From d37b5025ffc8be49699898369fbb59661e2a8ffb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christoph=20H=C3=B6sler?= Date: Mon, 24 Feb 2020 22:41:36 +0100 Subject: [PATCH] [stable/nginx-ingress] feature: add switch to disable clusterrole (-binding) (#20984) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feature: add switch to disable clusterrole (-binding) Signed-off-by: Christoph Hösler * bump version to 1.33.0 Signed-off-by: Christoph Hösler * update README.md Signed-off-by: Christoph Hösler --- stable/nginx-ingress/Chart.yaml | 2 +- stable/nginx-ingress/README.md | 1 + stable/nginx-ingress/templates/clusterrole.yaml | 2 +- stable/nginx-ingress/templates/clusterrolebinding.yaml | 2 +- stable/nginx-ingress/templates/controller-deployment.yaml | 3 +++ stable/nginx-ingress/values.yaml | 1 + 6 files changed, 8 insertions(+), 3 deletions(-) diff --git a/stable/nginx-ingress/Chart.yaml b/stable/nginx-ingress/Chart.yaml index 89caa18ad2..fb42838724 100644 --- a/stable/nginx-ingress/Chart.yaml +++ b/stable/nginx-ingress/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: nginx-ingress -version: 1.32.0 +version: 1.33.0 appVersion: 0.30.0 home: https://github.com/kubernetes/ingress-nginx description: An nginx Ingress controller that uses ConfigMap to store the nginx configuration. diff --git a/stable/nginx-ingress/README.md b/stable/nginx-ingress/README.md index 9adba4e146..84ab59669f 100644 --- a/stable/nginx-ingress/README.md +++ b/stable/nginx-ingress/README.md @@ -216,6 +216,7 @@ Parameter | Description | Default `defaultBackend.serviceAccount.name` | The name of the backend service account to use. If not set and `create` is `true`, a name is generated using the fullname template. Only useful if you need a pod security policy to run the backend. | `` `imagePullSecrets` | name of Secret resource containing private registry credentials | `nil` `rbac.create` | if `true`, create & use RBAC resources | `true` +`rbac.scope` | if `true`, do not create & use clusterrole and -binding. Set to `true` in combination with `controller.scope.enabled=true` to disable load-balancer status updates and scope the ingress entirely. | `false` `podSecurityPolicy.enabled` | if `true`, create & use Pod Security Policy resources | `false` `serviceAccount.create` | if `true`, create a service account for the controller | `true` `serviceAccount.name` | The name of the controller service account to use. If not set and `create` is `true`, a name is generated using the fullname template. | `` diff --git a/stable/nginx-ingress/templates/clusterrole.yaml b/stable/nginx-ingress/templates/clusterrole.yaml index 2b77de2f5f..5072603018 100644 --- a/stable/nginx-ingress/templates/clusterrole.yaml +++ b/stable/nginx-ingress/templates/clusterrole.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.create -}} +{{- if and (.Values.rbac.create) (not .Values.rbac.scope) -}} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: diff --git a/stable/nginx-ingress/templates/clusterrolebinding.yaml b/stable/nginx-ingress/templates/clusterrolebinding.yaml index 3679143c5d..1f6976a041 100644 --- a/stable/nginx-ingress/templates/clusterrolebinding.yaml +++ b/stable/nginx-ingress/templates/clusterrolebinding.yaml @@ -1,4 +1,4 @@ -{{- if .Values.rbac.create -}} +{{- if and (.Values.rbac.create) (not .Values.rbac.scope) -}} apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: diff --git a/stable/nginx-ingress/templates/controller-deployment.yaml b/stable/nginx-ingress/templates/controller-deployment.yaml index 1a00a4b8e9..1abcb26e48 100644 --- a/stable/nginx-ingress/templates/controller-deployment.yaml +++ b/stable/nginx-ingress/templates/controller-deployment.yaml @@ -97,6 +97,9 @@ spec: {{- if .Values.controller.scope.enabled }} - --watch-namespace={{ default .Release.Namespace .Values.controller.scope.namespace }} {{- end }} + {{- if and (.Values.controller.scope.enabled) (.Values.rbac.scope) }} + - --update-status=false + {{- end }} {{- if and (.Values.controller.reportNodeInternalIp) (.Values.controller.hostNetwork) }} - --report-node-internal-ip-address={{ .Values.controller.reportNodeInternalIp }} {{- end }} diff --git a/stable/nginx-ingress/values.yaml b/stable/nginx-ingress/values.yaml index 164658e87a..b17bfef426 100644 --- a/stable/nginx-ingress/values.yaml +++ b/stable/nginx-ingress/values.yaml @@ -527,6 +527,7 @@ defaultBackend: ## Enable RBAC as per https://github.com/kubernetes/ingress/tree/master/examples/rbac/nginx and https://github.com/kubernetes/ingress/issues/266 rbac: create: true + scope: false # If true, create & use Pod Security Policy resources # https://kubernetes.io/docs/concepts/policy/pod-security-policy/