synced with upstream
This commit is contained in:
Christoph Hartmann
commit
bb1175e9e1
35 changed files with 2250 additions and 2085 deletions
|
|
@ -38,6 +38,7 @@ the versions listed. Ingress-Nginx versions may work on older versions but the p
|
|||
|
||||
| Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version |
|
||||
|-----------------------|------------------------------|----------------|---------------|
|
||||
| v1.6.3 | 1.26, 1.25, 1.24, 1.23 | 3.17.0 | 1.21.6 |
|
||||
| v1.5.1 | 1.25, 1.24, 1.23 | 3.16.2 | 1.21.6 |
|
||||
| v1.4.0 | 1.25, 1.24, 1.23, 1.22 | 3.16.2 | 1.19.10† |
|
||||
| v1.3.1 | 1.24, 1.23, 1.22, 1.21, 1.20 | 3.16.2 | 1.19.10† |
|
||||
|
|
|
|||
3
TAG
3
TAG
|
|
@ -1 +1,2 @@
|
|||
v1.6.2
|
||||
v1.6.3
|
||||
|
||||
|
|
|
|||
|
|
@ -1,14 +1,59 @@
|
|||
# Changelog
|
||||
|
||||
### 1.5.2
|
||||
### 1.6.3
|
||||
Images:
|
||||
|
||||
<<<<<<< HEAD
|
||||
* registry.k8s.io/ingress-nginx/controller:controller-v1.5.2@sha256:3870522ed937c9efb94bfa31a7eb16009831567a0d4cbe01846fc5486d622655
|
||||
* registry.k8s.io/ingress-nginx/controller-chroot:controller-v1.5.2@sha256:84613555694f2c59a8b2551126d226c9aa648544ebf0cde1e0df942f7dbce42b
|
||||
* registry.k8s.io/controller:controller-v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
* registry.k8s.io/controller-chroot:controller-v1.6.3@sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4
|
||||
|
||||
### All Changes:
|
||||
|
||||
* Revert Implement pathType validation (#9511) (#9607)
|
||||
* update history and allow to pass a target test (#9605)
|
||||
* Allow to pass a target test (#9542)
|
||||
* Replace deprecated command with environment file (#9581)
|
||||
* build 1.6.2 to fix (#9569)
|
||||
* add lint on chart before release (#9570)
|
||||
* tcpproxy: increase buffer size to 16K (#9548)
|
||||
* Move and spell-check Kubernetes 1.22 migration FAQ (#9544)
|
||||
* Add CORS template check inside location for externalAuth.SignURL (#8814)
|
||||
* fix(grafana-dashboard): remove hardcoded namespace references (#9523)
|
||||
* Replace deprecated command with environment file (#9581)
|
||||
* add path validation to implementation specific as well (#9573)
|
||||
* add lint on chart before release (#9570)
|
||||
* Switch logic on path type validation and setting it to false (#9543)
|
||||
* tcpproxy: increase buffer size to 16K (#9548)
|
||||
* Move and spell-check Kubernetes 1.22 migration FAQ (#9544)
|
||||
* Add CORS template check inside location for externalAuth.SignURL (#8814)
|
||||
* fix(grafana-dashboard): remove hardcoded namespace references (#9523)
|
||||
* Align default value for keepalive_request with NGINX default (#9518)
|
||||
* Implement pathType validation (#9511)
|
||||
* feat(configmap): expose gzip-disable (#9505)
|
||||
* Values: Add missing `controller.metrics.service.labels`. (#9501)
|
||||
* Add docs about orphan_ingress metric (#9514)
|
||||
* Add new prometheus metric for orphaned ingress (#8230)
|
||||
* Sanitise request metrics in monitoring docs (#9384)
|
||||
* Change default value of enable-brotli (#9500)
|
||||
* feat: support topology aware hints (#9165)
|
||||
* Remove 1.5.2 from readme (#9498)
|
||||
* Remove nonexistent load flag from docker build commands (#9122)
|
||||
* added option to disable sync event creation (#8528)
|
||||
* Add buildResolvers to the stream module (#9184)
|
||||
* fix: disable auth access logs (#9049)
|
||||
* Adding ipdenylist annotation (#8795)
|
||||
* Add update updateStrategy and minReadySeconds for defaultBackend (#8506)
|
||||
* Fix indentation on serviceAccount annotation (#9129)
|
||||
* Update monitoring.md (#9269)
|
||||
* add github actions stale bot (#9439)
|
||||
* Admission Webhooks/Job: Add `NetworkPolicy`. (#9218)
|
||||
* update OpenTelemetry image (#9491)
|
||||
* bump OpenTelemetry (#9489)
|
||||
* Optional podman support (#9294)
|
||||
* fix change images (#9463)
|
||||
* move tests to gh actions (#9461)
|
||||
* Automated Release Controller 1.5.2 (#9455)
|
||||
* Add sslpassthrough tests (#9457)
|
||||
* updated the link in RELEASE.md file (#9456)
|
||||
* restart 1.5.2 release process (#9450)
|
||||
* Update command line arguments documentation (#9224)
|
||||
* start release 1.5.2 (#9445)
|
||||
|
|
@ -20,24 +65,6 @@ Images:
|
|||
* update the nginx run container for alpine:3.17.0 (#9430)
|
||||
* cleanup: remove ioutil for new go version (#9427)
|
||||
* start upgrade to golang 1.19.4 and alpine 3.17.0 (#9417)
|
||||
=======
|
||||
* registry.k8s.io/controller:controller-v1.5.2@sha256:c1c091b88a6c936a83bd7g098v62f60a87868d12452529bad0d178fb36143346
|
||||
* registry.k8s.io/controller-chroot:controller-v1.5.2@sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529b350d178fb36147345
|
||||
|
||||
### All Changes:
|
||||
|
||||
<<<<<<< HEAD
|
||||
>>>>>>> f4164ae0b (THE CHANGELOG WORKS)
|
||||
=======
|
||||
* upgrade nginx base image (#9436)
|
||||
* test the new e2e test images (#9444)
|
||||
* avoid builds and tests for non-code changes (#9392)
|
||||
* CI updates (#9440)
|
||||
* HPA: Add `controller.autoscaling.annotations` to `values.yaml`. (#9253)
|
||||
* update the nginx run container for alpine:3.17.0 (#9430)
|
||||
* cleanup: remove ioutil for new go version (#9427)
|
||||
* start upgrade to golang 1.19.4 and alpine 3.17.0 (#9417)
|
||||
>>>>>>> 9ecab7d85 (e2e doc updates work now)
|
||||
* ci: remove setup-helm step (#9404)
|
||||
* ci: remove setup-kind step (#9401)
|
||||
* Add reporter for all tests (#9395)
|
||||
|
|
@ -73,10 +100,17 @@ Images:
|
|||
* add containerSecurityContext to extraModules init containers (kubernetes#9016) (#9242)
|
||||
|
||||
### Dependencies updates:
|
||||
<<<<<<< HEAD
|
||||
<<<<<<< HEAD
|
||||
=======
|
||||
>>>>>>> 9ecab7d85 (e2e doc updates work now)
|
||||
* Bump google.golang.org/grpc from 1.52.0 to 1.52.3 (#9555)
|
||||
* Bump k8s.io/klog/v2 from 2.80.1 to 2.90.0 (#9553)
|
||||
* Bump sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.2 (#9552)
|
||||
* Bump google.golang.org/grpc from 1.51.0 to 1.52.0 (#9512)
|
||||
* Bump `client-go` to remove dependence on go-autorest dependency (#9488)
|
||||
* Bump google.golang.org/grpc from 1.52.0 to 1.52.3 (#9555)
|
||||
* Bump k8s.io/klog/v2 from 2.80.1 to 2.90.0 (#9553)
|
||||
* Bump sigs.k8s.io/controller-runtime from 0.13.1 to 0.14.2 (#9552)
|
||||
* Bump google.golang.org/grpc from 1.51.0 to 1.52.0 (#9512)
|
||||
* Bump `client-go` to remove dependence on go-autorest dependency (#9488)
|
||||
* Bump golang.org/x/crypto from 0.4.0 to 0.5.0 (#9494)
|
||||
* Bump golang.org/x/crypto from 0.3.0 to 0.4.0 (#9397)
|
||||
* Bump github.com/onsi/ginkgo/v2 from 2.6.0 to 2.6.1 (#9432)
|
||||
* Bump github.com/onsi/ginkgo/v2 from 2.6.0 to 2.6.1 (#9421)
|
||||
|
|
@ -85,11 +119,6 @@ Images:
|
|||
* Bump goreleaser/goreleaser-action from 3.2.0 to 4.1.0 (#9426)
|
||||
* Bump actions/dependency-review-action from 3.0.1 to 3.0.2 (#9424)
|
||||
* Bump ossf/scorecard-action from 2.0.6 to 2.1.0 (#9422)
|
||||
<<<<<<< HEAD
|
||||
=======
|
||||
>>>>>>> f4164ae0b (THE CHANGELOG WORKS)
|
||||
=======
|
||||
>>>>>>> 9ecab7d85 (e2e doc updates work now)
|
||||
* Bump github.com/prometheus/common from 0.37.0 to 0.39.0 (#9416)
|
||||
* Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0 (#9408)
|
||||
* Bump github.com/onsi/ginkgo/v2 from 2.5.1 to 2.6.0 (#9398)
|
||||
|
|
@ -104,12 +133,4 @@ Images:
|
|||
* Bump actions/dependency-review-action from 2.5.1 to 3.0.0 (#9301)
|
||||
* Bump k8s.io/component-base from 0.25.3 to 0.25.4 (#9300)
|
||||
|
||||
<<<<<<< HEAD
|
||||
<<<<<<< HEAD
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.5.2
|
||||
=======
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.2...controller-controller-v1.5.1
|
||||
>>>>>>> f4164ae0b (THE CHANGELOG WORKS)
|
||||
=======
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.5.2
|
||||
>>>>>>> 9ecab7d85 (e2e doc updates work now)
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-controller-v1.5.1...controller-controller-v1.6.3
|
||||
|
|
@ -1,31 +1,27 @@
|
|||
annotations:
|
||||
artifacthub.io/changes: |
|
||||
- "add lint on chart before release (#9570)"
|
||||
- "ci: remove setup-helm step (#9404)"
|
||||
- "feat(helm): Optionally use cert-manager instead admission patch (#9279)"
|
||||
- "run helm release on main only and when the chart/value changes only (#9290)"
|
||||
- "Update Ingress-Nginx version controller-v1.6.3"
|
||||
artifacthub.io/prerelease: "false"
|
||||
apiVersion: v2
|
||||
name: ingress-nginx
|
||||
# When the version is modified, make sure the artifacthub.io/changes list is updated
|
||||
# Also update CHANGELOG.md
|
||||
version: 4.4.2
|
||||
appVersion: 1.5.1
|
||||
appVersion: 1.6.3
|
||||
description: Ingress controller for Kubernetes using NGINX as a reverse proxy and
|
||||
load balancer
|
||||
engine: gotpl
|
||||
home: https://github.com/kubernetes/ingress-nginx
|
||||
description: Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
|
||||
icon: https://upload.wikimedia.org/wikipedia/commons/thumb/c/c5/Nginx_logo.svg/500px-Nginx_logo.svg.png
|
||||
keywords:
|
||||
- ingress
|
||||
- nginx
|
||||
sources:
|
||||
- https://github.com/kubernetes/ingress-nginx
|
||||
- ingress
|
||||
- nginx
|
||||
kubeVersion: '>=1.20.0-0'
|
||||
maintainers:
|
||||
- name: rikatz
|
||||
- name: strongjz
|
||||
- name: tao12345666333
|
||||
engine: gotpl
|
||||
kubeVersion: ">=1.20.0-0"
|
||||
annotations:
|
||||
# Use this annotation to indicate that this chart version is a pre-release.
|
||||
# https://artifacthub.io/docs/topics/annotations/helm/
|
||||
artifacthub.io/prerelease: "false"
|
||||
# List of changes for the release in artifacthub.io
|
||||
# https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx?modal=changelog
|
||||
artifacthub.io/changes: |
|
||||
- Adding support for disabling liveness and readiness probes to the Helm chart
|
||||
- add:(admission-webhooks) ability to set securityContext
|
||||
- Updated Helm chart to use the fullname for the electionID if not specified
|
||||
- Rename controller-wehbooks-networkpolicy.yaml
|
||||
- name: rikatz
|
||||
- name: strongjz
|
||||
- name: tao12345666333
|
||||
name: ingress-nginx
|
||||
sources:
|
||||
- https://github.com/kubernetes/ingress-nginx
|
||||
version: 4.5.0
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
|
||||
|
||||
 
|
||||
 
|
||||
|
||||
To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
|
||||
|
||||
|
|
@ -253,7 +253,6 @@ Kubernetes: `>=1.20.0-0`
|
|||
| Key | Type | Default | Description |
|
||||
|-----|------|---------|-------------|
|
||||
| commonLabels | object | `{}` | |
|
||||
| controller.EnablePathTypeValidation | bool | `false` | This configuration defines if Ingress Controller should validate pathType. If false, special characters will be allowed on paths of any pathType. If true, special characters are only allowed on paths with pathType = ImplementationSpecific |
|
||||
| controller.addHeaders | object | `{}` | Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers |
|
||||
| controller.admissionWebhooks.annotations | object | `{}` | |
|
||||
| controller.admissionWebhooks.certManager.admissionCert.duration | string | `""` | |
|
||||
|
|
@ -334,13 +333,13 @@ Kubernetes: `>=1.20.0-0`
|
|||
| controller.hostname | object | `{}` | Optionally customize the pod hostname. |
|
||||
| controller.image.allowPrivilegeEscalation | bool | `true` | |
|
||||
| controller.image.chroot | bool | `false` | |
|
||||
| controller.image.digest | string | `"sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629"` | |
|
||||
| controller.image.digestChroot | string | `"sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529bad0d178fb36147345"` | |
|
||||
| controller.image.digest | string | `"sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2"` | |
|
||||
| controller.image.digestChroot | string | `"sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4"` | |
|
||||
| controller.image.image | string | `"ingress-nginx/controller"` | |
|
||||
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
|
||||
| controller.image.registry | string | `"registry.k8s.io"` | |
|
||||
| controller.image.runAsUser | int | `101` | |
|
||||
| controller.image.tag | string | `"v1.5.1"` | |
|
||||
| controller.image.tag | string | `"v1.6.3"` | |
|
||||
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
|
||||
| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
|
||||
| controller.ingressClassResource.controllerValue | string | `"k8s.io/ingress-nginx"` | Controller-value of the controller that is processing this ingressClass |
|
||||
|
|
|
|||
|
|
@ -2,11 +2,12 @@
|
|||
|
||||
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
|
||||
|
||||
### 4.4.1
|
||||
### 4.5.0
|
||||
|
||||
* add lint on chart before release (#9570)
|
||||
* ci: remove setup-helm step (#9404)
|
||||
* feat(helm): Optionally use cert-manager instead admission patch (#9279)
|
||||
* run helm release on main only and when the chart/value changes only (#9290)
|
||||
* Update Ingress-Nginx version controller-v1.5.2
|
||||
* Update Ingress-Nginx version controller-v1.6.3
|
||||
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.1...helm-chart-4.4.1
|
||||
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.4.3...helm-chart-4.5.0
|
||||
|
|
@ -14,7 +14,6 @@ metadata:
|
|||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
allow-snippet-annotations: "{{ .Values.controller.allowSnippetAnnotations }}"
|
||||
enable-pathtype-validation: "{{ .Values.controller.EnablePathTypeValidation }}"
|
||||
{{- if .Values.controller.addHeaders }}
|
||||
add-headers: {{ .Release.Namespace }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers
|
||||
{{- end }}
|
||||
|
|
|
|||
|
|
@ -23,80 +23,58 @@ controller:
|
|||
## for backwards compatibility consider setting the full image url via the repository value below
|
||||
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
|
||||
## repository:
|
||||
tag: "v1.5.1"
|
||||
digest: sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
digestChroot: sha256:c1c091b88a6c936a83bd7b098662760a87868d12452529bad0d178fb36147345
|
||||
tag: "v1.6.3"
|
||||
digest: sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
digestChroot: sha256:4b4a249c9a35ac16a8ec0e22f6c522b8707f7e59e656e64a4ad9ace8fea830a4
|
||||
pullPolicy: IfNotPresent
|
||||
# www-data -> uid 101
|
||||
runAsUser: 101
|
||||
allowPrivilegeEscalation: true
|
||||
|
||||
# -- Use an existing PSP instead of creating one
|
||||
existingPsp: ""
|
||||
|
||||
# -- Configures the controller container name
|
||||
containerName: controller
|
||||
|
||||
# -- Configures the ports that the nginx-controller listens on
|
||||
containerPort:
|
||||
http: 80
|
||||
https: 443
|
||||
|
||||
# -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
|
||||
config: {}
|
||||
|
||||
# -- Annotations to be added to the controller config configuration configmap.
|
||||
configAnnotations: {}
|
||||
|
||||
# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers
|
||||
proxySetHeaders: {}
|
||||
|
||||
# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
|
||||
addHeaders: {}
|
||||
|
||||
# -- Optionally customize the pod dnsConfig.
|
||||
dnsConfig: {}
|
||||
|
||||
# -- Optionally customize the pod hostname.
|
||||
hostname: {}
|
||||
|
||||
# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.
|
||||
# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller
|
||||
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
|
||||
dnsPolicy: ClusterFirst
|
||||
|
||||
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
|
||||
# Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
|
||||
reportNodeInternalIp: false
|
||||
|
||||
# -- Process Ingress objects without ingressClass annotation/ingressClassName field
|
||||
# Overrides value for --watch-ingress-without-class flag of the controller binary
|
||||
# Defaults to false
|
||||
watchIngressWithoutClass: false
|
||||
|
||||
# -- Process IngressClass per name (additionally as per spec.controller).
|
||||
ingressClassByName: false
|
||||
|
||||
# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-aware-hints="auto"
|
||||
# Defaults to false
|
||||
enableTopologyAwareRouting: false
|
||||
|
||||
# -- This configuration defines if Ingress Controller should allow users to set
|
||||
# their own *-snippet annotations, otherwise this is forbidden / dropped
|
||||
# when users add those annotations.
|
||||
# Global snippets in ConfigMap are still respected
|
||||
allowSnippetAnnotations: true
|
||||
|
||||
# -- This configuration defines if Ingress Controller should validate pathType.
|
||||
# If false, special characters will be allowed on paths of any pathType.
|
||||
# If true, special characters are only allowed on paths with pathType = ImplementationSpecific
|
||||
EnablePathTypeValidation: false
|
||||
|
||||
# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
|
||||
# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
|
||||
# is merged
|
||||
hostNetwork: false
|
||||
|
||||
## Use host ports 80 and 443
|
||||
## Disabled by default
|
||||
hostPort:
|
||||
|
|
@ -107,10 +85,8 @@ controller:
|
|||
http: 80
|
||||
# -- 'hostPort' https port
|
||||
https: 443
|
||||
|
||||
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
|
||||
electionID: ""
|
||||
|
||||
## This section refers to the creation of the IngressClass resource
|
||||
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19
|
||||
ingressClassResource:
|
||||
|
|
@ -122,23 +98,19 @@ controller:
|
|||
default: false
|
||||
# -- Controller-value of the controller that is processing this ingressClass
|
||||
controllerValue: "k8s.io/ingress-nginx"
|
||||
|
||||
# -- Parameters is a link to a custom resource containing additional
|
||||
# configuration for the controller. This is optional if the controller
|
||||
# does not require extra parameters.
|
||||
parameters: {}
|
||||
|
||||
# -- For backwards compatibility with ingress.class annotation, use ingressClass.
|
||||
# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation
|
||||
ingressClass: nginx
|
||||
|
||||
# -- Labels to add to the pod container metadata
|
||||
podLabels: {}
|
||||
# key: value
|
||||
|
||||
# -- Security Context policies for controller pods
|
||||
podSecurityContext: {}
|
||||
|
||||
# -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls
|
||||
sysctls: {}
|
||||
# sysctls:
|
||||
|
|
@ -154,7 +126,6 @@ controller:
|
|||
# -- Allows overriding of the publish service to bind to
|
||||
# Must be <namespace>/<service_name>
|
||||
pathOverride: ""
|
||||
|
||||
# Limit the scope of the controller to a specific namespace
|
||||
scope:
|
||||
# -- Enable 'scope' or not
|
||||
|
|
@ -164,26 +135,21 @@ controller:
|
|||
# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels
|
||||
# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.
|
||||
namespaceSelector: ""
|
||||
|
||||
# -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)
|
||||
configMapNamespace: ""
|
||||
|
||||
tcp:
|
||||
# -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)
|
||||
configMapNamespace: ""
|
||||
# -- Annotations to be added to the tcp config configmap
|
||||
annotations: {}
|
||||
|
||||
udp:
|
||||
# -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)
|
||||
configMapNamespace: ""
|
||||
# -- Annotations to be added to the udp config configmap
|
||||
annotations: {}
|
||||
|
||||
# -- Maxmind license key to download GeoLite2 Databases.
|
||||
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
|
||||
maxmindLicenseKey: ""
|
||||
|
||||
# -- Additional command line arguments to pass to nginx-ingress-controller
|
||||
# E.g. to specify the default SSL certificate you can use
|
||||
extraArgs: {}
|
||||
|
|
@ -201,7 +167,6 @@ controller:
|
|||
|
||||
# -- Use a `DaemonSet` or `Deployment`
|
||||
kind: Deployment
|
||||
|
||||
# -- Annotations to be added to the controller Deployment or DaemonSet
|
||||
##
|
||||
annotations: {}
|
||||
|
|
@ -213,7 +178,6 @@ controller:
|
|||
# keel.sh/policy: patch
|
||||
# keel.sh/trigger: poll
|
||||
|
||||
|
||||
# -- The update strategy to apply to the Deployment or DaemonSet
|
||||
##
|
||||
updateStrategy: {}
|
||||
|
|
@ -224,8 +188,6 @@ controller:
|
|||
# -- `minReadySeconds` to avoid killing pods before we are ready
|
||||
##
|
||||
minReadySeconds: 0
|
||||
|
||||
|
||||
# -- Node tolerations for server scheduling to nodes with taints
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
||||
##
|
||||
|
|
@ -294,13 +256,11 @@ controller:
|
|||
## wait up to five minutes for the drain of connections
|
||||
##
|
||||
terminationGracePeriodSeconds: 300
|
||||
|
||||
# -- Node labels for controller pod assignment
|
||||
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
|
||||
##
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
## Liveness and readiness probe values
|
||||
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
|
||||
##
|
||||
|
|
@ -337,23 +297,17 @@ controller:
|
|||
timeoutSeconds: 1
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
|
||||
|
||||
# -- Path of the health check endpoint. All requests received on the port defined by
|
||||
# the healthz-port parameter are forwarded internally to this path.
|
||||
healthCheckPath: "/healthz"
|
||||
|
||||
# -- Address to bind the health check endpoint.
|
||||
# It is better to set this option to the internal node address
|
||||
# if the ingress nginx controller is running in the `hostNetwork: true` mode.
|
||||
healthCheckHost: ""
|
||||
|
||||
# -- Annotations to be added to controller pods
|
||||
##
|
||||
podAnnotations: {}
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
# -- Define either 'minAvailable' or 'maxUnavailable', never both.
|
||||
minAvailable: 1
|
||||
# -- Define either 'minAvailable' or 'maxUnavailable', never both.
|
||||
|
|
@ -370,7 +324,6 @@ controller:
|
|||
requests:
|
||||
cpu: 100m
|
||||
memory: 90Mi
|
||||
|
||||
# Mutually exclusive with keda autoscaling
|
||||
autoscaling:
|
||||
apiVersion: autoscaling/v2
|
||||
|
|
@ -393,7 +346,6 @@ controller:
|
|||
# - type: Pods
|
||||
# value: 2
|
||||
# periodSeconds: 60
|
||||
|
||||
autoscalingTemplate: []
|
||||
# Custom or additional autoscaling metrics
|
||||
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
|
||||
|
|
@ -448,15 +400,12 @@ controller:
|
|||
## ref: https://github.com/microsoft/mimalloc
|
||||
##
|
||||
enableMimalloc: true
|
||||
|
||||
## Override NGINX template
|
||||
customTemplate:
|
||||
configMapName: ""
|
||||
configMapKey: ""
|
||||
|
||||
service:
|
||||
enabled: true
|
||||
|
||||
# -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were
|
||||
# using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
|
||||
# It allows choosing the protocol for each backend specified in the Kubernetes service.
|
||||
|
|
@ -464,7 +413,6 @@ controller:
|
|||
# Will be ignored for Kubernetes versions older than 1.20
|
||||
##
|
||||
appProtocol: true
|
||||
|
||||
annotations: {}
|
||||
labels: {}
|
||||
# clusterIP: ""
|
||||
|
|
@ -473,14 +421,11 @@ controller:
|
|||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
|
||||
# -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
|
||||
loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
enableHttp: true
|
||||
enableHttps: true
|
||||
|
||||
## Set external traffic policy to: "Local" to preserve source IP on providers supporting it.
|
||||
## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
|
||||
# externalTrafficPolicy: ""
|
||||
|
|
@ -499,23 +444,18 @@ controller:
|
|||
# The ipFamilies and clusterIPs fields depend on the value of this field.
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
|
||||
ipFamilyPolicy: "SingleStack"
|
||||
|
||||
# -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically
|
||||
# based on cluster configuration and the ipFamilyPolicy field.
|
||||
## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/
|
||||
ipFamilies:
|
||||
- IPv4
|
||||
|
||||
ports:
|
||||
http: 80
|
||||
https: 443
|
||||
|
||||
targetPorts:
|
||||
http: http
|
||||
https: https
|
||||
|
||||
type: LoadBalancer
|
||||
|
||||
## type: NodePort
|
||||
## nodePorts:
|
||||
## http: 32080
|
||||
|
|
@ -527,30 +467,24 @@ controller:
|
|||
https: ""
|
||||
tcp: {}
|
||||
udp: {}
|
||||
|
||||
external:
|
||||
enabled: true
|
||||
|
||||
internal:
|
||||
# -- Enables an additional internal load balancer (besides the external one).
|
||||
enabled: false
|
||||
# -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service.
|
||||
annotations: {}
|
||||
|
||||
# loadBalancerIP: ""
|
||||
|
||||
# -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0.
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
## Set external traffic policy to: "Local" to preserve source IP on
|
||||
## providers supporting it
|
||||
## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer
|
||||
# externalTrafficPolicy: ""
|
||||
|
||||
# shareProcessNamespace enables process namespace sharing within the pod.
|
||||
# This can be used for example to signal log rotation using `kill -USR1` from a sidecar.
|
||||
shareProcessNamespace: false
|
||||
|
||||
# -- Additional containers to be added to the controller pod.
|
||||
# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.
|
||||
extraContainers: []
|
||||
|
|
@ -605,7 +539,6 @@ controller:
|
|||
image: registry.k8s.io/ingress-nginx/opentelemetry:v20230107-helm-chart-4.4.2-2-g96b3d2165@sha256:331b9bebd6acfcd2d3048abbdd86555f5be76b7e3d0b5af4300b04235c6056c9
|
||||
containerSecurityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
admissionWebhooks:
|
||||
annotations: {}
|
||||
# ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem".
|
||||
|
|
@ -632,11 +565,9 @@ controller:
|
|||
objectSelector: {}
|
||||
# -- Labels to be added to admission webhooks
|
||||
labels: {}
|
||||
|
||||
# -- Use an existing PSP instead of creating one
|
||||
existingPsp: ""
|
||||
networkPolicyEnabled: false
|
||||
|
||||
service:
|
||||
annotations: {}
|
||||
# clusterIP: ""
|
||||
|
|
@ -645,7 +576,6 @@ controller:
|
|||
loadBalancerSourceRanges: []
|
||||
servicePort: 443
|
||||
type: ClusterIP
|
||||
|
||||
createSecretJob:
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -656,12 +586,10 @@ controller:
|
|||
# requests:
|
||||
# cpu: 10m
|
||||
# memory: 20Mi
|
||||
|
||||
patchWebhookJob:
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
resources: {}
|
||||
|
||||
patch:
|
||||
enabled: true
|
||||
image:
|
||||
|
|
@ -686,46 +614,42 @@ controller:
|
|||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
fsGroup: 2000
|
||||
|
||||
# Use certmanager to generate webhook certs
|
||||
certManager:
|
||||
enabled: false
|
||||
# self-signed root certificate
|
||||
rootCert:
|
||||
duration: "" # default to be 5y
|
||||
# default to be 5y
|
||||
duration: ""
|
||||
admissionCert:
|
||||
duration: "" # default to be 1y
|
||||
# default to be 1y
|
||||
duration: ""
|
||||
# issuerRef:
|
||||
# name: "issuer"
|
||||
# kind: "ClusterIssuer"
|
||||
|
||||
metrics:
|
||||
port: 10254
|
||||
portName: metrics
|
||||
# if this port is changed, change healthz-port: in extraArgs: accordingly
|
||||
enabled: false
|
||||
|
||||
service:
|
||||
annotations: {}
|
||||
# prometheus.io/scrape: "true"
|
||||
# prometheus.io/port: "10254"
|
||||
# -- Labels to be added to the metrics service resource
|
||||
labels: {}
|
||||
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the stats-exporter service is available
|
||||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
|
||||
# loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
servicePort: 10254
|
||||
type: ClusterIP
|
||||
# externalTrafficPolicy: ""
|
||||
# nodePort: ""
|
||||
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
additionalLabels: {}
|
||||
|
|
@ -742,7 +666,6 @@ controller:
|
|||
targetLabels: []
|
||||
relabelings: []
|
||||
metricRelabelings: []
|
||||
|
||||
prometheusRule:
|
||||
enabled: false
|
||||
additionalLabels: {}
|
||||
|
|
@ -781,7 +704,6 @@ controller:
|
|||
# annotations:
|
||||
# description: Too many 4XXs
|
||||
# summary: More than 5% of all requests returned 4XX, this requires your attention
|
||||
|
||||
# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:
|
||||
# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds
|
||||
# to 300, allowing the draining of connections up to five minutes.
|
||||
|
|
@ -794,19 +716,15 @@ controller:
|
|||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
|
||||
priorityClassName: ""
|
||||
|
||||
# -- Rollback limit
|
||||
##
|
||||
revisionHistoryLimit: 10
|
||||
|
||||
## Default 404 backend
|
||||
##
|
||||
defaultBackend:
|
||||
##
|
||||
enabled: false
|
||||
|
||||
name: defaultbackend
|
||||
image:
|
||||
registry: registry.k8s.io
|
||||
|
|
@ -821,21 +739,16 @@ defaultBackend:
|
|||
runAsNonRoot: true
|
||||
readOnlyRootFilesystem: true
|
||||
allowPrivilegeEscalation: false
|
||||
|
||||
# -- Use an existing PSP instead of creating one
|
||||
existingPsp: ""
|
||||
|
||||
extraArgs: {}
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: ""
|
||||
automountServiceAccountToken: true
|
||||
# -- Additional environment variables to set for defaultBackend pods
|
||||
extraEnvs: []
|
||||
|
||||
port: 8080
|
||||
|
||||
## Readiness and liveness probes for default backend
|
||||
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
|
||||
##
|
||||
|
|
@ -851,7 +764,6 @@ defaultBackend:
|
|||
periodSeconds: 5
|
||||
successThreshold: 1
|
||||
timeoutSeconds: 5
|
||||
|
||||
# -- The update strategy to apply to the Deployment or DaemonSet
|
||||
##
|
||||
updateStrategy: {}
|
||||
|
|
@ -862,7 +774,6 @@ defaultBackend:
|
|||
# -- `minReadySeconds` to avoid killing pods before we are ready
|
||||
##
|
||||
minReadySeconds: 0
|
||||
|
||||
# -- Node tolerations for server scheduling to nodes with taints
|
||||
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
|
||||
##
|
||||
|
|
@ -873,19 +784,16 @@ defaultBackend:
|
|||
# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
|
||||
|
||||
affinity: {}
|
||||
|
||||
# -- Security Context policies for controller pods
|
||||
# See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
|
||||
# notes on enabling and using sysctls
|
||||
##
|
||||
podSecurityContext: {}
|
||||
|
||||
# -- Security Context policies for controller main container.
|
||||
# See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
|
||||
# notes on enabling and using sysctls
|
||||
##
|
||||
containerSecurityContext: {}
|
||||
|
||||
# -- Labels to add to the pod container metadata
|
||||
podLabels: {}
|
||||
# key: value
|
||||
|
|
@ -895,15 +803,11 @@ defaultBackend:
|
|||
##
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
|
||||
# -- Annotations to be added to default backend pods
|
||||
##
|
||||
podAnnotations: {}
|
||||
|
||||
replicaCount: 1
|
||||
|
||||
minAvailable: 1
|
||||
|
||||
resources: {}
|
||||
# limits:
|
||||
# cpu: 10m
|
||||
|
|
@ -929,43 +833,35 @@ defaultBackend:
|
|||
maxReplicas: 2
|
||||
targetCPUUtilizationPercentage: 50
|
||||
targetMemoryUtilizationPercentage: 50
|
||||
|
||||
service:
|
||||
annotations: {}
|
||||
|
||||
# clusterIP: ""
|
||||
|
||||
# -- List of IP addresses at which the default backend service is available
|
||||
## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
|
||||
##
|
||||
externalIPs: []
|
||||
|
||||
# loadBalancerIP: ""
|
||||
loadBalancerSourceRanges: []
|
||||
servicePort: 80
|
||||
type: ClusterIP
|
||||
|
||||
priorityClassName: ""
|
||||
# -- Labels to be added to the default backend resources
|
||||
labels: {}
|
||||
|
||||
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
|
||||
rbac:
|
||||
create: true
|
||||
scope: false
|
||||
|
||||
## If true, create & use Pod Security Policy resources
|
||||
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
|
||||
podSecurityPolicy:
|
||||
enabled: false
|
||||
|
||||
serviceAccount:
|
||||
create: true
|
||||
name: ""
|
||||
automountServiceAccountToken: true
|
||||
# -- Annotations for the controller service account
|
||||
annotations: {}
|
||||
|
||||
# -- Optional array of imagePullSecrets containing private registry credentials
|
||||
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
|
||||
imagePullSecrets: []
|
||||
|
|
@ -986,7 +882,6 @@ udp: {}
|
|||
# -- Prefix for TCP and UDP ports names in ingress controller service
|
||||
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
|
||||
portNamePrefix: ""
|
||||
|
||||
# -- (string) A base64-encoded Diffie-Hellman parameter.
|
||||
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
|
||||
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -343,7 +328,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -359,7 +344,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -392,7 +377,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -415,7 +400,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -455,7 +440,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -527,7 +512,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -538,7 +523,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -574,7 +559,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -585,7 +570,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -623,7 +608,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -636,7 +621,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -350,7 +335,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -368,7 +353,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -401,7 +386,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -424,7 +409,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -464,7 +449,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -539,7 +524,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -550,7 +535,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -586,7 +571,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -597,7 +582,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -635,7 +620,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -648,7 +633,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -343,7 +328,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -355,7 +340,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -387,7 +372,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -410,7 +395,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -449,7 +434,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -521,7 +506,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -532,7 +517,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -568,7 +553,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -579,7 +564,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -617,7 +602,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -630,7 +615,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -343,7 +328,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -355,7 +340,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -388,7 +373,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -411,7 +396,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -451,7 +436,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -523,7 +508,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -534,7 +519,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -570,7 +555,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -581,7 +566,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -619,7 +604,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -632,7 +617,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -344,7 +329,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -358,7 +343,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -391,7 +376,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -414,7 +399,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -454,7 +439,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -526,7 +511,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -537,7 +522,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -573,7 +558,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -584,7 +569,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -622,7 +607,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -635,7 +620,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -343,7 +328,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -364,7 +349,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -397,7 +382,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -420,7 +405,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -460,7 +445,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -532,7 +517,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -543,7 +528,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -579,7 +564,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -590,7 +575,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -628,7 +613,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -641,7 +626,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -343,7 +328,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -355,7 +340,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -387,7 +372,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -410,7 +395,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -455,7 +440,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -537,7 +522,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -548,7 +533,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -584,7 +569,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -595,7 +580,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -633,7 +618,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -646,7 +631,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -27,7 +27,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -39,7 +39,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -90,21 +90,6 @@ rules:
|
|||
- get
|
||||
- list
|
||||
- watch
|
||||
- apiGroups:
|
||||
- ""
|
||||
resourceNames:
|
||||
- ingress-nginx-leader
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- configmaps
|
||||
verbs:
|
||||
- create
|
||||
- apiGroups:
|
||||
- coordination.k8s.io
|
||||
resourceNames:
|
||||
|
|
@ -144,7 +129,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
|
|
@ -163,7 +148,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -245,7 +230,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
|
|
@ -264,7 +249,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -284,7 +269,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
|
|
@ -303,7 +288,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -322,7 +307,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
|
|
@ -344,7 +329,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
---
|
||||
|
|
@ -358,7 +343,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -391,7 +376,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -414,7 +399,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-controller
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -454,7 +439,7 @@ spec:
|
|||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.5.1@sha256:4ba73c697770664c1e00e9f968de14e08f606ff961c76e5d7033a4a9c593c629
|
||||
image: registry.k8s.io/ingress-nginx/controller:v1.6.3@sha256:b92667e0afde1103b736e6a3f00dd75ae66eec4e71827d19f19f471699e909d2
|
||||
imagePullPolicy: IfNotPresent
|
||||
lifecycle:
|
||||
preStop:
|
||||
|
|
@ -526,7 +511,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -537,7 +522,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -573,7 +558,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: ingress-nginx
|
||||
spec:
|
||||
|
|
@ -584,7 +569,7 @@ spec:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
|
|
@ -622,7 +607,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: nginx
|
||||
spec:
|
||||
controller: k8s.io/ingress-nginx
|
||||
|
|
@ -635,7 +620,7 @@ metadata:
|
|||
app.kubernetes.io/instance: ingress-nginx
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
app.kubernetes.io/version: 1.5.1
|
||||
app.kubernetes.io/version: 1.6.3
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
|
|
|
|||
|
|
@ -62,7 +62,7 @@ It will install the controller in the `ingress-nginx` namespace, creating that n
|
|||
**If you don't have Helm** or if you prefer to use a YAML manifest, you can run the following command instead:
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml
|
||||
```
|
||||
|
||||
!!! info
|
||||
|
|
@ -225,7 +225,7 @@ In AWS, we use a Network load balancer (NLB) to expose the NGINX Ingress control
|
|||
##### Network Load Balancer (NLB)
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/aws/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/deploy.yaml
|
||||
```
|
||||
|
||||
##### TLS termination in AWS Load Balancer (NLB)
|
||||
|
|
@ -233,10 +233,10 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont
|
|||
By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer.
|
||||
This section explains how to do that on AWS using an NLB.
|
||||
|
||||
1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template
|
||||
1. Download the [deploy.yaml](https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml) template
|
||||
|
||||
```console
|
||||
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml
|
||||
wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml
|
||||
```
|
||||
|
||||
2. Edit the file and change the VPC CIDR in use for the Kubernetes cluster:
|
||||
|
|
@ -282,7 +282,7 @@ Then, the ingress controller can be installed like this:
|
|||
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml
|
||||
```
|
||||
|
||||
!!! warning
|
||||
|
|
@ -299,7 +299,7 @@ Proxy-protocol is supported in GCE check the [Official Documentations on how to
|
|||
#### Azure
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml
|
||||
```
|
||||
|
||||
More information with regard to Azure annotations for ingress controller can be found in the [official AKS documentation](https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller).
|
||||
|
|
@ -307,7 +307,7 @@ More information with regard to Azure annotations for ingress controller can be
|
|||
#### Digital Ocean
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/do/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/do/deploy.yaml
|
||||
```
|
||||
- By default the service object of the ingress-nginx-controller for Digital-Ocean, only configures one annotation. Its this one `service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true"`. While this makes the service functional, it was reported that the Digital-Ocean LoadBalancer graphs shows `no data`, unless a few other annotations are also configured. Some of these other annotations require values that can not be generic and hence not forced in a out-of-the-box installation. These annotations and a discussion on them is well documented in [this issue](https://github.com/kubernetes/ingress-nginx/issues/8965). Please refer to the issue to add annotations, with values specific to user, to get graphs of the DO-LB populated with data.
|
||||
|
||||
|
|
@ -315,7 +315,7 @@ kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/cont
|
|||
#### Scaleway
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/scw/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/scw/deploy.yaml
|
||||
```
|
||||
|
||||
#### Exoscale
|
||||
|
|
@ -330,7 +330,7 @@ The full list of annotations supported by Exoscale is available in the Exoscale
|
|||
#### Oracle Cloud Infrastructure
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/cloud/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/cloud/deploy.yaml
|
||||
```
|
||||
|
||||
A
|
||||
|
|
@ -357,7 +357,7 @@ For quick testing, you can use a
|
|||
This should work on almost every cluster, but it will typically use a port in the range 30000-32767.
|
||||
|
||||
```console
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.5.1/deploy/static/provider/baremetal/deploy.yaml
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.6.3/deploy/static/provider/baremetal/deploy.yaml
|
||||
```
|
||||
|
||||
For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range),
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -25,200 +25,198 @@ data:
|
|||
|
||||
The following table shows a configuration option's name, type, and the default value:
|
||||
|
||||
| name | type | default |
|
||||
|:--------------------------------------------------------------------------------|:-------------|:-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| [add-headers](#add-headers) | string | "" |
|
||||
| [allow-backend-server-header](#allow-backend-server-header) | bool | "false" |
|
||||
| [allow-snippet-annotations](#allow-snippet-annotations) | bool | true |
|
||||
| [annotation-value-word-blocklist](#annotation-value-word-blocklist) | string array | "" |
|
||||
| [hide-headers](#hide-headers) | string array | empty |
|
||||
| [access-log-params](#access-log-params) | string | "" |
|
||||
| [access-log-path](#access-log-path) | string | "/var/log/nginx/access.log" |
|
||||
| [http-access-log-path](#http-access-log-path) | string | "" |
|
||||
| [stream-access-log-path](#stream-access-log-path) | string | "" |
|
||||
| [enable-access-log-for-default-backend](#enable-access-log-for-default-backend) | bool | "false" |
|
||||
| [error-log-path](#error-log-path) | string | "/var/log/nginx/error.log" |
|
||||
| [enable-modsecurity](#enable-modsecurity) | bool | "false" |
|
||||
| [modsecurity-snippet](#modsecurity-snippet) | string | "" |
|
||||
| [enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs) | bool | "false" |
|
||||
| [client-header-buffer-size](#client-header-buffer-size) | string | "1k" |
|
||||
| [client-header-timeout](#client-header-timeout) | int | 60 |
|
||||
| [client-body-buffer-size](#client-body-buffer-size) | string | "8k" |
|
||||
| [client-body-timeout](#client-body-timeout) | int | 60 |
|
||||
| [disable-access-log](#disable-access-log) | bool | false |
|
||||
| [disable-ipv6](#disable-ipv6) | bool | false |
|
||||
| [disable-ipv6-dns](#disable-ipv6-dns) | bool | false |
|
||||
| [enable-underscores-in-headers](#enable-underscores-in-headers) | bool | false |
|
||||
| [enable-ocsp](#enable-ocsp) | bool | false |
|
||||
| [ignore-invalid-headers](#ignore-invalid-headers) | bool | true |
|
||||
| [retry-non-idempotent](#retry-non-idempotent) | bool | "false" |
|
||||
| [error-log-level](#error-log-level) | string | "notice" |
|
||||
| [http2-max-field-size](#http2-max-field-size) | string | "4k" |
|
||||
| [http2-max-header-size](#http2-max-header-size) | string | "16k" |
|
||||
| [http2-max-requests](#http2-max-requests) | int | 1000 |
|
||||
| [http2-max-concurrent-streams](#http2-max-concurrent-streams) | int | 128 |
|
||||
| [hsts](#hsts) | bool | "true" |
|
||||
| [hsts-include-subdomains](#hsts-include-subdomains) | bool | "true" |
|
||||
| [hsts-max-age](#hsts-max-age) | string | "15724800" |
|
||||
| [hsts-preload](#hsts-preload) | bool | "false" |
|
||||
| [keep-alive](#keep-alive) | int | 75 |
|
||||
| [keep-alive-requests](#keep-alive-requests) | int | 1000 |
|
||||
| [large-client-header-buffers](#large-client-header-buffers) | string | "4 8k" |
|
||||
| [log-format-escape-none](#log-format-escape-none) | bool | "false" |
|
||||
| [log-format-escape-json](#log-format-escape-json) | bool | "false" |
|
||||
| [log-format-upstream](#log-format-upstream) | string | `$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id` |
|
||||
| [log-format-stream](#log-format-stream) | string | `[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time` |
|
||||
| [enable-multi-accept](#enable-multi-accept) | bool | "true" |
|
||||
| [max-worker-connections](#max-worker-connections) | int | 16384 |
|
||||
| [max-worker-open-files](#max-worker-open-files) | int | 0 |
|
||||
| [map-hash-bucket-size](#max-hash-bucket-size) | int | 64 |
|
||||
| [nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist) | []string | "127.0.0.1" |
|
||||
| [nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist) | []string | "::1" |
|
||||
| [proxy-real-ip-cidr](#proxy-real-ip-cidr) | []string | "0.0.0.0/0" |
|
||||
| [proxy-set-headers](#proxy-set-headers) | string | "" |
|
||||
| [server-name-hash-max-size](#server-name-hash-max-size) | int | 1024 |
|
||||
| [server-name-hash-bucket-size](#server-name-hash-bucket-size) | int | `<size of the processor’s cache line>` |
|
||||
| [proxy-headers-hash-max-size](#proxy-headers-hash-max-size) | int | 512 |
|
||||
| [proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size) | int | 64 |
|
||||
| [plugins](#plugins) | []string | |
|
||||
| [reuse-port](#reuse-port) | bool | "true" |
|
||||
| [server-tokens](#server-tokens) | bool | "false" |
|
||||
| [ssl-ciphers](#ssl-ciphers) | string | "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384" |
|
||||
| [ssl-ecdh-curve](#ssl-ecdh-curve) | string | "auto" |
|
||||
| [ssl-dh-param](#ssl-dh-param) | string | "" |
|
||||
| [ssl-protocols](#ssl-protocols) | string | "TLSv1.2 TLSv1.3" |
|
||||
| [ssl-session-cache](#ssl-session-cache) | bool | "true" |
|
||||
| [ssl-session-cache-size](#ssl-session-cache-size) | string | "10m" |
|
||||
| [ssl-session-tickets](#ssl-session-tickets) | bool | "false" |
|
||||
| [ssl-session-ticket-key](#ssl-session-ticket-key) | string | `<Randomly Generated>` |
|
||||
| [ssl-session-timeout](#ssl-session-timeout) | string | "10m" |
|
||||
| [ssl-buffer-size](#ssl-buffer-size) | string | "4k" |
|
||||
| [use-proxy-protocol](#use-proxy-protocol) | bool | "false" |
|
||||
| [proxy-protocol-header-timeout](#proxy-protocol-header-timeout) | string | "5s" |
|
||||
| [use-gzip](#use-gzip) | bool | "false" |
|
||||
| [use-geoip](#use-geoip) | bool | "true" |
|
||||
| [use-geoip2](#use-geoip2) | bool | "false" |
|
||||
| [enable-brotli](#enable-brotli) | bool | "false" |
|
||||
| [brotli-level](#brotli-level) | int | 4 |
|
||||
| [brotli-min-length](#brotli-min-length) | int | 20 |
|
||||
| [brotli-types](#brotli-types) | string | "application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component" |
|
||||
| [use-http2](#use-http2) | bool | "true" |
|
||||
| [gzip-disable](#gzip-disable) | string | "" |
|
||||
| [gzip-level](#gzip-level) | int | 1 |
|
||||
| [gzip-min-length](#gzip-min-length) | int | 256 |
|
||||
| [gzip-types](#gzip-types) | string | "application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component" |
|
||||
| [worker-processes](#worker-processes) | string | `<Number of CPUs>` |
|
||||
| [worker-cpu-affinity](#worker-cpu-affinity) | string | "" |
|
||||
| [worker-shutdown-timeout](#worker-shutdown-timeout) | string | "240s" |
|
||||
| [load-balance](#load-balance) | string | "round_robin" |
|
||||
| [variables-hash-bucket-size](#variables-hash-bucket-size) | int | 128 |
|
||||
| [variables-hash-max-size](#variables-hash-max-size) | int | 2048 |
|
||||
| [upstream-keepalive-connections](#upstream-keepalive-connections) | int | 320 |
|
||||
| [upstream-keepalive-time](#upstream-keepalive-time) | string | "1h" |
|
||||
| [upstream-keepalive-timeout](#upstream-keepalive-timeout) | int | 60 |
|
||||
| [upstream-keepalive-requests](#upstream-keepalive-requests) | int | 10000 |
|
||||
| [limit-conn-zone-variable](#limit-conn-zone-variable) | string | "$binary_remote_addr" |
|
||||
| [proxy-stream-timeout](#proxy-stream-timeout) | string | "600s" |
|
||||
| [proxy-stream-next-upstream](#proxy-stream-next-upstream) | bool | "true" |
|
||||
| [proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout) | string | "600s" |
|
||||
| [proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries) | int | 3 |
|
||||
| [proxy-stream-responses](#proxy-stream-responses) | int | 1 |
|
||||
| [bind-address](#bind-address) | []string | "" |
|
||||
| [use-forwarded-headers](#use-forwarded-headers) | bool | "false" |
|
||||
| [enable-real-ip](#enable-real-ip) | bool | "false" |
|
||||
| [forwarded-for-header](#forwarded-for-header) | string | "X-Forwarded-For" |
|
||||
| [compute-full-forwarded-for](#compute-full-forwarded-for) | bool | "false" |
|
||||
| [proxy-add-original-uri-header](#proxy-add-original-uri-header) | bool | "false" |
|
||||
| [generate-request-id](#generate-request-id) | bool | "true" |
|
||||
| [enable-opentracing](#enable-opentracing) | bool | "false" |
|
||||
| [opentracing-operation-name](#opentracing-operation-name) | string | "" |
|
||||
| [opentracing-location-operation-name](#opentracing-location-operation-name) | string | "" |
|
||||
| [zipkin-collector-host](#zipkin-collector-host) | string | "" |
|
||||
| [zipkin-collector-port](#zipkin-collector-port) | int | 9411 |
|
||||
| [zipkin-service-name](#zipkin-service-name) | string | "nginx" |
|
||||
| [zipkin-sample-rate](#zipkin-sample-rate) | float | 1.0 |
|
||||
| [jaeger-collector-host](#jaeger-collector-host) | string | "" |
|
||||
| [jaeger-collector-port](#jaeger-collector-port) | int | 6831 |
|
||||
| [jaeger-endpoint](#jaeger-endpoint) | string | "" |
|
||||
| [jaeger-service-name](#jaeger-service-name) | string | "nginx" |
|
||||
| [jaeger-propagation-format](#jaeger-propagation-format) | string | "jaeger" |
|
||||
| [jaeger-sampler-type](#jaeger-sampler-type) | string | "const" |
|
||||
| [jaeger-sampler-param](#jaeger-sampler-param) | string | "1" |
|
||||
| [jaeger-sampler-host](#jaeger-sampler-host) | string | "http://127.0.0.1" |
|
||||
| [jaeger-sampler-port](#jaeger-sampler-port) | int | 5778 |
|
||||
| [jaeger-trace-context-header-name](#jaeger-trace-context-header-name) | string | uber-trace-id |
|
||||
| [jaeger-debug-header](#jaeger-debug-header) | string | uber-debug-id |
|
||||
| [jaeger-baggage-header](#jaeger-baggage-header) | string | jaeger-baggage |
|
||||
| [jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix) | string | uberctx- |
|
||||
| [datadog-collector-host](#datadog-collector-host) | string | "" |
|
||||
| [datadog-collector-port](#datadog-collector-port) | int | 8126 |
|
||||
| [datadog-service-name](#datadog-service-name) | string | "nginx" |
|
||||
| [datadog-environment](#datadog-environment) | string | "prod" |
|
||||
| [datadog-operation-name-override](#datadog-operation-name-override) | string | "nginx.handle" |
|
||||
| [datadog-priority-sampling](#datadog-priority-sampling) | bool | "true" |
|
||||
| [datadog-sample-rate](#datadog-sample-rate) | float | 1.0 |
|
||||
| [main-snippet](#main-snippet) | string | "" |
|
||||
| [http-snippet](#http-snippet) | string | "" |
|
||||
| [server-snippet](#server-snippet) | string | "" |
|
||||
| [stream-snippet](#stream-snippet) | string | "" |
|
||||
| [location-snippet](#location-snippet) | string | "" |
|
||||
| [custom-http-errors](#custom-http-errors) | []int | []int{} |
|
||||
| [disable-proxy-intercept-errors](#disable-proxy-intercept-errors) | bool |"false" |
|
||||
| [proxy-body-size](#proxy-body-size) | string | "1m" |
|
||||
| [proxy-connect-timeout](#proxy-connect-timeout) | int | 5 |
|
||||
| [proxy-read-timeout](#proxy-read-timeout) | int | 60 |
|
||||
| [proxy-send-timeout](#proxy-send-timeout) | int | 60 |
|
||||
| [proxy-buffers-number](#proxy-buffers-number) | int | 4 |
|
||||
| [proxy-buffer-size](#proxy-buffer-size) | string | "4k" |
|
||||
| [proxy-cookie-path](#proxy-cookie-path) | string | "off" |
|
||||
| [proxy-cookie-domain](#proxy-cookie-domain) | string | "off" |
|
||||
| [proxy-next-upstream](#proxy-next-upstream) | string | "error timeout" |
|
||||
| [proxy-next-upstream-timeout](#proxy-next-upstream-timeout) | int | 0 |
|
||||
| [proxy-next-upstream-tries](#proxy-next-upstream-tries) | int | 3 |
|
||||
| [proxy-redirect-from](#proxy-redirect-from) | string | "off" |
|
||||
| [proxy-request-buffering](#proxy-request-buffering) | string | "on" |
|
||||
| [ssl-redirect](#ssl-redirect) | bool | "true" |
|
||||
| [force-ssl-redirect](#force-ssl-redirect) | bool | "false" |
|
||||
| [denylist-source-range](#denylist-source-range) | []string | []string{} |
|
||||
| [whitelist-source-range](#whitelist-source-range) | []string | []string{} |
|
||||
| [skip-access-log-urls](#skip-access-log-urls) | []string | []string{} |
|
||||
| [limit-rate](#limit-rate) | int | 0 |
|
||||
| [limit-rate-after](#limit-rate-after) | int | 0 |
|
||||
| [lua-shared-dicts](#lua-shared-dicts) | string | "" |
|
||||
| [http-redirect-code](#http-redirect-code) | int | 308 |
|
||||
| [proxy-buffering](#proxy-buffering) | string | "off" |
|
||||
| [limit-req-status-code](#limit-req-status-code) | int | 503 |
|
||||
| [limit-conn-status-code](#limit-conn-status-code) | int | 503 |
|
||||
| [enable-syslog](#enable-syslog) | bool | false |
|
||||
| [syslog-host](#syslog-host) | string | "" |
|
||||
| [syslog-port](#syslog-port) | int | 514 |
|
||||
| [no-tls-redirect-locations](#no-tls-redirect-locations) | string | "/.well-known/acme-challenge" |
|
||||
| [global-auth-url](#global-auth-url) | string | "" |
|
||||
| [global-auth-method](#global-auth-method) | string | "" |
|
||||
| [global-auth-signin](#global-auth-signin) | string | "" |
|
||||
| [global-auth-signin-redirect-param](#global-auth-signin-redirect-param) | string | "rd" |
|
||||
| [global-auth-response-headers](#global-auth-response-headers) | string | "" |
|
||||
| [global-auth-request-redirect](#global-auth-request-redirect) | string | "" |
|
||||
| [global-auth-snippet](#global-auth-snippet) | string | "" |
|
||||
| [global-auth-cache-key](#global-auth-cache-key) | string | "" |
|
||||
| [global-auth-cache-duration](#global-auth-cache-duration) | string | "200 202 401 5m" |
|
||||
| [no-auth-locations](#no-auth-locations) | string | "/.well-known/acme-challenge" |
|
||||
| [block-cidrs](#block-cidrs) | []string | "" |
|
||||
| [block-user-agents](#block-user-agents) | []string | "" |
|
||||
| [block-referers](#block-referers) | []string | "" |
|
||||
| [proxy-ssl-location-only](#proxy-ssl-location-only) | bool | "false" |
|
||||
| [default-type](#default-type) | string | "text/html" |
|
||||
| [global-rate-limit-memcached-host](#global-rate-limit) | string | "" |
|
||||
| [global-rate-limit-memcached-port](#global-rate-limit) | int | 11211 |
|
||||
| [global-rate-limit-memcached-connect-timeout](#global-rate-limit) | int | 50 |
|
||||
| [global-rate-limit-memcached-max-idle-timeout](#global-rate-limit) | int | 10000 |
|
||||
| [global-rate-limit-memcached-pool-size](#global-rate-limit) | int | 50 |
|
||||
| [global-rate-limit-status-code](#global-rate-limit) | int | 429 |
|
||||
| [service-upstream](#service-upstream) | bool | "false" |
|
||||
| [ssl-reject-handshake](#ssl-reject-handshake) | bool | "false" |
|
||||
| [debug-connections](#debug-connections) | []string | "127.0.0.1,1.1.1.1/24" |
|
||||
| [enable-pathtype-validation](#enable-pathtype-validation) | bool | "false" |
|
||||
| [path-additional-allowed-chars](#path-additional-allowed-chars) | string | "^%$[](){}*+?" |
|
||||
|name|type|default|
|
||||
|:---|:---|:------|
|
||||
|[add-headers](#add-headers)|string|""|
|
||||
|[allow-backend-server-header](#allow-backend-server-header)|bool|"false"|
|
||||
|[allow-snippet-annotations](#allow-snippet-annotations)|bool|true|
|
||||
|[annotation-value-word-blocklist](#annotation-value-word-blocklist)|string array|""|
|
||||
|[hide-headers](#hide-headers)|string array|empty|
|
||||
|[access-log-params](#access-log-params)|string|""|
|
||||
|[access-log-path](#access-log-path)|string|"/var/log/nginx/access.log"|
|
||||
|[http-access-log-path](#http-access-log-path)|string|""|
|
||||
|[stream-access-log-path](#stream-access-log-path)|string|""|
|
||||
|[enable-access-log-for-default-backend](#enable-access-log-for-default-backend)|bool|"false"|
|
||||
|[error-log-path](#error-log-path)|string|"/var/log/nginx/error.log"|
|
||||
|[enable-modsecurity](#enable-modsecurity)|bool|"false"|
|
||||
|[modsecurity-snippet](#modsecurity-snippet)|string|""|
|
||||
|[enable-owasp-modsecurity-crs](#enable-owasp-modsecurity-crs)|bool|"false"|
|
||||
|[client-header-buffer-size](#client-header-buffer-size)|string|"1k"|
|
||||
|[client-header-timeout](#client-header-timeout)|int|60|
|
||||
|[client-body-buffer-size](#client-body-buffer-size)|string|"8k"|
|
||||
|[client-body-timeout](#client-body-timeout)|int|60|
|
||||
|[disable-access-log](#disable-access-log)|bool|false|
|
||||
|[disable-ipv6](#disable-ipv6)|bool|false|
|
||||
|[disable-ipv6-dns](#disable-ipv6-dns)|bool|false|
|
||||
|[enable-underscores-in-headers](#enable-underscores-in-headers)|bool|false|
|
||||
|[enable-ocsp](#enable-ocsp)|bool|false|
|
||||
|[ignore-invalid-headers](#ignore-invalid-headers)|bool|true|
|
||||
|[retry-non-idempotent](#retry-non-idempotent)|bool|"false"|
|
||||
|[error-log-level](#error-log-level)|string|"notice"|
|
||||
|[http2-max-field-size](#http2-max-field-size)|string|"4k"|
|
||||
|[http2-max-header-size](#http2-max-header-size)|string|"16k"|
|
||||
|[http2-max-requests](#http2-max-requests)|int|1000|
|
||||
|[http2-max-concurrent-streams](#http2-max-concurrent-streams)|int|128|
|
||||
|[hsts](#hsts)|bool|"true"|
|
||||
|[hsts-include-subdomains](#hsts-include-subdomains)|bool|"true"|
|
||||
|[hsts-max-age](#hsts-max-age)|string|"15724800"|
|
||||
|[hsts-preload](#hsts-preload)|bool|"false"|
|
||||
|[keep-alive](#keep-alive)|int|75|
|
||||
|[keep-alive-requests](#keep-alive-requests)|int|1000|
|
||||
|[large-client-header-buffers](#large-client-header-buffers)|string|"4 8k"|
|
||||
|[log-format-escape-none](#log-format-escape-none)|bool|"false"|
|
||||
|[log-format-escape-json](#log-format-escape-json)|bool|"false"|
|
||||
|[log-format-upstream](#log-format-upstream)|string|`$remote_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" $request_length $request_time [$proxy_upstream_name] [$proxy_alternative_upstream_name] $upstream_addr $upstream_response_length $upstream_response_time $upstream_status $req_id`|
|
||||
|[log-format-stream](#log-format-stream)|string|`[$remote_addr] [$time_local] $protocol $status $bytes_sent $bytes_received $session_time`|
|
||||
|[enable-multi-accept](#enable-multi-accept)|bool|"true"|
|
||||
|[max-worker-connections](#max-worker-connections)|int|16384|
|
||||
|[max-worker-open-files](#max-worker-open-files)|int|0|
|
||||
|[map-hash-bucket-size](#max-hash-bucket-size)|int|64|
|
||||
|[nginx-status-ipv4-whitelist](#nginx-status-ipv4-whitelist)|[]string|"127.0.0.1"|
|
||||
|[nginx-status-ipv6-whitelist](#nginx-status-ipv6-whitelist)|[]string|"::1"|
|
||||
|[proxy-real-ip-cidr](#proxy-real-ip-cidr)|[]string|"0.0.0.0/0"|
|
||||
|[proxy-set-headers](#proxy-set-headers)|string|""|
|
||||
|[server-name-hash-max-size](#server-name-hash-max-size)|int|1024|
|
||||
|[server-name-hash-bucket-size](#server-name-hash-bucket-size)|int|`<size of the processor’s cache line>`
|
||||
|[proxy-headers-hash-max-size](#proxy-headers-hash-max-size)|int|512|
|
||||
|[proxy-headers-hash-bucket-size](#proxy-headers-hash-bucket-size)|int|64|
|
||||
|[plugins](#plugins)|[]string| |
|
||||
|[reuse-port](#reuse-port)|bool|"true"|
|
||||
|[server-tokens](#server-tokens)|bool|"false"|
|
||||
|[ssl-ciphers](#ssl-ciphers)|string|"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384"|
|
||||
|[ssl-ecdh-curve](#ssl-ecdh-curve)|string|"auto"|
|
||||
|[ssl-dh-param](#ssl-dh-param)|string|""|
|
||||
|[ssl-protocols](#ssl-protocols)|string|"TLSv1.2 TLSv1.3"|
|
||||
|[ssl-session-cache](#ssl-session-cache)|bool|"true"|
|
||||
|[ssl-session-cache-size](#ssl-session-cache-size)|string|"10m"|
|
||||
|[ssl-session-tickets](#ssl-session-tickets)|bool|"false"|
|
||||
|[ssl-session-ticket-key](#ssl-session-ticket-key)|string|`<Randomly Generated>`
|
||||
|[ssl-session-timeout](#ssl-session-timeout)|string|"10m"|
|
||||
|[ssl-buffer-size](#ssl-buffer-size)|string|"4k"|
|
||||
|[use-proxy-protocol](#use-proxy-protocol)|bool|"false"|
|
||||
|[proxy-protocol-header-timeout](#proxy-protocol-header-timeout)|string|"5s"|
|
||||
|[use-gzip](#use-gzip)|bool|"false"|
|
||||
|[use-geoip](#use-geoip)|bool|"true"|
|
||||
|[use-geoip2](#use-geoip2)|bool|"false"|
|
||||
|[enable-brotli](#enable-brotli)|bool|"false"|
|
||||
|[brotli-level](#brotli-level)|int|4|
|
||||
|[brotli-min-length](#brotli-min-length)|int|20|
|
||||
|[brotli-types](#brotli-types)|string|"application/xml+rss application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"|
|
||||
|[use-http2](#use-http2)|bool|"true"|
|
||||
|[gzip-disable](#gzip-disable)|string|""|
|
||||
|[gzip-level](#gzip-level)|int|1|
|
||||
|[gzip-min-length](#gzip-min-length)|int|256|
|
||||
|[gzip-types](#gzip-types)|string|"application/atom+xml application/javascript application/x-javascript application/json application/rss+xml application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/svg+xml image/x-icon text/css text/javascript text/plain text/x-component"|
|
||||
|[worker-processes](#worker-processes)|string|`<Number of CPUs>`|
|
||||
|[worker-cpu-affinity](#worker-cpu-affinity)|string|""|
|
||||
|[worker-shutdown-timeout](#worker-shutdown-timeout)|string|"240s"|
|
||||
|[load-balance](#load-balance)|string|"round_robin"|
|
||||
|[variables-hash-bucket-size](#variables-hash-bucket-size)|int|128|
|
||||
|[variables-hash-max-size](#variables-hash-max-size)|int|2048|
|
||||
|[upstream-keepalive-connections](#upstream-keepalive-connections)|int|320|
|
||||
|[upstream-keepalive-time](#upstream-keepalive-time)|string|"1h"|
|
||||
|[upstream-keepalive-timeout](#upstream-keepalive-timeout)|int|60|
|
||||
|[upstream-keepalive-requests](#upstream-keepalive-requests)|int|10000|
|
||||
|[limit-conn-zone-variable](#limit-conn-zone-variable)|string|"$binary_remote_addr"|
|
||||
|[proxy-stream-timeout](#proxy-stream-timeout)|string|"600s"|
|
||||
|[proxy-stream-next-upstream](#proxy-stream-next-upstream)|bool|"true"|
|
||||
|[proxy-stream-next-upstream-timeout](#proxy-stream-next-upstream-timeout)|string|"600s"|
|
||||
|[proxy-stream-next-upstream-tries](#proxy-stream-next-upstream-tries)|int|3|
|
||||
|[proxy-stream-responses](#proxy-stream-responses)|int|1|
|
||||
|[bind-address](#bind-address)|[]string|""|
|
||||
|[use-forwarded-headers](#use-forwarded-headers)|bool|"false"|
|
||||
|[enable-real-ip](#enable-real-ip)|bool|"false"|
|
||||
|[forwarded-for-header](#forwarded-for-header)|string|"X-Forwarded-For"|
|
||||
|[compute-full-forwarded-for](#compute-full-forwarded-for)|bool|"false"|
|
||||
|[proxy-add-original-uri-header](#proxy-add-original-uri-header)|bool|"false"|
|
||||
|[generate-request-id](#generate-request-id)|bool|"true"|
|
||||
|[enable-opentracing](#enable-opentracing)|bool|"false"|
|
||||
|[opentracing-operation-name](#opentracing-operation-name)|string|""|
|
||||
|[opentracing-location-operation-name](#opentracing-location-operation-name)|string|""|
|
||||
|[zipkin-collector-host](#zipkin-collector-host)|string|""|
|
||||
|[zipkin-collector-port](#zipkin-collector-port)|int|9411|
|
||||
|[zipkin-service-name](#zipkin-service-name)|string|"nginx"|
|
||||
|[zipkin-sample-rate](#zipkin-sample-rate)|float|1.0|
|
||||
|[jaeger-collector-host](#jaeger-collector-host)|string|""|
|
||||
|[jaeger-collector-port](#jaeger-collector-port)|int|6831|
|
||||
|[jaeger-endpoint](#jaeger-endpoint)|string|""|
|
||||
|[jaeger-service-name](#jaeger-service-name)|string|"nginx"|
|
||||
|[jaeger-propagation-format](#jaeger-propagation-format)|string|"jaeger"|
|
||||
|[jaeger-sampler-type](#jaeger-sampler-type)|string|"const"|
|
||||
|[jaeger-sampler-param](#jaeger-sampler-param)|string|"1"|
|
||||
|[jaeger-sampler-host](#jaeger-sampler-host)|string|"http://127.0.0.1"|
|
||||
|[jaeger-sampler-port](#jaeger-sampler-port)|int|5778|
|
||||
|[jaeger-trace-context-header-name](#jaeger-trace-context-header-name)|string|uber-trace-id|
|
||||
|[jaeger-debug-header](#jaeger-debug-header)|string|uber-debug-id|
|
||||
|[jaeger-baggage-header](#jaeger-baggage-header)|string|jaeger-baggage|
|
||||
|[jaeger-trace-baggage-header-prefix](#jaeger-trace-baggage-header-prefix)|string|uberctx-|
|
||||
|[datadog-collector-host](#datadog-collector-host)|string|""|
|
||||
|[datadog-collector-port](#datadog-collector-port)|int|8126|
|
||||
|[datadog-service-name](#datadog-service-name)|string|"nginx"|
|
||||
|[datadog-environment](#datadog-environment)|string|"prod"|
|
||||
|[datadog-operation-name-override](#datadog-operation-name-override)|string|"nginx.handle"|
|
||||
|[datadog-priority-sampling](#datadog-priority-sampling)|bool|"true"|
|
||||
|[datadog-sample-rate](#datadog-sample-rate)|float|1.0|
|
||||
|[main-snippet](#main-snippet)|string|""|
|
||||
|[http-snippet](#http-snippet)|string|""|
|
||||
|[server-snippet](#server-snippet)|string|""|
|
||||
|[stream-snippet](#stream-snippet)|string|""|
|
||||
|[location-snippet](#location-snippet)|string|""|
|
||||
|[custom-http-errors](#custom-http-errors)|[]int|[]int{}|
|
||||
|[disable-proxy-intercept-errors](#disable-proxy-intercept-errors)|bool|"false"|
|
||||
|[proxy-body-size](#proxy-body-size)|string|"1m"|
|
||||
|[proxy-connect-timeout](#proxy-connect-timeout)|int|5|
|
||||
|[proxy-read-timeout](#proxy-read-timeout)|int|60|
|
||||
|[proxy-send-timeout](#proxy-send-timeout)|int|60|
|
||||
|[proxy-buffers-number](#proxy-buffers-number)|int|4|
|
||||
|[proxy-buffer-size](#proxy-buffer-size)|string|"4k"|
|
||||
|[proxy-cookie-path](#proxy-cookie-path)|string|"off"|
|
||||
|[proxy-cookie-domain](#proxy-cookie-domain)|string|"off"|
|
||||
|[proxy-next-upstream](#proxy-next-upstream)|string|"error timeout"|
|
||||
|[proxy-next-upstream-timeout](#proxy-next-upstream-timeout)|int|0|
|
||||
|[proxy-next-upstream-tries](#proxy-next-upstream-tries)|int|3|
|
||||
|[proxy-redirect-from](#proxy-redirect-from)|string|"off"|
|
||||
|[proxy-request-buffering](#proxy-request-buffering)|string|"on"|
|
||||
|[ssl-redirect](#ssl-redirect)|bool|"true"|
|
||||
|[force-ssl-redirect](#force-ssl-redirect)|bool|"false"|
|
||||
|[denylist-source-range](#denylist-source-range)|[]string|[]string{}|
|
||||
|[whitelist-source-range](#whitelist-source-range)|[]string|[]string{}|
|
||||
|[skip-access-log-urls](#skip-access-log-urls)|[]string|[]string{}|
|
||||
|[limit-rate](#limit-rate)|int|0|
|
||||
|[limit-rate-after](#limit-rate-after)|int|0|
|
||||
|[lua-shared-dicts](#lua-shared-dicts)|string|""|
|
||||
|[http-redirect-code](#http-redirect-code)|int|308|
|
||||
|[proxy-buffering](#proxy-buffering)|string|"off"|
|
||||
|[limit-req-status-code](#limit-req-status-code)|int|503|
|
||||
|[limit-conn-status-code](#limit-conn-status-code)|int|503|
|
||||
|[enable-syslog](#enable-syslog)|bool|false|
|
||||
|[syslog-host](#syslog-host)|string|""|
|
||||
|[syslog-port](#syslog-port)|int|514|
|
||||
|[no-tls-redirect-locations](#no-tls-redirect-locations)|string|"/.well-known/acme-challenge"|
|
||||
|[global-auth-url](#global-auth-url)|string|""|
|
||||
|[global-auth-method](#global-auth-method)|string|""|
|
||||
|[global-auth-signin](#global-auth-signin)|string|""|
|
||||
|[global-auth-signin-redirect-param](#global-auth-signin-redirect-param)|string|"rd"|
|
||||
|[global-auth-response-headers](#global-auth-response-headers)|string|""|
|
||||
|[global-auth-request-redirect](#global-auth-request-redirect)|string|""|
|
||||
|[global-auth-snippet](#global-auth-snippet)|string|""|
|
||||
|[global-auth-cache-key](#global-auth-cache-key)|string|""|
|
||||
|[global-auth-cache-duration](#global-auth-cache-duration)|string|"200 202 401 5m"|
|
||||
|[no-auth-locations](#no-auth-locations)|string|"/.well-known/acme-challenge"|
|
||||
|[block-cidrs](#block-cidrs)|[]string|""|
|
||||
|[block-user-agents](#block-user-agents)|[]string|""|
|
||||
|[block-referers](#block-referers)|[]string|""|
|
||||
|[proxy-ssl-location-only](#proxy-ssl-location-only)|bool|"false"|
|
||||
|[default-type](#default-type)|string|"text/html"|
|
||||
|[global-rate-limit-memcached-host](#global-rate-limit)|string|""|
|
||||
|[global-rate-limit-memcached-port](#global-rate-limit)|int|11211|
|
||||
|[global-rate-limit-memcached-connect-timeout](#global-rate-limit)|int|50|
|
||||
|[global-rate-limit-memcached-max-idle-timeout](#global-rate-limit)|int|10000|
|
||||
|[global-rate-limit-memcached-pool-size](#global-rate-limit)|int|50|
|
||||
|[global-rate-limit-status-code](#global-rate-limit)|int|429|
|
||||
|[service-upstream](#service-upstream)|bool|"false"|
|
||||
|[ssl-reject-handshake](#ssl-reject-handshake)|bool|"false"|
|
||||
|[debug-connections](#debug-connections)|[]string|"127.0.0.1,1.1.1.1/24"|
|
||||
|
||||
## add-headers
|
||||
|
||||
|
|
@ -1335,22 +1333,3 @@ _**default:**_ ""
|
|||
|
||||
_References:_
|
||||
[http://nginx.org/en/docs/ngx_core_module.html#debug_connection](http://nginx.org/en/docs/ngx_core_module.html#debug_connection)
|
||||
|
||||
## enable-pathtype-validation
|
||||
Ingress Controller validates the pathType, and only allows special characters on "path" if pathType is
|
||||
ImplementationSpecific.
|
||||
|
||||
The only characters allowed on ingresses with pathType not ImplementationSpecific
|
||||
will be 0-9, a-z, A-Z, "-", ".", "_", "~", "/".
|
||||
|
||||
If the validation is disabled, the [#path-additional-allowed-chars](#path-additional-allowed-chars) will
|
||||
be allowed on any pathType.
|
||||
|
||||
This behavior is disabled by default, so special characters are accepted regardless of pathType
|
||||
_**default:**_ "false"
|
||||
|
||||
## path-additional-allowed-chars
|
||||
When [enable-pathtype-validation](enable-pathtype-validation) is set to true [#path-additional-allowed-chars](#path-additional-allowed-chars) defines the additional set of special characters that
|
||||
will be allowed.
|
||||
|
||||
_**default:**_ "^%$[](){}*+?|"
|
||||
|
|
|
|||
1
go.mod
1
go.mod
|
|
@ -77,6 +77,7 @@ require (
|
|||
github.com/inconshreveable/mousetrap v1.0.1 // indirect
|
||||
github.com/josharian/intern v1.0.0 // indirect
|
||||
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
|
||||
github.com/magefile/mage v1.14.0 // indirect
|
||||
github.com/mailru/easyjson v0.7.6 // indirect
|
||||
github.com/mattn/go-colorable v0.1.13 // indirect
|
||||
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
|
||||
|
|
|
|||
2
go.sum
2
go.sum
|
|
@ -235,6 +235,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
|
|||
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
|
||||
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
|
||||
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
|
||||
github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo=
|
||||
github.com/magefile/mage v1.14.0/go.mod h1:z5UZb/iS3GoOSn0JgWuiw7dxlurVYTu+/jHXqQg881A=
|
||||
github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
|
||||
github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
|
||||
github.com/mailru/easyjson v0.7.6 h1:8yTIVnZgCoiM1TgqoeTl+LfU5Jg6/xL3QhGQnimLYnA=
|
||||
|
|
|
|||
|
|
@ -786,18 +786,6 @@ type Configuration struct {
|
|||
// http://nginx.org/en/docs/ngx_core_module.html#debug_connection
|
||||
// Default: ""
|
||||
DebugConnections []string `json:"debug-connections"`
|
||||
|
||||
// EnablePathTypeValidation allows the admin to enable the pathType validation.
|
||||
// If EnablePathTypeValidation is enabled, the Controller will only allow alphanumeric
|
||||
// characters on path (0-9, a-z, A-Z, "-", ".", "_", "~", "/")
|
||||
// to control what characters are allowed set them with PathAdditionalAllowedChars
|
||||
EnablePathTypeValidation bool `json:"enable-pathtype-validation"`
|
||||
|
||||
// PathAdditionalAllowedChars allows the admin to specify what are the additional
|
||||
// characters allowed in case of pathType=ImplementationSpecific.
|
||||
// Case enable-pathtype-validation=true, this characters will be only allowed on ImplementationSpecific.
|
||||
// Defaults to: "^%$[](){}*+?"
|
||||
PathAdditionalAllowedChars string `json:"path-additional-allowed-chars"`
|
||||
}
|
||||
|
||||
// NewDefault returns the default nginx configuration
|
||||
|
|
@ -833,8 +821,6 @@ func NewDefault() Configuration {
|
|||
ClientHeaderTimeout: 60,
|
||||
ClientBodyBufferSize: "8k",
|
||||
ClientBodyTimeout: 60,
|
||||
EnablePathTypeValidation: false,
|
||||
PathAdditionalAllowedChars: "^%$[](){}*+?|",
|
||||
EnableUnderscoresInHeaders: false,
|
||||
ErrorLogLevel: errorLevel,
|
||||
UseForwardedHeaders: false,
|
||||
|
|
|
|||
|
|
@ -325,10 +325,6 @@ func (n *NGINXController) CheckIngress(ing *networking.Ingress) error {
|
|||
|
||||
k8s.SetDefaultNGINXPathType(ing)
|
||||
|
||||
if err := utilingress.ValidateIngressPath(ing, cfg.EnablePathTypeValidation, cfg.PathAdditionalAllowedChars); err != nil {
|
||||
return fmt.Errorf("ingress contains invalid characters: %s", err)
|
||||
}
|
||||
|
||||
allIngresses := n.store.ListIngresses()
|
||||
|
||||
filter := func(toCheck *ingress.Ingress) bool {
|
||||
|
|
|
|||
|
|
@ -201,97 +201,6 @@ func TestCheckIngress(t *testing.T) {
|
|||
},
|
||||
},
|
||||
}
|
||||
|
||||
t.Run("when validating pathType", func(t *testing.T) {
|
||||
t.Run("When ingress contains invalid path and pathType validation is enabled", func(t *testing.T) {
|
||||
nginx.store = fakeIngressStore{
|
||||
ingresses: []*ingress.Ingress{},
|
||||
configuration: ngx_config.Configuration{
|
||||
EnablePathTypeValidation: true,
|
||||
},
|
||||
}
|
||||
nginx.command = testNginxTestCommand{
|
||||
t: t,
|
||||
err: nil,
|
||||
expected: "",
|
||||
}
|
||||
nginx.cfg.IngressClassConfiguration = &ingressclass.IngressClassConfiguration{
|
||||
WatchWithoutClass: true,
|
||||
}
|
||||
ingPath := &networking.Ingress{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "test-ingress1",
|
||||
Namespace: "user-namespace1",
|
||||
Annotations: map[string]string{
|
||||
"kubernetes.io/ingress.class": "nginx",
|
||||
},
|
||||
},
|
||||
Spec: networking.IngressSpec{
|
||||
Rules: []networking.IngressRule{
|
||||
{
|
||||
Host: "example.com",
|
||||
IngressRuleValue: networking.IngressRuleValue{
|
||||
HTTP: &networking.HTTPIngressRuleValue{
|
||||
Paths: []networking.HTTPIngressPath{
|
||||
{
|
||||
Path: "/xpto/(a+)",
|
||||
PathType: &pathTypePrefix,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if nginx.CheckIngress(ingPath) == nil {
|
||||
t.Errorf("invalid path on pathTypePrefix and validation enabled should return an error")
|
||||
}
|
||||
})
|
||||
t.Run("When ingress contains invalid path and pathType validation is disabled", func(t *testing.T) {
|
||||
nginx.store = fakeIngressStore{
|
||||
ingresses: []*ingress.Ingress{},
|
||||
configuration: ngx_config.Configuration{
|
||||
EnablePathTypeValidation: false,
|
||||
PathAdditionalAllowedChars: "^%$[](){}*+?|",
|
||||
},
|
||||
}
|
||||
nginx.command = testNginxTestCommand{
|
||||
t: t,
|
||||
err: nil,
|
||||
expected: "_,example.com",
|
||||
}
|
||||
|
||||
ingPath := &networking.Ingress{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "test-ingress2",
|
||||
Namespace: "user-namespace2",
|
||||
},
|
||||
Spec: networking.IngressSpec{
|
||||
Rules: []networking.IngressRule{
|
||||
{
|
||||
Host: "example.com",
|
||||
IngressRuleValue: networking.IngressRuleValue{
|
||||
HTTP: &networking.HTTPIngressRuleValue{
|
||||
Paths: []networking.HTTPIngressPath{
|
||||
{
|
||||
Path: "/example(/|$)(.*)",
|
||||
PathType: &pathTypePrefix,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
if nginx.CheckIngress(ingPath) != nil {
|
||||
t.Errorf("invalid path on pathTypePrefix and validation disabled should not return an error: %s", nginx.CheckIngress(ingPath))
|
||||
}
|
||||
})
|
||||
})
|
||||
t.Run("when the class is the nginx one", func(t *testing.T) {
|
||||
ing.ObjectMeta.Annotations["kubernetes.io/ingress.class"] = "nginx"
|
||||
nginx.command = testNginxTestCommand{
|
||||
|
|
|
|||
|
|
@ -846,11 +846,6 @@ func (s *k8sStore) syncIngress(ing *networkingv1.Ingress) {
|
|||
copyIng := &networkingv1.Ingress{}
|
||||
ing.ObjectMeta.DeepCopyInto(©Ing.ObjectMeta)
|
||||
|
||||
if err := ingressutils.ValidateIngressPath(ing, s.backendConfig.EnablePathTypeValidation, s.backendConfig.PathAdditionalAllowedChars); err != nil {
|
||||
klog.Errorf("ingress %s contains invalid path and will be skipped: %s", key, err)
|
||||
return
|
||||
}
|
||||
|
||||
if s.backendConfig.AnnotationValueWordBlocklist != "" {
|
||||
if err := checkBadAnnotationValue(copyIng.Annotations, s.backendConfig.AnnotationValueWordBlocklist); err != nil {
|
||||
klog.Warningf("skipping ingress %s: %s", key, err)
|
||||
|
|
@ -870,6 +865,10 @@ func (s *k8sStore) syncIngress(ing *networkingv1.Ingress) {
|
|||
if path.Path == "" {
|
||||
copyIng.Spec.Rules[ri].HTTP.Paths[pi].Path = "/"
|
||||
}
|
||||
if !ingressutils.IsSafePath(copyIng, path.Path) {
|
||||
klog.Warningf("ingress %s contains invalid path %s", key, path.Path)
|
||||
return
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -180,6 +180,9 @@ func SetDefaultNGINXPathType(ing *networkingv1.Ingress) {
|
|||
p.PathType = &defaultPathType
|
||||
}
|
||||
|
||||
if *p.PathType == networkingv1.PathTypeImplementationSpecific {
|
||||
p.PathType = &defaultPathType
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -153,6 +153,9 @@ func updateChartValue(key, value string) {
|
|||
Info("HELM Ingress Nginx Helm Chart update %s %s", key, value)
|
||||
}
|
||||
|
||||
func (Helm) Helmdocs() error {
|
||||
return runHelmDocs()
|
||||
}
|
||||
func runHelmDocs() error {
|
||||
err := installHelmDocs()
|
||||
if err != nil {
|
||||
|
|
|
|||
|
|
@ -23,6 +23,7 @@ import (
|
|||
|
||||
networkingv1 "k8s.io/api/networking/v1"
|
||||
"k8s.io/apimachinery/pkg/util/sets"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
|
||||
"k8s.io/ingress-nginx/internal/k8s"
|
||||
"k8s.io/ingress-nginx/internal/net/ssl"
|
||||
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||
|
|
@ -30,15 +31,15 @@ import (
|
|||
)
|
||||
|
||||
const (
|
||||
alphaNumericChars = `A-Za-z0-9\-\.\_\~\/` // This is the default allowed set on paths
|
||||
alphaNumericChars = `\-\.\_\~a-zA-Z0-9/`
|
||||
regexEnabledChars = `\^\$\[\]\(\)\{\}\*\+`
|
||||
)
|
||||
|
||||
var (
|
||||
// pathAlphaNumeric is a regex validation that allows only (0-9, a-z, A-Z, "-", ".", "_", "~", "/")
|
||||
pathAlphaNumericRegex = regexp.MustCompile("^[" + alphaNumericChars + "]*$").MatchString
|
||||
|
||||
// default path type is Prefix to not break existing definitions
|
||||
defaultPathType = networkingv1.PathTypePrefix
|
||||
// pathAlphaNumeric is a regex validation of something like "^/[a-zA-Z]+$" on path
|
||||
pathAlphaNumeric = regexp.MustCompile("^/[" + alphaNumericChars + "]*$").MatchString
|
||||
// pathRegexEnabled is a regex validation of paths that may contain regex.
|
||||
pathRegexEnabled = regexp.MustCompile("^/[" + alphaNumericChars + regexEnabledChars + "]*$").MatchString
|
||||
)
|
||||
|
||||
func GetRemovedHosts(rucfg, newcfg *ingress.Configuration) []string {
|
||||
|
|
@ -246,68 +247,12 @@ func BuildRedirects(servers []*ingress.Server) []*redirect {
|
|||
return redirectServers
|
||||
}
|
||||
|
||||
func ValidateIngressPath(copyIng *networkingv1.Ingress, enablePathTypeValidation bool, pathAdditionalAllowedChars string) error {
|
||||
|
||||
if copyIng == nil {
|
||||
return nil
|
||||
// IsSafePath verifies if the path used in ingress object contains only valid characters.
|
||||
// It will behave differently if regex is enabled or not
|
||||
func IsSafePath(copyIng *networkingv1.Ingress, path string) bool {
|
||||
isRegex, _ := parser.GetBoolAnnotation("use-regex", copyIng)
|
||||
if isRegex {
|
||||
return pathRegexEnabled(path)
|
||||
}
|
||||
|
||||
escapedPathAdditionalAllowedChars := regexp.QuoteMeta(pathAdditionalAllowedChars)
|
||||
regexPath, err := regexp.Compile("^[" + alphaNumericChars + escapedPathAdditionalAllowedChars + "]*$")
|
||||
if err != nil {
|
||||
return fmt.Errorf("ingress has misconfigured validation regex on configmap: %s - %w", pathAdditionalAllowedChars, err)
|
||||
}
|
||||
|
||||
for _, rule := range copyIng.Spec.Rules {
|
||||
|
||||
if rule.HTTP == nil {
|
||||
continue
|
||||
}
|
||||
|
||||
if err := checkPath(rule.HTTP.Paths, enablePathTypeValidation, regexPath); err != nil {
|
||||
return fmt.Errorf("error validating ingressPath: %w", err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func checkPath(paths []networkingv1.HTTPIngressPath, enablePathTypeValidation bool, regexSpecificChars *regexp.Regexp) error {
|
||||
|
||||
for _, path := range paths {
|
||||
if path.PathType == nil {
|
||||
path.PathType = &defaultPathType
|
||||
}
|
||||
|
||||
klog.V(9).InfoS("PathType Validation", "enablePathTypeValidation", enablePathTypeValidation, "regexSpecificChars", regexSpecificChars.String(), "Path", path.Path)
|
||||
|
||||
switch pathType := *path.PathType; pathType {
|
||||
case networkingv1.PathTypeImplementationSpecific:
|
||||
if enablePathTypeValidation {
|
||||
//only match on regex chars per Ingress spec when path is implementation specific
|
||||
if !regexSpecificChars.MatchString(path.Path) {
|
||||
return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType)
|
||||
}
|
||||
}
|
||||
|
||||
case networkingv1.PathTypeExact, networkingv1.PathTypePrefix:
|
||||
//enforce path type validation
|
||||
if enablePathTypeValidation {
|
||||
//only allow alphanumeric chars, no regex chars
|
||||
if !pathAlphaNumericRegex(path.Path) {
|
||||
return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType)
|
||||
}
|
||||
continue
|
||||
} else {
|
||||
//path validation is disabled, so we check what regex chars are allowed by user
|
||||
if !regexSpecificChars.MatchString(path.Path) {
|
||||
return fmt.Errorf("path %s of type %s contains invalid characters", path.Path, *path.PathType)
|
||||
}
|
||||
continue
|
||||
}
|
||||
|
||||
default:
|
||||
return fmt.Errorf("unknown path type %v on path %v", *path.PathType, path.Path)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
return pathAlphaNumeric(path)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,10 +17,13 @@ limitations under the License.
|
|||
package ingress
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
networkingv1 "k8s.io/api/networking/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
networkingv1 "k8s.io/api/networking/v1"
|
||||
"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
|
||||
"k8s.io/ingress-nginx/pkg/apis/ingress"
|
||||
)
|
||||
|
||||
|
|
@ -133,172 +136,81 @@ func TestIsDynamicConfigurationEnough(t *testing.T) {
|
|||
}
|
||||
}
|
||||
|
||||
func generateDumbIngressforPathTest(pathType *networkingv1.PathType, path string) *networkingv1.Ingress {
|
||||
func generateDumbIngressforPathTest(regexEnabled bool) *networkingv1.Ingress {
|
||||
var annotations = make(map[string]string)
|
||||
regexAnnotation := fmt.Sprintf("%s/use-regex", parser.AnnotationsPrefix)
|
||||
if regexEnabled {
|
||||
annotations[regexAnnotation] = "true"
|
||||
}
|
||||
return &networkingv1.Ingress{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: "dumb",
|
||||
Namespace: "default",
|
||||
},
|
||||
Spec: networkingv1.IngressSpec{
|
||||
Rules: []networkingv1.IngressRule{
|
||||
{
|
||||
Host: "test.com",
|
||||
IngressRuleValue: networkingv1.IngressRuleValue{
|
||||
HTTP: &networkingv1.HTTPIngressRuleValue{
|
||||
Paths: []networkingv1.HTTPIngressPath{
|
||||
{
|
||||
PathType: pathType,
|
||||
Path: path,
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
Annotations: annotations,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
func generateComplexIngress(ing *networkingv1.Ingress) *networkingv1.Ingress {
|
||||
|
||||
oldRules := ing.Spec.DeepCopy().Rules
|
||||
ing.Spec.Rules = []networkingv1.IngressRule{
|
||||
{
|
||||
Host: "test1.com",
|
||||
IngressRuleValue: networkingv1.IngressRuleValue{
|
||||
HTTP: &networkingv1.HTTPIngressRuleValue{
|
||||
Paths: []networkingv1.HTTPIngressPath{
|
||||
{
|
||||
PathType: &pathTypeExact,
|
||||
Path: "/xpto",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
Host: "test2.com",
|
||||
IngressRuleValue: networkingv1.IngressRuleValue{
|
||||
HTTP: &networkingv1.HTTPIngressRuleValue{
|
||||
Paths: []networkingv1.HTTPIngressPath{
|
||||
{
|
||||
PathType: &pathTypeExact,
|
||||
Path: "/someotherpath",
|
||||
},
|
||||
{
|
||||
PathType: &pathTypePrefix,
|
||||
Path: "/someprefix/~xpto/lala123",
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
// we want to invert the order to test better :)
|
||||
ing.Spec.Rules = append(ing.Spec.Rules, oldRules...)
|
||||
|
||||
return ing
|
||||
}
|
||||
|
||||
var (
|
||||
pathTypeExact = networkingv1.PathTypeExact
|
||||
pathTypePrefix = networkingv1.PathTypePrefix
|
||||
pathTypeImplSpecific = networkingv1.PathTypeImplementationSpecific
|
||||
)
|
||||
|
||||
const (
|
||||
defaultAdditionalChars = "^%$[](){}*+?"
|
||||
)
|
||||
|
||||
func TestValidateIngressPath(t *testing.T) {
|
||||
func TestIsSafePath(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
copyIng *networkingv1.Ingress
|
||||
EnablePathTypeValidation bool
|
||||
additionalChars string
|
||||
wantErr bool
|
||||
path string
|
||||
want bool
|
||||
}{
|
||||
{
|
||||
name: "should return nil when ingress = nil",
|
||||
wantErr: false,
|
||||
copyIng: nil,
|
||||
name: "should accept valid path with regex disabled",
|
||||
want: true,
|
||||
copyIng: generateDumbIngressforPathTest(false),
|
||||
path: "/xpto/~user/t-e_st.exe",
|
||||
},
|
||||
{
|
||||
name: "should accept valid path on pathType Exact",
|
||||
wantErr: false,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/xpto/~user9/t-e_st.exe"),
|
||||
name: "should accept valid path / with regex disabled",
|
||||
want: true,
|
||||
copyIng: generateDumbIngressforPathTest(false),
|
||||
path: "/",
|
||||
},
|
||||
{
|
||||
name: "should accept valid path on pathType Prefix",
|
||||
wantErr: false,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypePrefix, "/xpto/~user9/t-e_st.exe"),
|
||||
name: "should reject invalid path with invalid chars",
|
||||
want: false,
|
||||
copyIng: generateDumbIngressforPathTest(false),
|
||||
path: "/foo/bar/;xpto",
|
||||
},
|
||||
{
|
||||
name: "should accept valid simple path on pathType Impl Specific",
|
||||
wantErr: false,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/xpto/~user9/t-e_st.exe"),
|
||||
name: "should reject regex path when regex is disabled",
|
||||
want: false,
|
||||
copyIng: generateDumbIngressforPathTest(false),
|
||||
path: "/foo/bar/(.+)",
|
||||
},
|
||||
{
|
||||
name: "should accept valid path on pathType nil",
|
||||
wantErr: false,
|
||||
copyIng: generateDumbIngressforPathTest(nil, "/xpto/~user/t-e_st.exe"),
|
||||
name: "should accept valid path / with regex enabled",
|
||||
want: true,
|
||||
copyIng: generateDumbIngressforPathTest(true),
|
||||
path: "/",
|
||||
},
|
||||
{
|
||||
name: "should accept empty path",
|
||||
wantErr: false,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypePrefix, ""),
|
||||
name: "should accept regex path when regex is enabled",
|
||||
want: true,
|
||||
copyIng: generateDumbIngressforPathTest(true),
|
||||
path: "/foo/bar/(.+)",
|
||||
},
|
||||
{
|
||||
name: "should deny path with bad characters and pathType not implementationSpecific",
|
||||
wantErr: true,
|
||||
additionalChars: "()",
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.+)"),
|
||||
name: "should reject regex path when regex is enabled but the path is invalid",
|
||||
want: false,
|
||||
copyIng: generateDumbIngressforPathTest(true),
|
||||
path: "/foo/bar/;xpto",
|
||||
},
|
||||
{
|
||||
name: "should accept path with regex characters and pathType implementationSpecific",
|
||||
wantErr: false,
|
||||
additionalChars: defaultAdditionalChars,
|
||||
EnablePathTypeValidation: false,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"),
|
||||
},
|
||||
{
|
||||
name: "should accept path with regex characters and pathType exact, but pathType validation disabled",
|
||||
wantErr: false,
|
||||
additionalChars: defaultAdditionalChars,
|
||||
EnablePathTypeValidation: false,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.+)"),
|
||||
},
|
||||
{
|
||||
name: "should reject path when the allowed additional set does not match",
|
||||
wantErr: true,
|
||||
additionalChars: "().?",
|
||||
EnablePathTypeValidation: true,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.+)"),
|
||||
},
|
||||
{
|
||||
name: "should accept path when the allowed additional set does match",
|
||||
wantErr: false,
|
||||
additionalChars: "().?",
|
||||
EnablePathTypeValidation: false,
|
||||
copyIng: generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)"),
|
||||
},
|
||||
{
|
||||
name: "should block if at least one path is bad",
|
||||
wantErr: true,
|
||||
EnablePathTypeValidation: false,
|
||||
copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeExact, "/foo/bar/(.?)")),
|
||||
},
|
||||
{
|
||||
name: "should block if at least one path is bad",
|
||||
wantErr: true,
|
||||
EnablePathTypeValidation: true,
|
||||
copyIng: generateComplexIngress(generateDumbIngressforPathTest(&pathTypeImplSpecific, "/foo/bar/(.?)")),
|
||||
name: "should reject regex path when regex is enabled but the path is invalid",
|
||||
want: false,
|
||||
copyIng: generateDumbIngressforPathTest(true),
|
||||
path: ";xpto",
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
if err := ValidateIngressPath(tt.copyIng, tt.EnablePathTypeValidation, tt.additionalChars); (err != nil) != tt.wantErr {
|
||||
t.Errorf("ValidateIngressPath() error = %v, wantErr %v", err, tt.wantErr)
|
||||
if got := IsSafePath(tt.copyIng, tt.path); got != tt.want {
|
||||
t.Errorf("IsSafePath() = %v, want %v", got, tt.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
|
|
|
|||
|
|
@ -30,14 +30,6 @@ import (
|
|||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
|
||||
"k8s.io/ingress-nginx/test/e2e/framework"
|
||||
|
||||
networkingv1 "k8s.io/api/networking/v1"
|
||||
)
|
||||
|
||||
var (
|
||||
pathExact = networkingv1.PathTypeExact
|
||||
pathPrefix = networkingv1.PathTypePrefix
|
||||
pathImplSpecific = networkingv1.PathTypeImplementationSpecific
|
||||
)
|
||||
|
||||
var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() {
|
||||
|
|
@ -160,35 +152,7 @@ var _ = framework.IngressNginxDescribe("[Serial] admission controller", func() {
|
|||
assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid annotation value should return an error")
|
||||
})
|
||||
|
||||
ginkgo.It("ADMISSION should not validate characters on ingress when validation of pathType is disabled", func() {
|
||||
host := "admission-test"
|
||||
|
||||
f.UpdateNginxConfigMapData("enable-pathtype-validation", "false")
|
||||
|
||||
firstIngress := framework.NewSingleIngress("first-ingress", "/xpto*", host, f.Namespace, framework.EchoService, 80, nil)
|
||||
firstIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathPrefix
|
||||
_, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{})
|
||||
assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with regex chars on path and pathType validation disabled should be accepted")
|
||||
})
|
||||
|
||||
ginkgo.It("ADMISSION should reject ingress with bad characters and pathType != ImplementationSpecific", func() {
|
||||
host := "admission-test"
|
||||
|
||||
f.UpdateNginxConfigMapData("enable-pathtype-validation", "true")
|
||||
|
||||
firstIngress := framework.NewSingleIngress("first-ingress", "/xpto*", host, f.Namespace, framework.EchoService, 80, nil)
|
||||
firstIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathPrefix
|
||||
_, err := f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), firstIngress, metav1.CreateOptions{})
|
||||
assert.NotNil(ginkgo.GinkgoT(), err, "creating an ingress with invalid path value should return an error")
|
||||
|
||||
secondIngress := framework.NewSingleIngress("second-ingress", "/abc123*", host, f.Namespace, framework.EchoService, 80, nil)
|
||||
secondIngress.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImplSpecific
|
||||
_, err = f.KubeClientSet.NetworkingV1().Ingresses(f.Namespace).Create(context.TODO(), secondIngress, metav1.CreateOptions{})
|
||||
assert.Nil(ginkgo.GinkgoT(), err, "creating an ingress with regex on path and pathType ImplementationSpecific should not return an error")
|
||||
|
||||
})
|
||||
|
||||
ginkgo.It("ADMISSION should return an error if there is a forbidden value in some annotation", func() {
|
||||
ginkgo.It("should return an error if there is a forbidden value in some annotation", func() {
|
||||
host := "admission-test"
|
||||
|
||||
annotations := map[string]string{
|
||||
|
|
|
|||
|
|
@ -35,8 +35,6 @@ import (
|
|||
var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() {
|
||||
f := framework.NewDefaultFramework("affinity")
|
||||
|
||||
pathImpl := networking.PathTypeImplementationSpecific
|
||||
|
||||
ginkgo.BeforeEach(func() {
|
||||
f.NewEchoDeployment(framework.WithDeploymentReplicas(2))
|
||||
})
|
||||
|
|
@ -278,8 +276,6 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() {
|
|||
annotations["nginx.ingress.kubernetes.io/session-cookie-path"] = "/foo/bar"
|
||||
|
||||
ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl
|
||||
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
|
|
@ -303,8 +299,6 @@ var _ = framework.DescribeAnnotation("affinity session-cookie-name", func() {
|
|||
annotations["nginx.ingress.kubernetes.io/use-regex"] = "true"
|
||||
|
||||
ing := framework.NewSingleIngress(host, "/foo/.*", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl
|
||||
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
|
|
|
|||
|
|
@ -720,51 +720,6 @@ http {
|
|||
})
|
||||
})
|
||||
|
||||
ginkgo.Context("when external authentication is configured along with CORS enabled", func() {
|
||||
host := "auth"
|
||||
var annotations map[string]string
|
||||
var ing *networking.Ingress
|
||||
|
||||
ginkgo.BeforeEach(func() {
|
||||
f.NewHttpbinDeployment()
|
||||
|
||||
var httpbinIP string
|
||||
|
||||
err := framework.WaitForEndpoints(f.KubeClientSet, framework.DefaultTimeout, framework.HTTPBinService, f.Namespace, 1)
|
||||
assert.Nil(ginkgo.GinkgoT(), err)
|
||||
|
||||
e, err := f.KubeClientSet.CoreV1().Endpoints(f.Namespace).Get(context.TODO(), framework.HTTPBinService, metav1.GetOptions{})
|
||||
assert.Nil(ginkgo.GinkgoT(), err)
|
||||
|
||||
httpbinIP = e.Subsets[0].Addresses[0].IP
|
||||
|
||||
annotations = map[string]string{
|
||||
"nginx.ingress.kubernetes.io/auth-url": fmt.Sprintf("http://%s/basic-auth/user/password", httpbinIP),
|
||||
"nginx.ingress.kubernetes.io/auth-signin": "http://$host/auth/start",
|
||||
"nginx.ingress.kubernetes.io/enable-cors": "true",
|
||||
}
|
||||
|
||||
ing = framework.NewSingleIngress(host, "/", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host, func(server string) bool {
|
||||
return strings.Contains(server, "server_name auth")
|
||||
})
|
||||
})
|
||||
|
||||
ginkgo.It("should redirect to signin url when not signed in along With CORS headers in response", func() {
|
||||
f.HTTPTestClient().
|
||||
GET("/").
|
||||
WithHeader("Host", host).
|
||||
WithQuery("a", "b").
|
||||
WithQuery("c", "d").
|
||||
Expect().
|
||||
Status(http.StatusFound).
|
||||
Header("Access-Control-Allow-Origin").Equal(fmt.Sprintf("*"))
|
||||
|
||||
})
|
||||
})
|
||||
|
||||
ginkgo.Context("when external authentication with caching is configured", func() {
|
||||
thisHost := "auth"
|
||||
thatHost := "different"
|
||||
|
|
|
|||
|
|
@ -24,15 +24,12 @@ import (
|
|||
"github.com/onsi/ginkgo/v2"
|
||||
"github.com/stretchr/testify/assert"
|
||||
|
||||
networking "k8s.io/api/networking/v1"
|
||||
"k8s.io/ingress-nginx/test/e2e/framework"
|
||||
)
|
||||
|
||||
var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-log", func() {
|
||||
f := framework.NewDefaultFramework("rewrite")
|
||||
|
||||
pathImpl := networking.PathTypeImplementationSpecific
|
||||
|
||||
ginkgo.BeforeEach(func() {
|
||||
f.NewEchoDeployment()
|
||||
})
|
||||
|
|
@ -129,7 +126,6 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo
|
|||
"nginx.ingress.kubernetes.io/rewrite-target": "/new/backend",
|
||||
}
|
||||
ing = framework.NewSingleIngress("regex", "/foo.+", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
|
|
@ -172,8 +168,6 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo
|
|||
"nginx.ingress.kubernetes.io/rewrite-target": "/new/backend",
|
||||
}
|
||||
ing = framework.NewSingleIngress("regex", "/foo/bar/[a-z]{3}", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl
|
||||
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
|
|
@ -202,8 +196,6 @@ var _ = framework.DescribeAnnotation("rewrite-target use-regex enable-rewrite-lo
|
|||
"nginx.ingress.kubernetes.io/rewrite-target": "/new/backend/$1",
|
||||
}
|
||||
ing := framework.NewSingleIngress("regex", "/foo/bar/(.+)", host, f.Namespace, framework.EchoService, 80, annotations)
|
||||
ing.Spec.Rules[0].IngressRuleValue.HTTP.Paths[0].PathType = &pathImpl
|
||||
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
|
|
|
|||
134
test/e2e/security/invalid_paths.go
Normal file
134
test/e2e/security/invalid_paths.go
Normal file
|
|
@ -0,0 +1,134 @@
|
|||
/*
|
||||
Copyright 2022 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package security
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/onsi/ginkgo/v2"
|
||||
|
||||
"k8s.io/ingress-nginx/test/e2e/framework"
|
||||
)
|
||||
|
||||
const (
|
||||
validPath = "/xpto/~user/t-e_st.exe"
|
||||
invalidPath = "/foo/bar/;xpto"
|
||||
regexPath = "/foo/bar/(.+)"
|
||||
host = "securitytest.com"
|
||||
)
|
||||
|
||||
var (
|
||||
annotationRegex = map[string]string{
|
||||
"nginx.ingress.kubernetes.io/use-regex": "true",
|
||||
}
|
||||
)
|
||||
|
||||
var _ = framework.IngressNginxDescribe("[Security] validate path fields", func() {
|
||||
f := framework.NewDefaultFramework("validate-path")
|
||||
|
||||
ginkgo.BeforeEach(func() {
|
||||
f.NewEchoDeployment()
|
||||
})
|
||||
|
||||
ginkgo.It("should accept an ingress with valid path", func() {
|
||||
|
||||
ing := framework.NewSingleIngress(host, validPath, host, f.Namespace, framework.EchoService, 80, nil)
|
||||
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
func(server string) bool {
|
||||
return strings.Contains(server, fmt.Sprintf("server_name %s ;", host))
|
||||
})
|
||||
|
||||
f.HTTPTestClient().
|
||||
GET(validPath).
|
||||
WithHeader("Host", host).
|
||||
Expect().
|
||||
Status(http.StatusOK)
|
||||
})
|
||||
|
||||
ginkgo.It("should drop an ingress with invalid path", func() {
|
||||
|
||||
ing := framework.NewSingleIngress(host, invalidPath, host, f.Namespace, framework.EchoService, 80, nil)
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
func(server string) bool {
|
||||
return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host))
|
||||
})
|
||||
|
||||
f.HTTPTestClient().
|
||||
GET(invalidPath).
|
||||
WithHeader("Host", host).
|
||||
Expect().
|
||||
Status(http.StatusNotFound)
|
||||
})
|
||||
|
||||
ginkgo.It("should drop an ingress with regex path and regex disabled", func() {
|
||||
|
||||
ing := framework.NewSingleIngress(host, regexPath, host, f.Namespace, framework.EchoService, 80, nil)
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
func(server string) bool {
|
||||
return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host))
|
||||
})
|
||||
|
||||
f.HTTPTestClient().
|
||||
GET("/foo/bar/lalala").
|
||||
WithHeader("Host", host).
|
||||
Expect().
|
||||
Status(http.StatusNotFound)
|
||||
})
|
||||
|
||||
ginkgo.It("should accept an ingress with regex path and regex enabled", func() {
|
||||
|
||||
ing := framework.NewSingleIngress(host, regexPath, host, f.Namespace, framework.EchoService, 80, annotationRegex)
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
func(server string) bool {
|
||||
return strings.Contains(server, fmt.Sprintf("server_name %s ;", host))
|
||||
})
|
||||
|
||||
f.HTTPTestClient().
|
||||
GET("/foo/bar/lalala").
|
||||
WithHeader("Host", host).
|
||||
Expect().
|
||||
Status(http.StatusOK)
|
||||
})
|
||||
|
||||
ginkgo.It("should reject an ingress with invalid path and regex enabled", func() {
|
||||
|
||||
ing := framework.NewSingleIngress(host, invalidPath, host, f.Namespace, framework.EchoService, 80, annotationRegex)
|
||||
f.EnsureIngress(ing)
|
||||
|
||||
f.WaitForNginxServer(host,
|
||||
func(server string) bool {
|
||||
return !strings.Contains(server, fmt.Sprintf("server_name %s ;", host))
|
||||
})
|
||||
|
||||
f.HTTPTestClient().
|
||||
GET(invalidPath).
|
||||
WithHeader("Host", host).
|
||||
Expect().
|
||||
Status(http.StatusNotFound)
|
||||
})
|
||||
})
|
||||
|
|
@ -25,14 +25,23 @@ set -o pipefail
|
|||
|
||||
BUSTED_ARGS="-v --pattern=_test"
|
||||
|
||||
resty \
|
||||
-I ./rootfs/etc/nginx/lua \
|
||||
--shdict "configuration_data 5M" \
|
||||
--shdict "certificate_data 16M" \
|
||||
--shdict "certificate_servers 1M" \
|
||||
--shdict "ocsp_response_cache 1M" \
|
||||
--shdict "balancer_ewma 1M" \
|
||||
--shdict "balancer_ewma_last_touched_at 1M" \
|
||||
--shdict "balancer_ewma_locks 512k" \
|
||||
--shdict "global_throttle_cache 5M" \
|
||||
./rootfs/etc/nginx/lua/test/run.lua ${BUSTED_ARGS} ./rootfs/etc/nginx/lua/test/ ./rootfs/etc/nginx/lua/plugins/**/test
|
||||
SHDICT_ARGS=(
|
||||
"-I" "./rootfs/etc/nginx/lua"
|
||||
"--shdict" "configuration_data 5M"
|
||||
"--shdict" "certificate_data 16M"
|
||||
"--shdict" "certificate_servers 1M"
|
||||
"--shdict" "ocsp_response_cache 1M"
|
||||
"--shdict" "balancer_ewma 1M"
|
||||
"--shdict" "quota_tracker 1M"
|
||||
"--shdict" "high_throughput_tracker 1M"
|
||||
"--shdict" "balancer_ewma_last_touched_at 1M"
|
||||
"--shdict" "balancer_ewma_locks 512k"
|
||||
"--shdict" "global_throttle_cache 5M"
|
||||
"./rootfs/etc/nginx/lua/test/run.lua"
|
||||
)
|
||||
|
||||
if [ $# -eq 0 ]; then
|
||||
resty "${SHDICT_ARGS[@]}" ./rootfs/etc/nginx/lua/test/ ./rootfs/etc/nginx/lua/plugins/**/test
|
||||
else
|
||||
resty "${SHDICT_ARGS[@]}" $@
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in a new issue