From 0e052d4dc0d15910a950ef44c8ac6854612d7879 Mon Sep 17 00:00:00 2001 From: Shivneil Prasad Date: Mon, 20 May 2019 14:10:14 -0700 Subject: [PATCH] [stable/nginx-ingress] Add podSecurityContext to controller (#13585) Allows inserting securityContext configuration into the controller pod definition for changing things like `net.core.somaxconn` Signed-off-by: Shivneil Prasad --- stable/nginx-ingress/Chart.yaml | 2 +- stable/nginx-ingress/README.md | 1 + stable/nginx-ingress/templates/controller-daemonset.yaml | 4 ++++ stable/nginx-ingress/templates/controller-deployment.yaml | 4 ++++ stable/nginx-ingress/values.yaml | 6 ++++++ 5 files changed, 16 insertions(+), 1 deletion(-) diff --git a/stable/nginx-ingress/Chart.yaml b/stable/nginx-ingress/Chart.yaml index 9a974a54db..862a0a57c3 100644 --- a/stable/nginx-ingress/Chart.yaml +++ b/stable/nginx-ingress/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: nginx-ingress -version: 1.6.9 +version: 1.6.10 appVersion: 0.24.1 home: https://github.com/kubernetes/ingress-nginx description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration. diff --git a/stable/nginx-ingress/README.md b/stable/nginx-ingress/README.md index f110407481..e2a9281066 100644 --- a/stable/nginx-ingress/README.md +++ b/stable/nginx-ingress/README.md @@ -77,6 +77,7 @@ Parameter | Description | Default `controller.nodeSelector` | node labels for pod assignment | `{}` `controller.podAnnotations` | annotations to be added to pods | `{}` `controller.podLabels` | labels to add to the pod container metadata | `{}` +`controller.podSecurityContext` | Security context policies to add to the controller pod | `{}` `controller.replicaCount` | desired number of controller pods | `1` `controller.minAvailable` | minimum number of available controller pods for PodDisruptionBudget | `1` `controller.resources` | controller pod resource requests & limits | `{}` diff --git a/stable/nginx-ingress/templates/controller-daemonset.yaml b/stable/nginx-ingress/templates/controller-daemonset.yaml index 2de3f8aeb5..dc190788b1 100644 --- a/stable/nginx-ingress/templates/controller-daemonset.yaml +++ b/stable/nginx-ingress/templates/controller-daemonset.yaml @@ -36,6 +36,10 @@ spec: {{- if .Values.controller.priorityClassName }} priorityClassName: "{{ .Values.controller.priorityClassName }}" {{- end }} + {{- if .Values.controller.podSecurityContext }} + securityContext: +{{ toYaml .Values.controller.podSecurityContext | indent 8 }} + {{- end }} containers: - name: {{ template "nginx-ingress.name" . }}-{{ .Values.controller.name }} image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}" diff --git a/stable/nginx-ingress/templates/controller-deployment.yaml b/stable/nginx-ingress/templates/controller-deployment.yaml index 164c5b6b80..784824a84e 100644 --- a/stable/nginx-ingress/templates/controller-deployment.yaml +++ b/stable/nginx-ingress/templates/controller-deployment.yaml @@ -39,6 +39,10 @@ spec: {{- if .Values.controller.priorityClassName }} priorityClassName: "{{ .Values.controller.priorityClassName }}" {{- end }} + {{- if .Values.controller.podSecurityContext }} + securityContext: +{{ toYaml .Values.controller.podSecurityContext | indent 8 }} + {{- end }} containers: - name: {{ template "nginx-ingress.name" . }}-{{ .Values.controller.name }} image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}" diff --git a/stable/nginx-ingress/values.yaml b/stable/nginx-ingress/values.yaml index af12b96dee..6ee350829a 100644 --- a/stable/nginx-ingress/values.yaml +++ b/stable/nginx-ingress/values.yaml @@ -56,6 +56,12 @@ controller: podLabels: {} # key: value + ## Security Context policies for controller pods + ## See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + ## notes on enabling and using sysctls + ## + podSecurityContext: {} + ## Allows customization of the external service ## the ingress will be bound to via DNS publishService: