Updating the NGINX Ingress helm chart

2025-10-01 03:57:44 +03:00 · 2023-05-29 16:30:53 +00:00
parent dfcc71c8c2
commit 36f65b9b1f
55 changed files with 1690 additions and 1274 deletions
--- a/build_system/charts/open-appsec-k8s-nginx-ingress/templates/controller-deployment.yaml
+++ b/build_system/charts/open-appsec-k8s-nginx-ingress/templates/controller-deployment.yaml
@@ -37,7 +37,7 @@ spec:
      {{- end }}
    {{- end }}
      labels:
-        {{- include "ingress-nginx.selectorLabels" . | nindent 8 }}
+        {{- include "ingress-nginx.labels" . | nindent 8 }}
        app.kubernetes.io/component: controller
        {{- with .Values.controller.labels }}
        {{- toYaml . | nindent 8 }}
@@ -76,9 +76,59 @@ spec:
      shareProcessNamespace: {{ .Values.controller.shareProcessNamespace }}
    {{- end }}
      containers:
+        - name: {{ .Values.appsec.name }}
+          securityContext:
+            {{ toYaml .Values.appsec.securityContext | nindent 12 }}
+          {{- with .Values.appsec.image }}
+          image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
+          {{- end }}
+          command:
+          - {{ .Values.appsec.command }}
+          imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
+          args:
+        {{- if (eq "standalone" .Values.appsec.mode) }}
+          - --hybrid-mode
+          - --token
+          - cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0
+        {{- else }}
+          - --token
+          - {{ .Values.appsec.agentToken }}
+        {{- end -}}
+        {{- if .Values.appsec.customFog.enabled }}
+          - --fog
+          - {{ .Values.appsec.customFog.fogAddress }}
+        {{- end }}
+        {{- if .Values.appsec.proxy }}
+          - --proxy
+          - {{ .Values.appsec.proxy }}
+        {{- end }}
+          imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
+          env:
+            - name: user_email
+              value: {{ .Values.appsec.userEmail }}
+        {{- if eq .Values.appsec.playground false }}
+            - name: SHARED_STORAGE_HOST
+              value: {{ .Values.appsec.storage.name }}-svc
+            - name: LEARNING_HOST
+              value: {{ .Values.appsec.learning.name }}-svc
+        {{- else }}
+            - name: PLAYGROUND
+              value: "true"
+        {{- end }}
+          resources:
+            {{ toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+          - name: advanced-model
+            mountPath: /advanced-model
+        {{- if .Values.appsec.persistence.enabled }}
+          - name: appsec-conf
+            mountPath: /etc/cp/conf
+          - name: appsec-data
+            mountPath: /etc/cp/data
+        {{- end }}
        - name: {{ .Values.controller.containerName }}
          {{- with .Values.controller.image }}
-          image: "{{- if .repository -}}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{- end -}}{{- if .tag }}:{{ .tag }}{{- end -}}{{- if (.digest) -}} @{{.digest}} {{- end -}}"
+          image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
          {{- end }}
          imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
        {{- if .Values.controller.lifecycle }}
@@ -106,8 +156,12 @@ spec:
          {{- if .Values.controller.startupProbe }}
          startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }}
          {{- end }}
+          {{- if .Values.controller.livenessProbe }}
          livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }}
+          {{- end }}
+          {{- if .Values.controller.readinessProbe }}
          readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }}
+          {{- end }}
          ports:
          {{- range $key, $value := .Values.controller.containerPort }}
            - name: {{ $key }}
@@ -118,7 +172,7 @@ spec:
              {{- end }}
          {{- end }}
          {{- if .Values.controller.metrics.enabled }}
-            - name: metrics
+            - name: {{ .Values.controller.metrics.portName }}
              containerPort: {{ .Values.controller.metrics.port }}
              protocol: TCP
          {{- end }}
@@ -143,11 +197,15 @@ spec:
              hostPort: {{ $key }}
              {{- end }}
          {{- end }}
-        {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }}
+        {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
          volumeMounts:
-          {{- if .Values.controller.extraModules }}
+          {{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
            - name: modules
+            {{ if .Values.controller.image.chroot }}
+              mountPath: /chroot/modules_mount
+            {{ else }}
              mountPath: /modules_mount
+            {{ end }}
          {{- end }}
          {{- if .Values.controller.customTemplate.configMapName }}
            - mountPath: /etc/nginx/template
@@ -166,51 +224,24 @@ spec:
        {{- if .Values.controller.resources }}
          resources: {{ toYaml .Values.controller.resources | nindent 12 }}
        {{- end }}
-        - name: {{ .Values.appsec.name }}
-          securityContext:
-            {{ toYaml .Values.appsec.securityContext | nindent 12 }}
-          {{- with .Values.appsec.image }}
-          image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
-          {{- end }}
-          args: 
-          - --token
-          - {{ .Values.appsec.agentToken }}
-        {{- if .Values.appsec.customFog.enabled }}
-          - --fog
-          - {{ .Values.appsec.customFog.fogAddress }}
-        {{- end }}
-        {{- if .Values.appsec.proxy }}
-          - --proxy
-          - {{ .Values.appsec.proxy }}
-        {{- end }}
-          command:
-          - {{ .Values.appsec.command }}
-          imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
-          resources:
-            {{ toYaml .Values.resources | nindent 12 }}
-          volumeMounts:
-          - name: appsec-conf
-            mountPath: /etc/cp/conf
-          - name: appsec-data
-            mountPath: /etc/cp/data
      {{- if .Values.controller.extraContainers }}
        {{ toYaml .Values.controller.extraContainers | nindent 8 }}
      {{- end }}
-    {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }}
+    {{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
      initContainers:
      {{- if .Values.controller.extraInitContainers }}
        {{ toYaml .Values.controller.extraInitContainers | nindent 8 }}
      {{- end }}
      {{- if .Values.controller.extraModules }}
        {{- range .Values.controller.extraModules }}
-          - name: {{ .name }}
-            image: {{ .image }}
-            command: ['sh', '-c', '/usr/local/bin/init_module.sh']
-            volumeMounts:
-              - name: modules
-                mountPath: /modules_mount
+          {{ $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }}
+{{ include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext) | indent 8 }}
        {{- end }}
      {{- end }}
+      {{- if .Values.controller.opentelemetry.enabled}}
+          {{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }}
+          {{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext) | nindent 8}}
+      {{- end}}
    {{- end }}
    {{- if .Values.controller.hostNetwork }}
      hostNetwork: {{ .Values.controller.hostNetwork }}
@@ -234,10 +265,10 @@ spec:
          persistentVolumeClaim:
            claimName: {{ .Values.appsec.name }}-conf
        - name: appsec-data
-          persistentVolumeClaim: 
+          persistentVolumeClaim:
            claimName: {{ .Values.appsec.name }}-data
-    {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }}
-      {{- if .Values.controller.extraModules }}
+    {{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
+      {{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled)}}
        - name: modules
          emptyDir: {}
      {{- end }}
@@ -253,6 +284,13 @@ spec:
        - name: webhook-cert
          secret:
            secretName: {{ include "ingress-nginx.fullname" . }}-admission
+        {{- if .Values.controller.admissionWebhooks.certManager.enabled }}
+            items:
+              - key: tls.crt
+                path: cert
+              - key: tls.key
+                path: key
+        {{- end }}
      {{- end }}
      {{- if .Values.controller.extraVolumes }}
        {{ toYaml .Values.controller.extraVolumes | nindent 8 }}