ingress-nginx-helm/charts/ingress-nginx/templates/default-backend-deployment.yaml

120 lines
5.4 KiB
YAML
Raw Normal View History

2020-03-02 14:49:26 +00:00
{{- if .Values.defaultBackend.enabled -}}
apiVersion: apps/v1
2020-02-24 19:25:57 +00:00
kind: Deployment
metadata:
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: default-backend
{{- with .Values.defaultBackend.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
name: {{ include "ingress-nginx.defaultBackend.fullname" . }}
namespace: {{ include "ingress-nginx.namespace" . }}
2020-02-24 19:25:57 +00:00
spec:
selector:
matchLabels:
{{- include "ingress-nginx.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: default-backend
2020-11-04 13:03:50 +00:00
{{- if not .Values.defaultBackend.autoscaling.enabled }}
2020-02-24 19:25:57 +00:00
replicas: {{ .Values.defaultBackend.replicaCount }}
2020-11-04 13:03:50 +00:00
{{- end }}
2020-02-24 19:25:57 +00:00
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
{{- if .Values.defaultBackend.updateStrategy }}
strategy:
{{ toYaml .Values.defaultBackend.updateStrategy | nindent 4 }}
{{- end }}
minReadySeconds: {{ .Values.defaultBackend.minReadySeconds }}
2020-02-24 19:25:57 +00:00
template:
metadata:
{{- if .Values.defaultBackend.podAnnotations }}
2020-03-02 14:49:26 +00:00
annotations: {{ toYaml .Values.defaultBackend.podAnnotations | nindent 8 }}
2020-02-24 19:25:57 +00:00
{{- end }}
labels:
{{- include "ingress-nginx.labels" . | nindent 8 }}
app.kubernetes.io/component: default-backend
{{- with .Values.defaultBackend.labels }}
{{- toYaml . | nindent 8 }}
{{- end }}
2020-03-02 14:49:26 +00:00
{{- if .Values.defaultBackend.podLabels }}
{{- toYaml .Values.defaultBackend.podLabels | nindent 8 }}
2020-02-24 19:25:57 +00:00
{{- end }}
2020-03-02 14:49:26 +00:00
spec:
{{- if .Values.imagePullSecrets }}
imagePullSecrets: {{ toYaml .Values.imagePullSecrets | nindent 8 }}
{{- end }}
{{- if .Values.defaultBackend.priorityClassName }}
priorityClassName: {{ .Values.defaultBackend.priorityClassName }}
{{- end }}
{{- if .Values.defaultBackend.podSecurityContext }}
securityContext: {{ toYaml .Values.defaultBackend.podSecurityContext | nindent 8 }}
{{- end }}
2020-02-24 19:25:57 +00:00
containers:
2020-04-30 02:20:12 +00:00
- name: {{ template "ingress-nginx.name" . }}-default-backend
{{- with .Values.defaultBackend.image }}
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }}
{{- end }}
2020-03-02 14:49:26 +00:00
imagePullPolicy: {{ .Values.defaultBackend.image.pullPolicy }}
{{- if .Values.defaultBackend.extraArgs }}
2020-02-24 19:25:57 +00:00
args:
{{- range $key, $value := .Values.defaultBackend.extraArgs }}
2020-09-21 16:03:49 +00:00
{{- /* Accept keys without values or with false as value */}}
{{- if eq ($value | quote | len) 2 }}
2020-02-24 19:25:57 +00:00
- --{{ $key }}
2020-09-21 16:03:49 +00:00
{{- else }}
- --{{ $key }}={{ $value }}
2020-02-24 19:25:57 +00:00
{{- end }}
{{- end }}
2020-03-02 14:49:26 +00:00
{{- end }}
Chart: Tighten `securityContext`s and Pod Security Policies. (#10491) * Values: Fix docs of `controller.podSecurityContext` & `controller.sysctls`. * Values: Add missing `controller.containerSecurityContext`. Already in use, but has never been added to values. * Values: Fix docs of `defaultBackend.podSecurityContext` & `defaultBackend.containerSecurityContext`. * Helpers: Rename `controller.containerSecurityContext` to `ingress-nginx.controller.containerSecurityContext`. Due to alignment with other templates. * Helpers: Improve `extraModules`. - Make `command` a multiline list. - Fix `toYaml` usage. - Remove `toYaml` where not necessary. * Helpers: Move `ingress-nginx.defaultBackend.fullname`. * Helpers: Add `ingress-nginx.defaultBackend.containerSecurityContext`. Extracts the default backend `securityContext` into a template, as for the controller. * Controller: Fix indentation of `controller.podSecurityContext` & `controller.sysctls`. * Controller: Improve `controller.extraModules` & `controller.opentelemetry`. - Add `controller.extraModules.distroless` & `controller.extraModules.resources`. - Add `controller.opentelemetry.name` & `controller.opentelemetry.distroless`. - Align `extraModules` inclusion for `controller.extraModules` & `controller.opentelemetry`. - Remove redundant whitespaces. * Controller/PSP: Align indentation. * Controller/PSP: Remove quotes. * Controller/PSP: Improve comments. * Controller/PSP: Reorder fields. See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy. * Admission Webhooks: Fix indentation of `controller.admissionWebhooks.patch.securityContext`. * Admission Webhooks/PSP: Align indentation. * Admission Webhooks/PSP: Reorder fields. * Admission Webhooks/PSP: Align condition. * Admission Webhooks/ClusterRole: Align PSP rule. * Default Backend/PSP: Align indentation. * Default Backend/PSP: Reorder fields. See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy. * Values: Tighten `controller.image`. Due to recent changes, the controller image can be run without privilege escalation: - https://github.com/kubernetes/ingress-nginx/issues/8499 - https://github.com/kubernetes/ingress-nginx/pull/7449 * Values: Tighten `controller.extraModules.containerSecurityContext`. * Values: Tighten `controller.opentelemetry.containerSecurityContext`. * Values: Tighten `controller.admissionWebhooks.*.securityContext`. Moves the pod `securityContext` to the containers to not interfere with injected containers. * Values: Tighten `defaultBackend.image`.
2023-11-07 17:52:36 +00:00
securityContext: {{ include "ingress-nginx.defaultBackend.containerSecurityContext" . | nindent 12 }}
2020-03-02 14:49:26 +00:00
{{- if .Values.defaultBackend.extraEnvs }}
env: {{ toYaml .Values.defaultBackend.extraEnvs | nindent 12 }}
{{- end }}
2020-02-24 19:25:57 +00:00
livenessProbe:
httpGet:
path: /healthz
port: {{ .Values.defaultBackend.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.defaultBackend.livenessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.defaultBackend.livenessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.defaultBackend.livenessProbe.timeoutSeconds }}
successThreshold: {{ .Values.defaultBackend.livenessProbe.successThreshold }}
failureThreshold: {{ .Values.defaultBackend.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: /healthz
port: {{ .Values.defaultBackend.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.defaultBackend.readinessProbe.initialDelaySeconds }}
periodSeconds: {{ .Values.defaultBackend.readinessProbe.periodSeconds }}
timeoutSeconds: {{ .Values.defaultBackend.readinessProbe.timeoutSeconds }}
successThreshold: {{ .Values.defaultBackend.readinessProbe.successThreshold }}
failureThreshold: {{ .Values.defaultBackend.readinessProbe.failureThreshold }}
ports:
- name: http
containerPort: {{ .Values.defaultBackend.port }}
protocol: TCP
{{- if .Values.defaultBackend.extraVolumeMounts }}
volumeMounts: {{- toYaml .Values.defaultBackend.extraVolumeMounts | nindent 12 }}
{{- end }}
2020-03-02 14:49:26 +00:00
{{- if .Values.defaultBackend.resources }}
resources: {{ toYaml .Values.defaultBackend.resources | nindent 12 }}
{{- end }}
2020-02-24 19:25:57 +00:00
{{- if .Values.defaultBackend.nodeSelector }}
2020-03-02 14:49:26 +00:00
nodeSelector: {{ toYaml .Values.defaultBackend.nodeSelector | nindent 8 }}
2020-02-24 19:25:57 +00:00
{{- end }}
serviceAccountName: {{ template "ingress-nginx.defaultBackend.serviceAccountName" . }}
2020-02-24 19:25:57 +00:00
{{- if .Values.defaultBackend.tolerations }}
2020-03-02 14:49:26 +00:00
tolerations: {{ toYaml .Values.defaultBackend.tolerations | nindent 8 }}
2020-02-24 19:25:57 +00:00
{{- end }}
{{- if .Values.defaultBackend.affinity }}
2020-03-02 14:49:26 +00:00
affinity: {{ toYaml .Values.defaultBackend.affinity | nindent 8 }}
2020-02-24 19:25:57 +00:00
{{- end }}
{{- if .Values.defaultBackend.topologySpreadConstraints }}
topologySpreadConstraints: {{ tpl (toYaml .Values.defaultBackend.topologySpreadConstraints) $ | nindent 8 }}
{{- end }}
2020-02-24 19:25:57 +00:00
terminationGracePeriodSeconds: 60
{{- if .Values.defaultBackend.extraVolumes }}
volumes: {{ toYaml .Values.defaultBackend.extraVolumes | nindent 8 }}
{{- end }}
2020-02-24 19:25:57 +00:00
{{- end }}