From afdcbd010c407108bffe8cc5cfc3f7a5299c5a86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20P=C3=B6hn?= Date: Tue, 16 Jul 2019 18:25:24 +0200 Subject: [PATCH] [stable/traefik] Use unprivileged ports (#13361) Signed-off-by: Sebastian Poehn --- stable/traefik/Chart.yaml | 2 +- stable/traefik/README.md | 1 + stable/traefik/templates/_helpers.tpl | 23 +++++++++++++++++++++++ stable/traefik/templates/configmap.yaml | 4 ++-- stable/traefik/templates/deployment.yaml | 8 ++++---- stable/traefik/values.yaml | 1 + 6 files changed, 32 insertions(+), 7 deletions(-) diff --git a/stable/traefik/Chart.yaml b/stable/traefik/Chart.yaml index 91b301fccc..0940fd39fd 100644 --- a/stable/traefik/Chart.yaml +++ b/stable/traefik/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: traefik -version: 1.71.2 +version: 1.72.0 appVersion: 1.7.12 description: A Traefik based Kubernetes ingress controller with Let's Encrypt support keywords: diff --git a/stable/traefik/README.md b/stable/traefik/README.md index 9d7274c56e..334a29ea93 100644 --- a/stable/traefik/README.md +++ b/stable/traefik/README.md @@ -108,6 +108,7 @@ The following table lists the configurable parameters of the Traefik chart and t | `rbac.enabled` | Whether to enable RBAC with a specific cluster role and binding for Traefik | `false` | | `deploymentStrategy` | Specify deployment spec rollout strategy | `{}` | | `securityContext` | Security context | `{}` | +| `useNonPriviledgedPorts` | Use non privileged ports to listen. Needed if container is not running as root | `false` | | `env` | Environment variables for the container | `{}` | | `nodeSelector` | Node labels for pod assignment | `{}` | | `affinity` | Affinity settings | `{}` | diff --git a/stable/traefik/templates/_helpers.tpl b/stable/traefik/templates/_helpers.tpl index 94318e42d6..128e89ee77 100644 --- a/stable/traefik/templates/_helpers.tpl +++ b/stable/traefik/templates/_helpers.tpl @@ -113,6 +113,7 @@ Create custom cipherSuites block ] {{- end -}} +{{/* Create the block for RootCAs. */}} {{- define "traefik.rootCAs" -}} @@ -123,3 +124,25 @@ Create the block for RootCAs. {{- end -}} ] {{- end -}} + +{{/* +Helper for containerPort (http) +*/}} +{{- define "traefik.containerPort.http" -}} + {{- if .Values.useNonPriviledgedPorts -}} + 6080 + {{- else -}} + 80 + {{- end -}} +{{- end -}} + +{{/* +Helper for containerPort (https) +*/}} +{{- define "traefik.containerPort.https" -}} + {{- if .Values.useNonPriviledgedPorts -}} + 6443 + {{- else -}} + 443 + {{- end -}} +{{- end -}} diff --git a/stable/traefik/templates/configmap.yaml b/stable/traefik/templates/configmap.yaml index 9e80a4f6a3..4d79823743 100644 --- a/stable/traefik/templates/configmap.yaml +++ b/stable/traefik/templates/configmap.yaml @@ -31,7 +31,7 @@ data: {{- end }} [entryPoints] [entryPoints.http] - address = ":80" + address = ":{{ template "traefik.containerPort.http" . }}" compress = {{ .Values.gzip.enabled }} {{- if .Values.forwardAuth }} {{- if has "http" .Values.forwardAuth.entryPoints }} @@ -64,7 +64,7 @@ data: {{- if .Values.whiteListSourceRange }} {{ template "traefik.whiteListSourceRange" . }} {{- end }} - address = ":443" + address = ":{{ template "traefik.containerPort.https" . }}" compress = {{ .Values.gzip.enabled }} {{- if .Values.forwardAuth }} {{- if has "https" .Values.forwardAuth.entryPoints }} diff --git a/stable/traefik/templates/deployment.yaml b/stable/traefik/templates/deployment.yaml index 7ce3935511..ad89e5d749 100644 --- a/stable/traefik/templates/deployment.yaml +++ b/stable/traefik/templates/deployment.yaml @@ -84,7 +84,7 @@ spec: readinessProbe: httpGet: path: /ping - port: 80 + port: {{ template "traefik.containerPort.http" . }} failureThreshold: 1 initialDelaySeconds: 10 periodSeconds: 10 @@ -93,7 +93,7 @@ spec: livenessProbe: httpGet: path: /ping - port: 80 + port: {{ template "traefik.containerPort.http" . }} failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 @@ -139,7 +139,7 @@ spec: {{- end }} ports: - name: http - containerPort: 80 + containerPort: {{ template "traefik.containerPort.http" . }} {{- if .Values.deployment.hostPort.httpEnabled }} hostPort: {{ default 80 .Values.deployment.hostPort.httpPort }} {{- end }} @@ -148,7 +148,7 @@ spec: containerPort: 8880 protocol: TCP - name: https - containerPort: 443 + containerPort: {{ template "traefik.containerPort.https" . }} {{- if .Values.deployment.hostPort.httpsEnabled }} hostPort: {{ default 443 .Values.deployment.hostPort.httpsPort }} {{- end }} diff --git a/stable/traefik/values.yaml b/stable/traefik/values.yaml index fc17105ca3..56cdc69773 100644 --- a/stable/traefik/values.yaml +++ b/stable/traefik/values.yaml @@ -46,6 +46,7 @@ deploymentStrategy: {} # type: RollingUpdate securityContext: {} +useNonPriviledgedPorts: false env: {} nodeSelector: {}