diff --git a/stable/nginx-ingress/Chart.yaml b/stable/nginx-ingress/Chart.yaml index 47da67c145..b0af816bf2 100755 --- a/stable/nginx-ingress/Chart.yaml +++ b/stable/nginx-ingress/Chart.yaml @@ -1,6 +1,6 @@ name: nginx-ingress -version: 0.7.2 -appVersion: 0.9.0-beta.7 +version: 0.8.0 +appVersion: 0.9.0-beta.11 description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration. icon: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/500px-Nginx_logo.svg.png keywords: diff --git a/stable/nginx-ingress/README.md b/stable/nginx-ingress/README.md index b76c49e9b2..32a80985c4 100644 --- a/stable/nginx-ingress/README.md +++ b/stable/nginx-ingress/README.md @@ -52,9 +52,10 @@ Parameter | Description | Default `controller.config` | nginx ConfigMap entries | none `controller.hostNetwork` | If the nginx deployment / daemonset should run on the host's network namespace | false `controller.defaultBackendService` | default 404 backend service; required only if `defaultBackend.enabled = false` | `""` +`controller.electionID` | election ID to use for the status update | `ingress-controller-leader` +`controller.ingressClass` | name of the ingress class to route through this controller | `nginx` `controller.scope.enabled` | limit the scope of the ingress controller | `false` (watch all namespaces) `controller.scope.namespace` | namespace to watch for ingress | `""` (use the release namespace) -`controller.serviceAccountName` | Service account to run under | `default` `controller.extraArgs` | Additional controller container arguments | `{}` `controller.kind` | install as Deployment or DaemonSet | `Deployment` `controller.nodeSelector` | node labels for pod assignment | `{}` @@ -95,6 +96,8 @@ Parameter | Description | Default `defaultBackend.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""` `defaultBackend.service.loadBalancerSourceRanges` | list of IP CIDRs allowed access to load balancer (if supported) | `[]` `defaultBackend.service.type` | type of default backend service to create | `ClusterIP` +`rbac.create` | If true, create & use RBAC resources | `false` +`rbac.serviceAccountName` | ServiceAccount to be used (ignored if rbac.create=true) | `default` `statsExporter.name` | name of the Prometheus metrics exporter component | `stats-exporter` `statsExporter.image.repository` | Prometheus metrics exporter container image repository | `quay.io/cy-play/vts-nginx-exporter` `statsExporter.image.tag` | Prometheus metrics exporter image tag | `v0.0.3` diff --git a/stable/nginx-ingress/templates/clusterrole.yaml b/stable/nginx-ingress/templates/clusterrole.yaml new file mode 100644 index 0000000000..84e41601bb --- /dev/null +++ b/stable/nginx-ingress/templates/clusterrole.yaml @@ -0,0 +1,69 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "fullname" . }} +rules: + - apiGroups: + - "" + resources: + - configmaps + - endpoints + - nodes + - pods + - secrets + verbs: + - list + - watch +{{- if and .Values.controller.scope.enabled .Values.controller.scope.namespace }} + - apiGroups: + - "" + resources: + - namespaces + resourceNames: + - "{{ .Values.controller.scope.namespace }}" + verbs: + - get +{{- end }} + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - update + - watch + - apiGroups: + - extensions + resources: + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - extensions + resources: + - ingresses/status + verbs: + - update +{{- end -}} diff --git a/stable/nginx-ingress/templates/clusterrolebinding.yaml b/stable/nginx-ingress/templates/clusterrolebinding.yaml new file mode 100644 index 0000000000..5a48ca212f --- /dev/null +++ b/stable/nginx-ingress/templates/clusterrolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ template "fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/stable/nginx-ingress/templates/controller-daemonset.yaml b/stable/nginx-ingress/templates/controller-daemonset.yaml index 3a07cfa32b..2f4d4c313f 100644 --- a/stable/nginx-ingress/templates/controller-daemonset.yaml +++ b/stable/nginx-ingress/templates/controller-daemonset.yaml @@ -12,19 +12,16 @@ metadata: spec: template: metadata: - {{- if .Values.controller.podAnnotations }} annotations: -{{ toYaml .Values.controller.podAnnotations | indent 8 }} + checksum/config: {{ include (print $.Template.BasePath "/controller-configmap.yaml") . | sha256sum }} + {{- if .Values.controller.podAnnotations }} +{{ toYaml .Values.controller.podAnnotations | indent 8}} {{- end }} labels: app: {{ template "name" . }} component: "{{ .Values.controller.name }}" release: {{ .Release.Name }} spec: - hostNetwork: {{ .Values.controller.hostNetwork }} - {{- if .Values.controller.serviceAccountName }} - serviceAccountName: {{ .Values.controller.serviceAccountName }} - {{- end }} containers: - name: {{ template "name" . }}-{{ .Values.controller.name }} image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}" @@ -35,6 +32,12 @@ spec: {{- if and (contains "0.9" .Values.controller.image.tag) .Values.controller.publishService.enabled }} - --publish-service={{ template "controller.publishServicePath" . }} {{- end }} + {{- if (contains "0.9" .Values.controller.image.tag) }} + - --election-id={{ .Values.controller.electionID }} + {{- end }} + {{- if (contains "0.9" .Values.controller.image.tag) }} + - --ingress-class={{ .Values.controller.ingressClass }} + {{- end }} {{- if (contains "0.9" .Values.controller.image.tag) }} - --configmap={{ .Release.Namespace }}/{{ template "controller.fullname" . }} {{- else }} @@ -97,7 +100,6 @@ spec: scheme: HTTP resources: {{ toYaml .Values.controller.resources | indent 12 }} - {{- if .Values.controller.stats.enabled }} - name: {{ template "name" . }}-{{ .Values.statsExporter.name }} image: "{{ .Values.statsExporter.image.repository }}:{{ .Values.statsExporter.image.tag }}" @@ -118,9 +120,11 @@ spec: resources: {{ toYaml .Values.statsExporter.resources | indent 12 }} {{- end }} + hostNetwork: {{ .Values.controller.hostNetwork }} {{- if .Values.controller.nodeSelector }} nodeSelector: {{ toYaml .Values.controller.nodeSelector | indent 8 }} {{- end }} + serviceAccountName: {{ if .Values.rbac.create }}{{ template "fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} terminationGracePeriodSeconds: 60 {{- end }} diff --git a/stable/nginx-ingress/templates/controller-deployment.yaml b/stable/nginx-ingress/templates/controller-deployment.yaml index 233a639cdd..630ea52494 100644 --- a/stable/nginx-ingress/templates/controller-deployment.yaml +++ b/stable/nginx-ingress/templates/controller-deployment.yaml @@ -13,19 +13,16 @@ spec: replicas: {{ .Values.controller.replicaCount }} template: metadata: - {{- if .Values.controller.podAnnotations }} annotations: -{{ toYaml .Values.controller.podAnnotations | indent 8 }} - {{- end }} + checksum/config: {{ include (print $.Template.BasePath "/controller-configmap.yaml") . | sha256sum }} + {{- if .Values.controller.podAnnotations }} +{{ toYaml .Values.controller.podAnnotations | indent 8}} + {{- end }} labels: app: {{ template "name" . }} component: "{{ .Values.controller.name }}" release: {{ .Release.Name }} spec: - hostNetwork: {{ .Values.controller.hostNetwork }} - {{- if .Values.controller.serviceAccountName }} - serviceAccountName: {{ .Values.controller.serviceAccountName }} - {{- end }} containers: - name: {{ template "name" . }}-{{ .Values.controller.name }} image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}" @@ -36,6 +33,12 @@ spec: {{- if and (contains "0.9" .Values.controller.image.tag) .Values.controller.publishService.enabled }} - --publish-service={{ template "controller.publishServicePath" . }} {{- end }} + {{- if (contains "0.9" .Values.controller.image.tag) }} + - --election-id={{ .Values.controller.electionID }} + {{- end }} + {{- if (contains "0.9" .Values.controller.image.tag) }} + - --ingress-class={{ .Values.controller.ingressClass }} + {{- end }} {{- if (contains "0.9" .Values.controller.image.tag) }} - --configmap={{ .Release.Namespace }}/{{ template "controller.fullname" . }} {{- else }} @@ -98,7 +101,6 @@ spec: scheme: HTTP resources: {{ toYaml .Values.controller.resources | indent 12 }} - {{- if .Values.controller.stats.enabled }} - name: {{ template "name" . }}-{{ .Values.statsExporter.name }} image: "{{ .Values.statsExporter.image.repository }}:{{ .Values.statsExporter.image.tag }}" @@ -119,9 +121,11 @@ spec: resources: {{ toYaml .Values.statsExporter.resources | indent 12 }} {{- end }} + hostNetwork: {{ .Values.controller.hostNetwork }} {{- if .Values.controller.nodeSelector }} nodeSelector: {{ toYaml .Values.controller.nodeSelector | indent 8 }} {{- end }} + serviceAccountName: {{ if .Values.rbac.create }}{{ template "fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} terminationGracePeriodSeconds: 60 {{- end }} diff --git a/stable/nginx-ingress/templates/default-backend-service.yaml b/stable/nginx-ingress/templates/default-backend-service.yaml index 6e0379db11..7ac61f8423 100644 --- a/stable/nginx-ingress/templates/default-backend-service.yaml +++ b/stable/nginx-ingress/templates/default-backend-service.yaml @@ -33,5 +33,5 @@ spec: app: {{ template "name" . }} component: "{{ .Values.defaultBackend.name }}" release: {{ .Release.Name }} - type: ClusterIP + type: "{{ .Values.defaultBackend.service.type }}" {{- end }} diff --git a/stable/nginx-ingress/templates/role.yaml b/stable/nginx-ingress/templates/role.yaml new file mode 100644 index 0000000000..ad3a80ffcc --- /dev/null +++ b/stable/nginx-ingress/templates/role.yaml @@ -0,0 +1,44 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: Role +metadata: + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "fullname" . }} +rules: + - apiGroups: + - "" + resources: + - configmaps + - namespaces + - pods + - secrets + verbs: + - get + - apiGroups: + - "" + resources: + - configmaps + resourceNames: + - {{ .Values.controller.electionID }}-{{ .Values.controller.ingressClass }} + verbs: + - get + - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - apiGroups: + - "" + resources: + - endpoints + verbs: + - create + - get + - update +{{- end -}} diff --git a/stable/nginx-ingress/templates/rolebinding.yaml b/stable/nginx-ingress/templates/rolebinding.yaml new file mode 100644 index 0000000000..7ba52c339e --- /dev/null +++ b/stable/nginx-ingress/templates/rolebinding.yaml @@ -0,0 +1,19 @@ +{{- if .Values.rbac.create -}} +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: RoleBinding +metadata: + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "fullname" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "fullname" . }} + namespace: {{ .Release.Namespace }} +{{- end -}} diff --git a/stable/nginx-ingress/templates/serviceaccount.yaml b/stable/nginx-ingress/templates/serviceaccount.yaml new file mode 100644 index 0000000000..8967eb1a75 --- /dev/null +++ b/stable/nginx-ingress/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.rbac.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: {{ template "name" . }} + chart: {{ .Chart.Name }}-{{ .Chart.Version }} + heritage: {{ .Release.Service }} + release: {{ .Release.Name }} + name: {{ template "fullname" . }} +{{- end -}} diff --git a/stable/nginx-ingress/values.yaml b/stable/nginx-ingress/values.yaml index 4a2038c137..3808d89843 100644 --- a/stable/nginx-ingress/values.yaml +++ b/stable/nginx-ingress/values.yaml @@ -20,6 +20,19 @@ controller: ## defaultBackendService: "" + ## Optionally specify the secret name for default SSL certificate + ## Must be / + ## + defaultSSLCertificate: "" + + ## Election ID to use for status update + ## + electionID: ingress-controller-leader + + ## Name of the ingress class to route through this controller + ## + ingressClass: nginx + ## Allows customization of the external service ## the ingress will be bound to via DNS publishService: @@ -46,11 +59,6 @@ controller: ## nodeSelector: {} - ## Run the controller via this service account - ## Ref: https://github.com/kubernetes/ingress/tree/master/examples/rbac/nginx - ## - serviceAccountName: "" - ## Annotations to be added to controller pods ## podAnnotations: {} @@ -162,6 +170,11 @@ defaultBackend: servicePort: 80 type: ClusterIP +## Enable RBAC as per https://github.com/kubernetes/ingress/tree/master/examples/rbac/nginx and https://github.com/kubernetes/ingress/issues/266 +rbac: + create: false + serviceAccountName: default + ## If controller.stats.enabled = true, Prometheus metrics will be exported ## Ref: https://github.com/hnlq715/nginx-vts-exporter ##