[incubator/haproxy-ingress] Added features (#11718)

* Allow setting affinity on controller pods

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

* Fix controller-daemonset template checksum annotation

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

* haproxy-ingress v0.7-beta.7

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

* Added missing securityContext for DaemonSet

Also added "quote" for priorityClassName.

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

* Added initContainers

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

* Added PodSecurityPolicy

This policy allows using privileged containers and sets the
CAP_SYS_RESOURCE capability by default. This allows changing sysctl
settings like fs.file-max and fs.nr_open in an init container. haproxy is
also allowed to change the ulimit nofile as required by the configured
maxconn.

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

* Bump chart version to 0.0.8

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

* Use livenessProbe for haproxy-exporter side-car container

Using a readinessProbe would cause the whole pod to become unavailable if
the metrics exporter side-car became unready.

Signed-off-by: Magnus Hyllander <magnus.hyllander@hivestreaming.com>

incubator/haproxy-ingress/Chart.yaml

@@ -1,5 +1,5 @@
 name: haproxy-ingress
-version: 0.0.7
+version: 0.0.8
 appVersion: 0.7.0
 home: https://github.com/jcmoraisjr/haproxy-ingress
 description: Ingress controller implementation for haproxy loadbalancer.

incubator/haproxy-ingress/README.md

@@ -36,12 +36,14 @@ The following table lists the configurable parameters of the haproxy-ingress cha
 Parameter | Description | Default
 --- | --- | ---
 `rbac.create` | If true, create & use RBAC resources | `true`
+`rbac.security.enable` | If true, and rbac.create is true, create & use PSP resources | `false`
 `serviceAccount.create` | If true, create serviceAccount | `true`
 `serviceAccount.name` | ServiceAccount to be used | ``
 `controller.name` | name of the controller component | `controller`
 `controller.image.repository` | controller container image repository | `quay.io/jcmoraisjr/haproxy-ingress`
-`controller.image.tag` | controller container image tag | `v0.7-beta.5`
+`controller.image.tag` | controller container image tag | `v0.7-beta.7`
 `controller.image.pullPolicy` | controller container image pullPolicy | `IfNotPresent`
+`controller.initContainers` | extra containers that can initialize the haproxy-ingress-controller | `{}`
 `controller.extraArgs` | extra command line arguments for the haproxy-ingress-controller | `{}`
 `controller.extraEnv` | extra environment variables for the haproxy-ingress-controller | `{}`
 `controller.template` | custom template for haproxy-ingress-controller | `{}`
@@ -64,6 +66,7 @@ Parameter | Description | Default
 `controller.readinessProbe.timeoutSeconds` | The readiness probe timeout (in seconds) | `1`
 `controller.podAnnotations` | Annotations for the haproxy-ingress-conrtoller pod | `{}`
 `controller.podLabels` | Labels for the haproxy-ingress-conrtoller pod | `{}`
+`controller.podAffinity` | Add affinity to the controller pods to control scheduling | `{}`
 `controller.priorityClassName` | Priority Class to be used | ``
 `controller.securityContext` | Security context settings for the haproxy-ingress-conrtoller pod | `{}`
 `controller.config` | additional haproxy-ingress [ConfigMap entries](https://github.com/jcmoraisjr/haproxy-ingress/blob/v0.6/README.md#configmap) | `{}`

incubator/haproxy-ingress/templates/clusterrole.yaml

@@ -1,4 +1,4 @@
-{{- if or .Values.rbac.create -}}
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: ClusterRole
 metadata:
@@ -35,7 +35,7 @@ rules:
       - list
       - watch
   - apiGroups:
-      - "extensions"
+      - extensions
     resources:
       - ingresses
     verbs:
@@ -50,7 +50,7 @@ rules:
       - create
       - patch
   - apiGroups:
-      - "extensions"
+      - extensions
     resources:
       - ingresses/status
     verbs:

incubator/haproxy-ingress/templates/controller-daemonset.yaml

@@ -19,11 +19,11 @@ spec:
       release: {{ .Release.Name }}
   template:
     metadata:
-      {{- if .Values.controller.podAnnotations }}
       annotations:
 {{- if .Values.controller.template }}
         checksum/config: {{ include (print $.Template.BasePath "/controller-template.yaml") . | sha256sum }}
 {{- end }}
+      {{- if .Values.controller.podAnnotations }}
 {{ toYaml .Values.controller.podAnnotations | indent 8}}
       {{- end }}
       labels:
@@ -34,7 +34,15 @@ spec:
 {{ toYaml .Values.controller.podLabels | indent 8 }}
         {{- end }}
     spec:
+    {{- if .Values.controller.podAffinity }}
+      affinity:
+{{ toYaml .Values.controller.podAffinity | indent 8 }}
+    {{- end }}
       serviceAccountName: {{ template "haproxy-ingress.serviceAccountName" . }}
+    {{- if .Values.controller.initContainers }}
+      initContainers:
+{{ toYaml .Values.controller.initContainers | indent 8 }}
+    {{- end }}
       containers:
         - name: haproxy-ingress
           image:  "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
@@ -148,10 +156,10 @@ spec:
             - name: metrics
               containerPort: 9101
               protocol: TCP
-          readinessProbe:
+          livenessProbe:
             httpGet:
               path: /
-              port: 9101
+              port: metrics
           resources:
             limits:
               cpu: 200m
@@ -182,6 +190,10 @@ spec:
 {{ toYaml .Values.controller.affinity | indent 8 }}
     {{- end }}
     {{- if .Values.controller.priorityClassName }}
-      priorityClassName: {{ .Values.controller.priorityClassName }}
+      priorityClassName: {{ .Values.controller.priorityClassName | quote }}
+    {{- end }}
+    {{- if .Values.controller.securityContext }}
+      securityContext:
+{{ toYaml .Values.controller.securityContext | indent 8 }}
     {{- end }}
 {{- end }}

incubator/haproxy-ingress/templates/controller-deployment.yaml

@@ -36,7 +36,15 @@ spec:
 {{ toYaml .Values.controller.podLabels | indent 8 }}
         {{- end }}
     spec:
+    {{- if .Values.controller.podAffinity }}
+      affinity:
+{{ toYaml .Values.controller.podAffinity | indent 8 }}
+    {{- end }}
       serviceAccountName: {{ template "haproxy-ingress.serviceAccountName" . }}
+    {{- if .Values.controller.initContainers }}
+      initContainers:
+{{ toYaml .Values.controller.initContainers | indent 8 }}
+    {{- end }}
       containers:
         - name: haproxy-ingress
           image:  "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
@@ -137,10 +145,10 @@ spec:
             - name: metrics
               containerPort: 9101
               protocol: TCP
-          readinessProbe:
+          livenessProbe:
             httpGet:
               path: /
-              port: 9101
+              port: metrics
           resources:
             limits:
               cpu: 200m
@@ -175,6 +183,6 @@ spec:
 {{ toYaml .Values.controller.securityContext | indent 8 }}
     {{- end }}
     {{- if .Values.controller.priorityClassName }}
-      priorityClassName: {{ .Values.controller.priorityClassName }}
+      priorityClassName: {{ .Values.controller.priorityClassName | quote }}
     {{- end }}
 {{- end }}

incubator/haproxy-ingress/templates/psp.yaml

@@ -0,0 +1,42 @@
+{{ if .Values.rbac.security.enable -}}
+apiVersion: extensions/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "haproxy-ingress.fullname" . }}
+  labels:
+    app: {{ template "haproxy-ingress.name" . }}
+    chart: {{ template "haproxy-ingress.chart" . }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName:  'docker/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName:  'runtime/default'
+spec:
+  privileged: true
+  allowPrivilegeEscalation: true
+  defaultAllowPrivilegeEscalation: false
+  allowedCapabilities:
+    - SYS_RESOURCE
+  defaultAddCapabilities:
+    - SYS_RESOURCE
+  volumes:
+    - configMap
+    - secret
+  hostNetwork: false
+  hostPorts:
+  - min: 0
+    max: 65535
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+  allowedHostPaths:
+    - pathPrefix: /etc/haproxy/template
+      readOnly: false
+{{ end -}}

incubator/haproxy-ingress/templates/role.yaml

@@ -1,4 +1,4 @@
-{{- if or .Values.rbac.create -}}
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: Role
 metadata:
@@ -12,7 +12,6 @@ rules:
   - apiGroups:
       - ""
     resources:
-      - configmaps
       - pods
       - secrets
       - namespaces
@@ -22,21 +21,19 @@ rules:
       - ""
     resources:
       - configmaps
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - create
-  - apiGroups:
-      - ""
-    resources:
       - endpoints
     verbs:
       - get
       - create
       - update
+{{- if .Values.rbac.security.enable }}
+  - apiGroups:
+      - extensions
+    resources:
+      - podsecuritypolicies
+    resourceNames:
+      - {{ template "haproxy-ingress.fullname" . }}
+    verbs:
+      - use
+{{- end -}}
 {{- end -}}

incubator/haproxy-ingress/templates/rolebinding.yaml

@@ -1,4 +1,4 @@
-{{- if or .Values.rbac.create -}}
+{{- if .Values.rbac.create -}}
 apiVersion: rbac.authorization.k8s.io/v1beta1
 kind: RoleBinding
 metadata:

incubator/haproxy-ingress/values.yaml

@@ -1,6 +1,8 @@
 # Enable RBAC
 rbac:
   create: true
+  security:
+    enable: false
 
 # Create ServiceAccount
 serviceAccount:
@@ -14,7 +16,7 @@ controller:
   name: controller
   image:
     repository: quay.io/jcmoraisjr/haproxy-ingress
-    tag: "v0.7-beta.5"
+    tag: "v0.7-beta.7"
     pullPolicy: IfNotPresent
 
   ## Additional command line arguments to pass to haproxy-ingress-controller
@@ -33,6 +35,9 @@ controller:
   #         key: FOO
   #         name: secret-resource
 
+  ## Additional containers that can initialize the pod.
+  initContainers: {}
+
   # custom haproxy template
   template: ""
 
@@ -75,6 +80,10 @@ controller:
   ##
   podLabels: {}
 
+  ## Affinity to be added to controller pods
+  ##
+  podAffinity: {}
+
   ## Priority Class to be used
   ##
   priorityClassName: ""