DevFW-CICD/ingress-nginx-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
7577 commits 4 branches 217 tags 166 MiB
Commit graph

15 commits

Author SHA1 Message Date
Marco Ebert
8b026f42d5
Chart: Tighten securityContexts and Pod Security Policies. (#10491) 
* Values: Fix docs of `controller.podSecurityContext` & `controller.sysctls`.

* Values: Add missing `controller.containerSecurityContext`.

Already in use, but has never been added to values.

* Values: Fix docs of `defaultBackend.podSecurityContext` & `defaultBackend.containerSecurityContext`.

* Helpers: Rename `controller.containerSecurityContext` to `ingress-nginx.controller.containerSecurityContext`.

Due to alignment with other templates.

* Helpers: Improve `extraModules`.

- Make `command` a multiline list.
- Fix `toYaml` usage.
- Remove `toYaml` where not necessary.

* Helpers: Move `ingress-nginx.defaultBackend.fullname`.

* Helpers: Add `ingress-nginx.defaultBackend.containerSecurityContext`.

Extracts the default backend `securityContext` into a template, as for the controller.

* Controller: Fix indentation of `controller.podSecurityContext` & `controller.sysctls`.

* Controller: Improve `controller.extraModules` & `controller.opentelemetry`.

- Add `controller.extraModules.distroless` & `controller.extraModules.resources`.
- Add `controller.opentelemetry.name` & `controller.opentelemetry.distroless`.
- Align `extraModules` inclusion for `controller.extraModules` & `controller.opentelemetry`.
- Remove redundant whitespaces.

* Controller/PSP: Align indentation.

* Controller/PSP: Remove quotes.

* Controller/PSP: Improve comments.

* Controller/PSP: Reorder fields.

See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy.

* Admission Webhooks: Fix indentation of `controller.admissionWebhooks.patch.securityContext`.

* Admission Webhooks/PSP: Align indentation.

* Admission Webhooks/PSP: Reorder fields.

* Admission Webhooks/PSP: Align condition.

* Admission Webhooks/ClusterRole: Align PSP rule.

* Default Backend/PSP: Align indentation.

* Default Backend/PSP: Reorder fields.

See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy.

* Values: Tighten `controller.image`.

Due to recent changes, the controller image can be run without privilege escalation:

- https://github.com/kubernetes/ingress-nginx/issues/8499
- https://github.com/kubernetes/ingress-nginx/pull/7449

* Values: Tighten `controller.extraModules.containerSecurityContext`.

* Values: Tighten `controller.opentelemetry.containerSecurityContext`.

* Values: Tighten `controller.admissionWebhooks.*.securityContext`.

Moves the pod `securityContext` to the containers to not interfere with injected containers.

* Values: Tighten `defaultBackend.image`.
 2023-11-07 18:52:36 +01:00
Taehyun Kim
e3c9382fc9
fix: controller psp's volume config (#9740) 
* fix: controller psp's volume config

* revert chart version
 2023-03-21 06:41:08 -07:00
James Strong
db3cdc04e4
release 1.3.1 (#9014) 
* release 1.3.1

Signed-off-by: James Strong <strong.james.e@gmail.com>

* fix readme

Signed-off-by: James Strong <strong.james.e@gmail.com>

* fix readme

Signed-off-by: James Strong <strong.james.e@gmail.com>

* fix readme

Signed-off-by: James Strong <strong.james.e@gmail.com>

* Fix chart linter

* Fix helm docs

* Fix helm docs

* fix helm docs

* Add warning about lease change

* Disable PSP in v1.25

* rollback cluster in helmchart to psp tests

Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: Ricardo Pchevuzinske Katz <ricardo.katz@gmail.com>
 2022-09-05 04:28:36 -07:00
Mac Chaffee
6c3a237d7d
Add CAP_SYS_CHROOT to DS/PSP when needed (#8587) 
Signed-off-by: Mac Chaffee <me@macchaffee.com>
 2022-05-16 06:30:18 -07:00
Muhammad Hamza Zaib
30c0d2260d
[Helm] Add labels to resources (#6992) 
* Add labels to RBAC resources

* Add labels to all resources

* Fix labels indentaton in patch jobs

* Add controller and default backend labels to pods

Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com>

* Bump chart version and update changelog

Signed-off-by: Muhammad Hamza Zaib <hamzazaib3202@gmail.com>
 2021-11-19 06:52:52 -08:00
Eric Bailey
63e35ac32b Support existing PSPs in Helm chart 2021-04-07 13:04:02 -05:00
Mitch Hulscher
39fea58085 feat: allow volume-type emptyDir in controller podsecuritypolicy 2020-12-28 11:01:32 +01:00
Tobias Wolf
1d54d8b565 Add sysctl exemptions to controller PSP 
I would like to be able to support this construction in my DaemonSet, I have coontrol over the host and this is the easiest way yo bump the socket properties.
```yaml
securityContext:
  sysctls:
    - name: net.core.somaxconn
      value: "8192"
```
 2020-06-16 19:11:45 +02:00
Manuel Alejandro de Brito Fontes
977178dea4 Remove chart old podSecurityPolicy check 2020-04-14 23:07:45 -04:00
Manuel Alejandro de Brito Fontes
1f3eac2c8c Remove duplicated annotations definition and refactor hostPort configuration 2020-04-06 19:15:47 -04:00
Naseem
5ae314bd64
Hardcode component names. 
By removing this, we reduce unecessary config options and moving parts.

Signed-off-by: Naseem <naseem@transit.app>
 2020-03-10 09:36:26 -04:00
ChiefAlexander
388a499533
Cleanup chart code 2020-03-03 09:20:45 -06:00
ChiefAlexander
710f1f2601
Update helm templates to match new chart name 2020-02-28 08:53:24 -06:00
Naseem
003039f23c
Use recommended labels and label helpers 
Signed-off-by: Naseem <naseem@transit.app>
 2020-02-27 22:35:34 -05:00
Manuel Alejandro de Brito Fontes
624cb5f048
Start migration of helm chart (#5159) 2020-02-24 16:25:57 -03:00