playbooks/roles/ingress/templates/ingress-nginx.yml.j2

   1
   2 apiVersion: v1
   3 kind: Namespace
   4 metadata:
   5   name: ingress-nginx
   6   labels:
   7     app.kubernetes.io/name: ingress-nginx
   8     app.kubernetes.io/instance: ingress-nginx
   9
  10 ---
  11 # Source: ingress-nginx/templates/controller-serviceaccount.yaml
  12 apiVersion: v1
  13 kind: ServiceAccount
  14 metadata:
  15   labels:
  16     helm.sh/chart: ingress-nginx-4.0.15
  17     app.kubernetes.io/name: ingress-nginx
  18     app.kubernetes.io/instance: ingress-nginx
  19     app.kubernetes.io/version: 1.1.1
  20     app.kubernetes.io/component: controller
  21   name: ingress-nginx
  22   namespace: ingress-nginx
  23 automountServiceAccountToken: true
  24 ---
  25 # Source: ingress-nginx/templates/controller-configmap.yaml
  26 apiVersion: v1
  27 kind: ConfigMap
  28 metadata:
  29   labels:
  30     helm.sh/chart: ingress-nginx-4.0.15
  31     app.kubernetes.io/name: ingress-nginx
  32     app.kubernetes.io/instance: ingress-nginx
  33     app.kubernetes.io/version: 1.1.1
  34     app.kubernetes.io/component: controller
  35   name: ingress-nginx-controller
  36   namespace: ingress-nginx
  37 data:
  38   allow-snippet-annotations: 'true'
  39 ---
  40 # Source: ingress-nginx/templates/clusterrole.yaml
  41 apiVersion: rbac.authorization.k8s.io/v1
  42 kind: ClusterRole
  43 metadata:
  44   labels:
  45     helm.sh/chart: ingress-nginx-4.0.15
  46     app.kubernetes.io/name: ingress-nginx
  47     app.kubernetes.io/instance: ingress-nginx
  48     app.kubernetes.io/version: 1.1.1
  49   name: ingress-nginx
  50 rules:
  51   - apiGroups:
  52       - ''
  53     resources:
  54       - configmaps
  55       - endpoints
  56       - nodes
  57       - pods
  58       - secrets
  59       - namespaces
  60     verbs:
  61       - list
  62       - watch
  63   - apiGroups:
  64       - ''
  65     resources:
  66       - nodes
  67     verbs:
  68       - get
  69   - apiGroups:
  70       - ''
  71     resources:
  72       - services
  73     verbs:
  74       - get
  75       - list
  76       - watch
  77   - apiGroups:
  78       - networking.k8s.io
  79     resources:
  80       - ingresses
  81     verbs:
  82       - get
  83       - list
  84       - watch
  85   - apiGroups:
  86       - ''
  87     resources:
  88       - events
  89     verbs:
  90       - create
  91       - patch
  92   - apiGroups:
  93       - networking.k8s.io
  94     resources:
  95       - ingresses/status
  96     verbs:
  97       - update
  98   - apiGroups:
  99       - networking.k8s.io
 100     resources:
 101       - ingressclasses
 102     verbs:
 103       - get
 104       - list
 105       - watch
 106 ---
 107 # Source: ingress-nginx/templates/clusterrolebinding.yaml
 108 apiVersion: rbac.authorization.k8s.io/v1
 109 kind: ClusterRoleBinding
 110 metadata:
 111   labels:
 112     helm.sh/chart: ingress-nginx-4.0.15
 113     app.kubernetes.io/name: ingress-nginx
 114     app.kubernetes.io/instance: ingress-nginx
 115     app.kubernetes.io/version: 1.1.1
 116   name: ingress-nginx
 117 roleRef:
 118   apiGroup: rbac.authorization.k8s.io
 119   kind: ClusterRole
 120   name: ingress-nginx
 121 subjects:
 122   - kind: ServiceAccount
 123     name: ingress-nginx
 124     namespace: ingress-nginx
 125 ---
 126 # Source: ingress-nginx/templates/controller-role.yaml
 127 apiVersion: rbac.authorization.k8s.io/v1
 128 kind: Role
 129 metadata:
 130   labels:
 131     helm.sh/chart: ingress-nginx-4.0.15
 132     app.kubernetes.io/name: ingress-nginx
 133     app.kubernetes.io/instance: ingress-nginx
 134     app.kubernetes.io/version: 1.1.1
 135     app.kubernetes.io/component: controller
 136   name: ingress-nginx
 137   namespace: ingress-nginx
 138 rules:
 139   - apiGroups:
 140       - ''
 141     resources:
 142       - namespaces
 143     verbs:
 144       - get
 145   - apiGroups:
 146       - ''
 147     resources:
 148       - configmaps
 149       - pods
 150       - secrets
 151       - endpoints
 152     verbs:
 153       - get
 154       - list
 155       - watch
 156   - apiGroups:
 157       - ''
 158     resources:
 159       - services
 160     verbs:
 161       - get
 162       - list
 163       - watch
 164   - apiGroups:
 165       - networking.k8s.io
 166     resources:
 167       - ingresses
 168     verbs:
 169       - get
 170       - list
 171       - watch
 172   - apiGroups:
 173       - networking.k8s.io
 174     resources:
 175       - ingresses/status
 176     verbs:
 177       - update
 178   - apiGroups:
 179       - networking.k8s.io
 180     resources:
 181       - ingressclasses
 182     verbs:
 183       - get
 184       - list
 185       - watch
 186   - apiGroups:
 187       - ''
 188     resources:
 189       - configmaps
 190     resourceNames:
 191       - ingress-controller-leader
 192     verbs:
 193       - get
 194       - update
 195   - apiGroups:
 196       - ''
 197     resources:
 198       - configmaps
 199     verbs:
 200       - create
 201   - apiGroups:
 202       - ''
 203     resources:
 204       - events
 205     verbs:
 206       - create
 207       - patch
 208 ---
 209 # Source: ingress-nginx/templates/controller-rolebinding.yaml
 210 apiVersion: rbac.authorization.k8s.io/v1
 211 kind: RoleBinding
 212 metadata:
 213   labels:
 214     helm.sh/chart: ingress-nginx-4.0.15
 215     app.kubernetes.io/name: ingress-nginx
 216     app.kubernetes.io/instance: ingress-nginx
 217     app.kubernetes.io/version: 1.1.1
 218     app.kubernetes.io/component: controller
 219   name: ingress-nginx
 220   namespace: ingress-nginx
 221 roleRef:
 222   apiGroup: rbac.authorization.k8s.io
 223   kind: Role
 224   name: ingress-nginx
 225 subjects:
 226   - kind: ServiceAccount
 227     name: ingress-nginx
 228     namespace: ingress-nginx
 229 ---
 230 # Source: ingress-nginx/templates/controller-service-webhook.yaml
 231 apiVersion: v1
 232 kind: Service
 233 metadata:
 234   labels:
 235     helm.sh/chart: ingress-nginx-4.0.15
 236     app.kubernetes.io/name: ingress-nginx
 237     app.kubernetes.io/instance: ingress-nginx
 238     app.kubernetes.io/version: 1.1.1
 239     app.kubernetes.io/component: controller
 240   name: ingress-nginx-controller-admission
 241   namespace: ingress-nginx
 242 spec:
 243   type: ClusterIP
 244   ports:
 245     - name: https-webhook
 246       port: 443
 247       targetPort: webhook
 248       appProtocol: https
 249   selector:
 250     app.kubernetes.io/name: ingress-nginx
 251     app.kubernetes.io/instance: ingress-nginx
 252     app.kubernetes.io/component: controller
 253 ---
 254 # Source: ingress-nginx/templates/controller-service.yaml
 255 apiVersion: v1
 256 kind: Service
 257 metadata:
 258   annotations:
 259   labels:
 260     helm.sh/chart: ingress-nginx-4.0.15
 261     app.kubernetes.io/name: ingress-nginx
 262     app.kubernetes.io/instance: ingress-nginx
 263     app.kubernetes.io/version: 1.1.1
 264     app.kubernetes.io/component: controller
 265   name: ingress-nginx-controller
 266   namespace: ingress-nginx
 267 spec:
 268   type: NodePort
 269   ipFamilyPolicy: SingleStack
 270   ipFamilies:
 271     - IPv4
 272   ports:
 273     - name: http
 274       port: 80
 275       nodePort: 30080
 276       protocol: TCP
 277       targetPort: http
 278       appProtocol: http
 279     - name: https
 280       port: 443
 281       nodePort: 30433
 282       protocol: TCP
 283       targetPort: https
 284       appProtocol: https
 285   selector:
 286     app.kubernetes.io/name: ingress-nginx
 287     app.kubernetes.io/instance: ingress-nginx
 288     app.kubernetes.io/component: controller
 289 ---
 290 # Source: ingress-nginx/templates/controller-deployment.yaml
 291 apiVersion: apps/v1
 292 kind: Deployment
 293 metadata:
 294   labels:
 295     helm.sh/chart: ingress-nginx-4.0.15
 296     app.kubernetes.io/name: ingress-nginx
 297     app.kubernetes.io/instance: ingress-nginx
 298     app.kubernetes.io/version: 1.1.1
 299     app.kubernetes.io/component: controller
 300   name: ingress-nginx-controller
 301   namespace: ingress-nginx
 302 spec:
 303   selector:
 304     matchLabels:
 305       app.kubernetes.io/name: ingress-nginx
 306       app.kubernetes.io/instance: ingress-nginx
 307       app.kubernetes.io/component: controller
 308   revisionHistoryLimit: 10
 309   minReadySeconds: 0
 310   template:
 311     metadata:
 312       labels:
 313         app.kubernetes.io/name: ingress-nginx
 314         app.kubernetes.io/instance: ingress-nginx
 315         app.kubernetes.io/component: controller
 316     spec:
 317       dnsPolicy: ClusterFirst
 318       containers:
 319         - name: controller
 320           image: "{{ ingress_repo_url }}/controller:{{ ingress_nginx_version }}"
 321           imagePullPolicy: IfNotPresent
 322           lifecycle:
 323             preStop:
 324               exec:
 325                 command:
 326                   - /wait-shutdown
 327           args:
 328             - /nginx-ingress-controller
 329             - --election-id=ingress-controller-leader
 330             - --controller-class=k8s.io/ingress-nginx
 331             - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
 332             - --validating-webhook=:8443
 333             - --validating-webhook-certificate=/usr/local/certificates/cert
 334             - --validating-webhook-key=/usr/local/certificates/key
 335           securityContext:
 336             capabilities:
 337               drop:
 338                 - ALL
 339               add:
 340                 - NET_BIND_SERVICE
 341             runAsUser: 101
 342             allowPrivilegeEscalation: true
 343           env:
 344             - name: POD_NAME
 345               valueFrom:
 346                 fieldRef:
 347                   fieldPath: metadata.name
 348             - name: POD_NAMESPACE
 349               valueFrom:
 350                 fieldRef:
 351                   fieldPath: metadata.namespace
 352             - name: LD_PRELOAD
 353               value: /usr/local/lib/libmimalloc.so
 354           livenessProbe:
 355             failureThreshold: 5
 356             httpGet:
 357               path: /healthz
 358               port: 10254
 359               scheme: HTTP
 360             initialDelaySeconds: 10
 361             periodSeconds: 10
 362             successThreshold: 1
 363             timeoutSeconds: 1
 364           readinessProbe:
 365             failureThreshold: 3
 366             httpGet:
 367               path: /healthz
 368               port: 10254
 369               scheme: HTTP
 370             initialDelaySeconds: 10
 371             periodSeconds: 10
 372             successThreshold: 1
 373             timeoutSeconds: 1
 374           ports:
 375             - name: http
 376               containerPort: 80
 377               protocol: TCP
 378             - name: https
 379               containerPort: 443
 380               protocol: TCP
 381             - name: webhook
 382               containerPort: 8443
 383               protocol: TCP
 384           volumeMounts:
 385             - name: webhook-cert
 386               mountPath: /usr/local/certificates/
 387               readOnly: true
 388           resources:
 389             requests:
 390               cpu: 100m
 391               memory: 90Mi
 392       nodeSelector:
 393         kubernetes.io/os: linux
 394       serviceAccountName: ingress-nginx
 395       terminationGracePeriodSeconds: 300
 396       volumes:
 397         - name: webhook-cert
 398           secret:
 399             secretName: ingress-nginx-admission
 400 ---
 401 # Source: ingress-nginx/templates/controller-ingressclass.yaml
 402 # We don't support namespaced ingressClass yet
 403 # So a ClusterRole and a ClusterRoleBinding is required
 404 apiVersion: networking.k8s.io/v1
 405 kind: IngressClass
 406 metadata:
 407   labels:
 408     helm.sh/chart: ingress-nginx-4.0.15
 409     app.kubernetes.io/name: ingress-nginx
 410     app.kubernetes.io/instance: ingress-nginx
 411     app.kubernetes.io/version: 1.1.1
 412     app.kubernetes.io/component: controller
 413   name: nginx
 414   namespace: ingress-nginx
 415 spec:
 416   controller: k8s.io/ingress-nginx
 417 ---
 418 # Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
 419 # before changing this value, check the required kubernetes version
 420 # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
 421 apiVersion: admissionregistration.k8s.io/v1
 422 kind: ValidatingWebhookConfiguration
 423 metadata:
 424   labels:
 425     helm.sh/chart: ingress-nginx-4.0.15
 426     app.kubernetes.io/name: ingress-nginx
 427     app.kubernetes.io/instance: ingress-nginx
 428     app.kubernetes.io/version: 1.1.1
 429     app.kubernetes.io/component: admission-webhook
 430   name: ingress-nginx-admission
 431 webhooks:
 432   - name: validate.nginx.ingress.kubernetes.io
 433     matchPolicy: Equivalent
 434     rules:
 435       - apiGroups:
 436           - networking.k8s.io
 437         apiVersions:
 438           - v1
 439         operations:
 440           - CREATE
 441           - UPDATE
 442         resources:
 443           - ingresses
 444     failurePolicy: Fail
 445     sideEffects: None
 446     admissionReviewVersions:
 447       - v1
 448     clientConfig:
 449       service:
 450         namespace: ingress-nginx
 451         name: ingress-nginx-controller-admission
 452         path: /networking/v1/ingresses
 453 ---
 454 # Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
 455 apiVersion: v1
 456 kind: ServiceAccount
 457 metadata:
 458   name: ingress-nginx-admission
 459   namespace: ingress-nginx
 460   annotations:
 461     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
 462     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 463   labels:
 464     helm.sh/chart: ingress-nginx-4.0.15
 465     app.kubernetes.io/name: ingress-nginx
 466     app.kubernetes.io/instance: ingress-nginx
 467     app.kubernetes.io/version: 1.1.1
 468     app.kubernetes.io/component: admission-webhook
 469 ---
 470 # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
 471 apiVersion: rbac.authorization.k8s.io/v1
 472 kind: ClusterRole
 473 metadata:
 474   name: ingress-nginx-admission
 475   annotations:
 476     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
 477     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 478   labels:
 479     helm.sh/chart: ingress-nginx-4.0.15
 480     app.kubernetes.io/name: ingress-nginx
 481     app.kubernetes.io/instance: ingress-nginx
 482     app.kubernetes.io/version: 1.1.1
 483     app.kubernetes.io/component: admission-webhook
 484 rules:
 485   - apiGroups:
 486       - admissionregistration.k8s.io
 487     resources:
 488       - validatingwebhookconfigurations
 489     verbs:
 490       - get
 491       - update
 492 ---
 493 # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
 494 apiVersion: rbac.authorization.k8s.io/v1
 495 kind: ClusterRoleBinding
 496 metadata:
 497   name: ingress-nginx-admission
 498   annotations:
 499     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
 500     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 501   labels:
 502     helm.sh/chart: ingress-nginx-4.0.15
 503     app.kubernetes.io/name: ingress-nginx
 504     app.kubernetes.io/instance: ingress-nginx
 505     app.kubernetes.io/version: 1.1.1
 506     app.kubernetes.io/component: admission-webhook
 507 roleRef:
 508   apiGroup: rbac.authorization.k8s.io
 509   kind: ClusterRole
 510   name: ingress-nginx-admission
 511 subjects:
 512   - kind: ServiceAccount
 513     name: ingress-nginx-admission
 514     namespace: ingress-nginx
 515 ---
 516 # Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
 517 apiVersion: rbac.authorization.k8s.io/v1
 518 kind: Role
 519 metadata:
 520   name: ingress-nginx-admission
 521   namespace: ingress-nginx
 522   annotations:
 523     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
 524     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 525   labels:
 526     helm.sh/chart: ingress-nginx-4.0.15
 527     app.kubernetes.io/name: ingress-nginx
 528     app.kubernetes.io/instance: ingress-nginx
 529     app.kubernetes.io/version: 1.1.1
 530     app.kubernetes.io/component: admission-webhook
 531 rules:
 532   - apiGroups:
 533       - ''
 534     resources:
 535       - secrets
 536     verbs:
 537       - get
 538       - create
 539 ---
 540 # Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
 541 apiVersion: rbac.authorization.k8s.io/v1
 542 kind: RoleBinding
 543 metadata:
 544   name: ingress-nginx-admission
 545   namespace: ingress-nginx
 546   annotations:
 547     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
 548     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 549   labels:
 550     helm.sh/chart: ingress-nginx-4.0.15
 551     app.kubernetes.io/name: ingress-nginx
 552     app.kubernetes.io/instance: ingress-nginx
 553     app.kubernetes.io/version: 1.1.1
 554     app.kubernetes.io/component: admission-webhook
 555 roleRef:
 556   apiGroup: rbac.authorization.k8s.io
 557   kind: Role
 558   name: ingress-nginx-admission
 559 subjects:
 560   - kind: ServiceAccount
 561     name: ingress-nginx-admission
 562     namespace: ingress-nginx
 563 ---
 564 # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
 565 apiVersion: batch/v1
 566 kind: Job
 567 metadata:
 568   name: ingress-nginx-admission-create
 569   namespace: ingress-nginx
 570   annotations:
 571     helm.sh/hook: pre-install,pre-upgrade
 572     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 573   labels:
 574     helm.sh/chart: ingress-nginx-4.0.15
 575     app.kubernetes.io/name: ingress-nginx
 576     app.kubernetes.io/instance: ingress-nginx
 577     app.kubernetes.io/version: 1.1.1
 578     app.kubernetes.io/component: admission-webhook
 579 spec:
 580   template:
 581     metadata:
 582       name: ingress-nginx-admission-create
 583       labels:
 584         helm.sh/chart: ingress-nginx-4.0.15
 585         app.kubernetes.io/name: ingress-nginx
 586         app.kubernetes.io/instance: ingress-nginx
 587         app.kubernetes.io/version: 1.1.1
 588         app.kubernetes.io/component: admission-webhook
 589     spec:
 590       containers:
 591         - name: create
 592           image: "{{ ingress_repo_url }}/kube-webhook-certgen:{{ ingress_nginx_version }}"
 593           imagePullPolicy: IfNotPresent
 594           args:
 595             - create
 596             - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
 597             - --namespace=$(POD_NAMESPACE)
 598             - --secret-name=ingress-nginx-admission
 599           env:
 600             - name: POD_NAMESPACE
 601               valueFrom:
 602                 fieldRef:
 603                   fieldPath: metadata.namespace
 604           securityContext:
 605             allowPrivilegeEscalation: false
 606       restartPolicy: OnFailure
 607       serviceAccountName: ingress-nginx-admission
 608       nodeSelector:
 609         kubernetes.io/os: linux
 610       securityContext:
 611         runAsNonRoot: true
 612         runAsUser: 2000
 613 ---
 614 # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
 615 apiVersion: batch/v1
 616 kind: Job
 617 metadata:
 618   name: ingress-nginx-admission-patch
 619   namespace: ingress-nginx
 620   annotations:
 621     helm.sh/hook: post-install,post-upgrade
 622     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
 623   labels:
 624     helm.sh/chart: ingress-nginx-4.0.15
 625     app.kubernetes.io/name: ingress-nginx
 626     app.kubernetes.io/instance: ingress-nginx
 627     app.kubernetes.io/version: 1.1.1
 628     app.kubernetes.io/component: admission-webhook
 629 spec:
 630   template:
 631     metadata:
 632       name: ingress-nginx-admission-patch
 633       labels:
 634         helm.sh/chart: ingress-nginx-4.0.15
 635         app.kubernetes.io/name: ingress-nginx
 636         app.kubernetes.io/instance: ingress-nginx
 637         app.kubernetes.io/version: 1.1.1
 638         app.kubernetes.io/managed-by: Helm
 639         app.kubernetes.io/component: admission-webhook
 640     spec:
 641       containers:
 642         - name: patch
 643           image: "{{ ingress_repo_url }}/kube-webhook-certgen:{{ ingress_nginx_version }}"
 644           imagePullPolicy: IfNotPresent
 645           args:
 646             - patch
 647             - --webhook-name=ingress-nginx-admission
 648             - --namespace=$(POD_NAMESPACE)
 649             - --patch-mutating=false
 650             - --secret-name=ingress-nginx-admission
 651             - --patch-failure-policy=Fail
 652           env:
 653             - name: POD_NAMESPACE
 654               valueFrom:
 655                 fieldRef:
 656                   fieldPath: metadata.namespace
 657           securityContext:
 658             allowPrivilegeEscalation: false
 659       restartPolicy: OnFailure
 660       serviceAccountName: ingress-nginx-admission
 661       nodeSelector:
 662         kubernetes.io/os: linux
 663       securityContext:
 664         runAsNonRoot: true
 665         runAsUser: 2000