Marco Ebert
027603927b
Chart: Remove Pod Security Policy. ( #11971 )
2024-09-15 17:03:24 +02:00
Reddysekhar Gaduputi
0c17748c44
Chart: Make admission webhook patch job RBAC configurable. ( #11376 )
...
* Add an option to skip rbac resources creation in helm chart for admission-webhooks (#11375 )
Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com>
* Add an option to skip rbac resources creation in helm chart update README (#11375 )
Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com>
* Add an option to skip serviceAccount resources creation in helm chart for admission-webhooks (#11375 )
Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com>
* Add helm chart tests for admission-webhooks (#11375 )
Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com>
* Chart make admission webhook patch job RBAC configurable (#11375 )
Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com>
* Update charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrole_test.yaml
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
* Update charts/ingress-nginx/tests/admission-webhooks/job-patch/clusterrolebinding_test.yaml
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
* Update charts/ingress-nginx/tests/admission-webhooks/job-patch/role_test.yaml
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
* Update charts/ingress-nginx/tests/admission-webhooks/job-patch/rolebinding_test.yaml
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
* Update charts/ingress-nginx/tests/admission-webhooks/job-patch/serviceaccount_test.yaml
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
---------
Signed-off-by: Reddysekhar Gaduputi <gsekhar73@gmail.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-06-03 02:17:23 -07:00
Marco Ebert
8b026f42d5
Chart: Tighten securityContexts and Pod Security Policies. ( #10491 )
...
* Values: Fix docs of `controller.podSecurityContext` & `controller.sysctls`.
* Values: Add missing `controller.containerSecurityContext`.
Already in use, but has never been added to values.
* Values: Fix docs of `defaultBackend.podSecurityContext` & `defaultBackend.containerSecurityContext`.
* Helpers: Rename `controller.containerSecurityContext` to `ingress-nginx.controller.containerSecurityContext`.
Due to alignment with other templates.
* Helpers: Improve `extraModules`.
- Make `command` a multiline list.
- Fix `toYaml` usage.
- Remove `toYaml` where not necessary.
* Helpers: Move `ingress-nginx.defaultBackend.fullname`.
* Helpers: Add `ingress-nginx.defaultBackend.containerSecurityContext`.
Extracts the default backend `securityContext` into a template, as for the controller.
* Controller: Fix indentation of `controller.podSecurityContext` & `controller.sysctls`.
* Controller: Improve `controller.extraModules` & `controller.opentelemetry`.
- Add `controller.extraModules.distroless` & `controller.extraModules.resources`.
- Add `controller.opentelemetry.name` & `controller.opentelemetry.distroless`.
- Align `extraModules` inclusion for `controller.extraModules` & `controller.opentelemetry`.
- Remove redundant whitespaces.
* Controller/PSP: Align indentation.
* Controller/PSP: Remove quotes.
* Controller/PSP: Improve comments.
* Controller/PSP: Reorder fields.
See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy .
* Admission Webhooks: Fix indentation of `controller.admissionWebhooks.patch.securityContext`.
* Admission Webhooks/PSP: Align indentation.
* Admission Webhooks/PSP: Reorder fields.
* Admission Webhooks/PSP: Align condition.
* Admission Webhooks/ClusterRole: Align PSP rule.
* Default Backend/PSP: Align indentation.
* Default Backend/PSP: Reorder fields.
See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy .
* Values: Tighten `controller.image`.
Due to recent changes, the controller image can be run without privilege escalation:
- https://github.com/kubernetes/ingress-nginx/issues/8499
- https://github.com/kubernetes/ingress-nginx/pull/7449
* Values: Tighten `controller.extraModules.containerSecurityContext`.
* Values: Tighten `controller.opentelemetry.containerSecurityContext`.
* Values: Tighten `controller.admissionWebhooks.*.securityContext`.
Moves the pod `securityContext` to the containers to not interfere with injected containers.
* Values: Tighten `defaultBackend.image`.
2023-11-07 18:52:36 +01:00
Marco Ebert
0120a2df48
Admission Webhook: Truncate name. ( #10523 )
2023-10-29 18:26:05 +01:00
Jan-Otto Kröpke
d7674e4323
feat(helm): Optionally use cert-manager instead admission patch ( #9279 )
2022-12-07 04:16:38 -08:00
Muhammad Hamza Zaib
30c0d2260d
[Helm] Add labels to resources ( #6992 )
...
* Add labels to RBAC resources
* Add labels to all resources
* Fix labels indentaton in patch jobs
* Add controller and default backend labels to pods
Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com>
* Bump chart version and update changelog
Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com>
2021-11-19 06:52:52 -08:00
Eric Bailey
63e35ac32b
Support existing PSPs in Helm chart
2021-04-07 13:04:02 -05:00
Naseem
5ae314bd64
Hardcode component names.
...
By removing this, we reduce unecessary config options and moving parts.
Signed-off-by: Naseem <naseem@transit.app>
2020-03-10 09:36:26 -04:00
ChiefAlexander
388a499533
Cleanup chart code
2020-03-03 09:20:45 -06:00
ChiefAlexander
710f1f2601
Update helm templates to match new chart name
2020-02-28 08:53:24 -06:00
Naseem
003039f23c
Use recommended labels and label helpers
...
Signed-off-by: Naseem <naseem@transit.app>
2020-02-27 22:35:34 -05:00
Manuel Alejandro de Brito Fontes
624cb5f048
Start migration of helm chart ( #5159 )
2020-02-24 16:25:57 -03:00
