mirror of
https://github.com/openappsec/openappsec.git
synced 2025-09-30 03:34:26 +03:00
Update charts
This commit is contained in:
noam
@@ -1,11 +1,12 @@
|
||||
annotations:
|
||||
artifacthub.io/changes: |
|
||||
- "[helm] Support custom port configuration for internal service (#9846)"
|
||||
- "Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803)"
|
||||
- "Update Ingress-Nginx version controller-v1.7.1"
|
||||
- "Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406)"
|
||||
- "feat(helm): Add loadBalancerClass (#9562)"
|
||||
- "added helmshowvalues example (#10019)"
|
||||
- "Update Ingress-Nginx version controller-v1.8.1"
|
||||
artifacthub.io/prerelease: "false"
|
||||
apiVersion: v2
|
||||
appVersion: 1.7.1
|
||||
appVersion: 1.8.1
|
||||
keywords:
|
||||
- ingress
|
||||
- nginx
|
||||
@@ -13,4 +14,4 @@ kubeVersion: '>=1.20.0-0'
|
||||
name: open-appsec-k8s-nginx-ingress
|
||||
sources:
|
||||
- https://github.com/kubernetes/ingress-nginx
|
||||
version: 4.6.1
|
||||
version: 4.7.1
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
|
||||
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
|
||||
|
||||
@@ -79,14 +79,14 @@ else it would make it impossible to evacuate a node. See [gh issue #7127](https:
|
||||
|
||||
### Prometheus Metrics
|
||||
|
||||
The Nginx ingress controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`.
|
||||
The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`.
|
||||
|
||||
You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`.
|
||||
Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`)
|
||||
|
||||
### ingress-nginx nginx\_status page/stats server
|
||||
|
||||
Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in nginx ingress controller:
|
||||
Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller:
|
||||
|
||||
- In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed
|
||||
- In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost.
|
||||
@@ -143,8 +143,10 @@ controller:
|
||||
internal:
|
||||
enabled: true
|
||||
annotations:
|
||||
# Create internal ELB
|
||||
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
||||
# Create internal NLB
|
||||
service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"
|
||||
# Create internal ELB(Deprecated)
|
||||
# service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
||||
# Any other annotation can be declared here.
|
||||
```
|
||||
|
||||
@@ -187,13 +189,15 @@ controller:
|
||||
# Any other annotation can be declared here.
|
||||
```
|
||||
|
||||
The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer).
|
||||
|
||||
An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object.
|
||||
|
||||
Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`.
|
||||
|
||||
### Ingress Admission Webhooks
|
||||
|
||||
With nginx-ingress-controller version 0.25+, the nginx ingress controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster.
|
||||
With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster.
|
||||
**This feature is enabled by default since 0.31.0.**
|
||||
|
||||
With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521)
|
||||
@@ -202,7 +206,7 @@ With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fi
|
||||
A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks.
|
||||
|
||||
1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits.
|
||||
2. The ingress nginx controller pod is configured to use a TLS proxy container, which will load that certificate.
|
||||
2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate.
|
||||
3. Validating and Mutating webhook configurations are created in the cluster.
|
||||
4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations
|
||||
|
||||
@@ -248,11 +252,11 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.admissionWebhooks.networkPolicyEnabled | bool | `false` | |
|
||||
| controller.admissionWebhooks.objectSelector | object | `{}` | |
|
||||
| controller.admissionWebhooks.patch.enabled | bool | `true` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f"` | |
|
||||
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b"` | |
|
||||
| controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | |
|
||||
| controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v20230312-helm-chart-4.5.2-28-g66a760794"` | |
|
||||
| controller.admissionWebhooks.patch.image.tag | string | `"v20230407"` | |
|
||||
| controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
|
||||
| controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
|
||||
| controller.admissionWebhooks.patch.podAnnotations | object | `{}` | |
|
||||
@@ -273,7 +277,6 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.allowSnippetAnnotations | bool | `true` | This configuration defines if Ingress Controller should allow users to set their own *-snippet annotations, otherwise this is forbidden / dropped when users add those annotations. Global snippets in ConfigMap are still respected |
|
||||
| controller.annotations | object | `{}` | Annotations to be added to the controller Deployment or DaemonSet # |
|
||||
| controller.autoscaling.annotations | object | `{}` | |
|
||||
| controller.autoscaling.apiVersion | string | `"autoscaling/v2"` | |
|
||||
| controller.autoscaling.behavior | object | `{}` | |
|
||||
| controller.autoscaling.enabled | bool | `false` | |
|
||||
| controller.autoscaling.maxReplicas | int | `11` | |
|
||||
@@ -294,14 +297,14 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # |
|
||||
| controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto" Defaults to false |
|
||||
| controller.existingPsp | string | `""` | Use an existing PSP instead of creating one |
|
||||
| controller.extraArgs | object | `{}` | Additional command line arguments to pass to nginx-ingress-controller E.g. to specify the default SSL certificate you can use |
|
||||
| controller.extraArgs | object | `{}` | Additional command line arguments to pass to Ingress-Nginx Controller E.g. to specify the default SSL certificate you can use |
|
||||
| controller.extraContainers | list | `[]` | Additional containers to be added to the controller pod. See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. |
|
||||
| controller.extraEnvs | list | `[]` | Additional environment variables to set |
|
||||
| controller.extraInitContainers | list | `[]` | Containers, which are run before the app containers are started. |
|
||||
| controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module |
|
||||
| controller.extraVolumeMounts | list | `[]` | Additional volumeMounts to the controller main container. |
|
||||
| controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. |
|
||||
| controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the ingress nginx controller is running in the `hostNetwork: true` mode. |
|
||||
| controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. |
|
||||
| controller.healthCheckPath | string | `"/healthz"` | Path of the health check endpoint. All requests received on the port defined by the healthz-port parameter are forwarded internally to this path. |
|
||||
| controller.hostNetwork | bool | `false` | Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 is merged |
|
||||
| controller.hostPort.enabled | bool | `false` | Enable 'hostPort' or not |
|
||||
@@ -310,13 +313,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.hostname | object | `{}` | Optionally customize the pod hostname. |
|
||||
| controller.image.allowPrivilegeEscalation | bool | `true` | |
|
||||
| controller.image.chroot | bool | `false` | |
|
||||
| controller.image.digest | string | `"sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407"` | |
|
||||
| controller.image.digestChroot | string | `"sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988"` | |
|
||||
| controller.image.digest | string | `"sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd"` | |
|
||||
| controller.image.digestChroot | string | `"sha256:e0d4121e3c5e39de9122e55e331a32d5ebf8d4d257227cb93ab54a1b912a7627"` | |
|
||||
| controller.image.image | string | `"ingress-nginx/controller"` | |
|
||||
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controller.image.registry | string | `"registry.k8s.io"` | |
|
||||
| controller.image.runAsUser | int | `101` | |
|
||||
| controller.image.tag | string | `"v1.7.1"` | |
|
||||
| controller.image.tag | string | `"v1.8.1"` | |
|
||||
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
|
||||
| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
|
||||
| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |
|
||||
@@ -353,7 +356,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.metrics.prometheusRule.enabled | bool | `false` | |
|
||||
| controller.metrics.prometheusRule.rules | list | `[]` | |
|
||||
| controller.metrics.service.annotations | object | `{}` | |
|
||||
| controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/user-guide/services/#external-ips # |
|
||||
| controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # |
|
||||
| controller.metrics.service.labels | object | `{}` | Labels to be added to the metrics service resource |
|
||||
| controller.metrics.service.loadBalancerSourceRanges | list | `[]` | |
|
||||
| controller.metrics.service.servicePort | int | `10254` | |
|
||||
@@ -366,13 +369,13 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.metrics.serviceMonitor.relabelings | list | `[]` | |
|
||||
| controller.metrics.serviceMonitor.scrapeInterval | string | `"30s"` | |
|
||||
| controller.metrics.serviceMonitor.targetLabels | list | `[]` | |
|
||||
| controller.minAvailable | int | `1` | Define either 'minAvailable' or 'maxUnavailable', never both. |
|
||||
| controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. |
|
||||
| controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # |
|
||||
| controller.name | string | `"controller"` | |
|
||||
| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/user-guide/node-selection/ # |
|
||||
| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # |
|
||||
| controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | |
|
||||
| controller.opentelemetry.enabled | bool | `false` | |
|
||||
| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f"` | |
|
||||
| controller.opentelemetry.image | string | `"registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0"` | |
|
||||
| controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # |
|
||||
| controller.podLabels | object | `{}` | Labels to add to the pod container metadata |
|
||||
| controller.podSecurityContext | object | `{}` | Security Context policies for controller pods |
|
||||
@@ -390,7 +393,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.readinessProbe.successThreshold | int | `1` | |
|
||||
| controller.readinessProbe.timeoutSeconds | int | `1` | |
|
||||
| controller.replicaCount | int | `1` | |
|
||||
| controller.reportNodeInternalIp | bool | `false` | Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply |
|
||||
| controller.reportNodeInternalIp | bool | `false` | Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply |
|
||||
| controller.resources.requests.cpu | string | `"100m"` | |
|
||||
| controller.resources.requests.memory | string | `"90Mi"` | |
|
||||
| controller.scope.enabled | bool | `false` | Enable 'scope' or not |
|
||||
@@ -402,15 +405,17 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.service.enableHttps | bool | `true` | |
|
||||
| controller.service.enabled | bool | `true` | |
|
||||
| controller.service.external.enabled | bool | `true` | |
|
||||
| controller.service.externalIPs | list | `[]` | List of IP addresses at which the controller services are available # Ref: https://kubernetes.io/docs/user-guide/services/#external-ips # |
|
||||
| controller.service.externalIPs | list | `[]` | List of IP addresses at which the controller services are available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # |
|
||||
| controller.service.internal.annotations | object | `{}` | Annotations are mandatory for the load balancer to come up. Varies with the cloud service. |
|
||||
| controller.service.internal.enabled | bool | `false` | Enables an additional internal load balancer (besides the external one). |
|
||||
| controller.service.internal.loadBalancerIP | string | `""` | Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. |
|
||||
| controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. |
|
||||
| controller.service.internal.ports | object | `{}` | Custom port mapping for internal service |
|
||||
| controller.service.internal.targetPorts | object | `{}` | Custom target port mapping for internal service |
|
||||
| controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically based on cluster configuration and the ipFamilyPolicy field. # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ |
|
||||
| controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack-ness requested or required by this Service. Possible values are SingleStack, PreferDualStack or RequireDualStack. The ipFamilies and clusterIPs fields depend on the value of this field. # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ |
|
||||
| controller.service.labels | object | `{}` | |
|
||||
| controller.service.loadBalancerClass | string | `""` | Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class |
|
||||
| controller.service.loadBalancerIP | string | `""` | Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer |
|
||||
| controller.service.loadBalancerSourceRanges | list | `[]` | |
|
||||
| controller.service.nodePorts.http | string | `""` | |
|
||||
@@ -435,7 +440,6 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| controller.watchIngressWithoutClass | bool | `false` | Process Ingress objects without ingressClass annotation/ingressClassName field Overrides value for --watch-ingress-without-class flag of the controller binary Defaults to false |
|
||||
| defaultBackend.affinity | object | `{}` | |
|
||||
| defaultBackend.autoscaling.annotations | object | `{}` | |
|
||||
| defaultBackend.autoscaling.apiVersion | string | `"autoscaling/v2"` | |
|
||||
| defaultBackend.autoscaling.enabled | bool | `false` | |
|
||||
| defaultBackend.autoscaling.maxReplicas | int | `2` | |
|
||||
| defaultBackend.autoscaling.minReplicas | int | `1` | |
|
||||
@@ -465,7 +469,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| defaultBackend.minAvailable | int | `1` | |
|
||||
| defaultBackend.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # |
|
||||
| defaultBackend.name | string | `"defaultbackend"` | |
|
||||
| defaultBackend.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for default backend pod assignment # Ref: https://kubernetes.io/docs/user-guide/node-selection/ # |
|
||||
| defaultBackend.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for default backend pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # |
|
||||
| defaultBackend.podAnnotations | object | `{}` | Annotations to be added to default backend pods # |
|
||||
| defaultBackend.podLabels | object | `{}` | Labels to add to the pod container metadata |
|
||||
| defaultBackend.podSecurityContext | object | `{}` | Security Context policies for controller pods See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls # |
|
||||
@@ -479,7 +483,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
|
||||
| defaultBackend.replicaCount | int | `1` | |
|
||||
| defaultBackend.resources | object | `{}` | |
|
||||
| defaultBackend.service.annotations | object | `{}` | |
|
||||
| defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/user-guide/services/#external-ips # |
|
||||
| defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # |
|
||||
| defaultBackend.service.loadBalancerSourceRanges | list | `[]` | |
|
||||
| defaultBackend.service.servicePort | int | `80` | |
|
||||
| defaultBackend.service.type | string | `"ClusterIP"` | |
|
||||
|
||||
@@ -76,14 +76,14 @@ else it would make it impossible to evacuate a node. See [gh issue #7127](https:
|
||||
|
||||
### Prometheus Metrics
|
||||
|
||||
The Nginx ingress controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`.
|
||||
The Ingress-Nginx Controller can export Prometheus metrics, by setting `controller.metrics.enabled` to `true`.
|
||||
|
||||
You can add Prometheus annotations to the metrics service using `controller.metrics.service.annotations`.
|
||||
Alternatively, if you use the Prometheus Operator, you can enable ServiceMonitor creation using `controller.metrics.serviceMonitor.enabled`. And set `controller.metrics.serviceMonitor.additionalLabels.release="prometheus"`. "release=prometheus" should match the label configured in the prometheus servicemonitor ( see `kubectl get servicemonitor prometheus-kube-prom-prometheus -oyaml -n prometheus`)
|
||||
|
||||
### ingress-nginx nginx\_status page/stats server
|
||||
|
||||
Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in nginx ingress controller:
|
||||
Previous versions of this chart had a `controller.stats.*` configuration block, which is now obsolete due to the following changes in Ingress-Nginx Controller:
|
||||
|
||||
- In [0.16.1](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0161), the vts (virtual host traffic status) dashboard was removed
|
||||
- In [0.23.0](https://github.com/kubernetes/ingress-nginx/blob/main/Changelog.md#0230), the status page at port 18080 is now a unix socket webserver only available at localhost.
|
||||
@@ -140,8 +140,10 @@ controller:
|
||||
internal:
|
||||
enabled: true
|
||||
annotations:
|
||||
# Create internal ELB
|
||||
service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
||||
# Create internal NLB
|
||||
service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"
|
||||
# Create internal ELB(Deprecated)
|
||||
# service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
||||
# Any other annotation can be declared here.
|
||||
```
|
||||
|
||||
@@ -184,13 +186,15 @@ controller:
|
||||
# Any other annotation can be declared here.
|
||||
```
|
||||
|
||||
The load balancer annotations of more cloud service providers can be found: [Internal load balancer](https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer).
|
||||
|
||||
An use case for this scenario is having a split-view DNS setup where the public zone CNAME records point to the external balancer URL while the private zone CNAME records point to the internal balancer URL. This way, you only need one ingress kubernetes object.
|
||||
|
||||
Optionally you can set `controller.service.loadBalancerIP` if you need a static IP for the resulting `LoadBalancer`.
|
||||
|
||||
### Ingress Admission Webhooks
|
||||
|
||||
With nginx-ingress-controller version 0.25+, the nginx ingress controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster.
|
||||
With nginx-ingress-controller version 0.25+, the Ingress-Nginx Controller pod exposes an endpoint that will integrate with the `validatingwebhookconfiguration` Kubernetes feature to prevent bad ingress from being added to the cluster.
|
||||
**This feature is enabled by default since 0.31.0.**
|
||||
|
||||
With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fix [this issue](https://github.com/kubernetes/ingress-nginx/pull/4521)
|
||||
@@ -199,7 +203,7 @@ With nginx-ingress-controller in 0.25.* work only with kubernetes 1.14+, 0.26 fi
|
||||
A validating and configuration requires the endpoint to which the request is sent to use TLS. It is possible to set up custom certificates to do this, but in most cases, a self-signed certificate is enough. The setup of this component requires some more complex orchestration when using helm. The steps are created to be idempotent and to allow turning the feature on and off without running into helm quirks.
|
||||
|
||||
1. A pre-install hook provisions a certificate into the same namespace using a format compatible with provisioning using end user certificates. If the certificate already exists, the hook exits.
|
||||
2. The ingress nginx controller pod is configured to use a TLS proxy container, which will load that certificate.
|
||||
2. The Ingress-Nginx Controller pod is configured to use a TLS proxy container, which will load that certificate.
|
||||
3. Validating and Mutating webhook configurations are created in the cluster.
|
||||
4. A post-install hook reads the CA from the secret created by step 1 and patches the Validating and Mutating webhook configurations. This process will allow a custom CA provisioned by some other process to also be patched into the webhook configurations. The chosen failure policy is also patched into the webhook configurations
|
||||
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
# Changelog
|
||||
|
||||
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
### 4.7.0
|
||||
|
||||
* helm: Fix opentelemetry module installation for daemonset (#9792)
|
||||
* Update charts/* to keep project name display aligned (#9931)
|
||||
* HPA: Use capabilites & align manifests. (#9521)
|
||||
* PodDisruptionBudget spec logic update (#9904)
|
||||
* add option for annotations in PodDisruptionBudget (#9843)
|
||||
* Update Ingress-Nginx version controller-v1.8.0
|
||||
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.6.1...helm-chart-4.7.0
|
||||
@@ -0,0 +1,12 @@
|
||||
# Changelog
|
||||
|
||||
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
### 4.7.1
|
||||
|
||||
* Added a doc line to the missing helm value service.internal.loadBalancerIP (#9406)
|
||||
* feat(helm): Add loadBalancerClass (#9562)
|
||||
* added helmshowvalues example (#10019)
|
||||
* Update Ingress-Nginx version controller-v1.8.1
|
||||
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.7.0...helm-chart-4.7.1
|
||||
@@ -201,8 +201,12 @@ Extra modules.
|
||||
|
||||
- name: {{ .name }}
|
||||
image: {{ .image }}
|
||||
{{- if .distroless | default false }}
|
||||
command: ['/init_module']
|
||||
{{- else }}
|
||||
command: ['sh', '-c', '/usr/local/bin/init_module.sh']
|
||||
{{- if (.containerSecurityContext) }}
|
||||
{{- end }}
|
||||
{{- if .containerSecurityContext }}
|
||||
securityContext: {{ .containerSecurityContext | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
volumeMounts:
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not (eq .Values.kind "Vanilla") -}}
|
||||
{{- if and (eq "standalone" .Values.appsec.mode) (eq .Values.appsec.persistence.enabled true) -}}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
@@ -18,3 +19,4 @@ spec:
|
||||
storageClassName: {{ required "A storage class for learning data is required" .Values.appsec.persistence.learning.storageClass.name }}
|
||||
{{- end -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if (eq .Values.controller.kind "Deployment") -}}
|
||||
{{- if (and (eq .Values.kind "AppSec") .Values.appsec.persistence.enabled) }}
|
||||
kind: PersistentVolumeClaim
|
||||
apiVersion: v1
|
||||
metadata:
|
||||
|
||||
@@ -0,0 +1,32 @@
|
||||
{{- if not (eq .Values.kind "Vanilla") -}}
|
||||
{{- if .Values.appsec.configMapContent }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ .Values.appsec.configMapName | default "appsec-settings-configmap" | quote }}
|
||||
data:
|
||||
{{- if .Values.appsec.configMapContent.crowdsec }}
|
||||
CROWDSEC_ENABLED: {{ .Values.appsec.configMapContent.crowdsec.enabled | default "false" | quote }}
|
||||
{{- if .Values.appsec.configMapContent.crowdsec.api }}
|
||||
CROWDSEC_API_URL: {{ .Values.appsec.configMapContent.crowdsec.api.url | default "http://crowdsec-service:8080/v1/decisions/stream" }}
|
||||
{{- else }}
|
||||
CROWDSEC_API_URL: "http://crowdsec-service:8080/v1/decisions/stream"
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.configMapContent.crowdsec.auth }}
|
||||
CROWDSEC_AUTH_METHOD: {{ .Values.appsec.configMapContent.crowdsec.auth.method | default "apikey" }}
|
||||
{{- else }}
|
||||
CROWDSEC_AUTH_METHOD: "apikey"
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.configMapContent.crowdsec.mode }}
|
||||
CROWDSEC_MODE: {{ .Values.appsec.configMapContent.crowdsec.mode | default "prevent" }}
|
||||
{{- else }}
|
||||
CROWDSEC_MODE: "prevent"
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.configMapContent.crowdsec.logging }}
|
||||
CROWDSEC_LOGGING: {{ .Values.appsec.configMapContent.crowdsec.logging | default "enabled" }}
|
||||
{{- else }}
|
||||
CROWDSEC_LOGGING: "enabled"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,12 @@
|
||||
{{- if not (eq .Values.kind "Vanilla") -}}
|
||||
{{ if .Values.appsec.secretContent }}
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: {{ .Values.appsec.secretName | default "appsec-settings-secret" | quote }}
|
||||
data:
|
||||
{{- if and .Values.appsec.secretContent.crowdsec .Values.appsec.secretContent.crowdsec.auth }}
|
||||
CROWDSEC_AUTH_DATA: {{ .Values.appsec.secretContent.crowdsec.auth.data | b64enc }}
|
||||
{{- end }}
|
||||
{{ end }}
|
||||
{{ end }}
|
||||
@@ -1,6 +1,15 @@
|
||||
{{- if or (eq .Values.controller.kind "StatefulSet") (eq .Values.controller.kind "Both") -}}
|
||||
{{- if (not (eq .Values.kind "Vanilla")) }}
|
||||
{{- include "isControllerTagValid" . -}}
|
||||
apiVersion: apps/v1
|
||||
{{- if (eq .Values.kind "AppSec") }}
|
||||
{{- if (eq .Values.controller.kind "DaemonSet") }}
|
||||
kind: DaemonSet
|
||||
{{- else }}
|
||||
kind: Deployment
|
||||
{{- end }}
|
||||
{{- else if eq .Values.kind "AppSecStateful" }}
|
||||
kind: StatefulSet
|
||||
{{- end }}
|
||||
metadata:
|
||||
labels:
|
||||
{{- include "ingress-nginx.labels" . | nindent 4 }}
|
||||
@@ -19,15 +28,25 @@ spec:
|
||||
{{- include "ingress-nginx.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: controller
|
||||
{{- if not .Values.controller.autoscaling.enabled }}
|
||||
{{- if eq .Values.kind "AppSecStateful" }}
|
||||
serviceName: "open-appsec-stateful-set"
|
||||
{{- end }}
|
||||
{{- if or (not (eq .Values.controller.kind "DaemonSet")) (and (eq .Values.kind "AppSecStateful") (eq .Values.controller.kind "DaemonSet")) }}
|
||||
replicas: {{ .Values.controller.replicaCount }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
|
||||
{{- if .Values.controller.updateStrategy }}
|
||||
{{- if (and (not (eq .Values.kind "AppSecStateful")) (eq .Values.controller.kind "DaemonSet")) }}
|
||||
updateStrategy:
|
||||
{{- else }}
|
||||
strategy:
|
||||
{{- end }}
|
||||
{{ toYaml .Values.controller.updateStrategy | nindent 4 }}
|
||||
{{- end }}
|
||||
#minReadySeconds: {{ .Values.controller.minReadySeconds }}
|
||||
{{- if (eq .Values.kind "AppSec") }}
|
||||
minReadySeconds: {{ .Values.controller.minReadySeconds }}
|
||||
{{- end }}
|
||||
template:
|
||||
metadata:
|
||||
{{- if .Values.controller.podAnnotations }}
|
||||
@@ -79,6 +98,10 @@ spec:
|
||||
- name: {{ .Values.appsec.name }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.appsec.securityContext | nindent 12 }}
|
||||
{{- $tag := .Values.appsec.image.tag }}
|
||||
{{- if .Values.appsec.configMapContent.crowdsec.enabled }}
|
||||
{{- $tag = "crowdsec-1.2314-rc1" }}
|
||||
{{- end }}
|
||||
{{- with .Values.appsec.image }}
|
||||
image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
|
||||
{{- end }}
|
||||
@@ -106,6 +129,8 @@ spec:
|
||||
env:
|
||||
- name: user_email
|
||||
value: {{ .Values.appsec.userEmail }}
|
||||
- name: registered_server
|
||||
value: "NGINX Server"
|
||||
{{- if eq .Values.appsec.playground false }}
|
||||
- name: SHARED_STORAGE_HOST
|
||||
value: {{ .Values.appsec.storage.name }}-svc
|
||||
@@ -115,20 +140,29 @@ spec:
|
||||
- name: PLAYGROUND
|
||||
value: "true"
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: {{ .Values.appsec.configMapName | default "appsec-settings-configmap" }}
|
||||
- secretRef:
|
||||
name: {{ .Values.appsec.secretName | default "appsec-settings-secret" }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: advanced-model
|
||||
mountPath: /advanced-model
|
||||
{{- if .Values.appsec.persistence.enabled }}
|
||||
{{- if (eq .Values.appsec.persistence.enabled true) }}
|
||||
- name: appsec-conf
|
||||
mountPath: /etc/cp/conf
|
||||
- name: appsec-data
|
||||
mountPath: /etc/cp/data
|
||||
{{- end }}
|
||||
- name: {{ .Values.controller.containerName }}
|
||||
{{- with .Values.controller.image }}
|
||||
image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
|
||||
{{- $tag := .Values.appsec.nginx.image.tag }}
|
||||
{{- if .Values.appsec.configMapContent.crowdsec.enabled }}
|
||||
{{- $tag = "1.2303.1-rc1-v1.3.0" }}
|
||||
{{- end }}
|
||||
{{- with .Values.appsec.nginx.image }}
|
||||
image: "{{ .repository }}:{{ .tag }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
|
||||
{{- if .Values.controller.lifecycle }}
|
||||
@@ -240,7 +274,11 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.controller.opentelemetry.enabled}}
|
||||
{{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }}
|
||||
{{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext) | nindent 8}}
|
||||
{{- if (and (not (eq .Values.kind "AppSecStateful")) (eq .Values.controller.kind "DaemonSet")) }}
|
||||
{{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext ) | nindent 8}}
|
||||
{{ else }}
|
||||
{{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" false) | nindent 8}}
|
||||
{{- end }}
|
||||
{{- end}}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.hostNetwork }}
|
||||
@@ -266,6 +304,14 @@ spec:
|
||||
configMap:
|
||||
name: advanced-model-config
|
||||
optional: true
|
||||
{{- if (and (eq .Values.kind "AppSec") .Values.appsec.persistence.enabled) }}
|
||||
- name: appsec-conf
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.appsec.name }}-conf
|
||||
- name: appsec-data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.appsec.name }}-data
|
||||
{{- end }}
|
||||
{{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled)}}
|
||||
- name: modules
|
||||
emptyDir: {}
|
||||
@@ -294,7 +340,7 @@ spec:
|
||||
{{ toYaml .Values.controller.extraVolumes | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.persistence.enabled }}
|
||||
{{- if (and (eq .Values.kind "AppSecStateful") .Values.appsec.persistence.enabled) }}
|
||||
volumeClaimTemplates:
|
||||
- metadata:
|
||||
name: appsec-conf
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if or (eq .Values.controller.kind "DaemonSet") (eq .Values.controller.kind "Both") -}}
|
||||
{{- if and (eq .Values.kind "Vanilla") (or (eq .Values.controller.kind "DaemonSet") (eq .Values.controller.kind "Both")) -}}
|
||||
{{- include "isControllerTagValid" . -}}
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
@@ -53,12 +53,12 @@ spec:
|
||||
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.priorityClassName }}
|
||||
priorityClassName: {{ .Values.controller.priorityClassName }}
|
||||
priorityClassName: {{ .Values.controller.priorityClassName | quote }}
|
||||
{{- end }}
|
||||
{{- if or .Values.controller.podSecurityContext .Values.controller.sysctls }}
|
||||
securityContext:
|
||||
{{- end }}
|
||||
{{- if .Values.controller.podSecurityContext }}
|
||||
{{- if .Values.controller.podSecurityContext }}
|
||||
{{- toYaml .Values.controller.podSecurityContext | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.sysctls }}
|
||||
@@ -143,11 +143,15 @@ spec:
|
||||
hostPort: {{ $key }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }}
|
||||
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
|
||||
volumeMounts:
|
||||
{{- if .Values.controller.extraModules }}
|
||||
{{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
|
||||
- name: modules
|
||||
{{ if .Values.controller.image.chroot }}
|
||||
mountPath: /chroot/modules_mount
|
||||
{{ else }}
|
||||
mountPath: /modules_mount
|
||||
{{ end }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.customTemplate.configMapName }}
|
||||
- mountPath: /etc/nginx/template
|
||||
@@ -169,9 +173,7 @@ spec:
|
||||
{{- if .Values.controller.extraContainers }}
|
||||
{{ toYaml .Values.controller.extraContainers | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
{{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }}
|
||||
{{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
|
||||
initContainers:
|
||||
{{- if .Values.controller.extraInitContainers }}
|
||||
{{ toYaml .Values.controller.extraInitContainers | nindent 8 }}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both") -}}
|
||||
{{- if and (eq .Values.kind "Vanilla") (or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both")) -}}
|
||||
{{- include "isControllerTagValid" . -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
@@ -76,59 +76,9 @@ spec:
|
||||
shareProcessNamespace: {{ .Values.controller.shareProcessNamespace }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: {{ .Values.appsec.name }}
|
||||
securityContext:
|
||||
{{ toYaml .Values.appsec.securityContext | nindent 12 }}
|
||||
{{- with .Values.appsec.image }}
|
||||
image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
|
||||
{{- end }}
|
||||
command:
|
||||
- {{ .Values.appsec.command }}
|
||||
imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
|
||||
args:
|
||||
{{- if (eq "standalone" .Values.appsec.mode) }}
|
||||
- --hybrid-mode
|
||||
- --token
|
||||
- cp-3fb5c718-5e39-47e6-8d5e-99b4bc5660b74b4b7fc8-5312-451d-a763-aaf7872703c0
|
||||
{{- else }}
|
||||
- --token
|
||||
- {{ .Values.appsec.agentToken }}
|
||||
{{- end -}}
|
||||
{{- if .Values.appsec.customFog.enabled }}
|
||||
- --fog
|
||||
- {{ .Values.appsec.customFog.fogAddress }}
|
||||
{{- end }}
|
||||
{{- if .Values.appsec.proxy }}
|
||||
- --proxy
|
||||
- {{ .Values.appsec.proxy }}
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.appsec.image.pullPolicy }}
|
||||
env:
|
||||
- name: user_email
|
||||
value: {{ .Values.appsec.userEmail }}
|
||||
{{- if eq .Values.appsec.playground false }}
|
||||
- name: SHARED_STORAGE_HOST
|
||||
value: {{ .Values.appsec.storage.name }}-svc
|
||||
- name: LEARNING_HOST
|
||||
value: {{ .Values.appsec.learning.name }}-svc
|
||||
{{- else }}
|
||||
- name: PLAYGROUND
|
||||
value: "true"
|
||||
{{- end }}
|
||||
resources:
|
||||
{{ toYaml .Values.resources | nindent 12 }}
|
||||
volumeMounts:
|
||||
- name: advanced-model
|
||||
mountPath: /advanced-model
|
||||
{{- if .Values.appsec.persistence.enabled }}
|
||||
- name: appsec-conf
|
||||
mountPath: /etc/cp/conf
|
||||
- name: appsec-data
|
||||
mountPath: /etc/cp/data
|
||||
{{- end }}
|
||||
- name: {{ .Values.controller.containerName }}
|
||||
{{- with .Values.controller.image }}
|
||||
image: "{{- if .registry }}{{ .registry }}/{{- end }}{{- if .repository }}{{ .repository }}/{{- end }}{{ .image }}{{- if .tag }}:{{ .tag }}{{- end }}{{- if (.digest) -}} @{{.digest}} {{- end }}"
|
||||
image: "{{- if .repository -}}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{- end -}}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }}"
|
||||
{{- end }}
|
||||
imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
|
||||
{{- if .Values.controller.lifecycle }}
|
||||
@@ -240,7 +190,7 @@ spec:
|
||||
{{- end }}
|
||||
{{- if .Values.controller.opentelemetry.enabled}}
|
||||
{{ $otelContainerSecurityContext := $.Values.controller.opentelemetry.containerSecurityContext | default $.Values.controller.containerSecurityContext }}
|
||||
{{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext) | nindent 8}}
|
||||
{{- include "extraModules" (dict "name" "opentelemetry" "image" .Values.controller.opentelemetry.image "containerSecurityContext" $otelContainerSecurityContext "distroless" false) | nindent 8}}
|
||||
{{- end}}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.hostNetwork }}
|
||||
@@ -260,14 +210,8 @@ spec:
|
||||
{{- end }}
|
||||
serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }}
|
||||
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
|
||||
volumes:
|
||||
- name: appsec-conf
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.appsec.name }}-conf
|
||||
- name: appsec-data
|
||||
persistentVolumeClaim:
|
||||
claimName: {{ .Values.appsec.name }}-data
|
||||
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
|
||||
volumes:
|
||||
{{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled)}}
|
||||
- name: modules
|
||||
emptyDir: {}
|
||||
|
||||
@@ -1,12 +1,9 @@
|
||||
{{- if and .Values.controller.autoscaling.enabled (or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both")) -}}
|
||||
{{- if not .Values.controller.keda.enabled }}
|
||||
|
||||
apiVersion: {{ .Values.controller.autoscaling.apiVersion }}
|
||||
{{- if and (or (eq .Values.controller.kind "Deployment") (eq .Values.controller.kind "Both")) .Values.controller.autoscaling.enabled (not .Values.controller.keda.enabled) -}}
|
||||
apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.controller.autoscaling.annotations }}
|
||||
{{- toYaml . | trimSuffix "\n" | nindent 4 }}
|
||||
annotations: {{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "ingress-nginx.labels" . | nindent 4 }}
|
||||
@@ -48,5 +45,3 @@ spec:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
|
||||
@@ -25,6 +25,11 @@ spec:
|
||||
cooldownPeriod: {{ .Values.controller.keda.cooldownPeriod }}
|
||||
minReplicaCount: {{ .Values.controller.keda.minReplicas }}
|
||||
maxReplicaCount: {{ .Values.controller.keda.maxReplicas }}
|
||||
{{- with .Values.controller.keda.fallback }}
|
||||
fallback:
|
||||
failureThreshold: {{ .failureThreshold | default 3 }}
|
||||
replicas: {{ .replicas | default $.Values.controller.keda.maxReplicas }}
|
||||
{{- end }}
|
||||
triggers:
|
||||
{{- with .Values.controller.keda.triggers }}
|
||||
{{ toYaml . | indent 2 }}
|
||||
|
||||
@@ -10,12 +10,15 @@ metadata:
|
||||
{{- end }}
|
||||
name: {{ include "ingress-nginx.controller.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- if .Values.controller.annotations }}
|
||||
annotations: {{ toYaml .Values.controller.annotations | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
{{- include "ingress-nginx.selectorLabels" . | nindent 6 }}
|
||||
app.kubernetes.io/component: controller
|
||||
{{- if .Values.controller.minAvailable }}
|
||||
{{- if and .Values.controller.minAvailable (not (hasKey .Values.controller "maxUnavailable")) }}
|
||||
minAvailable: {{ .Values.controller.minAvailable }}
|
||||
{{- else if .Values.controller.maxUnavailable }}
|
||||
maxUnavailable: {{ .Values.controller.maxUnavailable }}
|
||||
|
||||
@@ -28,6 +28,9 @@ spec:
|
||||
{{- if .Values.controller.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges: {{ toYaml .Values.controller.service.loadBalancerSourceRanges | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.service.loadBalancerClass }}
|
||||
loadBalancerClass: {{ .Values.controller.service.loadBalancerClass }}
|
||||
{{- end }}
|
||||
{{- if .Values.controller.service.externalTrafficPolicy }}
|
||||
externalTrafficPolicy: {{ .Values.controller.service.externalTrafficPolicy }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,37 +1,40 @@
|
||||
{{- if and .Values.defaultBackend.enabled .Values.defaultBackend.autoscaling.enabled }}
|
||||
apiVersion: {{ .Values.defaultBackend.autoscaling.apiVersion }}
|
||||
apiVersion: {{ ternary "autoscaling/v2" "autoscaling/v2beta2" (.Capabilities.APIVersions.Has "autoscaling/v2") }}
|
||||
kind: HorizontalPodAutoscaler
|
||||
metadata:
|
||||
{{- with .Values.defaultBackend.autoscaling.annotations }}
|
||||
annotations: {{ toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
labels:
|
||||
{{- include "ingress-nginx.labels" . | nindent 4 }}
|
||||
app.kubernetes.io/component: default-backend
|
||||
{{- with .Values.defaultBackend.labels }}
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
name: {{ template "ingress-nginx.defaultBackend.fullname" . }}
|
||||
name: {{ include "ingress-nginx.defaultBackend.fullname" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
scaleTargetRef:
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
name: {{ template "ingress-nginx.defaultBackend.fullname" . }}
|
||||
name: {{ include "ingress-nginx.defaultBackend.fullname" . }}
|
||||
minReplicas: {{ .Values.defaultBackend.autoscaling.minReplicas }}
|
||||
maxReplicas: {{ .Values.defaultBackend.autoscaling.maxReplicas }}
|
||||
metrics:
|
||||
{{- with .Values.defaultBackend.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.defaultBackend.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.defaultBackend.autoscaling.targetCPUUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: cpu
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ . }}
|
||||
{{- end }}
|
||||
{{- with .Values.defaultBackend.autoscaling.targetMemoryUtilizationPercentage }}
|
||||
- type: Resource
|
||||
resource:
|
||||
name: memory
|
||||
target:
|
||||
type: Utilization
|
||||
averageUtilization: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not (eq .Values.kind "Vanilla") -}}
|
||||
{{- if and (eq "standalone" .Values.appsec.mode) (eq .Values.appsec.playground false) }}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
@@ -137,3 +138,4 @@ spec:
|
||||
claimName: {{ .Values.appsec.name }}-storage
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
{{- if not (eq .Values.kind "Vanilla") -}}
|
||||
{{- if and (eq "standalone" .Values.appsec.mode) (eq .Values.appsec.playground false) }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -31,3 +32,4 @@ spec:
|
||||
selector:
|
||||
app: {{ .Values.appsec.storage.name }}-lbl
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -18,14 +18,14 @@ controller:
|
||||
image:
|
||||
## Keep false as default for now!
|
||||
chroot: false
|
||||
registry: ghcr.io/openappsec
|
||||
image: nginx-ingress-attachment
|
||||
registry: registry.k8s.io
|
||||
image: ingress-nginx/controller
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: latest
|
||||
digest:
|
||||
digestChroot: sha256:e35d5ab487861b9d419c570e3530589229224a0762c7b4d2e2222434abb8d988
|
||||
tag: "v1.8.1"
|
||||
digest: sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd
|
||||
digestChroot: sha256:e0d4121e3c5e39de9122e55e331a32d5ebf8d4d257227cb93ab54a1b912a7627
|
||||
pullPolicy: IfNotPresent
|
||||
# www-data -> uid 101
|
||||
runAsUser: 101
|
||||
@@ -55,7 +55,7 @@ controller:
|
||||
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
|
||||
dnsPolicy: ClusterFirst
|
||||
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
|
||||
# Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
|
||||
# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
|
||||
reportNodeInternalIp: false
|
||||
# -- Process Ingress objects without ingressClass annotation/ingressClassName field
|
||||
# Overrides value for --watch-ingress-without-class flag of the controller binary
|
||||
@@ -150,7 +150,7 @@ controller:
|
||||
# -- Maxmind license key to download GeoLite2 Databases.
|
||||
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
|
||||
maxmindLicenseKey: ""
|
||||
# -- Additional command line arguments to pass to nginx-ingress-controller
|
||||
# -- Additional command line arguments to pass to Ingress-Nginx Controller
|
||||
# E.g. to specify the default SSL certificate you can use
|
||||
extraArgs: {}
|
||||
## extraArgs:
|
||||
@@ -166,7 +166,7 @@ controller:
|
||||
# name: secret-resource
|
||||
|
||||
# -- Use a `DaemonSet` or `Deployment`
|
||||
kind: StatefulSet
|
||||
kind: Deployment
|
||||
# -- Annotations to be added to the controller Deployment or DaemonSet
|
||||
##
|
||||
annotations: {}
|
||||
@@ -257,7 +257,7 @@ controller:
|
||||
##
|
||||
terminationGracePeriodSeconds: 300
|
||||
# -- Node labels for controller pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
@@ -302,15 +302,16 @@ controller:
|
||||
healthCheckPath: "/healthz"
|
||||
# -- Address to bind the health check endpoint.
|
||||
# It is better to set this option to the internal node address
|
||||
# if the ingress nginx controller is running in the `hostNetwork: true` mode.
|
||||
# if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.
|
||||
healthCheckHost: ""
|
||||
# -- Annotations to be added to controller pods
|
||||
##
|
||||
podAnnotations: {}
|
||||
replicaCount: 1
|
||||
# -- Define either 'minAvailable' or 'maxUnavailable', never both.
|
||||
# -- Minimum available pods set in PodDisruptionBudget.
|
||||
# Define either 'minAvailable' or 'maxUnavailable', never both.
|
||||
minAvailable: 1
|
||||
# -- Define either 'minAvailable' or 'maxUnavailable', never both.
|
||||
# -- Maximum unavalaile pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
|
||||
# maxUnavailable: 1
|
||||
|
||||
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
|
||||
@@ -326,7 +327,6 @@ controller:
|
||||
memory: 90Mi
|
||||
# Mutually exclusive with keda autoscaling
|
||||
autoscaling:
|
||||
apiVersion: autoscaling/v2
|
||||
enabled: false
|
||||
annotations: {}
|
||||
minReplicas: 1
|
||||
@@ -368,6 +368,9 @@ controller:
|
||||
maxReplicas: 11
|
||||
pollingInterval: 30
|
||||
cooldownPeriod: 300
|
||||
# fallback:
|
||||
# failureThreshold: 3
|
||||
# replicas: 11
|
||||
restoreToOriginalReplicaCount: false
|
||||
scaledObject:
|
||||
annotations: {}
|
||||
@@ -417,12 +420,14 @@ controller:
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the controller services are available
|
||||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
# -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
# -- Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
|
||||
loadBalancerClass: ""
|
||||
enableHttp: true
|
||||
enableHttps: true
|
||||
## Set external traffic policy to: "Local" to preserve source IP on providers supporting it.
|
||||
@@ -473,8 +478,8 @@ controller:
|
||||
enabled: false
|
||||
# -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service.
|
||||
annotations: {}
|
||||
# loadBalancerIP: ""
|
||||
|
||||
# -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS.
|
||||
loadBalancerIP: ""
|
||||
# -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0.
|
||||
loadBalancerSourceRanges: []
|
||||
## Set external traffic policy to: "Local" to preserve source IP on
|
||||
@@ -547,7 +552,7 @@ controller:
|
||||
|
||||
opentelemetry:
|
||||
enabled: false
|
||||
image: registry.k8s.io/ingress-nginx/opentelemetry:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:40f766ac4a9832f36f217bb0e98d44c8d38faeccbfe861fbc1a76af7e9ab257f
|
||||
image: registry.k8s.io/ingress-nginx/opentelemetry:v20230527@sha256:fd7ec835f31b7b37187238eb4fdad4438806e69f413a203796263131f4f02ed0
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
admissionWebhooks:
|
||||
@@ -609,8 +614,8 @@ controller:
|
||||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: v20230312-helm-chart-4.5.2-28-g66a760794
|
||||
digest: sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f
|
||||
tag: v20230407
|
||||
digest: sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b
|
||||
pullPolicy: IfNotPresent
|
||||
# -- Provide a priority class name to the webhook patching job
|
||||
##
|
||||
@@ -652,7 +657,7 @@ controller:
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the stats-exporter service is available
|
||||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
# loadBalancerIP: ""
|
||||
@@ -810,7 +815,7 @@ defaultBackend:
|
||||
# key: value
|
||||
|
||||
# -- Node labels for default backend pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
|
||||
##
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
@@ -838,7 +843,6 @@ defaultBackend:
|
||||
# emptyDir: {}
|
||||
|
||||
autoscaling:
|
||||
apiVersion: autoscaling/v2
|
||||
annotations: {}
|
||||
enabled: false
|
||||
minReplicas: 1
|
||||
@@ -850,7 +854,7 @@ defaultBackend:
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the default backend service is available
|
||||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
# loadBalancerIP: ""
|
||||
@@ -907,7 +911,7 @@ appsec:
|
||||
repository: ghcr.io/openappsec
|
||||
image: agent
|
||||
tag: latest
|
||||
pullPolicy: IfNotPresent
|
||||
pullPolicy: Always
|
||||
|
||||
securityContext: {}
|
||||
# capabilities:
|
||||
@@ -916,7 +920,26 @@ appsec:
|
||||
# readOnlyRootFilesystem: true
|
||||
# runAsNonRoot: true
|
||||
# runAsUser: 1000
|
||||
|
||||
nginx:
|
||||
image:
|
||||
repository: "ghcr.io/openappsec/nginx-ingress-attachment"
|
||||
tag: "latest"
|
||||
configMapName: appsec-settings-configmap
|
||||
configMapContent:
|
||||
crowdsec:
|
||||
enabled: false
|
||||
mode: prevent
|
||||
logging: enabled
|
||||
api:
|
||||
url: http://crowdsec-service:8080/v1/decisions/stream
|
||||
auth:
|
||||
method: apikey
|
||||
secretName: appsec-settings-secret
|
||||
# If you would like to use your own secret with CrowdSec authentication data, please remove the following block
|
||||
secretContent:
|
||||
crowdsec:
|
||||
auth:
|
||||
data: "00000000000000000000000000000000"
|
||||
resources:
|
||||
# limits:
|
||||
# cpu: 100m
|
||||
@@ -980,3 +1003,8 @@ appsec:
|
||||
image: smartsync-shared-files
|
||||
tag: latest
|
||||
|
||||
# -- For nginx vanilla installation use kind Vanilla (no appsec components).
|
||||
# -- For nginx with appsec installation use kind AppSec (default: nginx + appsec without state).
|
||||
# -- For nginx with appsec (statefulset) installation use kind AppSecStateful.
|
||||
kind: AppSec
|
||||
|
||||
|
||||
Reference in New Issue
Block a user