DevFW-CICD/ingress-nginx-helm
16
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ingress-nginx-helm/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

83 lines
4.1 KiB
YAML
Raw Permalink Normal View History

feat(helm): Optionally use cert-manager instead admission patch (#9279)
2022-12-07 12:16:38 +00:00
{{- if and .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled (not .Values.controller.admissionWebhooks.certManager.enabled) -}}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
apiVersion: batch/v1
kind: Job
metadata:
Admission Webhook: Truncate name. (#10523)
2023-10-29 17:26:05 +00:00
name: {{ include "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" . }}
feat: add namespace overrides (#10539) * feat: add namespace overrides * add value in readme * fix: readme description * fix: description in value * fix: set max length and trim last "-"
2023-10-24 17:53:46 +00:00
namespace: {{ include "ingress-nginx.namespace" . }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
annotations:
"helm.sh/hook": post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
allow set annotations for admission Jobs (#7979) * allow set annotations for admission Jobs Signed-off-by: Alex Co <tuanclq@gmail.com> * Bump chart version & update CHANGELOG Signed-off-by: Alex Co <tuanclq@gmail.com> * Bump chart version again Signed-off-by: Alex Co <tuanclq@gmail.com> * Add example Signed-off-by: Alex Co <tuanclq@gmail.com>
2021-11-29 11:33:22 +00:00
{{- with .Values.controller.admissionWebhooks.annotations }}
Add newline indenting to admission webhook annotations (#8015) Signed-off-by: Alex Sears <me@alexsears.com>
2021-12-07 19:26:37 +00:00
{{- toYaml . | nindent 4 }}
allow set annotations for admission Jobs (#7979) * allow set annotations for admission Jobs Signed-off-by: Alex Co <tuanclq@gmail.com> * Bump chart version & update CHANGELOG Signed-off-by: Alex Co <tuanclq@gmail.com> * Bump chart version again Signed-off-by: Alex Co <tuanclq@gmail.com> * Add example Signed-off-by: Alex Co <tuanclq@gmail.com>
2021-11-29 11:33:22 +00:00
{{- end }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
labels:
Update helm templates to match new chart name
2020-02-28 14:53:24 +00:00
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: admission-webhook
[Helm] Add labels to resources (#6992) * Add labels to RBAC resources * Add labels to all resources * Fix labels indentaton in patch jobs * Add controller and default backend labels to pods Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com> * Bump chart version and update changelog Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com>
2021-11-19 14:52:52 +00:00
{{- with .Values.controller.admissionWebhooks.patch.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
spec:
Cleanup chart code
2020-03-02 14:49:26 +00:00
{{- if .Capabilities.APIVersions.Has "batch/v1alpha1" }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
# Alpha feature since k8s 1.12
ttlSecondsAfterFinished: 0
Cleanup chart code
2020-03-02 14:49:26 +00:00
{{- end }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
template:
metadata:
Admission Webhook: Truncate name. (#10523)
2023-10-29 17:26:05 +00:00
name: {{ include "ingress-nginx.admissionWebhooks.patchWebhookJob.fullname" . }}
Cleanup chart code
2020-03-02 14:49:26 +00:00
{{- if .Values.controller.admissionWebhooks.patch.podAnnotations }}
annotations: {{ toYaml .Values.controller.admissionWebhooks.patch.podAnnotations | nindent 8 }}
{{- end }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
labels:
Update helm templates to match new chart name
2020-02-28 14:53:24 +00:00
{{- include "ingress-nginx.labels" . | nindent 8 }}
app.kubernetes.io/component: admission-webhook
[Helm] Add labels to resources (#6992) * Add labels to RBAC resources * Add labels to all resources * Fix labels indentaton in patch jobs * Add controller and default backend labels to pods Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com> * Bump chart version and update changelog Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com>
2021-11-19 14:52:52 +00:00
{{- with .Values.controller.admissionWebhooks.patch.labels }}
{{- toYaml . | nindent 8 }}
{{- end }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
spec:
Cleanup chart code
2020-03-02 14:49:26 +00:00
{{- if .Values.controller.admissionWebhooks.patch.priorityClassName }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
priorityClassName: {{ .Values.controller.admissionWebhooks.patch.priorityClassName }}
Add configuration option for the imagePullSecrets in the WH jobs
2020-05-04 17:46:27 +00:00
{{- end }}
{{- if .Values.imagePullSecrets }}
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }}
Cleanup chart code
2020-03-02 14:49:26 +00:00
{{- end }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
containers:
- name: patch
Chart: Add `global.image.registry`. (#12028)
2024-09-30 08:26:04 +00:00
{{- with (merge .Values.controller.admissionWebhooks.patch.image .Values.global.image) }}
Chart: Simplify image templating. (#10708)
2023-12-05 16:22:12 +00:00
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }}
Allow pulling images by digest The digest uniquely identifies a specific version of the image, so it is never updated by Kubernetes unless you change the digest value. This is desirable for security to gain confidence that no unvetted changes are pulled to a deployment.
2020-05-20 15:34:18 +00:00
{{- end }}
Update job-patchWebhook.yaml Referencing `deploy.yaml` results in a `null` value for the `imagePullPolicy`. Looks like the pull policy value is set under image!
2020-05-04 17:48:05 +00:00
imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
args:
- patch
Admission Webhook: Truncate name. (#10523)
2023-10-29 17:26:05 +00:00
- --webhook-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }}
Use Env expansion for namespace in args When deploying the controller to a custom namespace, users have to overwrite the namespace attribute as well as the hardcoded namespace values in a number of args for the Deployment and the admission controller Jobs. Instead, this commit, uses the namespace name from the DownwardAPI, and allows users to simply change the namespace attribute without having to worry about the container args.
2020-07-29 09:08:51 +00:00
- --namespace=$(POD_NAMESPACE)
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
- --patch-mutating=false
Admission Webhook: Truncate name. (#10523)
2023-10-29 17:26:05 +00:00
- --secret-name={{ include "ingress-nginx.admissionWebhooks.fullname" . }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
- --patch-failure-policy={{ .Values.controller.admissionWebhooks.failurePolicy }}
Use Env expansion for namespace in args When deploying the controller to a custom namespace, users have to overwrite the namespace attribute as well as the hardcoded namespace values in a number of args for the Deployment and the admission controller Jobs. Instead, this commit, uses the namespace name from the DownwardAPI, and allows users to simply change the namespace attribute without having to worry about the container args.
2020-07-29 09:08:51 +00:00
env:
- name: POD_NAMESPACE
valueFrom:
fieldRef:
fieldPath: metadata.namespace
support extraEnvs for job resources in helm chart (#8545) * support extraEnvs for job resources in helm chart Signed-off-by: Li, Eric <Xiannan.li@fmr.com> * Update helm doc * Update helm doc * Updated helm doc - add controller.admissionWebhooks.extraEnvs * Added some test data for webhook controller.admissionWebhooks.extraEnvs * added new line at the end of deployment-webhook-extraEnvs-values.yaml * Fixed helm chart test issue
2022-06-21 14:16:26 +00:00
{{- if .Values.controller.admissionWebhooks.extraEnvs }}
{{- toYaml .Values.controller.admissionWebhooks.extraEnvs | nindent 12 }}
{{- end }}
add:(admission-webhooks) ability to set securityContext for job-containers createSecret and patchWebhook (#9186) Signed-off-by: ybelMekk <youssef.bel.mekki@nav.no> Signed-off-by: ybelMekk <youssef.bel.mekki@nav.no>
2022-10-25 21:14:36 +00:00
{{- if .Values.controller.admissionWebhooks.patchWebhookJob.securityContext }}
securityContext: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.securityContext | nindent 12 }}
{{- end }}
Helm - Enable configuring request and limit for containers in webhook jobs (#7434) * helm: add feature to configure request and limit for container in createSecret and patchWebhook job Signed-off-by: Bhumij Gupta <bhumijgupta@gmail.com> * Remove empty line in helm template Signed-off-by: Bhumij Gupta <bhumijgupta@gmail.com> * Add test for admission webhook job container resources Signed-off-by: Bhumij Gupta <bhumijgupta@gmail.com> * Add new line character at the end of charts ci file Signed-off-by: Bhumij Gupta <bhumijgupta@gmail.com>
2021-08-05 22:31:41 +00:00
{{- if .Values.controller.admissionWebhooks.patchWebhookJob.resources }}
resources: {{ toYaml .Values.controller.admissionWebhooks.patchWebhookJob.resources | nindent 12 }}
{{- end }}
Start migration of helm chart (#5159)
2020-02-24 19:25:57 +00:00
restartPolicy: OnFailure
Chart: Make admission webhook patch job RBAC configurable. (#11376) * Add an option to skip rbac resources creation in helm chart for admission-webhooks (#11375) Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com> * Add an option to skip rbac resources creation in helm chart update README (#11375) Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com> * Add an option to skip serviceAccount resources creation in helm chart for admission-webhooks (#11375) Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com> * Add helm chart tests for admission-webhooks (#11375) Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com> * Chart make admission webhook patch job RBAC configurable (#11375) Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com> * Update charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml Co-authored-by: Marco Ebert <marco_ebert@icloud.com> * Update charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml Co-authored-by: Marco Ebert <marco_ebert@icloud.com> * Update charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml Co-authored-by: Marco Ebert <marco_ebert@icloud.com> * Update charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml Co-authored-by: Marco Ebert <marco_ebert@icloud.com> * Update charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml Co-authored-by: Marco Ebert <marco_ebert@icloud.com> --------- Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com> Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-06-03 09:17:23 +00:00
serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }}
Chart: Set `automountServiceAccountToken` in workloads. (#12247) Signed-off-by: Aran Shavit <Aranshavit@gmail.com> Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-29 20:55:25 +00:00
automountServiceAccountToken: {{ .Values.controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken }}
Cleanup chart code
2020-03-02 14:49:26 +00:00
{{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
add toleration support for admission webhooks Update charts/ingress-nginx/Chart.yaml Co-authored-by: Alex Harder <13860012+ChiefAlexander@users.noreply.github.com>
2020-05-19 05:58:57 +00:00
{{- end }}
{{- if .Values.controller.admissionWebhooks.patch.tolerations }}
tolerations: {{ toYaml .Values.controller.admissionWebhooks.patch.tolerations | nindent 8 }}
Cleanup chart code
2020-03-02 14:49:26 +00:00
{{- end }}
Chart: Tighten `securityContext`s and Pod Security Policies. (#10491) * Values: Fix docs of `controller.podSecurityContext` & `controller.sysctls`. * Values: Add missing `controller.containerSecurityContext`. Already in use, but has never been added to values. * Values: Fix docs of `defaultBackend.podSecurityContext` & `defaultBackend.containerSecurityContext`. * Helpers: Rename `controller.containerSecurityContext` to `ingress-nginx.controller.containerSecurityContext`. Due to alignment with other templates. * Helpers: Improve `extraModules`. - Make `command` a multiline list. - Fix `toYaml` usage. - Remove `toYaml` where not necessary. * Helpers: Move `ingress-nginx.defaultBackend.fullname`. * Helpers: Add `ingress-nginx.defaultBackend.containerSecurityContext`. Extracts the default backend `securityContext` into a template, as for the controller. * Controller: Fix indentation of `controller.podSecurityContext` & `controller.sysctls`. * Controller: Improve `controller.extraModules` & `controller.opentelemetry`. - Add `controller.extraModules.distroless` & `controller.extraModules.resources`. - Add `controller.opentelemetry.name` & `controller.opentelemetry.distroless`. - Align `extraModules` inclusion for `controller.extraModules` & `controller.opentelemetry`. - Remove redundant whitespaces. * Controller/PSP: Align indentation. * Controller/PSP: Remove quotes. * Controller/PSP: Improve comments. * Controller/PSP: Reorder fields. See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy. * Admission Webhooks: Fix indentation of `controller.admissionWebhooks.patch.securityContext`. * Admission Webhooks/PSP: Align indentation. * Admission Webhooks/PSP: Reorder fields. * Admission Webhooks/PSP: Align condition. * Admission Webhooks/ClusterRole: Align PSP rule. * Default Backend/PSP: Align indentation. * Default Backend/PSP: Reorder fields. See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy. * Values: Tighten `controller.image`. Due to recent changes, the controller image can be run without privilege escalation: - https://github.com/kubernetes/ingress-nginx/issues/8499 - https://github.com/kubernetes/ingress-nginx/pull/7449 * Values: Tighten `controller.extraModules.containerSecurityContext`. * Values: Tighten `controller.opentelemetry.containerSecurityContext`. * Values: Tighten `controller.admissionWebhooks.*.securityContext`. Moves the pod `securityContext` to the containers to not interfere with injected containers. * Values: Tighten `defaultBackend.image`.
2023-11-07 17:52:36 +00:00
{{- if .Values.controller.admissionWebhooks.patch.securityContext }}
securityContext: {{ toYaml .Values.controller.admissionWebhooks.patch.securityContext | nindent 8 }}
{{- end }}
add toleration support for admission webhooks Update charts/ingress-nginx/Chart.yaml Co-authored-by: Alex Harder <13860012+ChiefAlexander@users.noreply.github.com>
2020-05-19 05:58:57 +00:00
{{- end }}
Reference in a new issue Copy permalink