[stable/nginx-ingress] Add fine-grained host port range in psp (#19858)

Give port-by-port permission in psp to improve security.

Signed-off-by: Yu Chih <secret104278@gmail.com>

stable/nginx-ingress/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: nginx-ingress
-version: 1.28.0
+version: 1.28.1
 appVersion: 0.26.2
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.

stable/nginx-ingress/templates/controller-psp.yaml

@@ -21,6 +21,34 @@ spec:
     - 'secret'
     #- 'downwardAPI'
   hostNetwork: {{ .Values.controller.hostNetwork }}
+{{- if .Values.controller.hostNetwork }}
+  hostPorts:
+{{- range $key, $value := .Values.controller.containerPort }}
+  # {{ $key }}
+  - min: {{ $value }}
+    max: {{ $value }}
+{{- end }}
+{{- if .Values.controller.metrics.enabled }}
+  # metrics
+  - min: {{ .Values.controller.metrics.port }}
+    max: {{ .Values.controller.metrics.port }}
+{{- end }}
+{{- if .Values.controller.admissionWebhooks.enabled }}
+  # admission webhooks
+  - min: {{ .Values.controller.admissionWebhooks.port }}
+    max: {{ .Values.controller.admissionWebhooks.port }}
+{{- end }}
+{{- range $key, $value := .Values.tcp }}
+  # {{ $key }}-tcp
+  - min: {{ $key }}
+    max: {{ $key }}
+{{- end }}
+{{- range $key, $value := .Values.udp }}
+  # {{ $key }}-udp
+  - min: {{ $key }}
+    max: {{ $key }}
+{{- end }}
+{{- end }}
   hostIPC: false
   hostPID: false
   runAsUser: