59b16c4e92
When deploying the controller to a custom namespace, users have to overwrite the namespace attribute as well as the hardcoded namespace values in a number of args for the Deployment and the admission controller Jobs. Instead, this commit, uses the namespace name from the DownwardAPI, and allows users to simply change the namespace attribute without having to worry about the container args.
62 lines
2.7 KiB
YAML
62 lines
2.7 KiB
YAML
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled -}}
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: {{ include "ingress-nginx.fullname" . }}-admission-patch
|
|
annotations:
|
|
"helm.sh/hook": post-install,post-upgrade
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
labels:
|
|
{{- include "ingress-nginx.labels" . | nindent 4 }}
|
|
app.kubernetes.io/component: admission-webhook
|
|
spec:
|
|
{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
|
|
# Alpha feature since k8s 1.12
|
|
ttlSecondsAfterFinished: 0
|
|
{{- end }}
|
|
template:
|
|
metadata:
|
|
name: {{ include "ingress-nginx.fullname" . }}-admission-patch
|
|
{{- if .Values.controller.admissionWebhooks.patch.podAnnotations }}
|
|
annotations: {{ toYaml .Values.controller.admissionWebhooks.patch.podAnnotations | nindent 8 }}
|
|
{{- end }}
|
|
labels:
|
|
{{- include "ingress-nginx.labels" . | nindent 8 }}
|
|
app.kubernetes.io/component: admission-webhook
|
|
spec:
|
|
{{- if .Values.controller.admissionWebhooks.patch.priorityClassName }}
|
|
priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }}
|
|
{{- end }}
|
|
{{- if .Values.imagePullSecrets }}
|
|
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }}
|
|
{{- end }}
|
|
containers:
|
|
- name: patch
|
|
{{- with .Values.controller.admissionWebhooks.patch.image }}
|
|
image: "{{.repository}}:{{ .tag }}{{- if (.digest) -}} @{{.digest}} {{- end -}}"
|
|
{{- end }}
|
|
imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }}
|
|
args:
|
|
- patch
|
|
- --webhook-name={{ include "ingress-nginx.fullname" . }}-admission
|
|
- --namespace=$(POD_NAMESPACE)
|
|
- --patch-mutating=false
|
|
- --secret-name={{ include "ingress-nginx.fullname" . }}-admission
|
|
- --patch-failure-policy={{ .Values.controller.admissionWebhooks.failurePolicy }}
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
restartPolicy: OnFailure
|
|
serviceAccountName: {{ include "ingress-nginx.fullname" . }}-admission
|
|
{{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
|
|
nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
|
|
{{- end }}
|
|
{{- if .Values.controller.admissionWebhooks.patch.tolerations }}
|
|
tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }}
|
|
{{- end }}
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: {{ .Values.controller.admissionWebhooks.patch.runAsUser }}
|
|
{{- end }}
|