From 46a84098c8439addb81dd8d2c15ccd077da85ff9 Mon Sep 17 00:00:00 2001
From: pinepinebrook <secret104278@gmail.com>
Date: Thu, 9 Jan 2020 00:05:40 +0800
Subject: [PATCH] [stable/nginx-ingress] Add fine-grained host port range in
 psp (#19858)

Give port-by-port permission in psp to improve security.

Signed-off-by: Yu Chih <secret104278@gmail.com>
---
 stable/nginx-ingress/Chart.yaml               |  2 +-
 .../templates/controller-psp.yaml             | 28 +++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/stable/nginx-ingress/Chart.yaml b/stable/nginx-ingress/Chart.yaml
index 027806e622..b98c1d8c01 100644
--- a/stable/nginx-ingress/Chart.yaml
+++ b/stable/nginx-ingress/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v1
 name: nginx-ingress
-version: 1.28.0
+version: 1.28.1
 appVersion: 0.26.2
 home: https://github.com/kubernetes/ingress-nginx
 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration.
diff --git a/stable/nginx-ingress/templates/controller-psp.yaml b/stable/nginx-ingress/templates/controller-psp.yaml
index 6e4a0e0d23..aea3ff8696 100644
--- a/stable/nginx-ingress/templates/controller-psp.yaml
+++ b/stable/nginx-ingress/templates/controller-psp.yaml
@@ -21,6 +21,34 @@ spec:
     - 'secret'
     #- 'downwardAPI'
   hostNetwork: {{ .Values.controller.hostNetwork }}
+{{- if .Values.controller.hostNetwork }}
+  hostPorts:
+{{- range $key, $value := .Values.controller.containerPort }}
+  # {{ $key }}
+  - min: {{ $value }}
+    max: {{ $value }}
+{{- end }}
+{{- if .Values.controller.metrics.enabled }}
+  # metrics
+  - min: {{ .Values.controller.metrics.port }}
+    max: {{ .Values.controller.metrics.port }}
+{{- end }}
+{{- if .Values.controller.admissionWebhooks.enabled }}
+  # admission webhooks
+  - min: {{ .Values.controller.admissionWebhooks.port }}
+    max: {{ .Values.controller.admissionWebhooks.port }}
+{{- end }}
+{{- range $key, $value := .Values.tcp }}
+  # {{ $key }}-tcp
+  - min: {{ $key }}
+    max: {{ $key }}
+{{- end }}
+{{- range $key, $value := .Values.udp }}
+  # {{ $key }}-udp
+  - min: {{ $key }}
+    max: {{ $key }}
+{{- end }}
+{{- end }}
   hostIPC: false
   hostPID: false
   runAsUser: