginx-ingress.controller.fullname" . }}'
{{- else if contains "ClusterIP" .Values.controller.service.type }}
Get the application URL by running these commands:
export POD_NAME=$(kubectl --namespace {{ .Release.Namespace }} get pods -o jsonpath="{.items[0].metadata.name}" -l "app={{ template "nginx-ingress.name" . }},component={{ .Values.controller.name }},release={{ .Release.Name }}")
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:80
echo "Visit http://127.0.0.1:8080 to access your application."
{{- end }}
An example Ingress that makes use of the controller:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: {{ .Values.controller.ingressClass }}
name: example
namespace: foo
spec:
rules:
- host: www.example.com
http:
paths:
- backend:
serviceName: exampleService
servicePort: 80
path: /
# This section is only required if TLS is to be enabled for the Ingress
tls:
- hosts:
- www.example.com
secretName: example-tls
If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:
apiVersion: v1
kind: Secret
metadata:
name: example-tls
namespace: foo
data:
tls.crt: <base64 encoded cert>
tls.key: <base64 encoded key>
type: kubernetes.io/tls
{{- if .Values.controller.headers }}
#################################################################################
###### WARNING: `controller.headers` has been deprecated! #####
###### It has been renamed to `controller.proxySetHeaders`. #####
#################################################################################
{{- end }}

117
charts/ingress-nginx/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,117 @@
{{/* vim: set filetype=mustache: */}}
{{/*
Expand the name of the chart.
*/}}
{{- define "nginx-ingress.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "nginx-ingress.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified app name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "nginx-ingress.fullname" -}}
{{- if .Values.fullnameOverride -}}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- $name := default .Chart.Name .Values.nameOverride -}}
{{- if contains $name .Release.Name -}}
{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
{{- else -}}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{- end -}}
{{- end -}}
{{/*
Create a default fully qualified controller name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "nginx-ingress.controller.fullname" -}}
{{- printf "%s-%s" (include "nginx-ingress.fullname" .) .Values.controller.name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Construct the path for the publish-service.
By convention this will simply use the <namespace>/<controller-name> to match the name of the
service generated.
Users can provide an override for an explicit service they want bound via `.Values.controller.publishService.pathOverride`
*/}}
{{- define "nginx-ingress.controller.publishServicePath" -}}
{{- $defServiceName := printf "%s/%s" .Release.Namespace (include "nginx-ingress.controller.fullname" .) -}}
{{- $servicePath := default $defServiceName .Values.controller.publishService.pathOverride }}
{{- print $servicePath | trimSuffix "-" -}}
{{- end -}}
{{/*
Create a default fully qualified default backend name.
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
*/}}
{{- define "nginx-ingress.defaultBackend.fullname" -}}
{{- printf "%s-%s" (include "nginx-ingress.fullname" .) .Values.defaultBackend.name | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Create the name of the controller service account to use
*/}}
{{- define "nginx-ingress.serviceAccountName" -}}
{{- if .Values.serviceAccount.create -}}
{{ default (include "nginx-ingress.fullname" .) .Values.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Create the name of the backend service account to use - only used when podsecuritypolicy is also enabled
*/}}
{{- define "nginx-ingress.defaultBackend.serviceAccountName" -}}
{{- if .Values.defaultBackend.serviceAccount.create -}}
{{ default (printf "%s-backend" (include "nginx-ingress.fullname" .)) .Values.defaultBackend.serviceAccount.name }}
{{- else -}}
{{ default "default-backend" .Values.defaultBackend.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Return the appropriate apiVersion for deployment.
*/}}
{{- define "deployment.apiVersion" -}}
{{- if semverCompare ">=1.9-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "apps/v1" -}}
{{- else -}}
{{- print "extensions/v1beta1" -}}
{{- end -}}
{{- end -}}
{{/*
Return the appropriate apiGroup for PodSecurityPolicy.
*/}}
{{- define "podSecurityPolicy.apiGroup" -}}
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "policy" -}}
{{- else -}}
{{- print "extensions" -}}
{{- end -}}
{{- end -}}
{{/*
Return the appropriate apiVersion for podSecurityPolicy.
*/}}
{{- define "podSecurityPolicy.apiVersion" -}}
{{- if semverCompare ">=1.10-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "policy/v1beta1" -}}
{{- else -}}
{{- print "extensions/v1beta1" -}}
{{- end -}}
{{- end -}}

14
charts/ingress-nginx/templates/addheaders-configmap.yaml Normal file
View file

@ -0,0 +1,14 @@
{{- if .Values.controller.addHeaders }}
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}-custom-add-headers
data:
{{ toYaml .Values.controller.addHeaders | indent 2 }}
{{- end }}

30
charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml Normal file
View file

@ -0,0 +1,30 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
rules:
- apiGroups:
- admissionregistration.k8s.io
resources:
- validatingwebhookconfigurations
verbs:
- get
- update
{{- if .Values.podSecurityPolicy.enabled }}
- apiGroups: ['extensions']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames:
- {{ template "nginx-ingress.fullname" . }}-admission
{{- end }}
{{- end }}

23
charts/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml Normal file
View file

@ -0,0 +1,23 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "nginx-ingress.fullname" . }}-admission
subjects:
- kind: ServiceAccount
name: {{ template "nginx-ingress.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
{{- end }}

55
charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml Normal file
View file

@ -0,0 +1,55 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission-create
annotations:
"helm.sh/hook": pre-install,pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
# Alpha feature since k8s 1.12
ttlSecondsAfterFinished: 0
{{- end }}
template:
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission-create
{{- with .Values.controller.admissionWebhooks.patch.podAnnotations }}
annotations:
{{ toYaml . | indent 8 }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
{{- if .Values.controller.admissionWebhooks.patch.priorityClassName }}
priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }}
{{- end }}
containers:
- name: create
image: {{ .Values.controller.admissionWebhooks.patch.image.repository }}:{{ .Values.controller.admissionWebhooks.patch.image.tag }}
imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }}
args:
- create
- --host={{ template "nginx-ingress.controller.fullname" . }}-admission,{{ template "nginx-ingress.controller.fullname" . }}-admission.{{ .Release.Namespace }}.svc
- --namespace={{ .Release.Namespace }}
- --secret-name={{ template "nginx-ingress.fullname". }}-admission
restartPolicy: OnFailure
serviceAccountName: {{ template "nginx-ingress.fullname" . }}-admission
{{- with .Values.controller.admissionWebhooks.patch.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
securityContext:
runAsNonRoot: true
runAsUser: 2000
{{- end }}

57
charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml Normal file
View file

@ -0,0 +1,57 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled }}
apiVersion: batch/v1
kind: Job
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission-patch
annotations:
"helm.sh/hook": post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
# Alpha feature since k8s 1.12
ttlSecondsAfterFinished: 0
{{- end }}
template:
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission-patch
{{- with .Values.controller.admissionWebhooks.patch.podAnnotations }}
annotations:
{{ toYaml . | indent 8 }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
{{- if .Values.controller.admissionWebhooks.patch.priorityClassName }}
priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }}
{{- end }}
containers:
- name: patch
image: {{ .Values.controller.admissionWebhooks.patch.image.repository }}:{{ .Values.controller.admissionWebhooks.patch.image.tag }}
imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.pullPolicy }}
args:
- patch
- --webhook-name={{ template "nginx-ingress.fullname" . }}-admission
- --namespace={{ .Release.Namespace }}
- --patch-mutating=false
- --secret-name={{ template "nginx-ingress.fullname". }}-admission
- --patch-failure-policy={{ .Values.controller.admissionWebhooks.failurePolicy }}
restartPolicy: OnFailure
serviceAccountName: {{ template "nginx-ingress.fullname" . }}-admission
{{- with .Values.controller.admissionWebhooks.patch.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
securityContext:
runAsNonRoot: true
runAsUser: 2000
{{- end }}

39
charts/ingress-nginx/templates/admission-webhooks/job-patch/psp.yaml Normal file
View file

@ -0,0 +1,39 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled .Values.podSecurityPolicy.enabled }}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
allowPrivilegeEscalation: false
fsGroup:
ranges:
- max: 65535
min: 1
rule: MustRunAs
requiredDropCapabilities:
- ALL
runAsUser:
rule: MustRunAsNonRoot
seLinux:
rule: RunAsAny
supplementalGroups:
ranges:
- max: 65535
min: 1
rule: MustRunAs
volumes:
- configMap
- emptyDir
- projected
- secret
- downwardAPI
{{- end }}

23
charts/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml Normal file
View file

@ -0,0 +1,23 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
rules:
- apiGroups:
- ""
resources:
- secrets
verbs:
- get
- create
{{- end }}

23
charts/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml Normal file
View file

@ -0,0 +1,23 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled }}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "nginx-ingress.fullname" . }}-admission
subjects:
- kind: ServiceAccount
name: {{ template "nginx-ingress.fullname" . }}-admission
namespace: {{ .Release.Namespace }}
{{- end }}

15
charts/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml Normal file
View file

@ -0,0 +1,15 @@
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "nginx-ingress.fullname" . }}-admission
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
{{- end }}

31
charts/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml Normal file
View file

@ -0,0 +1,31 @@
{{- if .Values.controller.admissionWebhooks.enabled }}
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingWebhookConfiguration
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}-admission
chart: {{ template "nginx-ingress.chart" . }}
component: "admission-webhook"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}-admission
webhooks:
- name: validate.nginx.ingress.kubernetes.io
rules:
- apiGroups:
- extensions
- networking.k8s.io
apiVersions:
- v1beta1
operations:
- CREATE
- UPDATE
resources:
- ingresses
failurePolicy: Fail
clientConfig:
service:
namespace: {{ .Release.Namespace }}
name: {{ template "nginx-ingress.controller.fullname" . }}-admission
path: /extensions/v1beta1/ingresses
{{- end }}

71
charts/ingress-nginx/templates/clusterrole.yaml Normal file
View file

@ -0,0 +1,71 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}
rules:
- apiGroups:
- ""
resources:
- configmaps
- endpoints
- nodes
- pods
- secrets
verbs:
- list
- watch
{{- if and .Values.controller.scope.enabled .Values.controller.scope.namespace }}
- apiGroups:
- ""
resources:
- namespaces
resourceNames:
- "{{ .Values.controller.scope.namespace }}"
verbs:
- get
{{- end }}
- apiGroups:
- ""
resources:
- nodes
verbs:
- get
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- update
- watch
- apiGroups:
- extensions
- "networking.k8s.io" # k8s 1.14+
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
- apiGroups:
- extensions
- "networking.k8s.io" # k8s 1.14+
resources:
- ingresses/status
verbs:
- update
{{- end -}}

19
charts/ingress-nginx/templates/clusterrolebinding.yaml Normal file
View file

@ -0,0 +1,19 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: {{ template "nginx-ingress.fullname" . }}
subjects:
- kind: ServiceAccount
name: {{ template "nginx-ingress.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end -}}

22
charts/ingress-nginx/templates/controller-configmap.yaml Normal file
View file

@ -0,0 +1,22 @@
{{- if or .Values.controller.config (or (or .Values.controller.proxySetHeaders .Values.controller.headers) .Values.controller.addHeaders) }}
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}
data:
{{- if .Values.controller.addHeaders }}
add-headers: {{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-custom-add-headers
{{- end }}
{{- if or .Values.controller.proxySetHeaders .Values.controller.headers }}
proxy-set-headers: {{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-custom-proxy-headers
{{- end }}
{{- if .Values.controller.config }}
{{ toYaml .Values.controller.config | indent 2 }}
{{- end }}
{{- end }}

253
charts/ingress-nginx/templates/controller-daemonset.yaml Normal file
View file

@ -0,0 +1,253 @@
{{- if or (eq .Values.controller.kind "DaemonSet") (eq .Values.controller.kind "Both") }}
{{- $useHostPort := .Values.controller.daemonset.useHostPort -}}
{{- $hostPorts := .Values.controller.daemonset.hostPorts -}}
apiVersion: {{ template "deployment.apiVersion" . }}
kind: DaemonSet
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}
annotations:
{{ toYaml .Values.controller.deploymentAnnotations | indent 4}}
spec:
selector:
matchLabels:
app: {{ template "nginx-ingress.name" . }}
release: {{ .Release.Name }}
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
updateStrategy:
{{ toYaml .Values.controller.updateStrategy | indent 4 }}
minReadySeconds: {{ .Values.controller.minReadySeconds }}
template:
metadata:
{{- if .Values.controller.podAnnotations }}
annotations:
{{- range $key, $value := .Values.controller.podAnnotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.controller.name }}"
release: {{ .Release.Name }}
{{- if .Values.controller.podLabels }}
{{ toYaml .Values.controller.podLabels | indent 8}}
{{- end }}
spec:
{{- if .Values.controller.dnsConfig }}
dnsConfig:
{{ toYaml .Values.controller.dnsConfig | indent 8 }}
{{- end }}
dnsPolicy: {{ .Values.controller.dnsPolicy }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.controller.priorityClassName }}
priorityClassName: "{{ .Values.controller.priorityClassName }}"
{{- end }}
{{- if .Values.controller.podSecurityContext }}
securityContext:
{{ toYaml .Values.controller.podSecurityContext | indent 8 }}
{{- end }}
containers:
- name: {{ template "nginx-ingress.name" . }}-{{ .Values.controller.name }}
image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
{{- if .Values.controller.lifecycle }}
lifecycle:
{{ toYaml .Values.controller.lifecycle | indent 12 }}
{{- end }}
args:
- /nginx-ingress-controller
{{- if .Values.defaultBackend.enabled }}
- --default-backend-service={{ .Release.Namespace }}/{{ template "nginx-ingress.defaultBackend.fullname" . }}
{{- else }}
{{- if (semverCompare "<0.21.0" .Values.controller.image.tag) }}
- --default-backend-service={{ required ".Values.controller.defaultBackendService is required if .Values.defaultBackend.enabled=false and .Values.controller.image.tag < 0.21.0" .Values.controller.defaultBackendService }}
{{- else if .Values.controller.defaultBackendService }}
- --default-backend-service={{ .Values.controller.defaultBackendService }}
{{- end }}
{{- end }}
{{- if and (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) .Values.controller.publishService.enabled }}
- --publish-service={{ template "nginx-ingress.controller.publishServicePath" . }}
{{- end }}
{{- if (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) }}
- --election-id={{ .Values.controller.electionID }}
{{- end }}
{{- if (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) }}
- --ingress-class={{ .Values.controller.ingressClass }}
{{- end }}
{{- if (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) }}
- --configmap={{ .Release.Namespace }}/{{ template "nginx-ingress.controller.fullname" . }}
{{- else }}
- --nginx-configmap={{ .Release.Namespace }}/{{ template "nginx-ingress.controller.fullname" . }}
{{- end }}
{{- if .Values.tcp }}
- --tcp-services-configmap={{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-tcp
{{- end }}
{{- if .Values.udp }}
- --udp-services-configmap={{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-udp
{{- end }}
{{- if .Values.controller.scope.enabled }}
- --watch-namespace={{ default .Release.Namespace .Values.controller.scope.namespace }}
{{- end }}
{{- if and (.Values.controller.reportNodeInternalIp) (.Values.controller.hostNetwork)}}
- --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- --validating-webhook=:{{ .Values.controller.admissionWebhooks.port }}
- --validating-webhook-certificate=/usr/local/certificates/cert
- --validating-webhook-key=/usr/local/certificates/key
{{- end }}
{{- if .Values.controller.maxmindLicenseKey }}
- --maxmind-license-key={{ .Values.controller.maxmindLicenseKey }}
{{- end }}
{{- range $key, $value := .Values.controller.extraArgs }}
{{- if $value }}
- --{{ $key }}={{ $value }}
{{- else }}
- --{{ $key }}
{{- end }}
{{- end }}
{{- if (semverCompare ">=0.16.0" .Values.controller.image.tag) }}
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
runAsUser: {{ .Values.controller.image.runAsUser }}
allowPrivilegeEscalation: {{ .Values.controller.image.allowPrivilegeEscalation }}
{{- end }}
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- if .Values.controller.extraEnvs }}
{{ toYaml .Values.controller.extraEnvs | indent 12 }}
{{- end }}
livenessProbe:
httpGet:
path: /healthz
port: {{ .Values.controller.livenessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.livenessProbe.failureThreshold }}
ports:
{{- range $key, $value := .Values.controller.containerPort }}
- name: {{ $key }}
containerPort: {{ $value }}
protocol: TCP
{{- if $useHostPort }}
hostPort: {{ index $hostPorts $key | default $value }}
{{- end }}
{{- end }}
{{- if .Values.controller.metrics.enabled }}
- name: metrics
containerPort: {{ .Values.controller.metrics.port }}
protocol: TCP
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- name: webhook
containerPort: {{ .Values.controller.admissionWebhooks.port }}
protocol: TCP
{{- end }}
{{- range $key, $value := .Values.tcp }}
- name: "{{ $key }}-tcp"
containerPort: {{ $key }}
protocol: TCP
{{- if $useHostPort }}
hostPort: {{ $key }}
{{- end }}
{{- end }}
{{- range $key, $value := .Values.udp }}
- name: "{{ $key }}-udp"
containerPort: {{ $key }}
protocol: UDP
{{- if $useHostPort }}
hostPort: {{ $key }}
{{- end }}
{{- end }}
readinessProbe:
httpGet:
path: /healthz
port: {{ .Values.controller.readinessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.readinessProbe.failureThreshold }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled) }}
volumeMounts:
{{- end }}
{{- if .Values.controller.customTemplate.configMapName }}
- mountPath: /etc/nginx/template
name: nginx-template-volume
readOnly: true
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- name: webhook-cert
mountPath: "/usr/local/certificates/"
readOnly: true
{{- end }}
{{- if .Values.controller.extraVolumeMounts }}
{{ toYaml .Values.controller.extraVolumeMounts | indent 12}}
{{- end }}
resources:
{{ toYaml .Values.controller.resources | indent 12 }}
{{- if .Values.controller.extraContainers }}
{{ toYaml .Values.controller.extraContainers | indent 8}}
{{- end }}
{{- if .Values.controller.extraInitContainers }}
initContainers:
{{ toYaml .Values.controller.extraInitContainers | indent 8}}
{{- end }}
hostNetwork: {{ .Values.controller.hostNetwork }}
{{- if .Values.controller.nodeSelector }}
nodeSelector:
{{ toYaml .Values.controller.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.controller.tolerations }}
tolerations:
{{ toYaml .Values.controller.tolerations | indent 8 }}
{{- end }}
{{- if .Values.controller.affinity }}
affinity:
{{ toYaml .Values.controller.affinity | indent 8 }}
{{- end }}
serviceAccountName: {{ template "nginx-ingress.serviceAccountName" . }}
terminationGracePeriodSeconds: 60
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes) }}
volumes:
{{- end }}
{{- if .Values.controller.customTemplate.configMapName }}
- name: nginx-template-volume
configMap:
name: {{ .Values.controller.customTemplate.configMapName }}
items:
- key: {{ .Values.controller.customTemplate.configMapKey }}
path: nginx.tmpl
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- name: webhook-cert
secret:
secretName: {{ template "nginx-ingress.fullname". }}-admission
{{- end }}
{{- if .Values.controller.extraVolumes }}
{{ toYaml .Values.controller.extraVolumes | indent 8}}
{{- end }}
{{- end }}

245
charts/ingress-nginx/templates/controller-deployment.yaml Normal file
View file

@ -0,0 +1,245 @@
{{- if or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both") }}
apiVersion: {{ template "deployment.apiVersion" . }}
kind: Deployment
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}
annotations:
{{ toYaml .Values.controller.deploymentAnnotations | indent 4}}
spec:
selector:
matchLabels:
app: {{ template "nginx-ingress.name" . }}
release: {{ .Release.Name }}
{{- if not .Values.controller.autoscaling.enabled }}
replicas: {{ .Values.controller.replicaCount }}
{{- end }}
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
strategy:
{{ toYaml .Values.controller.updateStrategy | indent 4 }}
minReadySeconds: {{ .Values.controller.minReadySeconds }}
template:
metadata:
{{- if .Values.controller.podAnnotations }}
annotations:
{{- range $key, $value := .Values.controller.podAnnotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.controller.name }}"
release: {{ .Release.Name }}
{{- if .Values.controller.podLabels }}
{{ toYaml .Values.controller.podLabels | indent 8 }}
{{- end }}
spec:
{{- if .Values.controller.dnsConfig }}
dnsConfig:
{{ toYaml .Values.controller.dnsConfig | indent 8 }}
{{- end }}
dnsPolicy: {{ .Values.controller.dnsPolicy }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.controller.priorityClassName }}
priorityClassName: "{{ .Values.controller.priorityClassName }}"
{{- end }}
{{- if .Values.controller.podSecurityContext }}
securityContext:
{{ toYaml .Values.controller.podSecurityContext | indent 8 }}
{{- end }}
containers:
- name: {{ template "nginx-ingress.name" . }}-{{ .Values.controller.name }}
image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
{{- if .Values.controller.lifecycle }}
lifecycle:
{{ toYaml .Values.controller.lifecycle | indent 12 }}
{{- end }}
args:
- /nginx-ingress-controller
{{- if .Values.defaultBackend.enabled }}
- --default-backend-service={{ .Release.Namespace }}/{{ template "nginx-ingress.defaultBackend.fullname" . }}
{{- else }}
{{- if (semverCompare "<0.21.0" .Values.controller.image.tag) }}
- --default-backend-service={{ required ".Values.controller.defaultBackendService is required if .Values.defaultBackend.enabled=false and .Values.controller.image.tag < 0.21.0" .Values.controller.defaultBackendService }}
{{- else if .Values.controller.defaultBackendService }}
- --default-backend-service={{ .Values.controller.defaultBackendService }}
{{- end }}
{{- end }}
{{- if and (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) .Values.controller.publishService.enabled }}
- --publish-service={{ template "nginx-ingress.controller.publishServicePath" . }}
{{- end }}
{{- if (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) }}
- --election-id={{ .Values.controller.electionID }}
{{- end }}
{{- if (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) }}
- --ingress-class={{ .Values.controller.ingressClass }}
{{- end }}
{{- if (semverCompare ">=0.9.0-beta.1" .Values.controller.image.tag) }}
- --configmap={{ default .Release.Namespace .Values.controller.configMapNamespace }}/{{ template "nginx-ingress.controller.fullname" . }}
{{- else }}
- --nginx-configmap={{ default .Release.Namespace .Values.controller.configMapNamespace }}/{{ template "nginx-ingress.controller.fullname" . }}
{{- end }}
{{- if .Values.tcp }}
- --tcp-services-configmap={{ default .Release.Namespace .Values.controller.tcp.configMapNamespace }}/{{ template "nginx-ingress.fullname" . }}-tcp
{{- end }}
{{- if .Values.udp }}
- --udp-services-configmap={{ default .Release.Namespace .Values.controller.udp.configMapNamespace }}/{{ template "nginx-ingress.fullname" . }}-udp
{{- end }}
{{- if .Values.controller.scope.enabled }}
- --watch-namespace={{ default .Release.Namespace .Values.controller.scope.namespace }}
{{- end }}
{{- if and (.Values.controller.reportNodeInternalIp) (.Values.controller.hostNetwork) }}
- --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- --validating-webhook=:{{ .Values.controller.admissionWebhooks.port }}
- --validating-webhook-certificate=/usr/local/certificates/cert
- --validating-webhook-key=/usr/local/certificates/key
{{- end }}
{{- if .Values.controller.maxmindLicenseKey }}
- --maxmind-license-key={{ .Values.controller.maxmindLicenseKey }}
{{- end }}
{{- range $key, $value := .Values.controller.extraArgs }}
{{- if $value }}
- --{{ $key }}={{ $value }}
{{- else }}
- --{{ $key }}
{{- end }}
{{- end }}
{{- if (semverCompare ">=0.16.0" .Values.controller.image.tag) }}
securityContext:
capabilities:
drop:
- ALL
add:
- NET_BIND_SERVICE
runAsUser: {{ .Values.controller.image.runAsUser }}
allowPrivilegeEscalation: {{ .Values.controller.image.allowPrivilegeEscalation }}
{{- end }}
env:
- name: POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
{{- if .Values.controller.extraEnvs }}
{{ toYaml .Values.controller.extraEnvs | indent 12 }}
{{- end }}
livenessProbe:
httpGet:
path: /healthz
port: {{ .Values.controller.livenessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.livenessProbe.failureThreshold }}
ports:
{{- range $key, $value := .Values.controller.containerPort }}
- name: {{ $key }}
containerPort: {{ $value }}
protocol: TCP
{{- end }}
{{- if .Values.controller.metrics.enabled }}
- name: metrics
containerPort: {{ .Values.controller.metrics.port }}
protocol: TCP
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- name: webhook
containerPort: {{ .Values.controller.admissionWebhooks.port }}
protocol: TCP
{{- end }}
{{- range $key, $value := .Values.tcp }}
- name: "{{ $key }}-tcp"
containerPort: {{ $key }}
protocol: TCP
{{- end }}
{{- range $key, $value := .Values.udp }}
- name: "{{ $key }}-udp"
containerPort: {{ $key }}
protocol: UDP
{{- end }}
readinessProbe:
httpGet:
path: /healthz
port: {{ .Values.controller.readinessProbe.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.controller.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.controller.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.controller.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.controller.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.controller.readinessProbe.failureThreshold }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled) }}
volumeMounts:
{{- end }}
{{- if .Values.controller.customTemplate.configMapName }}
- mountPath: /etc/nginx/template
name: nginx-template-volume
readOnly: true
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- name: webhook-cert
mountPath: "/usr/local/certificates/"
readOnly: true
{{- end }}
{{- if .Values.controller.extraVolumeMounts }}
{{ toYaml .Values.controller.extraVolumeMounts | indent 12}}
{{- end }}
resources:
{{ toYaml .Values.controller.resources | indent 12 }}
{{- if .Values.controller.extraContainers }}
{{ toYaml .Values.controller.extraContainers | indent 8}}
{{- end }}
{{- if .Values.controller.extraInitContainers }}
initContainers:
{{ toYaml .Values.controller.extraInitContainers | indent 8}}
{{- end }}
hostNetwork: {{ .Values.controller.hostNetwork }}
{{- if .Values.controller.nodeSelector }}
nodeSelector:
{{ toYaml .Values.controller.nodeSelector | indent 8 }}
{{- end }}
{{- if .Values.controller.tolerations }}
tolerations:
{{ toYaml .Values.controller.tolerations | indent 8 }}
{{- end }}
{{- if .Values.controller.affinity }}
affinity:
{{ toYaml .Values.controller.affinity | indent 8 }}
{{- end }}
serviceAccountName: {{ template "nginx-ingress.serviceAccountName" . }}
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes) }}
volumes:
{{- end }}
{{- if .Values.controller.customTemplate.configMapName }}
- name: nginx-template-volume
configMap:
name: {{ .Values.controller.customTemplate.configMapName }}
items:
- key: {{ .Values.controller.customTemplate.configMapKey }}
path: nginx.tmpl
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
- name: webhook-cert
secret:
secretName: {{ template "nginx-ingress.fullname". }}-admission
{{- end }}
{{- if .Values.controller.extraVolumes }}
{{ toYaml .Values.controller.extraVolumes | indent 8}}
{{- end }}
{{- end }}

34
charts/ingress-nginx/templates/controller-hpa.yaml Normal file
View file

@ -0,0 +1,34 @@
{{- if or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both") }}
{{- if .Values.controller.autoscaling.enabled }}
apiVersion: autoscaling/v2beta1
kind: HorizontalPodAutoscaler
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}
spec:
scaleTargetRef:
apiVersion: {{ template "deployment.apiVersion" . }}
kind: Deployment
name: {{ template "nginx-ingress.controller.fullname" . }}
minReplicas: {{ .Values.controller.autoscaling.minReplicas }}
maxReplicas: {{ .Values.controller.autoscaling.maxReplicas }}
metrics:
{{- with .Values.controller.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
targetAverageUtilization: {{ . }}
{{- end }}
{{- with .Values.controller.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
targetAverageUtilization: {{ . }}
{{- end }}
{{- end }}
{{- end }}

47
charts/ingress-nginx/templates/controller-metrics-service.yaml Normal file
View file

@ -0,0 +1,47 @@
{{- if .Values.controller.metrics.enabled }}
apiVersion: v1
kind: Service
metadata:
{{- if .Values.controller.metrics.service.annotations }}
annotations:
{{- range $key, $value := .Values.controller.metrics.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
labels:
{{- if .Values.controller.metrics.service.labels }}
{{ toYaml .Values.controller.metrics.service.labels | indent 4 }}
{{- end }}
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}-metrics
spec:
{{- if not .Values.controller.metrics.service.omitClusterIP }}
{{- with .Values.controller.metrics.service.clusterIP }}
clusterIP: {{ if eq "-" . }}""{{ else }}{{ . | quote }}{{ end }}
{{- end }}
{{- end }}
{{- if .Values.controller.metrics.service.externalIPs }}
externalIPs:
{{ toYaml .Values.controller.metrics.service.externalIPs | indent 4 }}
{{- end }}
{{- if .Values.controller.metrics.service.loadBalancerIP }}
loadBalancerIP: "{{ .Values.controller.metrics.service.loadBalancerIP }}"
{{- end }}
{{- if .Values.controller.metrics.service.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml .Values.controller.metrics.service.loadBalancerSourceRanges | indent 4 }}
{{- end }}
ports:
- name: metrics
port: {{ .Values.controller.metrics.service.servicePort }}
targetPort: metrics
selector:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.controller.name }}"
release: {{ .Release.Name }}
type: "{{ .Values.controller.metrics.service.type }}"
{{- end }}

19
charts/ingress-nginx/templates/controller-poddisruptionbudget.yaml Normal file
View file

@ -0,0 +1,19 @@
{{- if or (and .Values.controller.autoscaling.enabled (gt (.Values.controller.autoscaling.minReplicas | int) 1)) (gt (.Values.controller.replicaCount | int) 1) }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}
spec:
selector:
matchLabels:
app: {{ template "nginx-ingress.name" . }}
release: {{ .Release.Name }}
component: "{{ .Values.controller.name }}"
minAvailable: {{ .Values.controller.minAvailable }}
{{- end }}

24
charts/ingress-nginx/templates/controller-prometheusrules.yaml Normal file
View file

@ -0,0 +1,24 @@
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.prometheusRule.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
name: {{ template "nginx-ingress.controller.fullname" . }}
{{- if .Values.controller.metrics.prometheusRule.namespace }}
namespace: {{ .Values.controller.metrics.prometheusRule.namespace }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
{{- if .Values.controller.metrics.prometheusRule.additionalLabels }}
{{ toYaml .Values.controller.metrics.prometheusRule.additionalLabels | indent 4 }}
{{- end }}
spec:
{{- with .Values.controller.metrics.prometheusRule.rules }}
groups:
- name: {{ template "nginx-ingress.name" $ }}
rules: {{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

80
charts/ingress-nginx/templates/controller-psp.yaml Normal file
View file

@ -0,0 +1,80 @@
{{- if .Values.podSecurityPolicy.enabled}}
apiVersion: {{ template "podSecurityPolicy.apiVersion" . }}
kind: PodSecurityPolicy
metadata:
name: {{ template "nginx-ingress.fullname" . }}
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
allowedCapabilities:
- NET_BIND_SERVICE
privileged: false
allowPrivilegeEscalation: true
# Allow core volume types.
volumes:
- 'configMap'
#- 'emptyDir'
#- 'projected'
- 'secret'
#- 'downwardAPI'
hostNetwork: {{ .Values.controller.hostNetwork }}
{{- if or .Values.controller.hostNetwork .Values.controller.daemonset.useHostPort }}
hostPorts:
{{- if .Values.controller.hostNetwork }}
{{- range $key, $value := .Values.controller.containerPort }}
# {{ $key }}
- min: {{ $value }}
max: {{ $value }}
{{- end }}
{{- else if .Values.controller.daemonset.useHostPort }}
{{- range $key, $value := .Values.controller.daemonset.hostPorts }}
# {{ $key }}
- min: {{ $value }}
max: {{ $value }}
{{- end }}
{{- end }}
{{- if .Values.controller.metrics.enabled }}
# metrics
- min: {{ .Values.controller.metrics.port }}
max: {{ .Values.controller.metrics.port }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
# admission webhooks
- min: {{ .Values.controller.admissionWebhooks.port }}
max: {{ .Values.controller.admissionWebhooks.port }}
{{- end }}
{{- range $key, $value := .Values.tcp }}
# {{ $key }}-tcp
- min: {{ $key }}
max: {{ $key }}
{{- end }}
{{- range $key, $value := .Values.udp }}
# {{ $key }}-udp
- min: {{ $key }}
max: {{ $key }}
{{- end }}
{{- end }}
hostIPC: false
hostPID: false
runAsUser:
# Require the container to run without root privileges.
rule: 'MustRunAsNonRoot'
supplementalGroups:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
fsGroup:
rule: 'MustRunAs'
ranges:
# Forbid adding the root group.
- min: 1
max: 65535
readOnlyRootFilesystem: false
seLinux:
rule: 'RunAsAny'
{{- end }}

91
charts/ingress-nginx/templates/controller-role.yaml Normal file
View file

@ -0,0 +1,91 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}
rules:
- apiGroups:
- ""
resources:
- namespaces
verbs:
- get
- apiGroups:
- ""
resources:
- configmaps
- pods
- secrets
- endpoints
verbs:
- get
- list
- watch
- apiGroups:
- ""
resources:
- services
verbs:
- get
- list
- update
- watch
- apiGroups:
- extensions
- "networking.k8s.io" # k8s 1.14+
resources:
- ingresses
verbs:
- get
- list
- watch
- apiGroups:
- extensions
- "networking.k8s.io" # k8s 1.14+
resources:
- ingresses/status
verbs:
- update
- apiGroups:
- ""
resources:
- configmaps
resourceNames:
- {{ .Values.controller.electionID }}-{{ .Values.controller.ingressClass }}
verbs:
- get
- update
- apiGroups:
- ""
resources:
- configmaps
verbs:
- create
- apiGroups:
- ""
resources:
- endpoints
verbs:
- create
- get
- update
- apiGroups:
- ""
resources:
- events
verbs:
- create
- patch
{{- if .Values.podSecurityPolicy.enabled }}
- apiGroups: ['{{ template "podSecurityPolicy.apiGroup" . }}']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: [{{ template "nginx-ingress.fullname" . }}]
{{- end }}
{{- end -}}

19
charts/ingress-nginx/templates/controller-rolebinding.yaml Normal file
View file

@ -0,0 +1,19 @@
{{- if .Values.rbac.create -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "nginx-ingress.fullname" . }}
subjects:
- kind: ServiceAccount
name: {{ template "nginx-ingress.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end -}}

94
charts/ingress-nginx/templates/controller-service.yaml Normal file
View file

@ -0,0 +1,94 @@
{{- if .Values.controller.service.enabled }}
apiVersion: v1
kind: Service
metadata:
{{- if .Values.controller.service.annotations }}
annotations:
{{- range $key, $value := .Values.controller.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
labels:
{{- if .Values.controller.service.labels }}
{{ toYaml .Values.controller.service.labels | indent 4 }}
{{- end }}
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}
spec:
{{- if not .Values.controller.service.omitClusterIP }}
{{- with .Values.controller.service.clusterIP }}
clusterIP: {{ if eq "-" . }}""{{ else }}{{ . | quote }}{{ end }}
{{- end }}
{{- end }}
{{- if .Values.controller.service.externalIPs }}
externalIPs:
{{ toYaml .Values.controller.service.externalIPs | indent 4 }}
{{- end }}
{{- if .Values.controller.service.loadBalancerIP }}
loadBalancerIP: "{{ .Values.controller.service.loadBalancerIP }}"
{{- end }}
{{- if .Values.controller.service.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml .Values.controller.service.loadBalancerSourceRanges | indent 4 }}
{{- end }}
{{- if and (semverCompare ">=1.7-0" .Capabilities.KubeVersion.GitVersion) (.Values.controller.service.externalTrafficPolicy) }}
externalTrafficPolicy: "{{ .Values.controller.service.externalTrafficPolicy }}"
{{- end }}
{{- if .Values.controller.service.sessionAffinity }}
sessionAffinity: "{{ .Values.controller.service.sessionAffinity }}"
{{- end }}
{{- if and (semverCompare ">=1.7-0" .Capabilities.KubeVersion.GitVersion) (.Values.controller.service.healthCheckNodePort) }}
healthCheckNodePort: {{ .Values.controller.service.healthCheckNodePort }}
{{- end }}
ports:
{{- $setNodePorts := (or (eq .Values.controller.service.type "NodePort") (eq .Values.controller.service.type "LoadBalancer")) }}
{{- if .Values.controller.service.enableHttp }}
- name: http
port: {{ .Values.controller.service.ports.http }}
protocol: TCP
targetPort: {{ .Values.controller.service.targetPorts.http }}
{{- if (and $setNodePorts (not (empty .Values.controller.service.nodePorts.http))) }}
nodePort: {{ .Values.controller.service.nodePorts.http }}
{{- end }}
{{- end }}
{{- if .Values.controller.service.enableHttps }}
- name: https
port: {{ .Values.controller.service.ports.https }}
protocol: TCP
targetPort: {{ .Values.controller.service.targetPorts.https }}
{{- if (and $setNodePorts (not (empty .Values.controller.service.nodePorts.https))) }}
nodePort: {{ .Values.controller.service.nodePorts.https }}
{{- end }}
{{- end }}
{{- range $key, $value := .Values.tcp }}
- name: "{{ $key }}-tcp"
port: {{ $key }}
protocol: TCP
targetPort: "{{ $key }}-tcp"
{{- if $.Values.controller.service.nodePorts.tcp }}
{{- if index $.Values.controller.service.nodePorts.tcp $key }}
nodePort: {{ index $.Values.controller.service.nodePorts.tcp $key }}
{{- end }}
{{- end }}
{{- end }}
{{- range $key, $value := .Values.udp }}
- name: "{{ $key }}-udp"
port: {{ $key }}
protocol: UDP
targetPort: "{{ $key }}-udp"
{{- if $.Values.controller.service.nodePorts.udp }}
{{- if index $.Values.controller.service.nodePorts.udp $key }}
nodePort: {{ index $.Values.controller.service.nodePorts.udp $key }}
{{- end }}
{{- end }}
{{- end }}
selector:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.controller.name }}"
release: {{ .Release.Name }}
type: "{{ .Values.controller.service.type }}"
{{- end }}

11
charts/ingress-nginx/templates/controller-serviceaccount.yaml Normal file
View file

@ -0,0 +1,11 @@
{{- if or .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.serviceAccountName" . }}
{{- end -}}

38
charts/ingress-nginx/templates/controller-servicemonitor.yaml Normal file
View file

@ -0,0 +1,38 @@
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.serviceMonitor.enabled }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ template "nginx-ingress.controller.fullname" . }}
{{- if .Values.controller.metrics.serviceMonitor.namespace }}
namespace: {{ .Values.controller.metrics.serviceMonitor.namespace }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
{{- if .Values.controller.metrics.serviceMonitor.additionalLabels }}
{{ toYaml .Values.controller.metrics.serviceMonitor.additionalLabels | indent 4 }}
{{- end }}
spec:
endpoints:
- port: metrics
interval: {{ .Values.controller.metrics.serviceMonitor.scrapeInterval }}
{{- if .Values.controller.metrics.serviceMonitor.honorLabels }}
honorLabels: true
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.namespaceSelector }}
namespaceSelector:
{{ toYaml .Values.controller.metrics.serviceMonitor.namespaceSelector | indent 4 -}}
{{ else }}
namespaceSelector:
matchNames:
- {{ .Release.Namespace }}
{{- end }}
selector:
matchLabels:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.controller.name }}"
release: {{ .Release.Name }}
{{- end }}

44
charts/ingress-nginx/templates/controller-webhook-service.yaml Normal file
View file

@ -0,0 +1,44 @@
{{- if .Values.controller.admissionWebhooks.enabled }}
apiVersion: v1
kind: Service
metadata:
{{- if .Values.controller.admissionWebhooks.service.annotations }}
annotations:
{{- range $key, $value := .Values.controller.admissionWebhooks.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.controller.fullname" . }}-admission
spec:
{{- if not .Values.controller.admissionWebhooks.service.omitClusterIP }}
{{- with .Values.controller.admissionWebhooks.service.clusterIP }}
clusterIP: {{ if eq "-" . }}""{{ else }}{{ . | quote }}{{ end }}
{{- end }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.service.externalIPs }}
externalIPs:
{{ toYaml .Values.controller.admissionWebhooks.service.externalIPs | indent 4 }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.service.loadBalancerIP }}
loadBalancerIP: "{{ .Values.controller.admissionWebhooks.service.loadBalancerIP }}"
{{- end }}
{{- if .Values.controller.admissionWebhooks.service.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml .Values.controller.admissionWebhooks.service.loadBalancerSourceRanges | indent 4 }}
{{- end }}
ports:
- name: https-webhook
port: 443
targetPort: webhook
selector:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.controller.name }}"
release: {{ .Release.Name }}
type: "{{ .Values.controller.admissionWebhooks.service.type }}"
{{- end }}

104
charts/ingress-nginx/templates/default-backend-deployment.yaml Normal file
View file

@ -0,0 +1,104 @@
{{- if .Values.defaultBackend.enabled }}
apiVersion: {{ template "deployment.apiVersion" . }}
kind: Deployment
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.defaultBackend.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.defaultBackend.fullname" . }}
spec:
selector:
matchLabels:
app: {{ template "nginx-ingress.name" . }}
release: {{ .Release.Name }}
replicas: {{ .Values.defaultBackend.replicaCount }}
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
template:
metadata:
{{- if .Values.defaultBackend.podAnnotations }}
annotations:
{{- range $key, $value := .Values.defaultBackend.podAnnotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.defaultBackend.name }}"
release: {{ .Release.Name }}
{{- if .Values.defaultBackend.podLabels }}
{{ toYaml .Values.defaultBackend.podLabels | indent 8 }}
{{- end }}
spec:
{{- if .Values.imagePullSecrets }}
imagePullSecrets:
{{ toYaml .Values.imagePullSecrets | indent 8 }}
{{- end }}
{{- if .Values.defaultBackend.priorityClassName }}
priorityClassName: "{{ .Values.defaultBackend.priorityClassName }}"
{{- end }}
{{- if .Values.defaultBackend.podSecurityContext }}
securityContext:
{{ toYaml .Values.defaultBackend.podSecurityContext | indent 8 }}
{{- end }}
containers:
- name: {{ template "nginx-ingress.name" . }}-{{ .Values.defaultBackend.name }}
image: "{{ .Values.defaultBackend.image.repository }}:{{ .Values.defaultBackend.image.tag }}"
imagePullPolicy: "{{ .Values.defaultBackend.image.pullPolicy }}"
args:
{{- range $key, $value := .Values.defaultBackend.extraArgs }}
{{- if $value }}
- --{{ $key }}={{ $value }}
{{- else }}
- --{{ $key }}
{{- end }}
{{- end }}
securityContext:
runAsUser: {{ .Values.defaultBackend.image.runAsUser }}
{{- if .Values.defaultBackend.extraEnvs }}
env:
{{ toYaml .Values.defaultBackend.extraEnvs | indent 12 }}
{{- end }}
livenessProbe:
httpGet:
path: /healthz
port: {{ .Values.defaultBackend.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.defaultBackend.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.defaultBackend.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.defaultBackend.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.defaultBackend.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.defaultBackend.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: /healthz
port: {{ .Values.defaultBackend.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.defaultBackend.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.defaultBackend.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.defaultBackend.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.defaultBackend.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.defaultBackend.readinessProbe.failureThreshold }}
ports:
- name: http
containerPort: {{ .Values.defaultBackend.port }}
protocol: TCP
resources:
{{ toYaml .Values.defaultBackend.resources | indent 12 }}
{{- if .Values.defaultBackend.nodeSelector }}
nodeSelector:
{{ toYaml .Values.defaultBackend.nodeSelector | indent 8 }}
{{- end }}
serviceAccountName: {{ template "nginx-ingress.defaultBackend.serviceAccountName" . }}
{{- if .Values.defaultBackend.tolerations }}
tolerations:
{{ toYaml .Values.defaultBackend.tolerations | indent 8 }}
{{- end }}
{{- if .Values.defaultBackend.affinity }}
affinity:
{{ toYaml .Values.defaultBackend.affinity | indent 8 }}
{{- end }}
terminationGracePeriodSeconds: 60
{{- end }}

19
charts/ingress-nginx/templates/default-backend-poddisruptionbudget.yaml Normal file
View file

@ -0,0 +1,19 @@
{{- if gt (.Values.defaultBackend.replicaCount | int) 1 }}
apiVersion: policy/v1beta1
kind: PodDisruptionBudget
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.defaultBackend.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.defaultBackend.fullname" . }}
spec:
selector:
matchLabels:
app: {{ template "nginx-ingress.name" . }}
release: {{ .Release.Name }}
component: "{{ .Values.defaultBackend.name }}"
minAvailable: {{ .Values.defaultBackend.minAvailable }}
{{- end }}

35
charts/ingress-nginx/templates/default-backend-psp.yaml Normal file
View file

@ -0,0 +1,35 @@
{{- if and .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
apiVersion: {{ template "podSecurityPolicy.apiVersion" . }}
kind: PodSecurityPolicy
metadata:
name: {{ template "nginx-ingress.fullname" . }}-backend
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
spec:
allowPrivilegeEscalation: false
fsGroup:
ranges:
- max: 65535
min: 1
rule: MustRunAs
requiredDropCapabilities:
- ALL
runAsUser:
rule: MustRunAsNonRoot
seLinux:
rule: RunAsAny
supplementalGroups:
ranges:
- max: 65535
min: 1
rule: MustRunAs
volumes:
- configMap
- emptyDir
- projected
- secret
- downwardAPI
{{- end -}}

16
charts/ingress-nginx/templates/default-backend-role.yaml Normal file
View file

@ -0,0 +1,16 @@
{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}-backend
rules:
- apiGroups: ['{{ template "podSecurityPolicy.apiGroup" . }}']
resources: ['podsecuritypolicies']
verbs: ['use']
resourceNames: [{{ template "nginx-ingress.fullname" . }}-backend]
{{- end -}}

19
charts/ingress-nginx/templates/default-backend-rolebinding.yaml Normal file
View file

@ -0,0 +1,19 @@
{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}-backend
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ template "nginx-ingress.fullname" . }}-backend
subjects:
- kind: ServiceAccount
name: {{ template "nginx-ingress.defaultBackend.serviceAccountName" . }}
namespace: {{ .Release.Namespace }}
{{- end -}}

45
charts/ingress-nginx/templates/default-backend-service.yaml Normal file
View file

@ -0,0 +1,45 @@
{{- if .Values.defaultBackend.enabled }}
apiVersion: v1
kind: Service
metadata:
{{- if .Values.defaultBackend.service.annotations }}
annotations:
{{- range $key, $value := .Values.defaultBackend.service.annotations }}
{{ $key }}: {{ $value | quote }}
{{- end }}
{{- end }}
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.defaultBackend.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.defaultBackend.fullname" . }}
spec:
{{- if not .Values.defaultBackend.service.omitClusterIP }}
{{- with .Values.defaultBackend.service.clusterIP }}
clusterIP: {{ if eq "-" . }}""{{ else }}{{ . | quote }}{{ end }}
{{- end }}
{{- end }}
{{- if .Values.defaultBackend.service.externalIPs }}
externalIPs:
{{ toYaml .Values.defaultBackend.service.externalIPs | indent 4 }}
{{- end }}
{{- if .Values.defaultBackend.service.loadBalancerIP }}
loadBalancerIP: "{{ .Values.defaultBackend.service.loadBalancerIP }}"
{{- end }}
{{- if .Values.defaultBackend.service.loadBalancerSourceRanges }}
loadBalancerSourceRanges:
{{ toYaml .Values.defaultBackend.service.loadBalancerSourceRanges | indent 4 }}
{{- end }}
ports:
- name: http
port: {{ .Values.defaultBackend.service.servicePort }}
protocol: TCP
targetPort: http
selector:
app: {{ template "nginx-ingress.name" . }}
component: "{{ .Values.defaultBackend.name }}"
release: {{ .Release.Name }}
type: "{{ .Values.defaultBackend.service.type }}"
{{- end }}

11
charts/ingress-nginx/templates/default-backend-serviceaccount.yaml Normal file
View file

@ -0,0 +1,11 @@
{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.defaultBackend.serviceAccountName" . }}
{{- end }}

18
charts/ingress-nginx/templates/proxyheaders-configmap.yaml Normal file
View file

@ -0,0 +1,18 @@
{{- if or .Values.controller.proxySetHeaders .Values.controller.headers }}
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}-custom-proxy-headers
data:
{{- if .Values.controller.proxySetHeaders }}
{{ toYaml .Values.controller.proxySetHeaders | indent 2 }}
{{ else if and .Values.controller.headers (not .Values.controller.proxySetHeaders) }}
{{ toYaml .Values.controller.headers | indent 2 }}
{{- end }}
{{- end }}

14
charts/ingress-nginx/templates/tcp-configmap.yaml Normal file
View file

@ -0,0 +1,14 @@
{{- if .Values.tcp }}
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}-tcp
data:
{{ tpl (toYaml .Values.tcp) . | indent 2 }}
{{- end }}

14
charts/ingress-nginx/templates/udp-configmap.yaml Normal file
View file

@ -0,0 +1,14 @@
{{- if .Values.udp }}
apiVersion: v1
kind: ConfigMap
metadata:
labels:
app: {{ template "nginx-ingress.name" . }}
chart: {{ template "nginx-ingress.chart" . }}
component: "{{ .Values.controller.name }}"
heritage: {{ .Release.Service }}
release: {{ .Release.Name }}
name: {{ template "nginx-ingress.fullname" . }}-udp
data:
{{ tpl (toYaml .Values.udp) . | indent 2 }}
{{- end }}