Skip to content

Commit c559479

Browse files
JuckZJuckZ
committed
feat: 1.update ingress-nginx
1 parent ab29e7d commit c559479

12 files changed

+57
-25
lines changed

‎charts/ingress-nginx/CHANGELOG.md

+8-2
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,17 @@
11
# Changelog
22

3-
### test
43
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
54

5+
### 4.4.0
6+
7+
* Adding support for disabling liveness and readiness probes to the Helm chart by @njegosrailic in https://github.com/kubernetes/ingress-nginx/pull/9238
8+
* add:(admission-webhooks) ability to set securityContext by @ybelMekk in https://github.com/kubernetes/ingress-nginx/pull/9186
9+
* #7652 - Updated Helm chart to use the fullname for the electionID if not specified. by @FutureMatt in https://github.com/kubernetes/ingress-nginx/pull/9133
10+
* Rename controller-wehbooks-networkpolicy.yaml. by @Gacko in https://github.com/kubernetes/ingress-nginx/pull/9123
11+
612
### 4.3.0
713
- Support for Kubernetes v.1.25.0 was added and support for endpoint slices
8-
- Support for Kubernetes v1.20.0 was removed
14+
- Support for Kubernetes v1.20.0 and v1.21.0 was removed
915
- [8890](https://github.com/kubernetes/ingress-nginx/pull/8890) migrate to endpointslices
1016
- [9059](https://github.com/kubernetes/ingress-nginx/pull/9059) kubewebhookcertgen sha change after go1191
1117
- [9046](https://github.com/kubernetes/ingress-nginx/pull/9046) Parameterize metrics port name

‎charts/ingress-nginx/Chart.yaml

+6-6
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
annotations:
22
artifacthub.io/changes: |
3-
- "[8890](https://github.com/kubernetes/ingress-nginx/pull/8890) migrate to endpointslices"
4-
- "[9059](https://github.com/kubernetes/ingress-nginx/pull/9059) kubewebhookcertgen sha change after go1191"
5-
- "[9046](https://github.com/kubernetes/ingress-nginx/pull/9046) Parameterize metrics port name"
6-
- "[9104](https://github.com/kubernetes/ingress-nginx/pull/9104) Fix yaml formatting error with multiple annotations"
3+
- Adding support for disabling liveness and readiness probes to the Helm chart
4+
- add:(admission-webhooks) ability to set securityContext
5+
- Updated Helm chart to use the fullname for the electionID if not specified
6+
- Rename controller-wehbooks-networkpolicy.yaml
77
artifacthub.io/prerelease: "false"
88
apiVersion: v2
9-
appVersion: 1.4.0
9+
appVersion: 1.5.1
1010
description: Ingress controller for Kubernetes using NGINX as a reverse proxy and
1111
load balancer
1212
home: https://github.com/kubernetes/ingress-nginx
@@ -22,4 +22,4 @@ maintainers:
2222
name: ingress-nginx
2323
sources:
2424
- https://github.com/kubernetes/ingress-nginx
25-
version: 4.3.1-3
25+
version: 4.4.0-1

‎charts/ingress-nginx/README.md

+7-5
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
44

5-
![Version: 4.3.0](https://img.shields.io/badge/Version-4.3.0-informational?style=flat-square) ![AppVersion: 1.4.0](https://img.shields.io/badge/AppVersion-1.4.0-informational?style=flat-square)
5+
![Version: 4.4.0](https://img.shields.io/badge/Version-4.4.0-informational?style=flat-square) ![AppVersion: 1.5.1](https://img.shields.io/badge/AppVersion-1.5.1-informational?style=flat-square)
66

77
To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
88

@@ -242,6 +242,7 @@ Kubernetes: `>=1.20.0-0`
242242
| controller.admissionWebhooks.annotations | object | `{}` | |
243243
| controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` | |
244244
| controller.admissionWebhooks.createSecretJob.resources | object | `{}` | |
245+
| controller.admissionWebhooks.createSecretJob.securityContext.allowPrivilegeEscalation | bool | `false` | |
245246
| controller.admissionWebhooks.enabled | bool | `true` | |
246247
| controller.admissionWebhooks.existingPsp | string | `""` | Use an existing PSP instead of creating one |
247248
| controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set |
@@ -266,6 +267,7 @@ Kubernetes: `>=1.20.0-0`
266267
| controller.admissionWebhooks.patch.securityContext.runAsUser | int | `2000` | |
267268
| controller.admissionWebhooks.patch.tolerations | list | `[]` | |
268269
| controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` | |
270+
| controller.admissionWebhooks.patchWebhookJob.securityContext.allowPrivilegeEscalation | bool | `false` | |
269271
| controller.admissionWebhooks.port | int | `8443` | |
270272
| controller.admissionWebhooks.service.annotations | object | `{}` | |
271273
| controller.admissionWebhooks.service.externalIPs | list | `[]` | |
@@ -291,7 +293,7 @@ Kubernetes: `>=1.20.0-0`
291293
| controller.customTemplate.configMapName | string | `""` | |
292294
| controller.dnsConfig | object | `{}` | Optionally customize the pod dnsConfig. |
293295
| controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. |
294-
| controller.electionID | string | `"ingress-controller-leader"` | Election ID to use for status update |
296+
| controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' |
295297
| controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # |
296298
| controller.existingPsp | string | `""` | Use an existing PSP instead of creating one |
297299
| controller.extraArgs | object | `{}` | Additional command line arguments to pass to nginx-ingress-controller E.g. to specify the default SSL certificate you can use |
@@ -310,13 +312,13 @@ Kubernetes: `>=1.20.0-0`
310312
| controller.hostname | object | `{}` | Optionally customize the pod hostname. |
311313
| controller.image.allowPrivilegeEscalation | bool | `true` | |
312314
| controller.image.chroot | bool | `false` | |
313-
| controller.image.digest | string | `"sha256:34ee929b111ffc7aa426ffd409af44da48e5a0eea1eb2207994d9e0c0882d143"` | |
314-
| controller.image.digestChroot | string | `"sha256:b67e889f1db8692de7e41d4d9aef8de56645bf048261f31fa7f8bfc6ea2222a0"` | |
315+
| controller.image.digest | string | `"sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629"` | |
316+
| controller.image.digestChroot | string | `"sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529bad0d178fb36147345"` | |
315317
| controller.image.image | string | `"ingress-nginx/controller"` | |
316318
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
317319
| controller.image.registry | string | `"registry.k8s.io"` | |
318320
| controller.image.runAsUser | int | `101` | |
319-
| controller.image.tag | string | `"v1.4.0"` | |
321+
| controller.image.tag | string | `"v1.5.1"` | |
320322
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
321323
| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
322324
| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |

‎charts/ingress-nginx/templates/_helpers.tpl

+10
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,16 @@ We truncate at 63 chars because some Kubernetes name fields are limited to this
8585
{{- printf "%s-%s" (include "ingress-nginx.fullname" .) .Values.controller.name | trunc 63 | trimSuffix "-" -}}
8686
{{- end -}}
8787

88+
{{/*
89+
Construct a unique electionID.
90+
Users can provide an override for an explicit electionID if they want via `.Values.controller.electionID`
91+
*/}}
92+
{{- define "ingress-nginx.controller.electionID" -}}
93+
{{- $defElectionID := printf "%s-leader" (include "ingress-nginx.fullname" .) -}}
94+
{{- $electionID := default $defElectionID .Values.controller.electionID -}}
95+
{{- print $electionID -}}
96+
{{- end -}}
97+
8898
{{/*
8999
Construct the path for the publish-service.
90100

‎charts/ingress-nginx/templates/_params.tpl

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
- --publish-service={{ template "ingress-nginx.controller.publishServicePath" . }}-internal
1111
{{- end }}
1212
{{- end }}
13-
- --election-id={{ .Values.controller.electionID }}
13+
- --election-id={{ include "ingress-nginx.controller.electionID" . }}
1414
- --controller-class={{ .Values.controller.ingressClassResource.controllerValue }}
1515
{{- if .Values.controller.ingressClass }}
1616
- --ingress-class={{ .Values.controller.ingressClass }}

‎charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,9 @@ spec:
5959
{{- if .Values.controller.admissionWebhooks.extraEnvs }}
6060
{{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }}
6161
{{- end }}
62-
securityContext:
63-
allowPrivilegeEscalation: false
62+
{{- if .Values.controller.admissionWebhooks.createSecretJob.securityContext }}
63+
securityContext: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.securityContext | nindent 12 }}
64+
{{- end }}
6465
{{- if .Values.controller.admissionWebhooks.createSecretJob.resources }}
6566
resources: {{ toYaml .Values.controller.admissionWebhooks.createSecretJob.resources | nindent 12 }}
6667
{{- end }}

‎charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

+3-2
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,9 @@ spec:
6161
{{- if .Values.controller.admissionWebhooks.extraEnvs }}
6262
{{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }}
6363
{{- end }}
64-
securityContext:
65-
allowPrivilegeEscalation: false
64+
{{- if .Values.controller.admissionWebhooks.patchWebhookJob.securityContext }}
65+
securityContext: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.securityContext | nindent 12 }}
66+
{{- end }}
6667
{{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }}
6768
resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }}
6869
{{- end }}

‎charts/ingress-nginx/templates/controller-daemonset.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,12 @@ spec:
102102
{{- if .Values.controller.startupProbe }}
103103
startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }}
104104
{{- end }}
105+
{{- if .Values.controller.livenessProbe }}
105106
livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }}
107+
{{- end }}
108+
{{- if .Values.controller.readinessProbe }}
106109
readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }}
110+
{{- end }}
107111
ports:
108112
{{- range $key, $value := .Values.controller.containerPort }}
109113
- name: {{ $key }}

‎charts/ingress-nginx/templates/controller-deployment.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -106,8 +106,12 @@ spec:
106106
{{- if .Values.controller.startupProbe }}
107107
startupProbe: {{ toYaml .Values.controller.startupProbe | nindent 12 }}
108108
{{- end }}
109+
{{- if .Values.controller.livenessProbe }}
109110
livenessProbe: {{ toYaml .Values.controller.livenessProbe | nindent 12 }}
111+
{{- end }}
112+
{{- if .Values.controller.readinessProbe }}
110113
readinessProbe: {{ toYaml .Values.controller.readinessProbe | nindent 12 }}
114+
{{- end }}
111115
ports:
112116
{{- range $key, $value := .Values.controller.containerPort }}
113117
- name: {{ $key }}

‎charts/ingress-nginx/templates/controller-role.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ rules:
6868
resources:
6969
- configmaps
7070
resourceNames:
71-
- {{ .Values.controller.electionID }}
71+
- {{ include "ingress-nginx.controller.electionID" . }}
7272
verbs:
7373
- get
7474
- update
@@ -83,7 +83,7 @@ rules:
8383
resources:
8484
- leases
8585
resourceNames:
86-
- {{ .Values.controller.electionID }}
86+
- {{ include "ingress-nginx.controller.electionID" . }}
8787
verbs:
8888
- get
8989
- update

‎charts/ingress-nginx/templates/controller-wehbooks-networkpolicy.yaml ‎charts/ingress-nginx/templates/controller-webhooks-networkpolicy.yaml

File renamed without changes.

‎charts/ingress-nginx/values.yaml

+9-5
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@ controller:
2323
## for backwards compatibility consider setting the full image url via the repository value below
2424
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
2525
## repository:
26-
tag: "v1.4.0"
27-
#digest: sha256:34ee929b111ffc7aa426ffd409af44da48e5a0eea1eb2207994d9e0c0882d143
28-
digestChroot: sha256:b67e889f1db8692de7e41d4d9aef8de56645bf048261f31fa7f8bfc6ea2222a0
26+
tag: "v1.5.1"
27+
#digest: sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
28+
digestChroot: sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529bad0d178fb36147345
2929
pullPolicy: IfNotPresent
3030
# www-data -> uid 101
3131
runAsUser: 101
@@ -101,8 +101,8 @@ controller:
101101
# -- 'hostPort' https port
102102
https: 443
103103

104-
# -- Election ID to use for status update
105-
electionID: ingress-controller-leader
104+
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
105+
electionID: ""
106106

107107
## This section refers to the creation of the IngressClass resource
108108
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19
@@ -629,6 +629,8 @@ controller:
629629
type: ClusterIP
630630

631631
createSecretJob:
632+
securityContext:
633+
allowPrivilegeEscalation: false
632634
resources: {}
633635
# limits:
634636
# cpu: 10m
@@ -638,6 +640,8 @@ controller:
638640
# memory: 20Mi
639641

640642
patchWebhookJob:
643+
securityContext:
644+
allowPrivilegeEscalation: false
641645
resources: {}
642646

643647
patch:

0 commit comments

Comments
 (0)