diff --git a/incubator/haproxy-ingress/Chart.yaml b/incubator/haproxy-ingress/Chart.yaml index c9ed5f2a2b..4652b76577 100644 --- a/incubator/haproxy-ingress/Chart.yaml +++ b/incubator/haproxy-ingress/Chart.yaml @@ -1,5 +1,5 @@ name: haproxy-ingress -version: 0.0.7 +version: 0.0.8 appVersion: 0.7.0 home: https://github.com/jcmoraisjr/haproxy-ingress description: Ingress controller implementation for haproxy loadbalancer. diff --git a/incubator/haproxy-ingress/README.md b/incubator/haproxy-ingress/README.md index cd69f98be3..0233ac42c6 100644 --- a/incubator/haproxy-ingress/README.md +++ b/incubator/haproxy-ingress/README.md @@ -36,12 +36,14 @@ The following table lists the configurable parameters of the haproxy-ingress cha Parameter | Description | Default --- | --- | --- `rbac.create` | If true, create & use RBAC resources | `true` +`rbac.security.enable` | If true, and rbac.create is true, create & use PSP resources | `false` `serviceAccount.create` | If true, create serviceAccount | `true` `serviceAccount.name` | ServiceAccount to be used | `` `controller.name` | name of the controller component | `controller` `controller.image.repository` | controller container image repository | `quay.io/jcmoraisjr/haproxy-ingress` -`controller.image.tag` | controller container image tag | `v0.7-beta.5` +`controller.image.tag` | controller container image tag | `v0.7-beta.7` `controller.image.pullPolicy` | controller container image pullPolicy | `IfNotPresent` +`controller.initContainers` | extra containers that can initialize the haproxy-ingress-controller | `{}` `controller.extraArgs` | extra command line arguments for the haproxy-ingress-controller | `{}` `controller.extraEnv` | extra environment variables for the haproxy-ingress-controller | `{}` `controller.template` | custom template for haproxy-ingress-controller | `{}` @@ -64,6 +66,7 @@ Parameter | Description | Default `controller.readinessProbe.timeoutSeconds` | The readiness probe timeout (in seconds) | `1` `controller.podAnnotations` | Annotations for the haproxy-ingress-conrtoller pod | `{}` `controller.podLabels` | Labels for the haproxy-ingress-conrtoller pod | `{}` +`controller.podAffinity` | Add affinity to the controller pods to control scheduling | `{}` `controller.priorityClassName` | Priority Class to be used | `` `controller.securityContext` | Security context settings for the haproxy-ingress-conrtoller pod | `{}` `controller.config` | additional haproxy-ingress [ConfigMap entries](https://github.com/jcmoraisjr/haproxy-ingress/blob/v0.6/README.md#configmap) | `{}` diff --git a/incubator/haproxy-ingress/templates/clusterrole.yaml b/incubator/haproxy-ingress/templates/clusterrole.yaml index 9b05cf5261..1cc5880c73 100644 --- a/incubator/haproxy-ingress/templates/clusterrole.yaml +++ b/incubator/haproxy-ingress/templates/clusterrole.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.rbac.create -}} +{{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1beta1 kind: ClusterRole metadata: @@ -35,7 +35,7 @@ rules: - list - watch - apiGroups: - - "extensions" + - extensions resources: - ingresses verbs: @@ -50,7 +50,7 @@ rules: - create - patch - apiGroups: - - "extensions" + - extensions resources: - ingresses/status verbs: diff --git a/incubator/haproxy-ingress/templates/controller-daemonset.yaml b/incubator/haproxy-ingress/templates/controller-daemonset.yaml index f2e9a6236d..0dd16818bc 100644 --- a/incubator/haproxy-ingress/templates/controller-daemonset.yaml +++ b/incubator/haproxy-ingress/templates/controller-daemonset.yaml @@ -19,11 +19,11 @@ spec: release: {{ .Release.Name }} template: metadata: - {{- if .Values.controller.podAnnotations }} annotations: {{- if .Values.controller.template }} checksum/config: {{ include (print $.Template.BasePath "/controller-template.yaml") . | sha256sum }} {{- end }} + {{- if .Values.controller.podAnnotations }} {{ toYaml .Values.controller.podAnnotations | indent 8}} {{- end }} labels: @@ -34,7 +34,15 @@ spec: {{ toYaml .Values.controller.podLabels | indent 8 }} {{- end }} spec: + {{- if .Values.controller.podAffinity }} + affinity: +{{ toYaml .Values.controller.podAffinity | indent 8 }} + {{- end }} serviceAccountName: {{ template "haproxy-ingress.serviceAccountName" . }} + {{- if .Values.controller.initContainers }} + initContainers: +{{ toYaml .Values.controller.initContainers | indent 8 }} + {{- end }} containers: - name: haproxy-ingress image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}" @@ -148,10 +156,10 @@ spec: - name: metrics containerPort: 9101 protocol: TCP - readinessProbe: + livenessProbe: httpGet: path: / - port: 9101 + port: metrics resources: limits: cpu: 200m @@ -182,6 +190,10 @@ spec: {{ toYaml .Values.controller.affinity | indent 8 }} {{- end }} {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName }} + priorityClassName: {{ .Values.controller.priorityClassName | quote }} + {{- end }} + {{- if .Values.controller.securityContext }} + securityContext: +{{ toYaml .Values.controller.securityContext | indent 8 }} {{- end }} {{- end }} diff --git a/incubator/haproxy-ingress/templates/controller-deployment.yaml b/incubator/haproxy-ingress/templates/controller-deployment.yaml index 4898c0e5d1..0cd598f61b 100644 --- a/incubator/haproxy-ingress/templates/controller-deployment.yaml +++ b/incubator/haproxy-ingress/templates/controller-deployment.yaml @@ -36,7 +36,15 @@ spec: {{ toYaml .Values.controller.podLabels | indent 8 }} {{- end }} spec: + {{- if .Values.controller.podAffinity }} + affinity: +{{ toYaml .Values.controller.podAffinity | indent 8 }} + {{- end }} serviceAccountName: {{ template "haproxy-ingress.serviceAccountName" . }} + {{- if .Values.controller.initContainers }} + initContainers: +{{ toYaml .Values.controller.initContainers | indent 8 }} + {{- end }} containers: - name: haproxy-ingress image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}" @@ -137,10 +145,10 @@ spec: - name: metrics containerPort: 9101 protocol: TCP - readinessProbe: + livenessProbe: httpGet: path: / - port: 9101 + port: metrics resources: limits: cpu: 200m @@ -175,6 +183,6 @@ spec: {{ toYaml .Values.controller.securityContext | indent 8 }} {{- end }} {{- if .Values.controller.priorityClassName }} - priorityClassName: {{ .Values.controller.priorityClassName }} + priorityClassName: {{ .Values.controller.priorityClassName | quote }} {{- end }} {{- end }} diff --git a/incubator/haproxy-ingress/templates/psp.yaml b/incubator/haproxy-ingress/templates/psp.yaml new file mode 100644 index 0000000000..fbe95f11a2 --- /dev/null +++ b/incubator/haproxy-ingress/templates/psp.yaml @@ -0,0 +1,42 @@ +{{ if .Values.rbac.security.enable -}} +apiVersion: extensions/v1beta1 +kind: PodSecurityPolicy +metadata: + name: {{ template "haproxy-ingress.fullname" . }} + labels: + app: {{ template "haproxy-ingress.name" . }} + chart: {{ template "haproxy-ingress.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default' + apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default' + seccomp.security.alpha.kubernetes.io/defaultProfileName: 'docker/default' + apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default' +spec: + privileged: true + allowPrivilegeEscalation: true + defaultAllowPrivilegeEscalation: false + allowedCapabilities: + - SYS_RESOURCE + defaultAddCapabilities: + - SYS_RESOURCE + volumes: + - configMap + - secret + hostNetwork: false + hostPorts: + - min: 0 + max: 65535 + runAsUser: + rule: 'RunAsAny' + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'RunAsAny' + fsGroup: + rule: 'RunAsAny' + allowedHostPaths: + - pathPrefix: /etc/haproxy/template + readOnly: false +{{ end -}} diff --git a/incubator/haproxy-ingress/templates/role.yaml b/incubator/haproxy-ingress/templates/role.yaml index 888a044bce..059b41e1e1 100644 --- a/incubator/haproxy-ingress/templates/role.yaml +++ b/incubator/haproxy-ingress/templates/role.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.rbac.create -}} +{{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1beta1 kind: Role metadata: @@ -12,7 +12,6 @@ rules: - apiGroups: - "" resources: - - configmaps - pods - secrets - namespaces @@ -22,21 +21,19 @@ rules: - "" resources: - configmaps - verbs: - - get - - update - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - apiGroups: - - "" - resources: - endpoints verbs: - get - create - update +{{- if .Values.rbac.security.enable }} + - apiGroups: + - extensions + resources: + - podsecuritypolicies + resourceNames: + - {{ template "haproxy-ingress.fullname" . }} + verbs: + - use +{{- end -}} {{- end -}} diff --git a/incubator/haproxy-ingress/templates/rolebinding.yaml b/incubator/haproxy-ingress/templates/rolebinding.yaml index 801e27634d..46a9ff8df0 100644 --- a/incubator/haproxy-ingress/templates/rolebinding.yaml +++ b/incubator/haproxy-ingress/templates/rolebinding.yaml @@ -1,4 +1,4 @@ -{{- if or .Values.rbac.create -}} +{{- if .Values.rbac.create -}} apiVersion: rbac.authorization.k8s.io/v1beta1 kind: RoleBinding metadata: diff --git a/incubator/haproxy-ingress/values.yaml b/incubator/haproxy-ingress/values.yaml index c6df5b73c0..d8de3bfaf1 100644 --- a/incubator/haproxy-ingress/values.yaml +++ b/incubator/haproxy-ingress/values.yaml @@ -1,6 +1,8 @@ # Enable RBAC rbac: create: true + security: + enable: false # Create ServiceAccount serviceAccount: @@ -14,7 +16,7 @@ controller: name: controller image: repository: quay.io/jcmoraisjr/haproxy-ingress - tag: "v0.7-beta.5" + tag: "v0.7-beta.7" pullPolicy: IfNotPresent ## Additional command line arguments to pass to haproxy-ingress-controller @@ -33,6 +35,9 @@ controller: # key: FOO # name: secret-resource + ## Additional containers that can initialize the pod. + initContainers: {} + # custom haproxy template template: "" @@ -75,6 +80,10 @@ controller: ## podLabels: {} + ## Affinity to be added to controller pods + ## + podAffinity: {} + ## Priority Class to be used ## priorityClassName: ""