Compare commits

..

149 commits

Author SHA1 Message Date
Marco Ebert
f6456ea86c
Release controller v1.11.3 & chart v4.11.3. (#12156) 2024-10-08 22:08:23 +01:00
Marco Ebert
0106de65cf
Images: Trigger controller build. (#12134) 2024-10-08 06:26:22 +01:00
Marco Ebert
9849c92b91
Bump the actions group with 3 updates (#12149)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-07 22:06:22 +01:00
k8s-infra-cherrypick-robot
0a0a0e5502
Tests & Docs: Bump e2e-test-echo to v1.0.1. (#12145)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-07 21:42:22 +01:00
k8s-infra-cherrypick-robot
89c097d1d1
Images: Trigger e2e-test-echo build. (#12141)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-07 14:52:22 +01:00
k8s-infra-cherrypick-robot
9aaafd0381
Images: Drop s390x. (#12138)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-07 14:34:21 +01:00
k8s-infra-cherrypick-robot
95c43a3684
Images: Build s390x controller. (#12127)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-06 16:55:22 +02:00
Marco Ebert
f2aeb08873
Chart: Bump Kube Webhook CertGen. (#12123) 2024-10-06 16:20:55 +02:00
k8s-infra-cherrypick-robot
c5c1be168a
Tests & Docs: Bump images. (#12121)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-06 09:02:05 +01:00
Marco Ebert
2ddb730ad0
Cloud Build: Bump gcb-docker-gcloud to v20240718-5ef92b5c36. (#12117) 2024-10-06 00:55:19 +02:00
k8s-infra-cherrypick-robot
ba90c4ff75
Images: Trigger other builds. (#12112)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-06 00:09:32 +02:00
k8s-infra-cherrypick-robot
1e72428636
Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12109)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-05 08:36:03 +01:00
k8s-infra-cherrypick-robot
52a71c1736
Tests: Bump e2e-test-runner to v20241004-114a6abb. (#12105)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-04 19:46:28 +01:00
k8s-infra-cherrypick-robot
a506cb4877
Images: Trigger test-runner build. (#12102)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-10-04 13:59:05 +02:00
k8s-infra-cherrypick-robot
6cc603a63a
Docs: Add a multi-tenant warning. (#12099)
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-10-04 13:51:35 +02:00
k8s-infra-cherrypick-robot
d640ceaadf
Bump the actions group with 3 updates (#12097)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-04 13:43:52 +02:00
Marco Ebert
91a3ef1ad6
Go: Bump to v1.22.8. (#12094) 2024-10-04 13:41:48 +02:00
Marco Ebert
a49c586dc3
Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12089)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-02 19:07:50 +01:00
k8s-infra-cherrypick-robot
7d11997c8b
Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12087)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-02 18:09:49 +01:00
k8s-infra-cherrypick-robot
f7865db3cb
Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12085)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-02 18:05:49 +01:00
k8s-infra-cherrypick-robot
fc17081f7b
Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12083)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-02 17:53:49 +01:00
Marco Ebert
f21739401f
Images: Bump NGINX_BASE to v0.1.0. (#12080) 2024-10-02 13:02:04 +02:00
Marco Ebert
85b513b0b7
Images: Trigger NGINX build. (#12076) 2024-10-02 08:03:22 +02:00
Marco Ebert
eef1aa0e46
Images: Remove NGINX v1.21. (#12058) 2024-10-01 12:42:53 +02:00
k8s-infra-cherrypick-robot
f6398126da
Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12055)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 16:18:03 +01:00
k8s-infra-cherrypick-robot
edd8c7b158
Bump the go group across 1 directory with 3 updates (#12053)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 15:30:03 +01:00
k8s-infra-cherrypick-robot
0fb4adbd1e
Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12049)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 13:40:04 +01:00
k8s-infra-cherrypick-robot
737cfa0a83
Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12047)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 13:38:02 +01:00
k8s-infra-cherrypick-robot
5d0e706fa8
Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12046)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 13:35:04 +01:00
k8s-infra-cherrypick-robot
d70c2517d4
GitHub: Improve Dependabot. (#12038)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-09-30 14:25:01 +02:00
Marco Ebert
acdbd39bbf
Bump the all group with 2 updates (#12036)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-30 12:52:24 +02:00
k8s-infra-cherrypick-robot
b6ae93e62d
Chart: Improve CI. (#12030)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-09-28 15:42:02 +01:00
Marco Ebert
25cf0fee3e
Chart: Extend image tests. (#12027) 2024-09-28 13:15:42 +02:00
k8s-infra-cherrypick-robot
1a834b7fa9
Docs: Add health check annotations for AWS. (#12020)
Co-authored-by: longwuyuan <longwuyuan@gmail.com>
2024-09-26 12:04:01 +01:00
k8s-infra-cherrypick-robot
70f284873d
Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12016)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-23 14:16:36 +02:00
k8s-infra-cherrypick-robot
b3c70183b9
Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12014)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-23 14:16:26 +02:00
k8s-infra-cherrypick-robot
ea0ca17a5e
Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12012)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-23 14:16:00 +02:00
Marco Ebert
6495d9f0d1
Docs: Convert opentelemetry.md from CRLF to LF. (#12006) 2024-09-23 10:46:34 +02:00
k8s-infra-cherrypick-robot
85ccb34282
Chart: Test controller.minAvailable & controller.maxUnavailable. (#12002)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-09-20 14:21:23 +02:00
k8s-infra-cherrypick-robot
bd97375742
Chart: Align default backend PodDisruptionBudget. (#11999)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-09-20 14:20:03 +02:00
k8s-infra-cherrypick-robot
46e91fd359
Metrics: Fix namespace in nginx_ingress_controller_ssl_expire_time_seconds. (#11986)
Co-authored-by: Aleksey Gavrilov <alexey.gavrilov@flant.com>
2024-09-17 21:32:44 +01:00
k8s-infra-cherrypick-robot
1f82d3c936
Bump the all group with 2 updates (#11981)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-16 13:40:41 +02:00
k8s-infra-cherrypick-robot
d1a40089cf
Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11980)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-16 13:40:32 +02:00
k8s-infra-cherrypick-robot
694943163d
Chart: Improve default backend service account. (#11974)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-09-15 17:01:40 +02:00
k8s-infra-cherrypick-robot
21cd456618
Go: Bump to v1.22.7. (#11970)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-09-13 18:03:14 +01:00
k8s-infra-cherrypick-robot
2eebadf8dd
Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11961)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-10 11:27:44 +01:00
k8s-infra-cherrypick-robot
91946607fb
Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11958)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-09 15:26:25 +01:00
k8s-infra-cherrypick-robot
7b67e9716b
Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11957)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-09 15:26:16 +01:00
k8s-infra-cherrypick-robot
5d8e08f163
Images: Bump OpenTelemetry C++ Contrib. (#11951)
Co-authored-by: Damien Mehala <damien.mehala+github@gmail.com>
2024-09-08 11:19:20 +01:00
k8s-infra-cherrypick-robot
44efd44aed
Docs: Add note about --watch-namespace. (#11949)
Co-authored-by: longwuyuan <longwuyuan@gmail.com>
2024-09-08 06:19:20 +01:00
k8s-infra-cherrypick-robot
1507bd0609
Images: Use latest Alpine 3.20 everywhere. (#11946)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-09-08 05:33:20 +01:00
Marco Ebert
dcfa4507ae
Fix minor typos (#11941)
Co-authored-by: Nathan Baulch <nathan.baulch@gmail.com>
2024-09-06 23:19:50 +02:00
k8s-infra-cherrypick-robot
889afa9abd
Chart: Implement controller.admissionWebhooks.service.servicePort. (#11934)
Co-authored-by: Ramiro Algozino <ramiro@sighup.io>
2024-09-04 23:38:37 +01:00
k8s-infra-cherrypick-robot
e035493b9c
Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11930)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-04 12:21:22 +01:00
k8s-infra-cherrypick-robot
30cc82df1a
Bump the all group with 2 updates (#11925)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-02 18:03:16 +01:00
k8s-infra-cherrypick-robot
958f154ac9
Tests: Bump e2e-test-runner to v20240829-2c421762. (#11921)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-29 22:55:30 +01:00
k8s-infra-cherrypick-robot
17ba135668
Images: Trigger test-runner build. (#11917)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-29 19:27:32 +01:00
k8s-infra-cherrypick-robot
569c612748
Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11913)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-29 16:25:30 +01:00
k8s-infra-cherrypick-robot
e38b3cf2da
Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11910)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-29 16:02:43 +02:00
k8s-infra-cherrypick-robot
8de23fc54a
Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11909)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-29 16:02:26 +02:00
k8s-infra-cherrypick-robot
34b9099bf1
Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11908)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-29 14:00:30 +01:00
k8s-infra-cherrypick-robot
b401ff3912
Chart: Add tests for PrometheusRule & ServiceMonitor. (#11889)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-27 11:30:24 +02:00
k8s-infra-cherrypick-robot
13719ac7c5
Annotations: Allow commas in URLs. (#11887)
Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-08-27 01:08:53 +01:00
k8s-infra-cherrypick-robot
2421dd53cf
CI: Grant checks write permissions to E2E Test Report. (#11885)
Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>
Co-authored-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>
2024-08-26 23:42:44 +02:00
Marco Ebert
2e208230df
Chart: Use generic values for ConfigMap test. (#11879) 2024-08-26 22:33:39 +02:00
k8s-infra-cherrypick-robot
27697abbcb
Bump the all group with 2 updates (#11871)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-26 22:32:39 +02:00
k8s-infra-cherrypick-robot
162452b6e8
Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11868)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-26 22:32:14 +02:00
k8s-infra-cherrypick-robot
1165665591
Update maxmind post link about geolite2 license changes (#11881)
Signed-off-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>
Co-authored-by: Seonghyeon Cho <seonghyeoncho96@gmail.com>
2024-08-26 22:31:22 +02:00
Marco Ebert
63369beb6f
Go: Sync go.work.sum. (#11875) 2024-08-26 18:48:41 +02:00
k8s-infra-cherrypick-robot
8be1c5224a
Replace deprecated queue method (#11859)
Co-authored-by: Ricardo Katz <ricardo.katz@gmail.com>
2024-08-24 15:30:27 +02:00
k8s-infra-cherrypick-robot
ee0ccdcdf1
Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11840)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-21 09:55:30 +02:00
k8s-infra-cherrypick-robot
5a287a829a
Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11839)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-21 08:51:11 +01:00
k8s-infra-cherrypick-robot
4f7abea1f9
Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11837)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-21 07:23:12 +01:00
k8s-infra-cherrypick-robot
c142da7a64
Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11836)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-21 07:18:33 +01:00
k8s-infra-cherrypick-robot
0892d2912d
Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11834)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-21 07:16:18 +01:00
k8s-infra-cherrypick-robot
c9e67ea9d4
Auto-generate annotation docs (#11831)
Co-authored-by: Ricardo Katz <ricardo.katz@gmail.com>
2024-08-20 09:56:57 -07:00
Marco Ebert
d3bb2b4f87
Release controller v1.11.2 & chart v4.11.2. (#11814) 2024-08-16 08:54:22 +02:00
k8s-infra-cherrypick-robot
604e634846
Chart: Bump Kube Webhook CertGen & OpenTelemetry. (#11812)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-15 07:19:18 -07:00
Marco Ebert
46e76e5916
Images: Trigger controller build. (#11807) 2024-08-15 11:20:58 +02:00
Marco Ebert
890d39090a
Tests & Docs: Bump images. (#11805)
* Tests: Bump CFSSL.

* Docs: Bump Custom Error Pages.

* Tests: Bump FastCGI HelloServer.

* Tests: Bump HTTPBun.

* Docs: Bump OpenTelemetry.
2024-08-15 09:44:07 +02:00
k8s-infra-cherrypick-robot
e269ab5626
Images: Trigger failed builds. (#11802)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-13 11:58:42 -07:00
k8s-infra-cherrypick-robot
a04d2805dd
Images: Trigger other builds. (#11798)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-13 03:39:34 -07:00
k8s-infra-cherrypick-robot
c419a2ca27
Controller: Fix panic in alternative backend merging. (#11794)
Co-authored-by: joey <zchengjoey@gmail.com>
2024-08-13 03:00:56 -07:00
k8s-infra-cherrypick-robot
5fec9baa79
Tests: Bump e2e-test-runner to v20240812-3f0129aa. (#11792)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-13 00:45:56 -07:00
k8s-infra-cherrypick-robot
645f46ea03
Images: Trigger test-runner build. (#11787)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-12 23:32:48 -07:00
k8s-infra-cherrypick-robot
6fd9c09d07
Images: Bump NGINX_BASE to v0.0.12. (#11784)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-12 17:00:02 -07:00
k8s-infra-cherrypick-robot
ce91e4a057
Images: Trigger NGINX build. (#11781)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-13 00:27:17 +02:00
k8s-infra-cherrypick-robot
2ee9986947
Cloud Build: Add missing config, remove unused ones. (#11777)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-12 23:07:06 +02:00
Marco Ebert
596054a2d9
Generate correct output on NumCPU() when using cgroups2 (#11778)
Co-authored-by: Nicholas Orlowsky <nickorlow@nickorlow.com>
2024-08-12 23:06:45 +02:00
k8s-infra-cherrypick-robot
c31c9b0d06
Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 (#11773)
* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0

Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.19.1 to 2.20.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.19.1...v2.20.0)

* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 elsewhere

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-12 21:47:46 +02:00
k8s-infra-cherrypick-robot
a678bc81a9
Bump the all group with 2 updates (#11771)
Bumps the all group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact) and [github/codeql-action](https://github.com/github/codeql-action).

Updates `actions/upload-artifact` from 4.3.5 to 4.3.6
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](89ef406dd8...834a144ee9)

Updates `github/codeql-action` from 3.25.15 to 3.26.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](afb54ba388...eb055d739a)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-12 06:48:07 -07:00
k8s-infra-cherrypick-robot
5cabe5dd99
Bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#11769)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.25.0 to 0.26.0.
- [Commits](https://github.com/golang/crypto/compare/v0.25.0...v0.26.0)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-12 06:06:29 -07:00
k8s-infra-cherrypick-robot
60e55d351a
Cloud Build: Tweak timeouts. (#11763)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-11 10:07:46 +02:00
k8s-infra-cherrypick-robot
a4a3f0dc1c
Cloud Build: Fix substitutions. (#11760)
Prow hands in some substitutions via arguments we need to ignore.

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-11 10:05:16 +02:00
k8s-infra-cherrypick-robot
1330c06235
Cloud Build: Some chores. (#11757)
* Cloud Build: Remove comment.

* Cloud Build: Add newlines at EOF.

* Cloud Build: Align comment.

* Cloud Build: Remove trailing slash.

* Cloud Build: Remove quotes.

* Cloud Build: Align indentation.

* Cloud Build: Improve quotes.

* Cloud Build: Put arguments in one line.

* Cloud Build: Bump image.

* Cloud Build: Reorder entrypoint.

* Cloud Build: Adjust timeouts.

* Cloud Build: Remove useless files.

* Cloud Build: Remove `substitution_option`.

---------

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-11 10:00:30 +02:00
k8s-infra-cherrypick-robot
9585eb3384
Go: Bump to v1.22.6. (#11749)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-08 08:04:05 -07:00
k8s-infra-cherrypick-robot
735d4a8070
Images: Bump NGINX_BASE to v0.0.11. (#11743)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-06 09:52:50 -07:00
k8s-infra-cherrypick-robot
9d6859ec78
Images: Trigger NGINX build. (#11737)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-05 14:43:14 -07:00
k8s-infra-cherrypick-robot
cf088429b7
docs: update OpenSSL Roadmap link (#11733)
Co-authored-by: Mmx <green.dusk8264@fastmail.com>
2024-08-05 17:33:57 +02:00
k8s-infra-cherrypick-robot
0f8b04ac0d
Go: Bump to v1.22.5. (#11732)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-08-05 17:33:22 +02:00
k8s-infra-cherrypick-robot
16cd212667
Bump the all group with 3 updates (#11728)
Bumps the all group with 3 updates: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).

Updates `docker/setup-buildx-action` from 3.5.0 to 3.6.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](aa33708b10...988b5a0280)

Updates `actions/upload-artifact` from 4.3.4 to 4.3.5
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](0b2256b8c0...89ef406dd8)

Updates `golangci/golangci-lint-action` from 6.0.1 to 6.1.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](a4f60bb28d...aaa42aa062)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-05 07:13:00 -07:00
k8s-infra-cherrypick-robot
85b7b08a6a
Docs: Fix typo in AWS LB Controller reference (#11725)
Co-authored-by: Gaston Festari <cilindrox@gmail.com>
2024-08-05 00:22:39 -07:00
k8s-infra-cherrypick-robot
2fc7a6ec45
Perform some cleaning operations on line breaks. (#11721)
Co-authored-by: André Storfjord Kristiansen <33384479+dev-bio@users.noreply.github.com>
Co-authored-by: Jintao Zhang <zhangjintao9020@gmail.com>
2024-08-02 08:09:20 -07:00
k8s-infra-cherrypick-robot
6cd1f92775
Missing anchors in regular expression. (#11719)
Co-authored-by: André Storfjord Kristiansen <33384479+dev-bio@users.noreply.github.com>
2024-08-02 00:19:23 -07:00
k8s-infra-cherrypick-robot
5b7c0d9bb7
Docs: Fix from-to-www redirect description. (#11716)
Co-authored-by: dvg <vdruginin@gmail.com>
2024-08-01 04:49:12 -07:00
Marco Ebert
78a2b21d76
Chart: Remove isControllerTagValid. (#11713) 2024-08-01 04:41:02 -07:00
k8s-infra-cherrypick-robot
80c9ee7713
Tests: Bump e2e-test-runner to v20240729-04899b27. (#11705)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-29 21:58:28 -07:00
k8s-infra-cherrypick-robot
4099d37272
Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group (#11701)
* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group

Bumps the all group with 1 update: [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo).

Updates `github.com/onsi/ginkgo/v2` from 2.19.0 to 2.19.1
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.19.0...v2.19.1)

* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 elsewhere

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-29 07:39:33 -07:00
k8s-infra-cherrypick-robot
67452e0c8d
Bump the all group with 2 updates (#11698)
Bumps the all group with 2 updates: [ossf/scorecard-action](https://github.com/ossf/scorecard-action) and [github/codeql-action](https://github.com/github/codeql-action).

Updates `ossf/scorecard-action` from 2.3.3 to 2.4.0
- [Release notes](https://github.com/ossf/scorecard-action/releases)
- [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md)
- [Commits](dc50aa9510...62b2cac7ed)

Updates `github/codeql-action` from 3.25.13 to 3.25.15
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](2d790406f5...afb54ba388)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-29 05:57:24 -07:00
k8s-infra-cherrypick-robot
2eefef9845
Docs: Clarify from-to-www redirect direction. (#11693)
* docs: Clarify from-to-www redirect direction.

This was not clear to me when reading the docs whether the ingress will
redirect from non-www to with-www or the reverse. It's also not very
clear from just grepping around the codebase. I found the answer by
reading from this reddit link:

https://www.reddit.com/r/kubernetes/comments/pbl033/k8s_ingress_redirecting_www_to_nonwww_domains/

So, to save time for other people doing the same, which I assumes is a
lot of people since it's a common scenario, this little revision in the
docs is warranted.

* Docs: Implement suggestion.

---------

Co-authored-by: Chakrit Wichian <service@chakrit.net>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-29 02:55:14 -07:00
k8s-infra-cherrypick-robot
5bfe327e4e
Bump the all group with 4 updates (#11677)
Bumps the all group with 4 updates: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/login-action](https://github.com/docker/login-action) and [github/codeql-action](https://github.com/github/codeql-action).

Updates `docker/setup-qemu-action` from 3.1.0 to 3.2.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](5927c834f5...49b3bc8e6b)

Updates `docker/setup-buildx-action` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](4fd812986e...aa33708b10)

Updates `docker/login-action` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](0d4c9c5ea7...9780b0c442)

Updates `github/codeql-action` from 3.25.12 to 3.25.13
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](4fa2a79536...2d790406f5)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 17:24:07 +02:00
k8s-infra-cherrypick-robot
3bb5b50131
Bump the all group with 2 updates (#11675)
* Bump the all group with 2 updates

Bumps the all group with 2 updates: [github.com/ncabatoff/process-exporter](https://github.com/ncabatoff/process-exporter) and [k8s.io/component-base](https://github.com/kubernetes/component-base).

Updates `github.com/ncabatoff/process-exporter` from 0.8.2 to 0.8.3
- [Release notes](https://github.com/ncabatoff/process-exporter/releases)
- [Changelog](https://github.com/ncabatoff/process-exporter/blob/master/cloudbuild.release.yaml)
- [Commits](https://github.com/ncabatoff/process-exporter/compare/v0.8.2...v0.8.3)

Updates `k8s.io/component-base` from 0.30.2 to 0.30.3
- [Commits](https://github.com/kubernetes/component-base/compare/v0.30.2...v0.30.3)

* Metrics/Process: Adapt to API change in `ncabatoff/process-exporter`.

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-22 06:43:22 -07:00
k8s-infra-cherrypick-robot
104dc42adb
added real-client-ip faq (#11664)
Co-authored-by: longwuyuan <longwuyuan@gmail.com>
2024-07-21 09:54:42 -07:00
k8s-infra-cherrypick-robot
386609e14d
Docs: Format NGINX configuration table. (#11662)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-21 03:17:30 -07:00
Marco Ebert
0a3c19d9d6
Docs: Update version in deploy/index.md. (#11652) 2024-07-18 12:37:31 -07:00
Marco Ebert
7b37df8f38
Release controller v1.11.1 & chart v4.11.1. (#11650) 2024-07-18 10:57:33 -07:00
James Strong
7c44f99201
Merge pull request #11649 from Gacko/tpooj
Images: Trigger `controller` v1.11.1 build.
2024-07-18 10:05:42 -04:00
Marco Ebert
863df7da09 Images: Trigger controller v1.11.1 build. 2024-07-18 15:57:41 +02:00
k8s-infra-cherrypick-robot
b5673e957d
Tests: Bump test-runner to v20240717-1fe74b5f. (#11647)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-18 06:11:03 -07:00
k8s-infra-cherrypick-robot
34820545ea
Images: Re-run test-runner build. (#11644)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-18 03:02:07 -07:00
k8s-infra-cherrypick-robot
325f889616
Images: Trigger test-runner build. (#11640)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-18 02:58:00 -07:00
k8s-infra-cherrypick-robot
c3a5c8d333
Images: Bump NGINX_BASE to v0.0.10. (#11638)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-18 00:35:30 -07:00
k8s-infra-cherrypick-robot
ba90d2534c
Images: Trigger NGINX build. (#11632)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-17 15:02:34 -07:00
k8s-infra-cherrypick-robot
eefd069cab
bump testing runner (#11627)
Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-07-16 22:19:07 -07:00
k8s-infra-cherrypick-robot
7d7e632e51
Bump github.com/prometheus/common from 0.54.0 to 0.55.0 (#11621)
* Bump github.com/prometheus/common from 0.54.0 to 0.55.0

Bumps [github.com/prometheus/common](https://github.com/prometheus/common) from 0.54.0 to 0.55.0.
- [Release notes](https://github.com/prometheus/common/releases)
- [Changelog](https://github.com/prometheus/common/blob/main/RELEASE.md)
- [Commits](https://github.com/prometheus/common/compare/v0.54.0...v0.55.0)

* Go: Fix build.

---------

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-16 08:13:00 -07:00
k8s-infra-cherrypick-robot
a3af2999c2
remove modsecurity coreruleset test files from nginx image (#11620)
Co-authored-by: zeeZ <zeeZ@users.noreply.github.com>
2024-07-16 07:37:01 -07:00
k8s-infra-cherrypick-robot
812c47f029
unskip the ocsp tests and update images to fix cfssl bug (#11616)
Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-07-16 01:20:43 -07:00
k8s-infra-cherrypick-robot
72f934b56e
Bump the all group with 5 updates (#11614)
Bumps the all group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/setup-go](https://github.com/actions/setup-go) | `5.0.1` | `5.0.2` |
| [actions/setup-python](https://github.com/actions/setup-python) | `5.1.0` | `5.1.1` |
| [actions/dependency-review-action](https://github.com/actions/dependency-review-action) | `4.3.3` | `4.3.4` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.25.11` | `3.25.12` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) | `0.23.0` | `0.24.0` |

Updates `actions/setup-go` from 5.0.1 to 5.0.2
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](cdcb360436...0a12ed9d6a)

Updates `actions/setup-python` from 5.1.0 to 5.1.1
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](82c7e631bb...39cd14951b)

Updates `actions/dependency-review-action` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](72eb03d02c...5a2ce3f5b9)

Updates `github/codeql-action` from 3.25.11 to 3.25.12
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](b611370bb5...4fa2a79536)

Updates `aquasecurity/trivy-action` from 0.23.0 to 0.24.0
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](7c2007bcb5...6e7b7d1fd3)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-15 09:01:10 -07:00
k8s-infra-cherrypick-robot
4f53d1d6c7
Fix indent in YAML for example pod (#11610)
Co-authored-by: apiwat-chantawibul <billiska@gmail.com>
2024-07-12 00:53:16 -07:00
k8s-infra-cherrypick-robot
53fd0cb5ae
Images: Bump test-runner. (#11605)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-11 08:03:58 -07:00
k8s-infra-cherrypick-robot
5fe6890dd2
Images: Bump NGINX_BASE to v0.0.9. (#11602)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-11 07:42:54 -07:00
k8s-infra-cherrypick-robot
025839dd8b
revert module upgrade (#11597)
Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-07-11 01:11:45 -07:00
Marco Ebert
d5ddfdaf67
Release: Apply changes from main. (#11589) 2024-07-10 01:06:57 -07:00
k8s-infra-cherrypick-robot
1b93fe0ac5
Mage: Stop mutating release notes. (#11581)
* Mage: Implement static check recommendations.

* Mage: Stop mutating release notes.

---------

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-08 13:02:44 -07:00
k8s-infra-cherrypick-robot
2ea8594299
Images: Bump kube-webhook-certgen. (#11584)
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-08 12:55:19 -07:00
k8s-infra-cherrypick-robot
40d444d2ab
Bump golang.org/x/crypto from 0.24.0 to 0.25.0 (#11580)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.24.0 to 0.25.0.
- [Commits](https://github.com/golang/crypto/compare/v0.24.0...v0.25.0)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-08 12:52:50 -07:00
k8s-infra-cherrypick-robot
0b58e5f590
Bump google.golang.org/grpc from 1.64.0 to 1.65.0 (#11576)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.64.0 to 1.65.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.64.0...v1.65.0)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-08 12:50:22 -07:00
k8s-infra-cherrypick-robot
75f8768e45
Bump the all group with 4 updates (#11575)
Bumps the all group with 4 updates: [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action), [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact).

Updates `docker/setup-qemu-action` from 3.0.0 to 3.1.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](68827325e0...5927c834f5)

Updates `docker/setup-buildx-action` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](d70bba72b1...4fd812986e)

Updates `actions/upload-artifact` from 4.3.3 to 4.3.4
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](65462800fd...0b2256b8c0)

Updates `actions/download-artifact` from 4.1.7 to 4.1.8
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](65a9edc588...fa0a91b85d)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-08 12:47:58 -07:00
James Strong
96dea883d6
Merge pull request #11559 from strongjz/release-1.11
bumping TAG for 1.11 release
2024-07-04 16:21:39 -04:00
James Strong
6feeb5a549 bumping TAG for 1.11 release
Signed-off-by: James Strong <strong.james.e@gmail.com>
2024-07-04 13:48:53 -04:00
k8s-infra-cherrypick-robot
7d77bca047
update test runner to latest build (#11558)
Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-07-04 02:30:38 -07:00
k8s-infra-cherrypick-robot
f67052c054
add k8s 1.30 to ci build (#11554)
* add k8s 1.30 to ci build

Signed-off-by: James Strong <strong.james.e@gmail.com>

* force all ci to run on workflow dispatch

Signed-off-by: James Strong <strong.james.e@gmail.com>

* correct the 1.30 version

Signed-off-by: James Strong <strong.james.e@gmail.com>

* Update .github/workflows/ci.yaml

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>

---------

Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
2024-07-04 00:55:00 -07:00
k8s-infra-cherrypick-robot
66fc612ad3
update test runner go base to 3.20 (#11552)
Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-07-03 14:31:00 -07:00
k8s-infra-cherrypick-robot
9bcf45bd9a
tag new test runner image with new nginx base 0.0.8 (#11551)
Signed-off-by: James Strong <strong.james.e@gmail.com>
Co-authored-by: James Strong <strong.james.e@gmail.com>
2024-07-03 14:21:47 -07:00
k8s-infra-cherrypick-robot
d493fb9e39
bump NGINX_BASE to v0.0.8 (#11544)
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
Co-authored-by: Jintao Zhang <zhangjintao9020@gmail.com>
2024-07-03 13:22:18 -07:00
k8s-infra-cherrypick-robot
29aea6afe4
add ssl patches to nginx-1.25 image for coroutines to work in lua client hello and cert ssl blocks (#11535)
* feat: add ssl patches for coroutines to work in lua ssl blocks

Signed-off-by: Jon Carl <grounded042@joncarl.com>

* switch to include more patches

Signed-off-by: Jon Carl <grounded042@joncarl.com>

---------

Signed-off-by: Jon Carl <grounded042@joncarl.com>
Co-authored-by: Jon Carl <grounded042@joncarl.com>
2024-07-02 14:22:27 -07:00
k8s-infra-cherrypick-robot
d1e27b516a
trigger build for NGINX-1.25 v0.0.8 (#11539)
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
Co-authored-by: Jintao Zhang <zhangjintao9020@gmail.com>
2024-07-02 22:29:09 +02:00
k8s-infra-cherrypick-robot
0377536928
bump alpine version to 3.20 to custom-error-pages (#11538)
Co-authored-by: Olivier Wenger <olivier.wenger@liip.ch>
2024-07-02 08:51:59 -07:00
k8s-infra-cherrypick-robot
52f89fa1be
fix: Ensure changes in MatchCN annotation are detected (#11529)
Co-authored-by: Wouter Dullaert <wouter.dullaert@exoscale.ch>
2024-07-02 10:29:41 +02:00
324 changed files with 5620 additions and 3950 deletions

View file

@ -37,7 +37,7 @@ This questions are the first thing we need to know to understand the context.
<!-- What do you think went wrong? -->
**NGINX Ingress controller version** (exec into the pod and run `/nginx-ingress-controller --version`):
**NGINX Ingress controller version** (exec into the pod and run nginx-ingress-controller --version.):
<!--
POD_NAMESPACE=ingress-nginx
POD_NAME=$(kubectl get pods -n $POD_NAMESPACE -l app.kubernetes.io/name=ingress-nginx --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}')

View file

@ -5,6 +5,7 @@ title: ''
labels: kind/bug
assignees:
- Gacko
- rikatz
- strongjz
---

View file

@ -23,7 +23,7 @@ jobs:
steps:
- name: Set up Python
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
with:
python-version: 3.x
@ -31,12 +31,12 @@ jobs:
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
- name: Set up Helm Chart Testing
uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
- name: Set up Artifact Hub
run: |
curl --fail --location https://github.com/artifacthub/hub/releases/download/v1.20.0/ah_1.20.0_linux_amd64.tar.gz --output /tmp/ah.tar.gz
echo "9027626f19ff9f3ac668f222917130ac885e289e922e1428bfd2e7f066324e31 /tmp/ah.tar.gz" | shasum --check
curl --fail --location https://github.com/artifacthub/hub/releases/download/v1.19.0/ah_1.19.0_linux_amd64.tar.gz --output /tmp/ah.tar.gz
echo "0e430493521ce387ca04d79b26646a86f92886dbcceb44985bb71082a9530ca5 /tmp/ah.tar.gz" | shasum --check
sudo tar --extract --file /tmp/ah.tar.gz --directory /usr/local/bin ah
- name: Set up Git
@ -45,7 +45,7 @@ jobs:
git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
with:
fetch-depth: 0
@ -55,7 +55,7 @@ jobs:
ah lint --path charts/ingress-nginx
- name: Release chart
uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
env:
CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
CR_RELEASE_NAME_TEMPLATE: helm-chart-{{ .Version }}

View file

@ -47,7 +47,7 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
@ -71,22 +71,6 @@ jobs:
- 'images/nginx/**'
docs:
- '**/*.md'
lua:
- '**/*.lua'
lua-lint:
runs-on: ubuntu-latest
needs: changes
if: |
(needs.changes.outputs.lua == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Lint Lua
uses: lunarmodules/luacheck@v1
with:
args: --codes --globals lua_ingress --globals configuration --globals balancer --globals monitor --globals certificate --globals tcp_udp_configuration --globals tcp_udp_balancer --no-max-comment-line-length -q rootfs/etc/nginx/lua/
test-go:
runs-on: ubuntu-latest
@ -95,14 +79,14 @@ jobs:
(needs.changes.outputs.go == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Get go version
run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
- name: Set up Go
id: go
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: ${{ env.GOLANG_VERSION }}
check-latest: true
@ -119,12 +103,12 @@ jobs:
(needs.changes.outputs.go == 'true') || (needs.changes.outputs.docs == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Get go version
run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
- name: Set up Go
id: go
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: ${{ env.GOLANG_VERSION }}
check-latest: true
@ -144,7 +128,7 @@ jobs:
PLATFORMS: linux/amd64
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Get go version
id: golangversion
@ -153,17 +137,17 @@ jobs:
- name: Set up Go
id: go
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: ${{ steps.golangversion.outputs.version }}
check-latest: true
- name: Set up QEMU
uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3.4.0
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
with:
version: latest
@ -172,7 +156,7 @@ jobs:
- name: Prepare Host
run: |
curl -LO https://dl.k8s.io/release/v1.32.2/bin/linux/amd64/kubectl
curl -LO https://dl.k8s.io/release/v1.27.3/bin/linux/amd64/kubectl
chmod +x ./kubectl
sudo mv ./kubectl /usr/local/bin/kubectl
@ -202,7 +186,7 @@ jobs:
| gzip > docker.tar.gz
- name: cache
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
with:
name: docker.tar.gz
path: docker.tar.gz
@ -218,7 +202,7 @@ jobs:
steps:
- name: Set up Python
uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
with:
python-version: 3.x
@ -226,12 +210,12 @@ jobs:
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
- name: Set up Helm Chart Testing
uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
- name: Set up Artifact Hub
run: |
curl --fail --location https://github.com/artifacthub/hub/releases/download/v1.20.0/ah_1.20.0_linux_amd64.tar.gz --output /tmp/ah.tar.gz
echo "9027626f19ff9f3ac668f222917130ac885e289e922e1428bfd2e7f066324e31 /tmp/ah.tar.gz" | shasum --check
curl --fail --location https://github.com/artifacthub/hub/releases/download/v1.19.0/ah_1.19.0_linux_amd64.tar.gz --output /tmp/ah.tar.gz
echo "0e430493521ce387ca04d79b26646a86f92886dbcceb44985bb71082a9530ca5 /tmp/ah.tar.gz" | shasum --check
sudo tar --extract --file /tmp/ah.tar.gz --directory /usr/local/bin ah
- name: Set up Helm Docs
@ -241,7 +225,7 @@ jobs:
run: helm plugin install https://github.com/helm-unittest/helm-unittest
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
with:
fetch-depth: 0
@ -256,7 +240,7 @@ jobs:
git diff --exit-code charts/ingress-nginx/README.md
- name: Run tests
run: helm unittest charts/ingress-nginx --file "tests/**/*_test.yaml"
run: helm unittest charts/ingress-nginx
chart-test:
name: Chart / Test
@ -270,11 +254,11 @@ jobs:
strategy:
matrix:
k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Download cache
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@ -301,11 +285,26 @@ jobs:
(needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
strategy:
matrix:
k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
with:
k8s-version: ${{ matrix.k8s }}
kubernetes-validations:
name: Kubernetes with Validations
needs:
- changes
- build
if: |
(needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
strategy:
matrix:
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
with:
k8s-version: ${{ matrix.k8s }}
variation: "VALIDATIONS"
kubernetes-chroot:
name: Kubernetes chroot
needs:
@ -315,7 +314,7 @@ jobs:
(needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
strategy:
matrix:
k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
with:
k8s-version: ${{ matrix.k8s }}

View file

@ -9,6 +9,6 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: 'Checkout Repository'
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: 'Dependency Review'
uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

View file

@ -23,7 +23,7 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
@ -47,7 +47,7 @@ jobs:
steps:
- name: Checkout master
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Deploy
uses: ./.github/actions/mkdocs

View file

@ -15,20 +15,19 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Get go version
run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
- name: Set up Go
id: go
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: ${{ env.GOLANG_VERSION }}
check-latest: true
- name: golangci-lint
uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
with:
version: v1.62
only-new-issues: true
version: v1.56

View file

@ -36,10 +36,11 @@ jobs:
kube-webhook-certgen: ${{ steps.filter.outputs.kube-webhook-certgen }}
ext-auth-example-authsvc: ${{ steps.filter.outputs.ext-auth-example-authsvc }}
nginx: ${{ steps.filter.outputs.nginx }}
opentelemetry: ${{ steps.filter.outputs.opentelemetry }}
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
@ -63,6 +64,8 @@ jobs:
- 'images/ext-auth-example-authsvc/**'
nginx:
- 'images/nginx/**'
opentelemetry:
- 'images/opentelemetry/**'
#### TODO: Make the below jobs 'less dumb' and use the job name as parameter (the github.job context does not work here)
cfssl:
@ -135,17 +138,17 @@ jobs:
(needs.changes.outputs.kube-webhook-certgen == 'true')
strategy:
matrix:
k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Get go version
run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
- name: Set up Go
id: go
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: ${{ env.GOLANG_VERSION }}
check-latest: true
@ -160,6 +163,23 @@ jobs:
run: |
cd images/ && make NAME=kube-webhook-certgen test test-e2e
opentelemetry:
runs-on: ubuntu-latest
env:
PLATFORMS: linux/amd64,linux/arm,linux/arm64
needs: changes
if: |
(needs.changes.outputs.opentelemetry == 'true')
strategy:
matrix:
nginx: ['1.25.3', '1.21.6']
steps:
- name: Checkout
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: image build
run: |
cd images/opentelemetry && make NGINX_VERSION=${{ matrix.nginx }} build
nginx:
permissions:
contents: write
@ -172,12 +192,12 @@ jobs:
PLATFORMS: linux/amd64,linux/arm,linux/arm64
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Set up QEMU
uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3.4.0
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
with:
version: latest
platforms: ${{ env.PLATFORMS }}

View file

@ -19,7 +19,7 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Install K6
run: |

View file

@ -12,7 +12,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
with:
fetch-depth: 0
@ -20,31 +20,31 @@ jobs:
run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
- name: Set up Go
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: ${{ env.GOLANG_VERSION }}
check-latest: true
- name: Run GoReleaser Snapshot
if: ${{ ! startsWith(github.ref, 'refs/tags/') }}
uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
with:
version: "~> v2"
version: latest
args: release --snapshot --clean
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Run GoReleaser
if: ${{ startsWith(github.ref, 'refs/tags/') }}
uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
with:
version: "~> v2"
version: latest
args: release --clean
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Update new version in krew-index
if: ${{ startsWith(github.ref, 'refs/tags/') }}
uses: rajatjindal/krew-release-bot@3d9faef30a82761d610544f62afddca00993eef9 # v0.0.47
uses: rajatjindal/krew-release-bot@df3eb197549e3568be8b4767eec31c5e8e8e6ad8 # v0.0.46
with:
krew_template_file: cmd/plugin/krew.yaml

View file

@ -27,7 +27,7 @@ jobs:
steps:
- name: "Checkout code"
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
with:
persist-credentials: false
@ -51,7 +51,7 @@ jobs:
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
# format to the repository Actions tab.
- name: "Upload artifact"
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
with:
name: SARIF file
path: results.sarif
@ -59,6 +59,6 @@ jobs:
# Upload the results to GitHub's code scanning dashboard.
- name: "Upload to code-scanning"
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
uses: github/codeql-action/upload-sarif@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
with:
sarif_file: results.sarif

View file

@ -13,7 +13,7 @@ jobs:
pull-requests: write
steps:
- uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
with:
stale-issue-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack."
stale-pr-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack."

View file

@ -22,7 +22,7 @@ jobs:
versions: ${{ steps.version.outputs.TAGS }}
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
with:
fetch-depth: 0
@ -52,7 +52,7 @@ jobs:
versions: ${{ fromJSON(needs.version.outputs.versions) }}
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- shell: bash
id: test
@ -60,7 +60,7 @@ jobs:
- name: Scan image with AquaSec/Trivy
id: scan
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
with:
image-ref: registry.k8s.io/ingress-nginx/controller:${{ matrix.versions }}
format: 'sarif'
@ -75,7 +75,7 @@ jobs:
# This step checks out a copy of your repository.
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
uses: github/codeql-action/upload-sarif@c36620d31ac7c881962c3d9dd939c40ec9434f2b # v3.26.12
with:
token: ${{ github.token }}
# Path to SARIF file relative to the root of the repository

View file

@ -31,7 +31,7 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
@ -48,7 +48,7 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Build
run: |
@ -67,7 +67,7 @@ jobs:
PLATFORMS: ${{ inputs.platforms-publish }}
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: Login to GitHub Container Registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0

View file

@ -20,7 +20,7 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
- name: cache
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@ -43,13 +43,14 @@ jobs:
SKIP_CLUSTER_CREATION: true
SKIP_INGRESS_IMAGE_CREATION: true
SKIP_E2E_IMAGE_CREATION: true
ENABLE_VALIDATIONS: ${{ inputs.variation == 'VALIDATIONS' }}
IS_CHROOT: ${{ inputs.variation == 'CHROOT' }}
run: |
kind get kubeconfig > $HOME/.kube/kind-config-kind
make kind-e2e-test
- name: Upload e2e junit-reports ${{ inputs.variation }}
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
uses: actions/upload-artifact@604373da6381bf24206979c74d06a550515601b9 # v4.4.1
if: success() || failure()
with:
name: e2e-test-reports-${{ inputs.k8s-version }}${{ inputs.variation }}

View file

@ -2,7 +2,6 @@ run:
timeout: 10m
allow-parallel-runners: true
issues:
# Maximum issues count per one linter. Set to 0 to disable. Default is 50.
max-issues-per-linter: 0
@ -23,6 +22,7 @@ linters:
- errcheck
- errchkjson
- errname
- execinquery
- ginkgolinter
- gocheckcompilerdirectives
- goconst
@ -227,6 +227,9 @@ linters-settings:
nolintlint:
# Enable to ensure that nolint directives are all used. Default is true.
allow-unused: false
# Disable to ensure that nolint directives don't have a leading space. Default is true.
# TODO(lint): Enforce machine-readable `nolint` directives
allow-leading-space: true
# Exclude following linters from requiring an explanation. Default is [].
allow-no-explanation: []
# Enable to require an explanation of nonzero length after each nolint directive. Default is false.

View file

@ -1,6 +1,6 @@
std = 'ngx_lua'
max_line_length = 100
exclude_files = {'./rootfs/etc/nginx/lua/test/**/*.lua'}
exclude_files = {'./rootfs/etc/nginx/lua/test/**/*.lua', './rootfs/etc/nginx/lua/plugins/**/test/**/*.lua'}
files["rootfs/etc/nginx/lua/lua_ingress.lua"] = {
ignore = { "122" },
-- TODO(elvinefendi) figure out why this does not work

View file

@ -1 +1 @@
1.23.6
1.22.8

View file

@ -93,7 +93,7 @@ Promoting the images basically means that images, that were pushed to staging co
```
...
pushing manifest for us-central1-docker.pkg.dev/k8s-staging-images/ingress-nginx/controller:v1.0.2@sha256:e15fac6e8474d77e1f017edc33d804ce72a184e3c0a30963b2a0d7f0b89f6b16
pushing manifest for gcr.io/k8s-staging-ingress-nginx/controller:v1.0.2@sha256:e15fac6e8474d77e1f017edc33d804ce72a184e3c0a30963b2a0d7f0b89f6b16
...
```
@ -113,7 +113,7 @@ Promoting the images basically means that images, that were pushed to staging co
- For making, it easier, you can edit your branch directly in the browser. But be careful about making any mistake.
- Insert the sha(s) & the tag(s), in a new line, in this file [Project kubernetes/k8s.io Ingress-Nginx-Controller Images](https://github.com/kubernetes/k8s.io/blob/main/registry.k8s.io/images/k8s-staging-ingress-nginx/images.yaml) Look at this [example PR and the diff](https://github.com/kubernetes/k8s.io/pull/2536) to see how it was done before
- Insert the sha(s) & the tag(s), in a new line, in this file [Project kubernetes/k8s.io Ingress-Nginx-Controller Images](https://github.com/kubernetes/k8s.io/blob/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml) Look at this [example PR and the diff](https://github.com/kubernetes/k8s.io/pull/2536) to see how it was done before
- Save and commit

View file

@ -58,7 +58,7 @@ ifneq ($(PLATFORM),)
PLATFORM_FLAG="--platform"
endif
REGISTRY ?= us-central1-docker.pkg.dev/k8s-staging-images/ingress-nginx
REGISTRY ?= gcr.io/k8s-staging-ingress-nginx
BASE_IMAGE ?= $(shell cat NGINX_BASE)
@ -110,7 +110,7 @@ clean-chroot-image: ## Removes local image
.PHONY: build
build: ## Build ingress controller, debug tool and pre-stop hook.
E2E_IMAGE=golang:$(GO_VERSION)-alpine3.21 USE_SHELL=/bin/sh build/run-in-docker.sh \
E2E_IMAGE=golang:$(GO_VERSION)-alpine3.20 USE_SHELL=/bin/sh build/run-in-docker.sh \
MAC_OS=$(MAC_OS) \
PKG=$(PKG) \
ARCH=$(ARCH) \

View file

@ -325,9 +325,9 @@ minikube start
🐳 Preparing Kubernetes v1.23.3 on Docker 20.10.12 ...
▪ kubelet.housekeeping-interval=5m
🔎 Verifying Kubernetes components...
▪ Using image registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1
▪ Using image registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1
▪ Using image registry.k8s.io/ingress-nginx/controller:v1.2.1
▪ Using image k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.1.1
▪ Using image k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.1.1
▪ Using image k8s.gcr.io/ingress-nginx/controller:v1.2.1
▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
🔎 Verifying ingress addon...
🌟 Enabled addons: ingress, storage-provisioner, default-storageclass

View file

@ -1 +1 @@
registry.k8s.io/ingress-nginx/nginx:v2.0.0@sha256:3e7bda4cf5111d283ed1e4ff5cc9a2b5cdc5ebe62d50ba67473d3e25b1389133
registry.k8s.io/ingress-nginx/nginx:v0.1.0@sha256:87dcd5ed0206161b86f3767ccdc592716617481e3eac89bfc46ec515419c0b94

1
OWNERS
View file

@ -10,4 +10,3 @@ emeritus_approvers:
- aledbf # 2020-04-02
- bowei # 2022-10-12
- ElvinEfendi # 2023-04-23
- rikatz # 2024-12-15

View file

@ -1,17 +1,40 @@
# See the OWNERS docs: https://www.kubernetes.dev/docs/guide/owners
aliases:
sig-network-leads:
- caseydavenport
- dcbw
- thockin
ingress-nginx-admins:
- Gacko
- rikatz
- strongjz
ingress-nginx-maintainers:
- cpanato
- Gacko
- puerco
- rikatz
- strongjz
- tao12345666333
ingress-nginx-reviewers:
- cpanato
- Gacko
- puerco
- rikatz
- strongjz
- tao12345666333
ingress-nginx-helm-maintainers:
- ubergesundheit
ingress-nginx-helm-reviewers:
- ubergesundheit
ingress-nginx-docs-maintainers:
- longwuyuan
ingress-nginx-kube-webhook-certgen-reviewers:
- invidian

View file

@ -39,20 +39,13 @@ the versions listed. Ingress-Nginx versions **may** work on older versions, but
| Supported | Ingress-NGINX version | k8s supported version | Alpine Version | Nginx Version | Helm Chart Version |
| :-------: | --------------------- | ----------------------------- | -------------- | ------------- | ------------------ |
| 🔄 | **v1.12.0** | 1.32, 1.31, 1.30, 1.29, 1.28 | 3.21.0 | 1.25.5 | 4.12.0 |
| 🔄 | **v1.12.0-beta.0** | 1.32, 1.31, 1.30, 1.29, 1.28 | 3.20.3 | 1.25.5 | 4.12.0-beta.0 |
| 🔄 | **v1.11.4** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.21.0 | 1.25.5 | 4.11.4 |
| 🔄 | **v1.11.3** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.3 | 1.25.5 | 4.11.3 |
| 🔄 | **v1.11.2** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.0 | 1.25.5 | 4.11.2 |
| 🔄 | **v1.11.1** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.0 | 1.25.5 | 4.11.1 |
| 🔄 | **v1.11.0** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.0 | 1.25.5 | 4.11.0 |
| | **v1.10.6** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.21.0 | 1.25.5 | 4.10.6 |
| | **v1.10.5** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.3 | 1.25.5 | 4.10.5 |
| | **v1.10.4** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.0 | 1.25.5 | 4.10.4 |
| | **v1.10.3** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.0 | 1.25.5 | 4.10.3 |
| | **v1.10.2** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.0 | 1.25.5 | 4.10.2 |
| | **v1.10.1** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.19.1 | 1.25.3 | 4.10.1 |
| | **v1.10.0** | 1.29, 1.28, 1.27, 1.26 | 3.19.1 | 1.25.3 | 4.10.0 |
| 🔄 | **v1.10.2** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.20.0 | 1.25.5 | 4.10.2 |
| 🔄 | **v1.10.1** | 1.30, 1.29, 1.28, 1.27, 1.26 | 3.19.1 | 1.25.3 | 4.10.1 |
| 🔄 | **v1.10.0** | 1.29, 1.28, 1.27, 1.26 | 3.19.1 | 1.25.3 | 4.10.0 |
| | v1.9.6 | 1.29, 1.28, 1.27, 1.26, 1.25 | 3.19.0 | 1.21.6 | 4.9.1 |
| | v1.9.5 | 1.28, 1.27, 1.26, 1.25 | 3.18.4 | 1.21.6 | 4.9.0 |
| | v1.9.4 | 1.28, 1.27, 1.26, 1.25 | 3.18.4 | 1.21.6 | 4.8.3 |

View file

@ -10,4 +10,5 @@
# DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
# INSTRUCTIONS AT https://kubernetes.io/security/
Gacko
rikatz
strongjz

1
TAG Normal file
View file

@ -0,0 +1 @@
v1.11.3

View file

@ -64,7 +64,7 @@ echo "[dev-env] building image"
make build image
docker tag "${REGISTRY}/controller:${TAG}" "${DEV_IMAGE}"
export K8S_VERSION=${K8S_VERSION:-v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027}
export K8S_VERSION=${K8S_VERSION:-v1.29.2@sha256:51a1434a5397193442f0be2a297b488b6c919ce8a3931be0ce822606ea5ca245}
KIND_CLUSTER_NAME="ingress-nginx-dev"

View file

@ -26,11 +26,14 @@ set -o nounset
set -o pipefail
# temporal directory for the /etc/ingress-controller directory
if [[ "$OSTYPE" == darwin* ]]; then
if [[ "$OSTYPE" == darwin* ]] && [[ "$RUNTIME" == podman ]]; then
mkdir -p "tmp"
INGRESS_VOLUME=$(pwd)/$(mktemp -d tmp/XXXXXX)
else
INGRESS_VOLUME=$(mktemp -d)
if [[ "$OSTYPE" == darwin* ]]; then
INGRESS_VOLUME=/private$INGRESS_VOLUME
fi
fi
# make sure directory for SSL cert storage exists under ingress volume
@ -41,7 +44,7 @@ function cleanup {
}
trap cleanup EXIT
E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20250112-a188f4eb@sha256:043038b1e30e5a0b64f3f919f096c5c9488ac3f617ac094b07fb9db8215f9441}
E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20241004-114a6abb@sha256:1389ec0589abbf5c431c9290c4c307437c8396995c63dda5eac26abd70963dc8}
if [[ "$RUNTIME" == podman ]]; then
# Podman does not support both tag and digest
@ -79,7 +82,7 @@ if [[ "$DOCKER_IN_DOCKER_ENABLED" == "true" ]]; then
echo "..reached DIND check TRUE block, inside run-in-docker.sh"
echo "FLAGS=$FLAGS"
#go env
go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.22.2
go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.20.2
find / -type f -name ginkgo 2>/dev/null
which ginkgo
/bin/bash -c "${FLAGS}"

View file

@ -1,37 +0,0 @@
# Changelog
### controller-v1.10.3
Images:
* registry.k8s.io/ingress-nginx/controller:v1.10.3@sha256:b5a5082f8e508cc1aac1c0ef101dc2f87b63d51598a5747d81d6cf6e7ba058fd
* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.3@sha256:9033e04bd3cd01f92414f8d5999c5095734d4caceb4923942298152a38373d4b
### All changes:
* Images: Trigger `controller` v1.10.3 build. (#11648)
* Tests: Bump `test-runner` to v20240717-1fe74b5f. (#11646)
* Images: Re-run `test-runner` build. (#11643)
* Images: Trigger `test-runner` build. (#11639)
* Images: Bump `NGINX_BASE` to v0.0.10. (#11637)
* Images: Trigger NGINX build. (#11631)
* bump testing runner (#11626)
* remove modsecurity coreruleset test files from nginx image (#11619)
* unskip the ocsp tests and update images to fix cfssl bug (#11615)
* Fix indent in YAML for example pod (#11609)
* Images: Bump `test-runner`. (#11604)
* Images: Bump `NGINX_BASE` to v0.0.9. (#11601)
* revert module upgrade (#11595)
* README: Fix support matrix. (#11593)
* Mage: Stop mutating release notes. (#11582)
* Images: Bump `kube-webhook-certgen`. (#11583)
### Dependency updates:
* Bump github.com/prometheus/common from 0.54.0 to 0.55.0 (#11622)
* Bump the all group with 5 updates (#11613)
* Bump golang.org/x/crypto from 0.24.0 to 0.25.0 (#11579)
* Bump google.golang.org/grpc from 1.64.0 to 1.65.0 (#11577)
* Bump the all group with 4 updates (#11574)
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.2...controller-v1.10.3

View file

@ -1,53 +0,0 @@
# Changelog
### controller-v1.10.4
Images:
* registry.k8s.io/ingress-nginx/controller:v1.10.4@sha256:505b9048c02dde3d6c8667bf0b52aba7b36adf7b03da34c47d5fa312d2d4c6fc
* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.4@sha256:bf71acf6e71830a4470e2183e3bc93c4f006b954f8a05fb434242ef0f8a24858
### All changes:
* Chart: Bump Kube Webhook CertGen & OpenTelemetry. (#11811)
* Images: Trigger controller build. (#11808)
* Tests & Docs: Bump images. (#11804)
* Images: Trigger failed builds. (#11801)
* Images: Trigger other builds. (#11797)
* Controller: Fix panic in alternative backend merging. (#11793)
* Tests: Bump `e2e-test-runner` to v20240812-3f0129aa. (#11791)
* Images: Trigger `test-runner` build. (#11786)
* Images: Bump `NGINX_BASE` to v0.0.12. (#11783)
* Images: Trigger NGINX build. (#11780)
* Cloud Build: Add missing config, remove unused ones. (#11776)
* Generate correct output on NumCPU() when using cgroups2 (#11775)
* Cloud Build: Tweak timeouts. (#11762)
* Cloud Build: Fix substitutions. (#11759)
* Cloud Build: Some chores. (#11756)
* Go: Bump to v1.22.6. (#11748)
* Images: Bump `NGINX_BASE` to v0.0.11. (#11744)
* Images: Trigger NGINX build. (#11736)
* docs: update OpenSSL Roadmap link (#11734)
* Go: Bump to v1.22.5. (#11731)
* Docs: Fix typo in AWS LB Controller reference (#11724)
* Perform some cleaning operations on line breaks. (#11722)
* Missing anchors in regular expression. (#11718)
* Docs: Fix `from-to-www` redirect description. (#11715)
* Chart: Remove `isControllerTagValid`. (#11714)
* Tests: Bump `e2e-test-runner` to v20240729-04899b27. (#11704)
* Docs: Clarify `from-to-www` redirect direction. (#11692)
* added real-client-ip faq (#11665)
* Docs: Format NGINX configuration table. (#11660)
### Dependency updates:
* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 (#11772)
* Bump the all group with 2 updates (#11770)
* Bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#11768)
* Bump the all group with 3 updates (#11729)
* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group (#11700)
* Bump the all group with 2 updates (#11697)
* Bump the all group with 4 updates (#11676)
* Bump the all group with 2 updates (#11674)
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.3...controller-v1.10.4

View file

@ -1,90 +0,0 @@
# Changelog
### controller-v1.10.5
Images:
* registry.k8s.io/ingress-nginx/controller:v1.10.5@sha256:c84d11b1f7bd14ebbf49918a7f0dc01b31c0c6e757e0129520ea93453096315c
* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.5@sha256:030a43bdd5f0212a7e135cc4da76b15a6706ef65a6824eb4cc401f87a81c2987
### All changes:
* Images: Trigger controller build. (#12133)
* Tests & Docs: Bump `e2e-test-echo` to v1.0.1. (#12146)
* Images: Trigger `e2e-test-echo` build. (#12142)
* Images: Drop `s390x`. (#12139)
* Images: Build `s390x` controller. (#12128)
* Chart: Bump Kube Webhook CertGen. (#12122)
* Tests & Docs: Bump images. (#12120)
* Cloud Build: Bump `gcb-docker-gcloud` to v20240718-5ef92b5c36. (#12116)
* Images: Trigger other builds. (#12111)
* Tests: Bump `e2e-test-runner` to v20241004-114a6abb. (#12104)
* Images: Trigger `test-runner` build. (#12101)
* Docs: Add a multi-tenant warning. (#12098)
* Go: Bump to v1.22.8. (#12093)
* Images: Bump `NGINX_BASE` to v0.1.0. (#12079)
* Images: Trigger NGINX build. (#12077)
* Images: Remove NGINX v1.21. (#12057)
* GitHub: Improve Dependabot. (#12037)
* Chart: Improve CI. (#12029)
* Chart: Extend image tests. (#12026)
* Docs: Add health check annotations for AWS. (#12021)
* Docs: Convert `opentelemetry.md` from CRLF to LF. (#12007)
* Chart: Test `controller.minAvailable` & `controller.maxUnavailable`. (#12001)
* Chart: Align default backend `PodDisruptionBudget`. (#11998)
* Metrics: Fix namespace in `nginx_ingress_controller_ssl_expire_time_seconds`. (#11985)
* Chart: Improve default backend service account. (#11973)
* Go: Bump to v1.22.7. (#11969)
* Images: Bump OpenTelemetry C++ Contrib. (#11950)
* Docs: Add note about `--watch-namespace`. (#11948)
* Images: Use latest Alpine 3.20 everywhere. (#11945)
* Fix minor typos (#11940)
* Chart: Implement `controller.admissionWebhooks.service.servicePort`. (#11933)
* Tests: Bump `e2e-test-runner` to v20240829-2c421762. (#11920)
* Images: Trigger `test-runner` build. (#11918)
* Chart: Add tests for `PrometheusRule` & `ServiceMonitor`. (#11888)
* Annotations: Allow commas in URLs. (#11886)
* CI: Grant checks write permissions to E2E Test Report. (#11884)
* Update maxmind post link about geolite2 license changes (#11880)
* Go: Sync `go.work.sum`. (#11876)
* Replace deprecated queue method (#11858)
* Auto-generate annotation docs (#11835)
### Dependency updates:
* Bump the actions group with 3 updates (#12150)
* Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12108)
* Bump the actions group with 3 updates (#12096)
* Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12088)
* Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12086)
* Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12084)
* Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12082)
* Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12054)
* Bump the go group across 1 directory with 3 updates (#12052)
* Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12048)
* Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12044)
* Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12045)
* Bump the all group with 2 updates (#12035)
* Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12015)
* Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12013)
* Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12011)
* Bump the all group with 2 updates (#11979)
* Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11978)
* Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11960)
* Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11959)
* Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11956)
* Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11929)
* Bump the all group with 2 updates (#11924)
* Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11912)
* Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11907)
* Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11906)
* Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11905)
* Bump the all group with 2 updates (#11870)
* Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11869)
* Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11848)
* Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11847)
* Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11846)
* Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11841)
* Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11833)
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.4...controller-v1.10.5

View file

@ -1,92 +0,0 @@
# Changelog
### controller-v1.10.6
Images:
* registry.k8s.io/ingress-nginx/controller:v1.10.6@sha256:b6fbd102255edb3ba8e5421feebe14fd3e94cf53d199af9e40687f536152189c
* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.6@sha256:44ceedafc0e04a75521b5d472c1b6b5cc08afb8038b5bbfd79c21d066ccf300e
### All changes:
* Images: Trigger controller build. (#12611)
* Chart: Bump Kube Webhook CertGen. (#12608)
* Tests & Docs: Bump images. (#12605)
* Images: Trigger other builds (2/2). (#12598)
* Images: Trigger other builds (1/2). (#12597)
* Tests: Bump `e2e-test-runner` to v20241224-68ed4e7b. (#12592)
* Images: Trigger `test-runner` build. (#12586)
* Images: Bump `NGINX_BASE` to v0.2.0. (#12584)
* Images: Trigger NGINX build. (#12578)
* Go: Clean `go.work.sum`. (#12575)
* Repository: Update owners. (#12570)
* Images: Bump `gcb-docker-gcloud` to v20241217-ff46a068cd. (#12563)
* CI: Update KIND images. (#12559)
* Images: Bump Alpine to v3.21. (#12530)
* Docs: Add guide on how to set a Maintenance Page. (#12527)
* rikatz is stepping down (#12518)
* rikatz is stepping down (#12497)
* Go: Bump to v1.23.4. (#12485)
* Plugin: Bump `goreleaser` to v2. (#12442)
* GitHub: Fix `exec` in issue template. (#12389)
* CI: Update KIND images. (#12368)
* Images: Bump `gcb-docker-gcloud` to v20241110-72bb0b1665. (#12341)
* Go: Bump to v1.23.3. (#12339)
* Auth TLS: Add `_` to redirect RegEx. (#12328)
* Auth TLS: Improve redirect RegEx. (#12321)
* Tests: Bump `e2e-test-runner` to v20241104-02a3933e. (#12314)
* Images: Trigger `test-runner` build. (#12307)
* Config: Fix panic on invalid `lua-shared-dict`. (#12282)
* Docs: fix limit-rate-after references (#12280)
* Chart: Rework ServiceMonitor. (#12268)
* Chart: Add ServiceAccount tests. (#12266)
* CI: Fix chart testing. (#12260)
* [fix] fix nginx temp configs cleanup (#12224)
* Chart: Suggest `matchLabelKeys` in Topology Spread Constraints. (#12204)
* Docs: Add Pod Security Admission. (#12198)
* Docs: Clarify external & service port in TCP/UDP services explanation. (#12194)
### Dependency updates:
* Bump k8s.io/apiextensions-apiserver from 0.31.3 to 0.32.0 (#12565)
* Bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 (#12557)
* Bump k8s.io/code-generator from 0.31.3 to 0.32.0 (#12552)
* Bump k8s.io/cli-runtime from 0.31.3 to 0.32.0 (#12549)
* Bump k8s.io/apiserver from 0.31.3 to 0.32.0 (#12546)
* Bump the actions group with 2 updates (#12543)
* Bump google.golang.org/grpc from 1.68.1 to 1.69.2 (#12540)
* Bump k8s.io/client-go from 0.31.3 to 0.32.0 (#12514)
* Bump github.com/opencontainers/runc from 1.2.2 to 1.2.3 in the go group across 1 directory (#12511)
* Bump the actions group with 3 updates (#12508)
* Bump k8s.io/kube-aggregator from 0.31.3 to 0.32.0 in /images/kube-webhook-certgen/rootfs (#12504)
* Bump k8s.io/apimachinery from 0.31.3 to 0.32.0 in /images/ext-auth-example-authsvc/rootfs (#12501)
* Bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#12478)
* Bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /magefiles (#12473)
* Bump github.com/prometheus/common from 0.60.1 to 0.61.0 (#12466)
* Bump github/codeql-action from 3.27.5 to 3.27.6 in the actions group (#12463)
* Bump the go group across 1 directory with 2 updates (#12459)
* Bump github.com/onsi/ginkgo/v2 from 2.21.0 to 2.22.0 (#12425)
* Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#12416)
* Bump the go group across 3 directories with 10 updates (#12414)
* Bump the actions group with 3 updates (#12410)
* Bump github.com/opencontainers/runc from 1.2.1 to 1.2.2 in the go group across 1 directory (#12382)
* Bump github/codeql-action from 3.27.1 to 3.27.4 in the actions group (#12375)
* Bump golangci-lint on actions and disable deprecated linters (#12363)
* Bump google.golang.org/grpc from 1.67.1 to 1.68.0 (#12356)
* Bump the actions group with 3 updates (#12353)
* Bump golang.org/x/crypto from 0.28.0 to 0.29.0 (#12351)
* Bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 (#12297)
* Bump github.com/opencontainers/runc from 1.2.0 to 1.2.1 in the go group across 1 directory (#12294)
* Bump github.com/onsi/ginkgo/v2 from 2.20.2 to 2.21.0 (#12290)
* Bump actions/dependency-review-action from 4.3.5 to 4.4.0 in the actions group (#12275)
* Bump the go group across 3 directories with 11 updates (#12246)
* Bump github.com/opencontainers/runc from 1.1.15 to 1.2.0 (#12241)
* Bump the actions group with 5 updates (#12243)
* Bump github.com/ncabatoff/process-exporter from 0.8.3 to 0.8.4 in the go group across 1 directory (#12219)
* Bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 in the actions group (#12215)
* Bump github/codeql-action from 3.26.12 to 3.26.13 in the actions group (#12191)
* Bump the go group across 2 directories with 1 update (#12189)
* Bump the actions group with 2 updates (#12185)
* Bump github.com/opencontainers/runc from 1.1.14 to 1.1.15 in the go group across 1 directory (#12184)
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.5...controller-v1.10.6

View file

@ -1,94 +0,0 @@
# Changelog
### controller-v1.11.4
Images:
* registry.k8s.io/ingress-nginx/controller:v1.11.4@sha256:981a97d78bee3109c0b149946c07989f8f1478a9265031d2d23dea839ba05b52
* registry.k8s.io/ingress-nginx/controller-chroot:v1.11.4@sha256:f29d0f9e7a9ef4947eda59ed0c09ec13380b13639d1518cf1ab8ec09c3e22ef8
### All changes:
* Images: Trigger controller build. (#12610)
* Chart: Bump Kube Webhook CertGen. (#12607)
* Tests & Docs: Bump images. (#12604)
* Images: Trigger other builds (2/2). (#12600)
* Images: Trigger other builds (1/2). (#12596)
* Tests: Bump `e2e-test-runner` to v20241224-68ed4e7b. (#12591)
* Images: Trigger `test-runner` build. (#12588)
* Images: Bump `NGINX_BASE` to v0.2.0. (#12583)
* Images: Trigger NGINX build. (#12577)
* Go: Clean `go.work.sum`. (#12574)
* Repository: Update owners. (#12569)
* Images: Bump `gcb-docker-gcloud` to v20241217-ff46a068cd. (#12562)
* CI: Update KIND images. (#12558)
* Images: Bump Alpine to v3.21. (#12529)
* Docs: Add guide on how to set a Maintenance Page. (#12526)
* rikatz is stepping down (#12517)
* rikatz is stepping down (#12495)
* Go: Bump to v1.23.4. (#12484)
* Plugin: Bump `goreleaser` to v2. (#12441)
* GitHub: Fix `exec` in issue template. (#12388)
* CI: Update KIND images. (#12365)
* Images: Bump `gcb-docker-gcloud` to v20241110-72bb0b1665. (#12343)
* Go: Bump to v1.23.3. (#12338)
* Auth TLS: Add `_` to redirect RegEx. (#12327)
* Auth TLS: Improve redirect RegEx. (#12322)
* Update custom headers annotation documentation (#12319)
* Tests: Bump `e2e-test-runner` to v20241104-02a3933e. (#12313)
* Images: Trigger `test-runner` build. (#12306)
* Config: Fix panic on invalid `lua-shared-dict`. (#12284)
* Docs: fix limit-rate-after references (#12279)
* Chart: Rework ServiceMonitor. (#12270)
* Chart: Add ServiceAccount tests. (#12264)
* CI: Fix chart testing. (#12259)
* [fix] fix nginx temp configs cleanup (#12223)
* Chart: Suggest `matchLabelKeys` in Topology Spread Constraints. (#12203)
* Docs: Add Pod Security Admission. (#12197)
* Docs: Clarify external & service port in TCP/UDP services explanation. (#12193)
* Docs: Goodbye, v1.10. (#12159)
### Dependency updates:
* Bump k8s.io/apiextensions-apiserver from 0.31.3 to 0.32.0 (#12567)
* Bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 (#12556)
* Bump k8s.io/code-generator from 0.31.3 to 0.32.0 (#12551)
* Bump k8s.io/cli-runtime from 0.31.3 to 0.32.0 (#12548)
* Bump k8s.io/apiserver from 0.31.3 to 0.32.0 (#12545)
* Bump the actions group with 2 updates (#12542)
* Bump google.golang.org/grpc from 1.68.1 to 1.69.2 (#12539)
* Bump k8s.io/client-go from 0.31.3 to 0.32.0 (#12513)
* Bump github.com/opencontainers/runc from 1.2.2 to 1.2.3 in the go group across 1 directory (#12510)
* Bump the actions group with 3 updates (#12507)
* Bump k8s.io/kube-aggregator from 0.31.3 to 0.32.0 in /images/kube-webhook-certgen/rootfs (#12503)
* Bump k8s.io/apimachinery from 0.31.3 to 0.32.0 in /images/ext-auth-example-authsvc/rootfs (#12500)
* Bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#12477)
* Bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /magefiles (#12475)
* Bump github.com/prometheus/common from 0.60.1 to 0.61.0 (#12465)
* Bump github/codeql-action from 3.27.5 to 3.27.6 in the actions group (#12462)
* Bump the go group across 1 directory with 2 updates (#12458)
* Bump github.com/onsi/ginkgo/v2 from 2.21.0 to 2.22.0 (#12427)
* Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#12417)
* Bump the go group across 3 directories with 10 updates (#12415)
* Bump the actions group with 3 updates (#12411)
* Bump github.com/opencontainers/runc from 1.2.1 to 1.2.2 in the go group across 1 directory (#12381)
* Bump github/codeql-action from 3.27.1 to 3.27.4 in the actions group (#12374)
* Bump golangci-lint on actions and disable deprecated linters (#12362)
* Bump google.golang.org/grpc from 1.67.1 to 1.68.0 (#12355)
* Bump the actions group with 3 updates (#12352)
* Bump golang.org/x/crypto from 0.28.0 to 0.29.0 (#12350)
* Bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 (#12298)
* Bump github.com/opencontainers/runc from 1.2.0 to 1.2.1 in the go group across 1 directory (#12295)
* Bump github.com/onsi/ginkgo/v2 from 2.20.2 to 2.21.0 (#12289)
* Bump actions/dependency-review-action from 4.3.5 to 4.4.0 in the actions group (#12274)
* Bump the go group across 3 directories with 11 updates (#12245)
* Bump github.com/opencontainers/runc from 1.1.15 to 1.2.0 (#12239)
* Bump the actions group with 5 updates (#12240)
* Bump github.com/ncabatoff/process-exporter from 0.8.3 to 0.8.4 in the go group across 1 directory (#12220)
* Bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 in the actions group (#12216)
* Bump github/codeql-action from 3.26.12 to 3.26.13 in the actions group (#12190)
* Bump the go group across 2 directories with 1 update (#12187)
* Bump the actions group with 2 updates (#12181)
* Bump github.com/opencontainers/runc from 1.1.14 to 1.1.15 in the go group across 1 directory (#12179)
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.11.3...controller-v1.11.4

View file

@ -1,216 +0,0 @@
# Changelog
### controller-v1.12.0-beta.0
Images:
* registry.k8s.io/ingress-nginx/controller:v1.12.0-beta.0@sha256:9724476b928967173d501040631b23ba07f47073999e80e34b120e8db5f234d5
* registry.k8s.io/ingress-nginx/controller-chroot:v1.12.0-beta.0@sha256:6e2f8f52e1f2571ff65bc4fc4826d5282d5def5835ec4ab433dcb8e659b2fbac
### All changes:
* Images: Trigger controller build. (#12154)
* ⚠️ Metrics: Disable by default. (#12153) ⚠️
This changes the default of the following CLI arguments:
* `--enable-metrics` gets disabled by default.
* Tests & Docs: Bump `e2e-test-echo` to v1.0.1. (#12147)
* Images: Trigger `e2e-test-echo` build. (#12140)
* ⚠️ Images: Drop `s390x`. (#12137) ⚠️
Support for the `s390x` architecture has already been removed from the controller image. This also removes it from the NGINX base image and CI relevant images.
* Images: Build `s390x` controller. (#12126)
* Chart: Bump Kube Webhook CertGen. (#12119)
* Tests & Docs: Bump images. (#12118)
* Cloud Build: Bump `gcb-docker-gcloud` to v20240718-5ef92b5c36. (#12113)
* Images: Trigger other builds. (#12110)
* Tests: Bump `e2e-test-runner` to v20241004-114a6abb. (#12103)
* Images: Trigger `test-runner` build. (#12100)
* Docs: Add a multi-tenant warning. (#12091)
* Go: Bump to v1.22.8. (#12069)
* Images: Bump `NGINX_BASE` to v1.0.0. (#12066)
* Images: Trigger NGINX build. (#12063)
* Images: Remove NGINX v1.21. (#12031)
* Chart: Add `controller.metrics.service.enabled`. (#12056)
* GitHub: Improve Dependabot. (#12033)
* Chart: Add `global.image.registry`. (#12028)
* ⚠️ Images: Remove OpenTelemetry. (#12024) ⚠️
OpenTelemetry is still supported, but since the module is built into the controller image since v1.10, we hereby remove the init container and image which were used to install it upon controller startup.
* Chart: Improve CI. (#12003)
* Chart: Extend image tests. (#12025)
* Chart: Add `controller.progressDeadlineSeconds`. (#12017)
* Docs: Add health check annotations for AWS. (#12018)
* Docs: Convert `opentelemetry.md` from CRLF to LF. (#12005)
* Chart: Implement `unhealthyPodEvictionPolicy`. (#11992)
* Chart: Add `defaultBackend.maxUnavailable`. (#11995)
* Chart: Test `controller.minAvailable` & `controller.maxUnavailable`. (#12000)
* Chart: Align default backend `PodDisruptionBudget`. (#11993)
* Metrics: Fix namespace in `nginx_ingress_controller_ssl_expire_time_seconds`. (#10274)
* ⚠️ Chart: Remove Pod Security Policy. (#11971) ⚠️
This removes Pod Security Policies and related resources from the chart.
* Chart: Improve default backend service account. (#11972)
* Go: Bump to v1.22.7. (#11943)
* NGINX: Remove inline Lua from template. (#11806)
* Images: Bump OpenTelemetry C++ Contrib. (#11629)
* Docs: Add note about `--watch-namespace`. (#11947)
* Images: Use latest Alpine 3.20 everywhere. (#11944)
* Fix minor typos (#11935)
* Chart: Implement `controller.admissionWebhooks.service.servicePort`. (#11931)
* Allow any protocol for cors origins (#11153)
* Tests: Bump `e2e-test-runner` to v20240829-2c421762. (#11919)
* Images: Trigger `test-runner` build. (#11916)
* Chart: Add `controller.metrics.prometheusRule.annotations`. (#11849)
* Chart: Add tests for `PrometheusRule` & `ServiceMonitor`. (#11883)
* Annotations: Allow commas in URLs. (#11882)
* CI: Grant checks write permissions to E2E Test Report. (#11862)
* Chart: Use generic values for `ConfigMap` test. (#11877)
* Security: Follow-up on recent changes. (#11874)
* Lua: Remove plugins from `.luacheckrc` & E2E docs. (#11872)
* Dashboard: Remove `ingress_upstream_latency_seconds`. (#11878)
* Metrics: Add `--metrics-per-undefined-host` argument. (#11818)
* Update maxmind post link about geolite2 license changes (#11861)
* ⚠️ Remove global-rate-limit feature (#11851) ⚠️
This removes the following configuration options:
* `global-rate-limit-memcached-host`
* `global-rate-limit-memcached-port`
* `global-rate-limit-memcached-connect-timeout`
* `global-rate-limit-memcached-max-idle-timeout`
* `global-rate-limit-memcached-pool-size`
* `global-rate-limit-status-code`
It also removes the following annotations:
* `global-rate-limit`
* `global-rate-limit-window`
* `global-rate-limit-key`
* `global-rate-limit-ignored-cidrs`
* Revert "docs: Add deployment for AWS NLB Proxy." (#11857)
* Add custom code handling for temporal redirect (#10651)
* Add native histogram support for histogram metrics (#9971)
* Replace deprecated queue method (#11853)
* ⚠️ Enable security features by default (#11819) ⚠️
This changes the default of the following CLI arguments:
* `--enable-annotation-validation` gets enabled by default.
It also changes the default of the following configuration options:
* `allow-cross-namespace-resources` gets disabled by default.
* `annotations-risk-level` gets lowered to "High" by default.
* `strict-validate-path-type` gets enabled by default.
* docs: Add deployment for AWS NLB Proxy. (#9565)
* ⚠️ Remove 3rd party lua plugin support (#11821) ⚠️
This removes the following configuration options:
* `plugins`
It also removes support for user provided Lua plugins in the `/etc/nginx/lua/plugins` directory.
* Auto-generate annotation docs (#11820)
* ⚠️ Metrics: Remove `ingress_upstream_latency_seconds`. (#11795) ⚠️
This metric has already been deprecated and is now getting removed.
* Release controller v1.11.2/v1.10.4 & chart v4.11.2/v4.10.4. (#11816)
* Chart: Bump Kube Webhook CertGen & OpenTelemetry. (#11809)
* Tests & Docs: Bump images. (#11803)
* Images: Trigger failed builds. (#11800)
* Images: Trigger other builds. (#11796)
* Controller: Fix panic in alternative backend merging. (#11789)
* Tests: Bump `e2e-test-runner` to v20240812-3f0129aa. (#11788)
* Images: Trigger `test-runner` build. (#11785)
* Images: Bump `NGINX_BASE` to v0.0.12. (#11782)
* Images: Trigger NGINX build. (#11779)
* Cloud Build: Add missing config, remove unused ones. (#11774)
* Cloud Build: Tweak timeouts. (#11761)
* Cloud Build: Fix substitutions. (#11758)
* Cloud Build: Some chores. (#11633)
* Go: Bump to v1.22.6. (#11747)
* Images: Bump `NGINX_BASE` to v0.0.11. (#11741)
* Images: Trigger NGINX build. (#11735)
* docs: update OpenSSL Roadmap link (#11730)
* Go: Bump to v1.22.5. (#11634)
* Docs: Fix typo in AWS LB Controller reference (#11723)
* Perform some cleaning operations on line breaks. (#11720)
* Missing anchors in regular expression. (#11717)
* Docs: Fix `from-to-www` redirect description. (#11712)
* Chart: Remove `isControllerTagValid`. (#11710)
* Tests: Bump `e2e-test-runner` to v20240729-04899b27. (#11702)
* Chart: Explicitly set `runAsGroup`. (#11679)
* Docs: Clarify `from-to-www` redirect direction. (#11682)
* added real-client-ip faq (#11663)
* Docs: Format NGINX configuration table. (#11659)
* Release controller v1.11.1/v1.10.3 & chart v4.11.1/v4.10.3. (#11654)
* Tests: Bump `test-runner` to v20240717-1fe74b5f. (#11645)
* Images: Trigger `test-runner` build. (#11636)
* Images: Bump `NGINX_BASE` to v0.0.10. (#11635)
* remove modsecurity coreruleset test files from nginx image (#11617)
* unskip the ocsp tests and update images to fix cfssl bug (#11606)
* Fix indent in YAML for example pod (#11598)
* Images: Bump `test-runner`. (#11600)
* Images: Bump `NGINX_BASE` to v0.0.9. (#11599)
* revert module upgrade (#11594)
* README: Fix support matrix. (#11586)
* Repository: Add changelogs from `release-v1.10`. (#11587)
### Dependency updates:
* Bump the actions group with 3 updates (#12152)
* Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12107)
* Bump the actions group with 3 updates (#12092)
* Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12062)
* Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12060)
* Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12059)
* Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12061)
* Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12051)
* Bump the go group across 1 directory with 3 updates (#12050)
* Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12043)
* Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12041)
* Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12040)
* Bump the all group with 2 updates (#12032)
* Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12010)
* Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12009)
* Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12008)
* Bump the all group with 2 updates (#11977)
* Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11976)
* Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11954)
* Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11955)
* Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11953)
* Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11928)
* Bump the all group with 2 updates (#11922)
* Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11901)
* Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11902)
* Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11903)
* Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11904)
* Bump the all group with 2 updates (#11865)
* Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11867)
* Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11832)
* Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11823)
* Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11822)
* Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11825)
* Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11826)
* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 (#11766)
* Bump the all group with 2 updates (#11767)
* Bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#11765)
* Bump the all group with 3 updates (#11727)
* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group (#11696)
* Bump the all group with 2 updates (#11695)
* Bump the all group with 4 updates (#11673)
* Bump the all group with 2 updates (#11672)
* Bump github.com/prometheus/common from 0.54.0 to 0.55.0 (#11522)
* Bump the all group with 5 updates (#11611)
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.11.0...controller-v1.12.0-beta.0

View file

@ -1,294 +0,0 @@
# Changelog
### controller-v1.12.0
Images:
* registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa
* registry.k8s.io/ingress-nginx/controller-chroot:v1.12.0@sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3
### All changes:
* Images: Trigger controller build. (#12609)
* Chart: Bump Kube Webhook CertGen. (#12606)
* Tests & Docs: Bump images. (#12603)
* Images: Trigger other builds (2/2). (#12599)
* Images: Trigger other builds (1/2). (#12595)
* Tests: Bump `e2e-test-runner` to v20241224-68ed4e7b. (#12590)
* Images: Trigger `test-runner` build. (#12587)
* Images: Bump `NGINX_BASE` to v1.1.0. (#12582)
* Images: Trigger NGINX build. (#12579)
* Go: Clean `go.work.sum`. (#12573)
* Repository: Update owners. (#12568)
* Images: Bump `gcb-docker-gcloud` to v20241217-ff46a068cd. (#12561)
* CI: Update KIND images. (#12560)
* Images: Bump Alpine to v3.21. (#12528)
* Docs: Add guide on how to set a Maintenance Page. (#12525)
* rikatz is stepping down (#12516)
* rikatz is stepping down (#12494)
* Go: Bump to v1.23.4. (#12483)
* Plugin: Bump `goreleaser` to v2. (#12440)
* GitHub: Fix `exec` in issue template. (#12387)
* CI: Update KIND images. (#12367)
* Images: Bump `gcb-docker-gcloud` to v20241110-72bb0b1665. (#12342)
* Go: Bump to v1.23.3. (#12337)
* Auth TLS: Add `_` to redirect RegEx. (#12326)
* Auth TLS: Improve redirect RegEx. (#12323)
* Update custom headers annotation documentation (#12318)
* Tests: Bump `e2e-test-runner` to v20241104-02a3933e. (#12312)
* Docs: Add CPU usage note for `--metrics-per-undefined-host`. (#12310)
* Images: Trigger `test-runner` build. (#12308)
* Config: Fix panic on invalid `lua-shared-dict`. (#12283)
* Docs: fix limit-rate-after references (#12278)
* Chart: Rework ServiceMonitor. (#12269)
* Chart: Add ServiceAccount tests. (#12263)
* CI: Fix chart testing. (#12258)
* [fix] fix nginx temp configs cleanup (#12225)
* Chart: Suggest `matchLabelKeys` in Topology Spread Constraints. (#12202)
* Docs: Add Pod Security Admission. (#12195)
* Docs: Clarify external & service port in TCP/UDP services explanation. (#12192)
* Images: Trigger controller build. (#12154)
* ⚠️ Metrics: Disable by default. (#12153) ⚠️
This changes the default of the following CLI arguments:
* `--enable-metrics` gets disabled by default.
* Tests & Docs: Bump `e2e-test-echo` to v1.0.1. (#12147)
* Images: Trigger `e2e-test-echo` build. (#12140)
* ⚠️ Images: Drop `s390x`. (#12137) ⚠️
Support for the `s390x` architecture has already been removed from the controller image. This also removes it from the NGINX base image and CI relevant images.
* Images: Build `s390x` controller. (#12126)
* Chart: Bump Kube Webhook CertGen. (#12119)
* Tests & Docs: Bump images. (#12118)
* Cloud Build: Bump `gcb-docker-gcloud` to v20240718-5ef92b5c36. (#12113)
* Images: Trigger other builds. (#12110)
* Tests: Bump `e2e-test-runner` to v20241004-114a6abb. (#12103)
* Images: Trigger `test-runner` build. (#12100)
* Docs: Add a multi-tenant warning. (#12091)
* Go: Bump to v1.22.8. (#12069)
* Images: Bump `NGINX_BASE` to v1.0.0. (#12066)
* Images: Trigger NGINX build. (#12063)
* Images: Remove NGINX v1.21. (#12031)
* Chart: Add `controller.metrics.service.enabled`. (#12056)
* GitHub: Improve Dependabot. (#12033)
* Chart: Add `global.image.registry`. (#12028)
* ⚠️ Images: Remove OpenTelemetry. (#12024) ⚠️
OpenTelemetry is still supported, but since the module is built into the controller image since v1.10, we hereby remove the init container and image which were used to install it upon controller startup.
* Chart: Improve CI. (#12003)
* Chart: Extend image tests. (#12025)
* Chart: Add `controller.progressDeadlineSeconds`. (#12017)
* Docs: Add health check annotations for AWS. (#12018)
* Docs: Convert `opentelemetry.md` from CRLF to LF. (#12005)
* Chart: Implement `unhealthyPodEvictionPolicy`. (#11992)
* Chart: Add `defaultBackend.maxUnavailable`. (#11995)
* Chart: Test `controller.minAvailable` & `controller.maxUnavailable`. (#12000)
* Chart: Align default backend `PodDisruptionBudget`. (#11993)
* Metrics: Fix namespace in `nginx_ingress_controller_ssl_expire_time_seconds`. (#10274)
* ⚠️ Chart: Remove Pod Security Policy. (#11971) ⚠️
This removes Pod Security Policies and related resources from the chart.
* Chart: Improve default backend service account. (#11972)
* Go: Bump to v1.22.7. (#11943)
* NGINX: Remove inline Lua from template. (#11806)
* Images: Bump OpenTelemetry C++ Contrib. (#11629)
* Docs: Add note about `--watch-namespace`. (#11947)
* Images: Use latest Alpine 3.20 everywhere. (#11944)
* Fix minor typos (#11935)
* Chart: Implement `controller.admissionWebhooks.service.servicePort`. (#11931)
* Allow any protocol for cors origins (#11153)
* Tests: Bump `e2e-test-runner` to v20240829-2c421762. (#11919)
* Images: Trigger `test-runner` build. (#11916)
* Chart: Add `controller.metrics.prometheusRule.annotations`. (#11849)
* Chart: Add tests for `PrometheusRule` & `ServiceMonitor`. (#11883)
* Annotations: Allow commas in URLs. (#11882)
* CI: Grant checks write permissions to E2E Test Report. (#11862)
* Chart: Use generic values for `ConfigMap` test. (#11877)
* Security: Follow-up on recent changes. (#11874)
* Lua: Remove plugins from `.luacheckrc` & E2E docs. (#11872)
* Dashboard: Remove `ingress_upstream_latency_seconds`. (#11878)
* Metrics: Add `--metrics-per-undefined-host` argument. (#11818)
* Update maxmind post link about geolite2 license changes (#11861)
* ⚠️ Remove global-rate-limit feature (#11851) ⚠️
This removes the following configuration options:
* `global-rate-limit-memcached-host`
* `global-rate-limit-memcached-port`
* `global-rate-limit-memcached-connect-timeout`
* `global-rate-limit-memcached-max-idle-timeout`
* `global-rate-limit-memcached-pool-size`
* `global-rate-limit-status-code`
It also removes the following annotations:
* `global-rate-limit`
* `global-rate-limit-window`
* `global-rate-limit-key`
* `global-rate-limit-ignored-cidrs`
* Revert "docs: Add deployment for AWS NLB Proxy." (#11857)
* Add custom code handling for temporal redirect (#10651)
* Add native histogram support for histogram metrics (#9971)
* Replace deprecated queue method (#11853)
* ⚠️ Enable security features by default (#11819) ⚠️
This changes the default of the following CLI arguments:
* `--enable-annotation-validation` gets enabled by default.
It also changes the default of the following configuration options:
* `allow-cross-namespace-resources` gets disabled by default.
* `annotations-risk-level` gets lowered to "High" by default.
* `strict-validate-path-type` gets enabled by default.
* docs: Add deployment for AWS NLB Proxy. (#9565)
* ⚠️ Remove 3rd party lua plugin support (#11821) ⚠️
This removes the following configuration options:
* `plugins`
It also removes support for user provided Lua plugins in the `/etc/nginx/lua/plugins` directory.
* Auto-generate annotation docs (#11820)
* ⚠️ Metrics: Remove `ingress_upstream_latency_seconds`. (#11795) ⚠️
This metric has already been deprecated and is now getting removed.
* Release controller v1.11.2/v1.10.4 & chart v4.11.2/v4.10.4. (#11816)
* Chart: Bump Kube Webhook CertGen & OpenTelemetry. (#11809)
* Tests & Docs: Bump images. (#11803)
* Images: Trigger failed builds. (#11800)
* Images: Trigger other builds. (#11796)
* Controller: Fix panic in alternative backend merging. (#11789)
* Tests: Bump `e2e-test-runner` to v20240812-3f0129aa. (#11788)
* Images: Trigger `test-runner` build. (#11785)
* Images: Bump `NGINX_BASE` to v0.0.12. (#11782)
* Images: Trigger NGINX build. (#11779)
* Cloud Build: Add missing config, remove unused ones. (#11774)
* Cloud Build: Tweak timeouts. (#11761)
* Cloud Build: Fix substitutions. (#11758)
* Cloud Build: Some chores. (#11633)
* Go: Bump to v1.22.6. (#11747)
* Images: Bump `NGINX_BASE` to v0.0.11. (#11741)
* Images: Trigger NGINX build. (#11735)
* docs: update OpenSSL Roadmap link (#11730)
* Go: Bump to v1.22.5. (#11634)
* Docs: Fix typo in AWS LB Controller reference (#11723)
* Perform some cleaning operations on line breaks. (#11720)
* Missing anchors in regular expression. (#11717)
* Docs: Fix `from-to-www` redirect description. (#11712)
* Chart: Remove `isControllerTagValid`. (#11710)
* Tests: Bump `e2e-test-runner` to v20240729-04899b27. (#11702)
* Chart: Explicitly set `runAsGroup`. (#11679)
* Docs: Clarify `from-to-www` redirect direction. (#11682)
* added real-client-ip faq (#11663)
* Docs: Format NGINX configuration table. (#11659)
* Release controller v1.11.1/v1.10.3 & chart v4.11.1/v4.10.3. (#11654)
* Tests: Bump `test-runner` to v20240717-1fe74b5f. (#11645)
* Images: Trigger `test-runner` build. (#11636)
* Images: Bump `NGINX_BASE` to v0.0.10. (#11635)
* remove modsecurity coreruleset test files from nginx image (#11617)
* unskip the ocsp tests and update images to fix cfssl bug (#11606)
* Fix indent in YAML for example pod (#11598)
* Images: Bump `test-runner`. (#11600)
* Images: Bump `NGINX_BASE` to v0.0.9. (#11599)
* revert module upgrade (#11594)
* README: Fix support matrix. (#11586)
* Repository: Add changelogs from `release-v1.10`. (#11587)
### Dependency updates:
* Bump k8s.io/apiextensions-apiserver from 0.31.3 to 0.32.0 (#12566)
* Bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 (#12555)
* Bump k8s.io/code-generator from 0.31.3 to 0.32.0 (#12550)
* Bump k8s.io/cli-runtime from 0.31.3 to 0.32.0 (#12547)
* Bump k8s.io/apiserver from 0.31.3 to 0.32.0 (#12544)
* Bump the actions group with 2 updates (#12541)
* Bump google.golang.org/grpc from 1.68.1 to 1.69.2 (#12538)
* Bump k8s.io/client-go from 0.31.3 to 0.32.0 (#12512)
* Bump github.com/opencontainers/runc from 1.2.2 to 1.2.3 in the go group across 1 directory (#12509)
* Bump the actions group with 3 updates (#12506)
* Bump k8s.io/kube-aggregator from 0.31.3 to 0.32.0 in /images/kube-webhook-certgen/rootfs (#12505)
* Bump k8s.io/apimachinery from 0.31.3 to 0.32.0 in /images/ext-auth-example-authsvc/rootfs (#12502)
* Bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#12476)
* Bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /magefiles (#12472)
* Bump github.com/prometheus/common from 0.60.1 to 0.61.0 (#12464)
* Bump github/codeql-action from 3.27.5 to 3.27.6 in the actions group (#12461)
* Bump the go group across 1 directory with 2 updates (#12460)
* Bump github.com/onsi/ginkgo/v2 from 2.21.0 to 2.22.0 (#12426)
* Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#12418)
* Bump the go group across 3 directories with 10 updates (#12413)
* Bump the actions group with 3 updates (#12412)
* Bump github.com/opencontainers/runc from 1.2.1 to 1.2.2 in the go group across 1 directory (#12380)
* Bump github/codeql-action from 3.27.1 to 3.27.4 in the actions group (#12373)
* Bump golangci-lint on actions and disable deprecated linters (#12361)
* Bump google.golang.org/grpc from 1.67.1 to 1.68.0 (#12357)
* Bump the actions group with 3 updates (#12354)
* Bump golang.org/x/crypto from 0.28.0 to 0.29.0 (#12349)
* Bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 (#12299)
* Bump github.com/opencontainers/runc from 1.2.0 to 1.2.1 in the go group across 1 directory (#12296)
* Bump github.com/onsi/ginkgo/v2 from 2.20.2 to 2.21.0 (#12288)
* Bump actions/dependency-review-action from 4.3.5 to 4.4.0 in the actions group (#12273)
* Bump the go group across 3 directories with 11 updates (#12244)
* Bump github.com/opencontainers/runc from 1.1.15 to 1.2.0 (#12242)
* Bump the actions group with 5 updates (#12236)
* Bump github.com/ncabatoff/process-exporter from 0.8.3 to 0.8.4 in the go group across 1 directory (#12218)
* Bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 in the actions group (#12217)
* Bump github/codeql-action from 3.26.12 to 3.26.13 in the actions group (#12188)
* Bump the go group across 2 directories with 1 update (#12186)
* Bump the actions group with 2 updates (#12180)
* Bump github.com/opencontainers/runc from 1.1.14 to 1.1.15 in the go group across 1 directory (#12178)
* Bump the actions group with 3 updates (#12152)
* Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12107)
* Bump the actions group with 3 updates (#12092)
* Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12062)
* Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12060)
* Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12059)
* Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12061)
* Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12051)
* Bump the go group across 1 directory with 3 updates (#12050)
* Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12043)
* Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12041)
* Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12040)
* Bump the all group with 2 updates (#12032)
* Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12010)
* Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12009)
* Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12008)
* Bump the all group with 2 updates (#11977)
* Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11976)
* Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11954)
* Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11955)
* Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11953)
* Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11928)
* Bump the all group with 2 updates (#11922)
* Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11901)
* Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11902)
* Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11903)
* Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11904)
* Bump the all group with 2 updates (#11865)
* Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11867)
* Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11832)
* Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11823)
* Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11822)
* Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11825)
* Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11826)
* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 (#11766)
* Bump the all group with 2 updates (#11767)
* Bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#11765)
* Bump the all group with 3 updates (#11727)
* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group (#11696)
* Bump the all group with 2 updates (#11695)
* Bump the all group with 4 updates (#11673)
* Bump the all group with 2 updates (#11672)
* Bump github.com/prometheus/common from 0.54.0 to 0.55.0 (#11522)
* Bump the all group with 5 updates (#11611)
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.11.0...controller-v1.12.0

View file

@ -1,10 +1,9 @@
annotations:
artifacthub.io/changes: |
- 'CI: Fix chart testing. (#12258)'
- Update Ingress-Nginx version controller-v1.12.0
- Update Ingress-Nginx version controller-v1.11.3
artifacthub.io/prerelease: "false"
apiVersion: v2
appVersion: 1.12.0
appVersion: 1.11.3
description: Ingress controller for Kubernetes using NGINX as a reverse proxy and
load balancer
home: https://github.com/kubernetes/ingress-nginx
@ -16,9 +15,11 @@ kubeVersion: '>=1.21.0-0'
maintainers:
- name: cpanato
- name: Gacko
- name: puerco
- name: rikatz
- name: strongjz
- name: tao12345666333
name: ingress-nginx
sources:
- https://github.com/kubernetes/ingress-nginx
version: 4.12.0
version: 4.11.3

View file

@ -1,4 +1,10 @@
# See the OWNERS docs: https://www.kubernetes.dev/docs/guide/owners
approvers:
- ingress-nginx-helm-maintainers
reviewers:
- ingress-nginx-helm-reviewers
labels:
- area/helm

View file

@ -2,7 +2,7 @@
[ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
![Version: 4.12.0](https://img.shields.io/badge/Version-4.12.0-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square)
![Version: 4.11.3](https://img.shields.io/badge/Version-4.11.3-informational?style=flat-square) ![AppVersion: 1.11.3](https://img.shields.io/badge/AppVersion-1.11.3-informational?style=flat-square)
To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
@ -229,24 +229,6 @@ Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13
As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered.
### Pod Security Admission
You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels).
Example:
```yaml
apiVersion: v1
kind: Namespace
metadata:
name: ingress-nginx
labels:
kubernetes.io/metadata.name: ingress-nginx
name: ingress-nginx
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/enforce-version: v1.31
```
## Values
| Key | Type | Default | Description |
@ -260,8 +242,9 @@ metadata:
| controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` | |
| controller.admissionWebhooks.createSecretJob.name | string | `"create"` | |
| controller.admissionWebhooks.createSecretJob.resources | object | `{}` | |
| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers |
| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers |
| controller.admissionWebhooks.enabled | bool | `true` | |
| controller.admissionWebhooks.existingPsp | string | `""` | Use an existing PSP instead of creating one |
| controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set |
| controller.admissionWebhooks.failurePolicy | string | `"Fail"` | Admission Webhook failure policy to use |
| controller.admissionWebhooks.key | string | `"/usr/local/certificates/key"` | |
@ -270,10 +253,11 @@ metadata:
| controller.admissionWebhooks.namespaceSelector | object | `{}` | |
| controller.admissionWebhooks.objectSelector | object | `{}` | |
| controller.admissionWebhooks.patch.enabled | bool | `true` | |
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:0de05718b59dc33b57ddfb4d8ad5f637cefd13eafdec0e1579d782b3483c27c3"` | |
| controller.admissionWebhooks.patch.image.digest | string | `"sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f"` | |
| controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` | |
| controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` | |
| controller.admissionWebhooks.patch.image.tag | string | `"v1.5.1"` | |
| controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` | |
| controller.admissionWebhooks.patch.image.tag | string | `"v1.4.4"` | |
| controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
| controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
| controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` | |
@ -289,7 +273,7 @@ metadata:
| controller.admissionWebhooks.patch.tolerations | list | `[]` | |
| controller.admissionWebhooks.patchWebhookJob.name | string | `"patch"` | |
| controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` | |
| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers |
| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers |
| controller.admissionWebhooks.port | int | `8443` | |
| controller.admissionWebhooks.service.annotations | object | `{}` | |
| controller.admissionWebhooks.service.externalIPs | list | `[]` | |
@ -320,14 +304,15 @@ metadata:
| controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. |
| controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' |
| controller.electionTTL | string | `""` | Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s) |
| controller.enableAnnotationValidations | bool | `true` | |
| controller.enableAnnotationValidations | bool | `false` | |
| controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # |
| controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" Defaults to false |
| controller.existingPsp | string | `""` | Use an existing PSP instead of creating one |
| controller.extraArgs | object | `{}` | Additional command line arguments to pass to Ingress-Nginx Controller E.g. to specify the default SSL certificate you can use |
| controller.extraContainers | list | `[]` | Additional containers to be added to the controller pod. See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. |
| controller.extraEnvs | list | `[]` | Additional environment variables to set |
| controller.extraInitContainers | list | `[]` | Containers, which are run before the app containers are started. |
| controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. |
| controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module |
| controller.extraVolumeMounts | list | `[]` | Additional volumeMounts to the controller main container. |
| controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. |
| controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. |
@ -340,16 +325,16 @@ metadata:
| controller.hostname | object | `{}` | Optionally customize the pod hostname. |
| controller.image.allowPrivilegeEscalation | bool | `false` | |
| controller.image.chroot | bool | `false` | |
| controller.image.digest | string | `"sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa"` | |
| controller.image.digestChroot | string | `"sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3"` | |
| controller.image.digest | string | `"sha256:d56f135b6462cfc476447cfe564b83a45e8bb7da2774963b00d12161112270b7"` | |
| controller.image.digestChroot | string | `"sha256:22701f0fc0f2dd209ef782f4e281bfe2d8cccd50ededa00aec88e0cdbe7edd14"` | |
| controller.image.image | string | `"ingress-nginx/controller"` | |
| controller.image.pullPolicy | string | `"IfNotPresent"` | |
| controller.image.readOnlyRootFilesystem | bool | `false` | |
| controller.image.runAsGroup | int | `82` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) |
| controller.image.registry | string | `"registry.k8s.io"` | |
| controller.image.runAsNonRoot | bool | `true` | |
| controller.image.runAsUser | int | `101` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) |
| controller.image.runAsUser | int | `101` | |
| controller.image.seccompProfile.type | string | `"RuntimeDefault"` | |
| controller.image.tag | string | `"v1.12.0"` | |
| controller.image.tag | string | `"v1.11.3"` | |
| controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
| controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
| controller.ingressClassResource | object | `{"aliases":[],"annotations":{},"controllerValue":"k8s.io/ingress-nginx","default":false,"enabled":true,"name":"nginx","parameters":{}}` | This section refers to the creation of the IngressClass resource. IngressClasses are immutable and cannot be changed after creation. We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required. |
@ -386,11 +371,9 @@ metadata:
| controller.metrics.port | int | `10254` | |
| controller.metrics.portName | string | `"metrics"` | |
| controller.metrics.prometheusRule.additionalLabels | object | `{}` | |
| controller.metrics.prometheusRule.annotations | object | `{}` | Annotations to be added to the PrometheusRule. |
| controller.metrics.prometheusRule.enabled | bool | `false` | |
| controller.metrics.prometheusRule.rules | list | `[]` | |
| controller.metrics.service.annotations | object | `{}` | |
| controller.metrics.service.enabled | bool | `true` | Enable the metrics service or not. |
| controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # |
| controller.metrics.service.labels | object | `{}` | Labels to be added to the metrics service resource |
| controller.metrics.service.loadBalancerSourceRanges | list | `[]` | |
@ -399,27 +382,35 @@ metadata:
| controller.metrics.serviceMonitor.additionalLabels | object | `{}` | |
| controller.metrics.serviceMonitor.annotations | object | `{}` | Annotations to be added to the ServiceMonitor. |
| controller.metrics.serviceMonitor.enabled | bool | `false` | |
| controller.metrics.serviceMonitor.labelLimit | int | `0` | Per-scrape limit on number of labels that will be accepted for a sample. |
| controller.metrics.serviceMonitor.labelNameLengthLimit | int | `0` | Per-scrape limit on length of labels name that will be accepted for a sample. |
| controller.metrics.serviceMonitor.labelValueLengthLimit | int | `0` | Per-scrape limit on length of labels value that will be accepted for a sample. |
| controller.metrics.serviceMonitor.metricRelabelings | list | `[]` | |
| controller.metrics.serviceMonitor.namespace | string | `""` | |
| controller.metrics.serviceMonitor.namespaceSelector | object | `{}` | |
| controller.metrics.serviceMonitor.relabelings | list | `[]` | |
| controller.metrics.serviceMonitor.sampleLimit | int | `0` | Defines a per-scrape limit on the number of scraped samples that will be accepted. |
| controller.metrics.serviceMonitor.scrapeInterval | string | `"30s"` | |
| controller.metrics.serviceMonitor.targetLabels | list | `[]` | |
| controller.metrics.serviceMonitor.targetLimit | int | `0` | Defines a limit on the number of scraped targets that will be accepted. |
| controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. |
| controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # |
| controller.name | string | `"controller"` | |
| controller.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
| controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # |
| controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` | |
| controller.opentelemetry.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` | |
| controller.opentelemetry.containerSecurityContext.readOnlyRootFilesystem | bool | `true` | |
| controller.opentelemetry.containerSecurityContext.runAsNonRoot | bool | `true` | |
| controller.opentelemetry.containerSecurityContext.runAsUser | int | `65532` | The image's default user, inherited from its base image `cgr.dev/chainguard/static`. |
| controller.opentelemetry.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
| controller.opentelemetry.enabled | bool | `false` | |
| controller.opentelemetry.image.digest | string | `"sha256:f7604ac0547ed64d79b98d92133234e66c2c8aade3c1f4809fed5eec1fb7f922"` | |
| controller.opentelemetry.image.distroless | bool | `true` | |
| controller.opentelemetry.image.image | string | `"ingress-nginx/opentelemetry-1.25.3"` | |
| controller.opentelemetry.image.registry | string | `"registry.k8s.io"` | |
| controller.opentelemetry.image.tag | string | `"v20240813-b933310d"` | |
| controller.opentelemetry.name | string | `"opentelemetry"` | |
| controller.opentelemetry.resources | object | `{}` | |
| controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # |
| controller.podLabels | object | `{}` | Labels to add to the pod container metadata |
| controller.podSecurityContext | object | `{}` | Security context for controller pods |
| controller.priorityClassName | string | `""` | |
| controller.progressDeadlineSeconds | int | `0` | Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed. Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds |
| controller.proxySetHeaders | object | `{}` | Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers |
| controller.publishService | object | `{"enabled":true,"pathOverride":""}` | Allows customization of the source of the IP address or FQDN to report in the ingress status field. By default, it reads the information provided by the service. If disable, the status field reports the IP address of the node or nodes where an ingress controller pod is running. |
| controller.publishService.enabled | bool | `true` | Enable 'publishService' or not |
@ -442,24 +433,20 @@ metadata:
| controller.service.annotations | object | `{}` | Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service. |
| controller.service.appProtocol | bool | `true` | Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol |
| controller.service.clusterIP | string | `""` | Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
| controller.service.clusterIPs | list | `[]` | Pre-defined cluster internal IP addresses of the external controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
| controller.service.enableHttp | bool | `true` | Enable the HTTP listener on both controller services or not. |
| controller.service.enableHttps | bool | `true` | Enable the HTTPS listener on both controller services or not. |
| controller.service.enabled | bool | `true` | Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service. |
| controller.service.external.enabled | bool | `true` | Enable the external controller service or not. Useful for internal-only deployments. |
| controller.service.external.labels | object | `{}` | Labels to be added to the external controller service. |
| controller.service.externalIPs | list | `[]` | List of node IP addresses at which the external controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips |
| controller.service.externalTrafficPolicy | string | `""` | External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip |
| controller.service.internal.annotations | object | `{}` | Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer |
| controller.service.internal.appProtocol | bool | `true` | Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol |
| controller.service.internal.clusterIP | string | `""` | Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
| controller.service.internal.clusterIPs | list | `[]` | Pre-defined cluster internal IP addresses of the internal controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
| controller.service.internal.enabled | bool | `false` | Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this. |
| controller.service.internal.externalIPs | list | `[]` | List of node IP addresses at which the internal controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips |
| controller.service.internal.externalTrafficPolicy | string | `""` | External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip |
| controller.service.internal.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
| controller.service.internal.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
| controller.service.internal.labels | object | `{}` | Labels to be added to the internal controller service. |
| controller.service.internal.loadBalancerClass | string | `""` | Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class |
| controller.service.internal.loadBalancerIP | string | `""` | Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer |
| controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default. |
@ -470,7 +457,6 @@ metadata:
| controller.service.internal.ports | object | `{}` | |
| controller.service.internal.sessionAffinity | string | `""` | Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity |
| controller.service.internal.targetPorts | object | `{}` | |
| controller.service.internal.trafficDistribution | string | `""` | Traffic distribution policy of the internal controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution |
| controller.service.internal.type | string | `""` | Type of the internal controller service. Defaults to the value of `controller.service.type`. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types |
| controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
| controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
@ -487,7 +473,6 @@ metadata:
| controller.service.sessionAffinity | string | `""` | Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity |
| controller.service.targetPorts.http | string | `"http"` | Port of the ingress controller the external HTTP listener is mapped to. |
| controller.service.targetPorts.https | string | `"https"` | Port of the ingress controller the external HTTPS listener is mapped to. |
| controller.service.trafficDistribution | string | `""` | Traffic distribution policy of the external controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution |
| controller.service.type | string | `"LoadBalancer"` | Type of the external controller service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types |
| controller.shareProcessNamespace | bool | `false` | |
| controller.sysctls | object | `{}` | sysctls for controller pods # Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ |
@ -498,7 +483,6 @@ metadata:
| controller.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. # Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ # |
| controller.udp.annotations | object | `{}` | Annotations to be added to the udp config configmap |
| controller.udp.configMapNamespace | string | `""` | Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) |
| controller.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ |
| controller.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # |
| controller.watchIngressWithoutClass | bool | `false` | Process Ingress objects without ingressClass annotation/ingressClassName field Overrides value for --watch-ingress-without-class flag of the controller binary Defaults to false |
| defaultBackend.affinity | object | `{}` | Affinity and anti-affinity rules for server scheduling to nodes # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
@ -510,6 +494,7 @@ metadata:
| defaultBackend.autoscaling.targetMemoryUtilizationPercentage | int | `50` | |
| defaultBackend.containerSecurityContext | object | `{}` | Security context for default backend containers |
| defaultBackend.enabled | bool | `false` | |
| defaultBackend.existingPsp | string | `""` | Use an existing PSP instead of creating one |
| defaultBackend.extraArgs | object | `{}` | |
| defaultBackend.extraConfigMaps | list | `[]` | |
| defaultBackend.extraEnvs | list | `[]` | Additional environment variables to set for defaultBackend pods |
@ -519,7 +504,7 @@ metadata:
| defaultBackend.image.image | string | `"defaultbackend-amd64"` | |
| defaultBackend.image.pullPolicy | string | `"IfNotPresent"` | |
| defaultBackend.image.readOnlyRootFilesystem | bool | `true` | |
| defaultBackend.image.runAsGroup | int | `65534` | |
| defaultBackend.image.registry | string | `"registry.k8s.io"` | |
| defaultBackend.image.runAsNonRoot | bool | `true` | |
| defaultBackend.image.runAsUser | int | `65534` | |
| defaultBackend.image.seccompProfile.type | string | `"RuntimeDefault"` | |
@ -530,7 +515,7 @@ metadata:
| defaultBackend.livenessProbe.periodSeconds | int | `10` | |
| defaultBackend.livenessProbe.successThreshold | int | `1` | |
| defaultBackend.livenessProbe.timeoutSeconds | int | `5` | |
| defaultBackend.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. |
| defaultBackend.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. |
| defaultBackend.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # |
| defaultBackend.name | string | `"defaultbackend"` | |
| defaultBackend.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
@ -548,7 +533,6 @@ metadata:
| defaultBackend.replicaCount | int | `1` | |
| defaultBackend.resources | object | `{}` | |
| defaultBackend.service.annotations | object | `{}` | |
| defaultBackend.service.clusterIPs | list | `[]` | Pre-defined cluster internal IP addresses of the default backend service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
| defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # |
| defaultBackend.service.loadBalancerSourceRanges | list | `[]` | |
| defaultBackend.service.servicePort | int | `80` | |
@ -558,12 +542,11 @@ metadata:
| defaultBackend.serviceAccount.name | string | `""` | |
| defaultBackend.tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ # |
| defaultBackend.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. Ref.: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ |
| defaultBackend.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ |
| defaultBackend.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # |
| dhParam | string | `""` | A base64-encoded Diffie-Hellman parameter. This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` # Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param |
| global.image.registry | string | `"registry.k8s.io"` | Registry host to pull images from. |
| imagePullSecrets | list | `[]` | Optional array of imagePullSecrets containing private registry credentials # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ |
| namespaceOverride | string | `""` | Override the deployment namespace; defaults to .Release.Namespace |
| podSecurityPolicy.enabled | bool | `false` | |
| portNamePrefix | string | `""` | Prefix for TCP and UDP ports names in ingress controller service # Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration |
| rbac.create | bool | `true` | |
| rbac.scope | bool | `false` | |

View file

@ -226,22 +226,4 @@ Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13
As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered.
### Pod Security Admission
You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels).
Example:
```yaml
apiVersion: v1
kind: Namespace
metadata:
name: ingress-nginx
labels:
kubernetes.io/metadata.name: ingress-nginx
name: ingress-nginx
pod-security.kubernetes.io/enforce: restricted
pod-security.kubernetes.io/enforce-version: v1.31
```
{{ template "chart.valuesSection" . }}

View file

@ -1,9 +0,0 @@
# Changelog
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
### 4.10.3
* Update Ingress-Nginx version controller-v1.10.3
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.2...helm-chart-4.10.3

View file

@ -1,9 +0,0 @@
# Changelog
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
### 4.10.4
* Update Ingress-Nginx version controller-v1.10.4
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.3...helm-chart-4.10.4

View file

@ -1,9 +0,0 @@
# Changelog
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
### 4.10.5
* Update Ingress-Nginx version controller-v1.10.5
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.4...helm-chart-4.10.5

View file

@ -1,10 +0,0 @@
# Changelog
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
### 4.10.6
* CI: Fix chart testing. (#12260)
* Update Ingress-Nginx version controller-v1.10.6
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.5...helm-chart-4.10.6

View file

@ -1,10 +0,0 @@
# Changelog
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
### 4.11.4
* CI: Fix chart testing. (#12259)
* Update Ingress-Nginx version controller-v1.11.4
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.3...helm-chart-4.11.4

View file

@ -1,9 +0,0 @@
# Changelog
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
### 4.12.0-beta.0
* Update Ingress-Nginx version controller-v1.12.0-beta.0
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0-beta.0

View file

@ -1,10 +0,0 @@
# Changelog
This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
### 4.12.0
* CI: Fix chart testing. (#12258)
* Update Ingress-Nginx version controller-v1.12.0
**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0

View file

@ -0,0 +1,30 @@
controller:
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
service:
type: ClusterIP
kind: DaemonSet
extraModules:
- name: opentelemetry
image:
registry: registry.k8s.io
image: ingress-nginx/opentelemetry-1.25.3
tag: v20240813-b933310d
digest: sha256:f7604ac0547ed64d79b98d92133234e66c2c8aade3c1f4809fed5eec1fb7f922
distroless: true
containerSecurityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true

View file

@ -0,0 +1,13 @@
controller:
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
service:
type: ClusterIP
kind: DaemonSet
opentelemetry:
enabled: true

View file

@ -0,0 +1,30 @@
controller:
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
service:
type: ClusterIP
kind: Deployment
extraModules:
- name: opentelemetry
image:
registry: registry.k8s.io
image: ingress-nginx/opentelemetry-1.25.3
tag: v20240813-b933310d
digest: sha256:f7604ac0547ed64d79b98d92133234e66c2c8aade3c1f4809fed5eec1fb7f922
distroless: true
containerSecurityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true

View file

@ -0,0 +1,13 @@
controller:
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
service:
type: ClusterIP
kind: Deployment
opentelemetry:
enabled: true

View file

@ -9,7 +9,5 @@ controller:
internal:
enabled: true
labels:
external-dns.alpha.kubernetes.io/hostname: internal.example.com
annotations:
service.beta.kubernetes.io/aws-load-balancer-internal: "true"

View file

@ -7,10 +7,6 @@ controller:
service:
type: NodePort
external:
labels:
external-dns.alpha.kubernetes.io/hostname: external.example.com
nodePorts:
tcp:
9000: 30090

View file

@ -0,0 +1,13 @@
controller:
kind: DaemonSet
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
admissionWebhooks:
enabled: false
service:
type: ClusterIP
podSecurityPolicy:
enabled: true

View file

@ -0,0 +1,13 @@
controller:
kind: DaemonSet
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
admissionWebhooks:
enabled: true
service:
type: ClusterIP
podSecurityPolicy:
enabled: true

View file

@ -0,0 +1,10 @@
controller:
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
service:
type: ClusterIP
podSecurityPolicy:
enabled: true

View file

@ -0,0 +1,12 @@
controller:
image:
repository: ingress-controller/controller
tag: 1.0.0-dev
digest: null
admissionWebhooks:
enabled: true
service:
type: ClusterIP
podSecurityPolicy:
enabled: true

View file

@ -47,7 +47,6 @@ Controller container security context.
{{- else -}}
runAsNonRoot: {{ .Values.controller.image.runAsNonRoot }}
runAsUser: {{ .Values.controller.image.runAsUser }}
runAsGroup: {{ .Values.controller.image.runAsGroup }}
allowPrivilegeEscalation: {{ or .Values.controller.image.allowPrivilegeEscalation .Values.controller.image.chroot }}
{{- if .Values.controller.image.seccompProfile }}
seccompProfile: {{ toYaml .Values.controller.image.seccompProfile | nindent 2 }}
@ -223,7 +222,6 @@ Default backend container security context.
{{- else -}}
runAsNonRoot: {{ .Values.defaultBackend.image.runAsNonRoot }}
runAsUser: {{ .Values.defaultBackend.image.runAsUser }}
runAsGroup: {{ .Values.defaultBackend.image.runAsGroup }}
allowPrivilegeEscalation: {{ .Values.defaultBackend.image.allowPrivilegeEscalation }}
{{- if .Values.defaultBackend.image.seccompProfile }}
seccompProfile: {{ toYaml .Values.defaultBackend.image.seccompProfile | nindent 2 }}
@ -235,6 +233,17 @@ readOnlyRootFilesystem: {{ .Values.defaultBackend.image.readOnlyRootFilesystem }
{{- end -}}
{{- end -}}
{{/*
Return the appropriate apiGroup for PodSecurityPolicy.
*/}}
{{- define "podSecurityPolicy.apiGroup" -}}
{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
{{- print "policy" -}}
{{- else -}}
{{- print "extensions" -}}
{{- end -}}
{{- end -}}
{{/*
Extra modules.
*/}}

View file

@ -1,7 +1,7 @@
{{- define "ingress-nginx.params" -}}
- /nginx-ingress-controller
{{- if not .Values.controller.enableAnnotationValidations }}
- --enable-annotation-validation=false
{{- if .Values.controller.enableAnnotationValidations }}
- --enable-annotation-validation=true
{{- end }}
{{- if .Values.defaultBackend.enabled }}
- --default-backend-service=$(POD_NAMESPACE)/{{ include "ingress-nginx.defaultBackend.fullname" . }}
@ -54,7 +54,7 @@
{{- if .Values.controller.watchIngressWithoutClass }}
- --watch-ingress-without-class=true
{{- end }}
{{- if .Values.controller.metrics.enabled }}
{{- if not .Values.controller.metrics.enabled }}
- --enable-metrics={{ .Values.controller.metrics.enabled }}
{{- end }}
{{- if .Values.controller.enableTopologyAwareRouting }}

View file

@ -20,4 +20,14 @@ rules:
verbs:
- get
- update
{{- if .Values.podSecurityPolicy.enabled }}
- apiGroups: [{{ template "podSecurityPolicy.apiGroup" . }}]
resources: ['podsecuritypolicies']
verbs: ['use']
{{- with .Values.controller.admissionWebhooks.existingPsp }}
resourceNames: [{{ . }}]
{{- else }}
resourceNames: [{{ include "ingress-nginx.admissionWebhooks.fullname" . }}]
{{- end }}
{{- end }}
{{- end }}

View file

@ -42,7 +42,7 @@ spec:
{{- end }}
containers:
- name: create
{{- with (merge .Values.controller.admissionWebhooks.patch.image .Values.global.image) }}
{{- with .Values.controller.admissionWebhooks.patch.image }}
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }}
{{- end }}
imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }}
@ -67,7 +67,6 @@ spec:
{{- end }}
restartPolicy: OnFailure
serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken }}
{{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
{{- end }}

View file

@ -42,7 +42,7 @@ spec:
{{- end }}
containers:
- name: patch
{{- with (merge .Values.controller.admissionWebhooks.patch.image .Values.global.image) }}
{{- with .Values.controller.admissionWebhooks.patch.image }}
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }}
{{- end }}
imagePullPolicy: {{ .Values.controller.admissionWebhooks.patch.image.pullPolicy }}
@ -69,7 +69,6 @@ spec:
{{- end }}
restartPolicy: OnFailure
serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken }}
{{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
{{- end }}

View file

@ -0,0 +1,52 @@
{{- if (semverCompare "<1.25.0-0" .Capabilities.KubeVersion.Version) }}
{{- if and .Values.podSecurityPolicy.enabled .Values.controller.admissionWebhooks.enabled .Values.controller.admissionWebhooks.patch.enabled (empty .Values.controller.admissionWebhooks.existingPsp) -}}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ include "ingress-nginx.admissionWebhooks.fullname" . }}
annotations:
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
seccomp.security.alpha.kubernetes.io/allowedProfileNames: "*"
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: admission-webhook
{{- with .Values.controller.admissionWebhooks.patch.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
privileged: false
hostPID: false
hostIPC: false
hostNetwork: false
volumes:
- configMap
- downwardAPI
- emptyDir
- secret
- projected
fsGroup:
rule: MustRunAs
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: true
runAsUser:
rule: MustRunAsNonRoot
runAsGroup:
rule: MustRunAs
ranges:
- min: 1
max: 65535
supplementalGroups:
rule: MustRunAs
ranges:
- min: 1
max: 65535
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
seLinux:
rule: RunAsAny
{{- end }}
{{- end }}

View file

@ -13,9 +13,7 @@ metadata:
name: {{ include "ingress-nginx.controller.fullname" . }}
namespace: {{ include "ingress-nginx.namespace" . }}
data:
{{- if .Values.controller.allowSnippetAnnotations }}
allow-snippet-annotations: "true"
{{- end }}
allow-snippet-annotations: "{{ .Values.controller.allowSnippetAnnotations }}"
{{- if .Values.controller.addHeaders }}
add-headers: {{ include "ingress-nginx.namespace" . }}/{{ include "ingress-nginx.fullname" . }}-custom-add-headers
{{- end }}

View file

@ -75,7 +75,7 @@ spec:
{{- end }}
containers:
- name: {{ .Values.controller.containerName }}
{{- with (merge .Values.controller.image .Values.global.image) }}
{{- with .Values.controller.image }}
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{ end }}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }}
{{- end }}
imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
@ -144,9 +144,9 @@ spec:
hostPort: {{ $key }}
{{- end }}
{{- end }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
volumeMounts:
{{- if .Values.controller.extraModules }}
{{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
- name: modules
{{- if .Values.controller.image.chroot }}
mountPath: /chroot/modules_mount
@ -174,7 +174,7 @@ spec:
{{- if .Values.controller.extraContainers }}
{{- toYaml .Values.controller.extraContainers | nindent 8 }}
{{- end }}
{{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }}
{{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
initContainers:
{{- if .Values.controller.extraInitContainers }}
{{- toYaml .Values.controller.extraInitContainers | nindent 8 }}
@ -182,7 +182,13 @@ spec:
{{- if .Values.controller.extraModules }}
{{- range .Values.controller.extraModules }}
{{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }}
{{- include "extraModules" (dict "name" .name "image" (merge .image $.Values.global.image) "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }}
{{- include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }}
{{- end }}
{{- end }}
{{- if .Values.controller.opentelemetry.enabled }}
{{- with .Values.controller.opentelemetry }}
{{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }}
{{- include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}
@ -202,11 +208,10 @@ spec:
topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }}
{{- end }}
serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
volumes:
{{- if .Values.controller.extraModules }}
{{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled)}}
- name: modules
emptyDir: {}
{{- end }}

View file

@ -22,9 +22,6 @@ spec:
replicas: {{ .Values.controller.replicaCount }}
{{- end }}
revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
{{- if .Values.controller.progressDeadlineSeconds }}
progressDeadlineSeconds: {{ .Values.controller.progressDeadlineSeconds }}
{{- end }}
{{- if .Values.controller.updateStrategy }}
strategy: {{ toYaml .Values.controller.updateStrategy | nindent 4 }}
{{- end }}
@ -81,7 +78,7 @@ spec:
{{- end }}
containers:
- name: {{ .Values.controller.containerName }}
{{- with (merge .Values.controller.image .Values.global.image) }}
{{- with .Values.controller.image }}
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ include "ingress-nginx.image" . }}{{ end }}:{{ .tag }}{{ include "ingress-nginx.imageDigest" . }}
{{- end }}
imagePullPolicy: {{ .Values.controller.image.pullPolicy }}
@ -150,9 +147,9 @@ spec:
hostPort: {{ $key }}
{{- end }}
{{- end }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules) }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
volumeMounts:
{{- if .Values.controller.extraModules }}
{{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
- name: modules
{{- if .Values.controller.image.chroot }}
mountPath: /chroot/modules_mount
@ -180,7 +177,7 @@ spec:
{{- if .Values.controller.extraContainers }}
{{- toYaml .Values.controller.extraContainers | nindent 8 }}
{{- end }}
{{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules) }}
{{- if (or .Values.controller.extraInitContainers .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
initContainers:
{{- if .Values.controller.extraInitContainers }}
{{- toYaml .Values.controller.extraInitContainers | nindent 8 }}
@ -188,7 +185,13 @@ spec:
{{- if .Values.controller.extraModules }}
{{- range .Values.controller.extraModules }}
{{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }}
{{- include "extraModules" (dict "name" .name "image" (merge .image $.Values.global.image) "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }}
{{- include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }}
{{- end }}
{{- end }}
{{- if .Values.controller.opentelemetry.enabled }}
{{- with .Values.controller.opentelemetry }}
{{- $containerSecurityContext := .containerSecurityContext | default $.Values.controller.containerSecurityContext }}
{{- include "extraModules" (dict "name" .name "image" .image "containerSecurityContext" $containerSecurityContext "resources" .resources) | nindent 8 }}
{{- end }}
{{- end }}
{{- end }}
@ -208,11 +211,10 @@ spec:
topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }}
{{- end }}
serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules .Values.controller.opentelemetry.enabled) }}
volumes:
{{- if .Values.controller.extraModules }}
{{- if (or .Values.controller.extraModules .Values.controller.opentelemetry.enabled)}}
- name: modules
emptyDir: {}
{{- end }}

View file

@ -32,8 +32,5 @@ spec:
{{- else if .Values.controller.maxUnavailable }}
maxUnavailable: {{ .Values.controller.maxUnavailable }}
{{- end }}
{{- if .Values.controller.unhealthyPodEvictionPolicy }}
unhealthyPodEvictionPolicy: {{ .Values.controller.unhealthyPodEvictionPolicy }}
{{- end }}
{{- end }}
{{- end }}

View file

@ -14,9 +14,6 @@ metadata:
{{- if .Values.controller.metrics.prometheusRule.additionalLabels }}
{{- toYaml .Values.controller.metrics.prometheusRule.additionalLabels | nindent 4 }}
{{- end }}
{{- if .Values.controller.metrics.prometheusRule.annotations }}
annotations: {{ toYaml .Values.controller.metrics.prometheusRule.annotations | nindent 4 }}
{{- end }}
spec:
{{- if .Values.controller.metrics.prometheusRule.rules }}
groups:

View file

@ -0,0 +1,100 @@
{{- if (semverCompare "<1.25.0-0" .Capabilities.KubeVersion.Version) }}
{{- if and .Values.podSecurityPolicy.enabled (empty .Values.controller.existingPsp) -}}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ include "ingress-nginx.fullname" . }}
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: "*"
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: controller
{{- with .Values.controller.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
privileged: false
hostPID: false
hostIPC: false
hostNetwork: {{ .Values.controller.hostNetwork }}
{{- if or .Values.controller.hostNetwork .Values.controller.hostPort.enabled }}
hostPorts:
{{- if .Values.controller.hostNetwork }}
{{- range $key, $value := .Values.controller.containerPort }}
# controller.containerPort.{{ $key }}
- min: {{ $value }}
max: {{ $value }}
{{- end }}
{{- else if .Values.controller.hostPort.enabled }}
{{- range $key, $value := .Values.controller.hostPort.ports }}
# controller.hostPort.ports.{{ $key }}
- min: {{ $value }}
max: {{ $value }}
{{- end }}
{{- end }}
{{- if .Values.controller.metrics.enabled }}
# controller.metrics.port
- min: {{ .Values.controller.metrics.port }}
max: {{ .Values.controller.metrics.port }}
{{- end }}
{{- if .Values.controller.admissionWebhooks.enabled }}
# controller.admissionWebhooks.port
- min: {{ .Values.controller.admissionWebhooks.port }}
max: {{ .Values.controller.admissionWebhooks.port }}
{{- end }}
{{- range $key, $value := .Values.tcp }}
# tcp.{{ $key }}
- min: {{ $key }}
max: {{ $key }}
{{- end }}
{{- range $key, $value := .Values.udp }}
# udp.{{ $key }}
- min: {{ $key }}
max: {{ $key }}
{{- end }}
{{- end }}
volumes:
- configMap
- downwardAPI
- emptyDir
- secret
- projected
fsGroup:
rule: MustRunAs
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: false
runAsUser:
rule: MustRunAsNonRoot
runAsGroup:
rule: MustRunAs
ranges:
- min: 1
max: 65535
supplementalGroups:
rule: MustRunAs
ranges:
- min: 1
max: 65535
allowPrivilegeEscalation: {{ or .Values.controller.image.allowPrivilegeEscalation .Values.controller.image.chroot }}
requiredDropCapabilities:
- ALL
allowedCapabilities:
- NET_BIND_SERVICE
{{- if .Values.controller.image.chroot }}
{{- if .Values.controller.image.seccompProfile }}
- SYS_ADMIN
{{- end }}
- SYS_CHROOT
{{- end }}
seLinux:
rule: RunAsAny
{{- if .Values.controller.sysctls }}
allowedUnsafeSysctls:
{{- range $sysctl, $value := .Values.controller.sysctls }}
- {{ $sysctl }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

View file

@ -91,4 +91,14 @@ rules:
- list
- watch
- get
{{- if .Values.podSecurityPolicy.enabled }}
- apiGroups: [{{ template "podSecurityPolicy.apiGroup" . }}]
resources: ['podsecuritypolicies']
verbs: ['use']
{{- with .Values.controller.existingPsp }}
resourceNames: [{{ . }}]
{{- else }}
resourceNames: [{{ include "ingress-nginx.fullname" . }}]
{{- end }}
{{- end }}
{{- end }}

View file

@ -12,9 +12,6 @@ metadata:
{{- if .Values.controller.service.labels }}
{{- toYaml .Values.controller.service.labels | nindent 4 }}
{{- end }}
{{- if .Values.controller.service.internal.labels }}
{{- toYaml .Values.controller.service.internal.labels | nindent 4 }}
{{- end }}
name: {{ include "ingress-nginx.controller.fullname" . }}-internal
namespace: {{ include "ingress-nginx.namespace" . }}
spec:
@ -22,9 +19,6 @@ spec:
{{- if .Values.controller.service.internal.clusterIP }}
clusterIP: {{ .Values.controller.service.internal.clusterIP }}
{{- end }}
{{- if .Values.controller.service.internal.clusterIPs }}
clusterIPs: {{ toYaml .Values.controller.service.internal.clusterIPs | nindent 4 }}
{{- end }}
{{- if .Values.controller.service.internal.externalIPs }}
externalIPs: {{ toYaml .Values.controller.service.internal.externalIPs | nindent 4 }}
{{- end }}
@ -49,11 +43,6 @@ spec:
{{- if .Values.controller.service.internal.healthCheckNodePort }}
healthCheckNodePort: {{ .Values.controller.service.internal.healthCheckNodePort }}
{{- end }}
{{- if semverCompare ">=1.31.0-0" .Capabilities.KubeVersion.Version -}}
{{- if .Values.controller.service.internal.trafficDistribution }}
trafficDistribution: {{ .Values.controller.service.internal.trafficDistribution }}
{{- end }}
{{- end }}
{{- if semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version -}}
{{- if .Values.controller.service.internal.ipFamilyPolicy }}
ipFamilyPolicy: {{ .Values.controller.service.internal.ipFamilyPolicy }}

View file

@ -1,4 +1,4 @@
{{- if and .Values.controller.metrics.enabled .Values.controller.metrics.service.enabled -}}
{{- if .Values.controller.metrics.enabled -}}
apiVersion: v1
kind: Service
metadata:

View file

@ -12,9 +12,6 @@ metadata:
{{- if .Values.controller.service.labels }}
{{- toYaml .Values.controller.service.labels | nindent 4 }}
{{- end }}
{{- if .Values.controller.service.external.labels }}
{{- toYaml .Values.controller.service.external.labels | nindent 4 }}
{{- end }}
name: {{ include "ingress-nginx.controller.fullname" . }}
namespace: {{ include "ingress-nginx.namespace" . }}
spec:
@ -22,9 +19,6 @@ spec:
{{- if .Values.controller.service.clusterIP }}
clusterIP: {{ .Values.controller.service.clusterIP }}
{{- end }}
{{- if .Values.controller.service.clusterIPs }}
clusterIPs: {{ toYaml .Values.controller.service.clusterIPs | nindent 4 }}
{{- end }}
{{- if .Values.controller.service.externalIPs }}
externalIPs: {{ toYaml .Values.controller.service.externalIPs | nindent 4 }}
{{- end }}
@ -49,11 +43,6 @@ spec:
{{- if .Values.controller.service.healthCheckNodePort }}
healthCheckNodePort: {{ .Values.controller.service.healthCheckNodePort }}
{{- end }}
{{- if semverCompare ">=1.31.0-0" .Capabilities.KubeVersion.Version -}}
{{- if .Values.controller.service.trafficDistribution }}
trafficDistribution: {{ .Values.controller.service.trafficDistribution }}
{{- end }}
{{- end }}
{{- if semverCompare ">=1.21.0-0" .Capabilities.KubeVersion.Version -}}
{{- if .Values.controller.service.ipFamilyPolicy }}
ipFamilyPolicy: {{ .Values.controller.service.ipFamilyPolicy }}

View file

@ -3,63 +3,51 @@ apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
name: {{ include "ingress-nginx.controller.fullname" . }}
{{- if .Values.controller.metrics.serviceMonitor.namespace }}
{{- if .Values.controller.metrics.serviceMonitor.namespace }}
namespace: {{ .Values.controller.metrics.serviceMonitor.namespace }}
{{- else }}
{{- else }}
namespace: {{ include "ingress-nginx.namespace" . }}
{{- end }}
{{- end }}
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: controller
{{- if .Values.controller.metrics.serviceMonitor.additionalLabels }}
{{- if .Values.controller.metrics.serviceMonitor.additionalLabels }}
{{- toYaml .Values.controller.metrics.serviceMonitor.additionalLabels | nindent 4 }}
{{- end }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.annotations }}
annotations: {{ toYaml .Values.controller.metrics.serviceMonitor.annotations | nindent 4 }}
{{- end }}
spec:
{{- if .Values.controller.metrics.serviceMonitor.namespaceSelector }}
endpoints:
- port: {{ .Values.controller.metrics.portName }}
interval: {{ .Values.controller.metrics.serviceMonitor.scrapeInterval }}
{{- if .Values.controller.metrics.serviceMonitor.honorLabels }}
honorLabels: true
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.relabelings }}
relabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.relabelings | nindent 8 }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.metricRelabelings }}
metricRelabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.metricRelabelings | nindent 8 }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.jobLabel }}
jobLabel: {{ .Values.controller.metrics.serviceMonitor.jobLabel | quote }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.namespaceSelector }}
namespaceSelector: {{ toYaml .Values.controller.metrics.serviceMonitor.namespaceSelector | nindent 4 }}
{{- else }}
{{- else }}
namespaceSelector:
matchNames:
- {{ include "ingress-nginx.namespace" . }}
- {{ include "ingress-nginx.namespace" . }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.targetLabels }}
targetLabels:
{{- range .Values.controller.metrics.serviceMonitor.targetLabels }}
- {{ . }}
{{- end }}
{{- end }}
selector:
matchLabels:
{{- include "ingress-nginx.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: controller
endpoints:
- port: {{ .Values.controller.metrics.portName }}
interval: {{ .Values.controller.metrics.serviceMonitor.scrapeInterval }}
{{- if .Values.controller.metrics.serviceMonitor.honorLabels }}
honorLabels: true
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.relabelings }}
relabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.relabelings | nindent 4 }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.metricRelabelings }}
metricRelabelings: {{ toYaml .Values.controller.metrics.serviceMonitor.metricRelabelings | nindent 4 }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.jobLabel }}
jobLabel: {{ .Values.controller.metrics.serviceMonitor.jobLabel | quote }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.targetLabels }}
targetLabels: {{ toYaml .Values.controller.metrics.serviceMonitor.targetLabels | nindent 2 }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.labelLimit }}
labelLimit: {{ .Values.controller.metrics.serviceMonitor.labelLimit }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.labelNameLengthLimit }}
labelNameLengthLimit: {{ .Values.controller.metrics.serviceMonitor.labelNameLengthLimit }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.labelValueLengthLimit }}
labelValueLengthLimit: {{ .Values.controller.metrics.serviceMonitor.labelValueLengthLimit }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.sampleLimit }}
sampleLimit: {{ .Values.controller.metrics.serviceMonitor.sampleLimit }}
{{- end }}
{{- if .Values.controller.metrics.serviceMonitor.targetLimit }}
targetLimit: {{ .Values.controller.metrics.serviceMonitor.targetLimit }}
{{- end }}
{{- end }}

View file

@ -50,7 +50,7 @@ spec:
{{- end }}
containers:
- name: {{ template "ingress-nginx.name" . }}-default-backend
{{- with (merge .Values.defaultBackend.image .Values.global.image) }}
{{- with .Values.defaultBackend.image }}
image: {{ if .repository }}{{ .repository }}{{ else }}{{ .registry }}/{{ .image }}{{ end }}:{{ .tag }}{{ if .digest }}@{{ .digest }}{{ end }}
{{- end }}
imagePullPolicy: {{ .Values.defaultBackend.image.pullPolicy }}
@ -103,7 +103,6 @@ spec:
nodeSelector: {{ toYaml .Values.defaultBackend.nodeSelector | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "ingress-nginx.defaultBackend.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.defaultBackend.serviceAccount.automountServiceAccountToken }}
{{- if .Values.defaultBackend.tolerations }}
tolerations: {{ toYaml .Values.defaultBackend.tolerations | nindent 8 }}
{{- end }}

View file

@ -20,13 +20,6 @@ spec:
matchLabels:
{{- include "ingress-nginx.selectorLabels" . | nindent 6 }}
app.kubernetes.io/component: default-backend
{{- if and .Values.defaultBackend.minAvailable (not (hasKey .Values.defaultBackend "maxUnavailable")) }}
minAvailable: {{ .Values.defaultBackend.minAvailable }}
{{- else if .Values.defaultBackend.maxUnavailable }}
maxUnavailable: {{ .Values.defaultBackend.maxUnavailable }}
{{- end }}
{{- if .Values.defaultBackend.unhealthyPodEvictionPolicy }}
unhealthyPodEvictionPolicy: {{ .Values.defaultBackend.unhealthyPodEvictionPolicy }}
{{- end }}
{{- end }}
{{- end }}

View file

@ -0,0 +1,50 @@
{{- if (semverCompare "<1.25.0-0" .Capabilities.KubeVersion.Version) }}
{{- if and .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled (empty .Values.defaultBackend.existingPsp) -}}
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
name: {{ include "ingress-nginx.fullname" . }}-backend
annotations:
seccomp.security.alpha.kubernetes.io/allowedProfileNames: "*"
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: default-backend
{{- with .Values.defaultBackend.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
privileged: false
hostPID: false
hostIPC: false
hostNetwork: false
volumes:
- configMap
- downwardAPI
- emptyDir
- secret
- projected
fsGroup:
rule: MustRunAs
ranges:
- min: 1
max: 65535
readOnlyRootFilesystem: true
runAsUser:
rule: MustRunAsNonRoot
runAsGroup:
rule: MustRunAs
ranges:
- min: 1
max: 65535
supplementalGroups:
rule: MustRunAs
ranges:
- min: 1
max: 65535
allowPrivilegeEscalation: false
requiredDropCapabilities:
- ALL
seLinux:
rule: RunAsAny
{{- end }}
{{- end }}

View file

@ -0,0 +1,22 @@
{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: default-backend
{{- with .Values.defaultBackend.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
name: {{ include "ingress-nginx.fullname" . }}-backend
namespace: {{ include "ingress-nginx.namespace" . }}
rules:
- apiGroups: [{{ template "podSecurityPolicy.apiGroup" . }}]
resources: ['podsecuritypolicies']
verbs: ['use']
{{- with .Values.defaultBackend.existingPsp }}
resourceNames: [{{ . }}]
{{- else }}
resourceNames: [{{ include "ingress-nginx.fullname" . }}-backend]
{{- end }}
{{- end }}

View file

@ -0,0 +1,21 @@
{{- if and .Values.rbac.create .Values.podSecurityPolicy.enabled .Values.defaultBackend.enabled -}}
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
app.kubernetes.io/component: default-backend
{{- with .Values.defaultBackend.labels }}
{{- toYaml . | nindent 4 }}
{{- end }}
name: {{ include "ingress-nginx.fullname" . }}-backend
namespace: {{ include "ingress-nginx.namespace" . }}
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: {{ include "ingress-nginx.fullname" . }}-backend
subjects:
- kind: ServiceAccount
name: {{ template "ingress-nginx.defaultBackend.serviceAccountName" . }}
namespace: {{ include "ingress-nginx.namespace" . }}
{{- end }}

View file

@ -18,9 +18,6 @@ spec:
{{- if .Values.defaultBackend.service.clusterIP }}
clusterIP: {{ .Values.defaultBackend.service.clusterIP }}
{{- end }}
{{- if .Values.defaultBackend.service.clusterIPs }}
clusterIPs: {{ toYaml .Values.defaultBackend.service.clusterIPs | nindent 4 }}
{{- end }}
{{- if .Values.defaultBackend.service.externalIPs }}
externalIPs: {{ toYaml .Values.defaultBackend.service.externalIPs | nindent 4 }}
{{- end }}

View file

@ -1,12 +0,0 @@
suite: Admission Webhooks > Patch Job > Create Secret Job
templates:
- admission-webhooks/job-patch/job-createSecret.yaml
tests:
- it: should create a Job with token auto-mounting disabled if `controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken` is false
set:
controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

View file

@ -1,12 +0,0 @@
suite: Admission Webhooks > Patch Job > Patch Webhook Job
templates:
- admission-webhooks/job-patch/job-patchWebhook.yaml
tests:
- it: should create a Job with token auto-mounting disabled if `controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken` is false
set:
controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

View file

@ -20,7 +20,7 @@ tests:
of: ServiceAccount
- equal:
path: metadata.name
value: RELEASE-NAME-ingress-nginx-admission
value: ingress-nginx-admission
- it: should create a ServiceAccount with specified name if `controller.admissionWebhooks.patch.serviceAccount.name` is set
set:

View file

@ -20,7 +20,7 @@ tests:
of: ValidatingWebhookConfiguration
- equal:
path: metadata.name
value: RELEASE-NAME-ingress-nginx-admission
value: RELEASE-NAME-admission
- it: should create a ValidatingWebhookConfiguration with a custom port if `controller.admissionWebhooks.service.servicePort` is set
set:

View file

@ -15,23 +15,23 @@ tests:
path: metadata.name
value: RELEASE-NAME-ingress-nginx-controller
- it: should create a DaemonSet with argument `--enable-metrics=true` if `controller.metrics.enabled` is true
set:
controller.kind: DaemonSet
controller.metrics.enabled: true
asserts:
- contains:
path: spec.template.spec.containers[0].args
content: --enable-metrics=true
- it: should create a DaemonSet without argument `--enable-metrics=true` if `controller.metrics.enabled` is false
- it: should create a DaemonSet with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
set:
controller.kind: DaemonSet
controller.metrics.enabled: false
asserts:
- contains:
path: spec.template.spec.containers[0].args
content: --enable-metrics=false
- it: should create a DaemonSet without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
set:
controller.kind: DaemonSet
controller.metrics.enabled: true
asserts:
- notContains:
path: spec.template.spec.containers[0].args
content: --enable-metrics=true
content: --enable-metrics=false
- it: should create a DaemonSet with argument `--controller-class=k8s.io/ingress-nginx-internal` if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal"
set:
@ -139,26 +139,6 @@ tests:
- controller
topologyKey: kubernetes.io/hostname
- it: should create a DaemonSet with `runAsGroup` if `controller.image.runAsGroup` is set
set:
controller.kind: DaemonSet
controller.image.runAsGroup: 1000
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.runAsGroup
value: 1000
- it: should create a DaemonSet with a custom registry if `global.image.registry` is set
set:
global.image.registry: custom.registry.io
controller.kind: DaemonSet
controller.image.tag: v1.0.0-dev
controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
asserts:
- equal:
path: spec.template.spec.containers[0].image
value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a DaemonSet with a custom registry if `controller.image.registry` is set
set:
controller.kind: DaemonSet
@ -190,12 +170,3 @@ tests:
- equal:
path: spec.template.spec.containers[0].image
value: registry.k8s.io/ingress-nginx/controller:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a DaemonSet with token auto-mounting disabled if `serviceAccount.automountServiceAccountToken` is false
set:
controller.kind: DaemonSet
serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

View file

@ -43,21 +43,21 @@ tests:
- exists:
path: spec.replicas
- it: should create a Deployment with argument `--enable-metrics=true` if `controller.metrics.enabled` is true
set:
controller.metrics.enabled: true
asserts:
- contains:
path: spec.template.spec.containers[0].args
content: --enable-metrics=true
- it: should create a Deployment without argument `--enable-metrics=true` if `controller.metrics.enabled` is false
- it: should create a Deployment with argument `--enable-metrics=false` if `controller.metrics.enabled` is false
set:
controller.metrics.enabled: false
asserts:
- contains:
path: spec.template.spec.containers[0].args
content: --enable-metrics=false
- it: should create a Deployment without argument `--enable-metrics=false` if `controller.metrics.enabled` is true
set:
controller.metrics.enabled: true
asserts:
- notContains:
path: spec.template.spec.containers[0].args
content: --enable-metrics=true
content: --enable-metrics=false
- it: should create a Deployment with argument `--controller-class=k8s.io/ingress-nginx-internal` if `controller.ingressClassResource.controllerValue` is "k8s.io/ingress-nginx-internal"
set:
@ -161,24 +161,6 @@ tests:
- controller
topologyKey: kubernetes.io/hostname
- it: should create a Deployment with `runAsGroup` if `controller.image.runAsGroup` is set
set:
controller.image.runAsGroup: 1000
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.runAsGroup
value: 1000
- it: should create a Deployment with a custom registry if `global.image.registry` is set
set:
global.image.registry: custom.registry.io
controller.image.tag: v1.0.0-dev
controller.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
asserts:
- equal:
path: spec.template.spec.containers[0].image
value: custom.registry.io/ingress-nginx/controller:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a Deployment with a custom registry if `controller.image.registry` is set
set:
controller.image.registry: custom.registry.io
@ -207,19 +189,3 @@ tests:
- equal:
path: spec.template.spec.containers[0].image
value: registry.k8s.io/ingress-nginx/controller:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a Deployment with `progressDeadlineSeconds` if `controller.progressDeadlineSeconds` is set
set:
controller.progressDeadlineSeconds: 111
asserts:
- equal:
path: spec.progressDeadlineSeconds
value: 111
- it: should create a Deployment with token auto-mounting disabled if `serviceAccount.automountServiceAccountToken` is false
set:
serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

View file

@ -87,16 +87,3 @@ tests:
- equal:
path: spec.maxUnavailable
value: 1
- it: should create a PodDisruptionBudget with `unhealthyPodEvictionPolicy` if `controller.unhealthyPodEvictionPolicy` is set
set:
controller.replicaCount: 2
controller.unhealthyPodEvictionPolicy: IfHealthyBudget
asserts:
- hasDocuments:
count: 1
- isKind:
of: PodDisruptionBudget
- equal:
path: spec.unhealthyPodEvictionPolicy
value: IfHealthyBudget

View file

@ -15,15 +15,3 @@ tests:
- equal:
path: metadata.name
value: RELEASE-NAME-ingress-nginx-controller
- it: should create a PrometheusRule with annotations if `controller.metrics.prometheusRule.annotations` is set
set:
controller.metrics.enabled: true
controller.metrics.prometheusRule.enabled: true
controller.metrics.prometheusRule.annotations:
my-little-annotation: test-value
asserts:
- equal:
path: metadata.annotations
value:
my-little-annotation: test-value

View file

@ -23,53 +23,3 @@ tests:
- equal:
path: metadata.name
value: RELEASE-NAME-ingress-nginx-controller-internal
- it: should create a Service without `clusterIPs` if `controller.service.internal.clusterIPs` is not set
set:
controller.service.internal.enabled: true
controller.service.internal.annotations:
test.annotation: "true"
asserts:
- notExists:
path: spec.clusterIPs
- it: should create a Service with `clusterIPs` if `controller.service.internal.clusterIPs` is set
set:
controller.service.internal.enabled: true
controller.service.internal.annotations:
test.annotation: "true"
controller.service.internal.clusterIPs:
- 10.0.0.1
- fd00::1
asserts:
- equal:
path: spec.clusterIPs
value:
- 10.0.0.1
- fd00::1
- it: should create a Service with `trafficDistribution` if `controller.service.internal.trafficDistribution` is set
capabilities:
majorVersion: 1
minorVersion: 31
set:
controller.service.internal.enabled: true
controller.service.internal.annotations:
test.annotation: "true"
controller.service.internal.trafficDistribution: PreferClose
asserts:
- equal:
path: spec.trafficDistribution
value: PreferClose
- it: should create a Service with labels if `controller.service.internal.labels` is set
set:
controller.service.internal.enabled: true
controller.service.internal.annotations:
test.annotation: "true"
controller.service.internal.labels:
external-dns.alpha.kubernetes.io/hostname: internal.example.com
asserts:
- equal:
path: metadata.labels["external-dns.alpha.kubernetes.io/hostname"]
value: internal.example.com

View file

@ -3,34 +3,16 @@ templates:
- controller-service-metrics.yaml
tests:
- it: should not create a metrics Service if `controller.metrics.enabled` is false and `controller.metrics.service.enabled` is false
- it: should not create a metrics Service if `controller.metrics.enabled` is false
set:
controller.metrics.enabled: false
controller.metrics.service.enabled: false
asserts:
- hasDocuments:
count: 0
- it: should not create a metrics Service if `controller.metrics.enabled` is false and `controller.metrics.service.enabled` is true
set:
controller.metrics.enabled: false
controller.metrics.service.enabled: true
asserts:
- hasDocuments:
count: 0
- it: should not create a metrics Service if `controller.metrics.enabled` is true and `controller.metrics.service.enabled` is false
- it: should create a metrics Service if `controller.metrics.enabled` is true
set:
controller.metrics.enabled: true
controller.metrics.service.enabled: false
asserts:
- hasDocuments:
count: 0
- it: should create a metrics Service if `controller.metrics.enabled` is true and `controller.metrics.service.enabled` is true
set:
controller.metrics.enabled: true
controller.metrics.service.enabled: true
asserts:
- hasDocuments:
count: 1

View file

@ -30,45 +30,3 @@ tests:
- equal:
path: spec.type
value: NodePort
- it: should create a Service without `clusterIPs` if `controller.service.clusterIPs` is not set
set:
controller.service.external.enabled: true
asserts:
- notExists:
path: spec.clusterIPs
- it: should create a Service with `clusterIPs` if `controller.service.clusterIPs` is set
set:
controller.service.external.enabled: true
controller.service.clusterIPs:
- 10.0.0.1
- fd00::1
asserts:
- equal:
path: spec.clusterIPs
value:
- 10.0.0.1
- fd00::1
- it: should create a Service with `trafficDistribution` if `controller.service.trafficDistribution` is set
capabilities:
majorVersion: 1
minorVersion: 31
set:
controller.service.external.enabled: true
controller.service.trafficDistribution: PreferClose
asserts:
- equal:
path: spec.trafficDistribution
value: PreferClose
- it: should create a Service with labels if `controller.service.external.labels` is set
set:
controller.service.external.enabled: true
controller.service.external.labels:
external-dns.alpha.kubernetes.io/hostname: external.example.com
asserts:
- equal:
path: metadata.labels["external-dns.alpha.kubernetes.io/hostname"]
value: external.example.com

View file

@ -1,47 +0,0 @@
suite: Controller > ServiceAccount
templates:
- controller-serviceaccount.yaml
tests:
- it: should not create a ServiceAccount if `serviceAccount.create` is false
set:
serviceAccount.create: false
asserts:
- hasDocuments:
count: 0
- it: should create a ServiceAccount if `serviceAccount.create` is true
set:
serviceAccount.create: true
asserts:
- hasDocuments:
count: 1
- isKind:
of: ServiceAccount
- equal:
path: metadata.name
value: RELEASE-NAME-ingress-nginx
- it: should create a ServiceAccount with specified name if `serviceAccount.name` is set
set:
serviceAccount.name: ingress-nginx-admission-test-sa
asserts:
- hasDocuments:
count: 1
- isKind:
of: ServiceAccount
- equal:
path: metadata.name
value: ingress-nginx-admission-test-sa
- it: should create a ServiceAccount with token auto-mounting disabled if `serviceAccount.automountServiceAccountToken` is false
set:
serviceAccount.automountServiceAccountToken: false
asserts:
- hasDocuments:
count: 1
- isKind:
of: ServiceAccount
- equal:
path: automountServiceAccountToken
value: false

View file

@ -27,53 +27,3 @@ tests:
path: metadata.annotations
value:
my-little-annotation: test-value
- it: should create a ServiceMonitor with `labelLimit` if `controller.metrics.serviceMonitor.labelLimit` is set
set:
controller.metrics.enabled: true
controller.metrics.serviceMonitor.enabled: true
controller.metrics.serviceMonitor.labelLimit: 20
asserts:
- equal:
path: spec.labelLimit
value: 20
- it: should create a ServiceMonitor with `labelNameLengthLimit` if `controller.metrics.serviceMonitor.labelNameLengthLimit` is set
set:
controller.metrics.enabled: true
controller.metrics.serviceMonitor.enabled: true
controller.metrics.serviceMonitor.labelNameLengthLimit: 50
asserts:
- equal:
path: spec.labelNameLengthLimit
value: 50
- it: should create a ServiceMonitor with `labelValueLengthLimit` if `controller.metrics.serviceMonitor.labelValueLengthLimit` is set
set:
controller.metrics.enabled: true
controller.metrics.serviceMonitor.enabled: true
controller.metrics.serviceMonitor.labelValueLengthLimit: 50
asserts:
- equal:
path: spec.labelValueLengthLimit
value: 50
- it: should create a ServiceMonitor with `sampleLimit` if `controller.metrics.serviceMonitor.sampleLimit` is set
set:
controller.metrics.enabled: true
controller.metrics.serviceMonitor.enabled: true
controller.metrics.serviceMonitor.sampleLimit: 5000
asserts:
- equal:
path: spec.sampleLimit
value: 5000
- it: should create a ServiceMonitor with `targetLimit` if `controller.metrics.serviceMonitor.targetLimit` is set
set:
controller.metrics.enabled: true
controller.metrics.serviceMonitor.enabled: true
controller.metrics.serviceMonitor.targetLimit: 100
asserts:
- equal:
path: spec.targetLimit
value: 100

View file

@ -136,26 +136,6 @@ tests:
- default-backend
topologyKey: kubernetes.io/hostname
- it: should create a Deployment with `runAsGroup` if `defaultBackend.image.runAsGroup` is set
set:
defaultBackend.enabled: true
defaultBackend.image.runAsGroup: 1000
asserts:
- equal:
path: spec.template.spec.containers[0].securityContext.runAsGroup
value: 1000
- it: should create a Deployment with a custom registry if `global.image.registry` is set
set:
global.image.registry: custom.registry.io
defaultBackend.enabled: true
defaultBackend.image.tag: v1.0.0-dev
defaultBackend.image.digest: sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
asserts:
- equal:
path: spec.template.spec.containers[0].image
value: custom.registry.io/defaultbackend-amd64:v1.0.0-dev@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a Deployment with a custom registry if `defaultBackend.image.registry` is set
set:
defaultBackend.enabled: true
@ -187,12 +167,3 @@ tests:
- equal:
path: spec.template.spec.containers[0].image
value: registry.k8s.io/defaultbackend-amd64:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a Deployment with token auto-mounting disabled if `defaultBackend.serviceAccount.automountServiceAccountToken` is false
set:
defaultBackend.enabled: true
defaultBackend.serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

View file

@ -46,34 +46,3 @@ tests:
asserts:
- hasDocuments:
count: 0
- it: should create a PodDisruptionBudget without `minAvailable` and with `maxUnavailable` if `defaultBackend.minAvailable` and `defaultBackend.maxUnavailable` are set
set:
defaultBackend.enabled: true
defaultBackend.replicaCount: 2
defaultBackend.minAvailable: 1
defaultBackend.maxUnavailable: 1
asserts:
- hasDocuments:
count: 1
- isKind:
of: PodDisruptionBudget
- notExists:
path: spec.minAvailable
- equal:
path: spec.maxUnavailable
value: 1
- it: should create a PodDisruptionBudget with `unhealthyPodEvictionPolicy` if `defaultBackend.unhealthyPodEvictionPolicy` is set
set:
defaultBackend.enabled: true
defaultBackend.replicaCount: 2
defaultBackend.unhealthyPodEvictionPolicy: IfHealthyBudget
asserts:
- hasDocuments:
count: 1
- isKind:
of: PodDisruptionBudget
- equal:
path: spec.unhealthyPodEvictionPolicy
value: IfHealthyBudget

View file

@ -30,23 +30,3 @@ tests:
- equal:
path: spec.ports[0].port
value: 80
- it: should create a Service without `clusterIPs` if `defaultBackend.service.clusterIPs` is not set
set:
defaultBackend.enabled: true
asserts:
- notExists:
path: spec.clusterIPs
- it: should create a Service with `clusterIPs` if `defaultBackend.service.clusterIPs` is set
set:
defaultBackend.enabled: true
defaultBackend.service.clusterIPs:
- 10.0.0.1
- fd00::1
asserts:
- equal:
path: spec.clusterIPs
value:
- 10.0.0.1
- fd00::1

View file

@ -1,51 +0,0 @@
suite: Default Backend > ServiceAccount
templates:
- default-backend-serviceaccount.yaml
tests:
- it: should not create a ServiceAccount if `defaultBackend.serviceAccount.create` is false
set:
defaultBackend.enabled: true
defaultBackend.serviceAccount.create: false
asserts:
- hasDocuments:
count: 0
- it: should create a ServiceAccount if `defaultBackend.serviceAccount.create` is true
set:
defaultBackend.enabled: true
defaultBackend.serviceAccount.create: true
asserts:
- hasDocuments:
count: 1
- isKind:
of: ServiceAccount
- equal:
path: metadata.name
value: RELEASE-NAME-ingress-nginx-backend
- it: should create a ServiceAccount with specified name if `defaultBackend.serviceAccount.name` is set
set:
defaultBackend.enabled: true
defaultBackend.serviceAccount.name: ingress-nginx-admission-test-sa
asserts:
- hasDocuments:
count: 1
- isKind:
of: ServiceAccount
- equal:
path: metadata.name
value: ingress-nginx-admission-test-sa
- it: should create a ServiceAccount with token auto-mounting disabled if `defaultBackend.serviceAccount.automountServiceAccountToken` is false
set:
defaultBackend.enabled: true
defaultBackend.serviceAccount.automountServiceAccountToken: false
asserts:
- hasDocuments:
count: 1
- isKind:
of: ServiceAccount
- equal:
path: automountServiceAccountToken
value: false

View file

@ -2,10 +2,6 @@
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md
##
global:
image:
# -- Registry host to pull images from.
registry: registry.k8s.io
## Overrides for generated resource names
# See templates/_helpers.tpl
# nameOverride:
@ -21,30 +17,28 @@ commonLabels: {}
controller:
name: controller
enableAnnotationValidations: true
enableAnnotationValidations: false
image:
## Keep false as default for now!
chroot: false
# registry: registry.k8s.io
registry: registry.k8s.io
image: ingress-nginx/controller
## for backwards compatibility consider setting the full image url via the repository value below
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
## repository:
tag: "v1.12.0"
digest: sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa
digestChroot: sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3
tag: "v1.11.3"
digest: sha256:d56f135b6462cfc476447cfe564b83a45e8bb7da2774963b00d12161112270b7
digestChroot: sha256:22701f0fc0f2dd209ef782f4e281bfe2d8cccd50ededa00aec88e0cdbe7edd14
pullPolicy: IfNotPresent
runAsNonRoot: true
# -- This value must not be changed using the official image.
# uid=101(www-data) gid=82(www-data) groups=82(www-data)
# www-data -> uid 101
runAsUser: 101
# -- This value must not be changed using the official image.
# uid=101(www-data) gid=82(www-data) groups=82(www-data)
runAsGroup: 82
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
readOnlyRootFilesystem: false
# -- Use an existing PSP instead of creating one
existingPsp: ""
# -- Configures the controller container name
containerName: controller
# -- Configures the ports that the nginx-controller listens on
@ -240,9 +234,6 @@ controller:
# maxUnavailable: 1
# type: RollingUpdate
# -- Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed.
# Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds
progressDeadlineSeconds: 0
# -- `minReadySeconds` to avoid killing pods before we are ready
##
minReadySeconds: 0
@ -308,8 +299,6 @@ controller:
# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
# app.kubernetes.io/instance: '{{ .Release.Name }}'
# app.kubernetes.io/component: controller
# matchLabelKeys:
# - pod-template-hash
# topologyKey: topology.kubernetes.io/zone
# maxSkew: 1
# whenUnsatisfiable: ScheduleAnyway
@ -318,8 +307,6 @@ controller:
# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
# app.kubernetes.io/instance: '{{ .Release.Name }}'
# app.kubernetes.io/component: controller
# matchLabelKeys:
# - pod-template-hash
# topologyKey: kubernetes.io/hostname
# maxSkew: 1
# whenUnsatisfiable: ScheduleAnyway
@ -385,9 +372,7 @@ controller:
minAvailable: 1
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
# maxUnavailable: 1
# -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
# Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
unhealthyPodEvictionPolicy: ""
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
## Ideally, there should be no limits.
@ -486,8 +471,6 @@ controller:
external:
# -- Enable the external controller service or not. Useful for internal-only deployments.
enabled: true
# -- Labels to be added to the external controller service.
labels: {}
# -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.
annotations: {}
# -- Labels to be added to both controller services.
@ -499,10 +482,6 @@ controller:
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
clusterIP: ""
# -- Pre-defined cluster internal IP addresses of the external controller service. Take care of collisions with existing services.
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
clusterIPs: []
# -- List of node IP addresses at which the external controller service is available.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
externalIPs: []
@ -529,10 +508,6 @@ controller:
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
# healthCheckNodePort: 0
# -- Traffic distribution policy of the external controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution
trafficDistribution: ""
# -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
@ -576,8 +551,6 @@ controller:
internal:
# -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.
enabled: false
# -- Labels to be added to the internal controller service.
labels: {}
# -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
annotations: {}
@ -589,10 +562,6 @@ controller:
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
clusterIP: ""
# -- Pre-defined cluster internal IP addresses of the internal controller service. Take care of collisions with existing services.
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
clusterIPs: []
# -- List of node IP addresses at which the internal controller service is available.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
externalIPs: []
@ -619,10 +588,6 @@ controller:
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
# healthCheckNodePort: 0
# -- Traffic distribution policy of the internal controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution
trafficDistribution: ""
# -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
@ -708,11 +673,11 @@ controller:
# image: busybox
# command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
# -- Modules, which are mounted into the core nginx image.
# -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module
extraModules: []
# - name: mytestmodule
# image:
# # registry: registry.k8s.io
# registry: registry.k8s.io
# image: ingress-nginx/mytestmodule
# ## for backwards compatibility consider setting the full image url via the repository value below
# ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
@ -723,7 +688,6 @@ controller:
# containerSecurityContext:
# runAsNonRoot: true
# runAsUser: <user-id>
# runAsGroup: <group-id>
# allowPrivilegeEscalation: false
# seccompProfile:
# type: RuntimeDefault
@ -737,6 +701,30 @@ controller:
# will be executed as initContainers, to move its config files within the
# mounted volume.
opentelemetry:
enabled: false
name: opentelemetry
image:
registry: registry.k8s.io
image: ingress-nginx/opentelemetry-1.25.3
## for backwards compatibility consider setting the full image url via the repository value below
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
## repository:
tag: v20240813-b933310d
digest: sha256:f7604ac0547ed64d79b98d92133234e66c2c8aade3c1f4809fed5eec1fb7f922
distroless: true
containerSecurityContext:
runAsNonRoot: true
# -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.
runAsUser: 65532
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
resources: {}
admissionWebhooks:
name: admission
annotations: {}
@ -764,6 +752,8 @@ controller:
objectSelector: {}
# -- Labels to be added to admission webhooks
labels: {}
# -- Use an existing PSP instead of creating one
existingPsp: ""
service:
annotations: {}
# clusterIP: ""
@ -778,7 +768,6 @@ controller:
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
@ -799,7 +788,6 @@ controller:
securityContext:
runAsNonRoot: true
runAsUser: 65532
runAsGroup: 65532
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
@ -811,13 +799,13 @@ controller:
patch:
enabled: true
image:
# registry: registry.k8s.io
registry: registry.k8s.io
image: ingress-nginx/kube-webhook-certgen
## for backwards compatibility consider setting the full image url via the repository value below
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
## repository:
tag: v1.5.1
digest: sha256:0de05718b59dc33b57ddfb4d8ad5f637cefd13eafdec0e1579d782b3483c27c3
tag: v1.4.4
digest: sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f
pullPolicy: IfNotPresent
# -- Provide a priority class name to the webhook patching job
##
@ -865,8 +853,6 @@ controller:
# if this port is changed, change healthz-port: in extraArgs: accordingly
enabled: false
service:
# -- Enable the metrics service or not.
enabled: true
annotations: {}
# prometheus.io/scrape: "true"
# prometheus.io/port: "10254"
@ -902,21 +888,9 @@ controller:
targetLabels: []
relabelings: []
metricRelabelings: []
# -- Per-scrape limit on number of labels that will be accepted for a sample.
labelLimit: 0
# -- Per-scrape limit on length of labels name that will be accepted for a sample.
labelNameLengthLimit: 0
# -- Per-scrape limit on length of labels value that will be accepted for a sample.
labelValueLengthLimit: 0
# -- Defines a per-scrape limit on the number of scraped samples that will be accepted.
sampleLimit: 0
# -- Defines a limit on the number of scraped targets that will be accepted.
targetLimit: 0
prometheusRule:
enabled: false
additionalLabels: {}
# -- Annotations to be added to the PrometheusRule.
annotations: {}
# namespace: ""
rules: []
# # These are just examples rules, please adapt them to your needs
@ -980,7 +954,7 @@ defaultBackend:
enabled: false
name: defaultbackend
image:
# registry: registry.k8s.io
registry: registry.k8s.io
image: defaultbackend-amd64
## for backwards compatibility consider setting the full image url via the repository value below
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
@ -990,11 +964,12 @@ defaultBackend:
runAsNonRoot: true
# nobody user -> uid 65534
runAsUser: 65534
runAsGroup: 65534
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
readOnlyRootFilesystem: true
# -- Use an existing PSP instead of creating one
existingPsp: ""
extraArgs: {}
serviceAccount:
create: true
@ -1088,8 +1063,6 @@ defaultBackend:
# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
# app.kubernetes.io/instance: '{{ .Release.Name }}'
# app.kubernetes.io/component: default-backend
# matchLabelKeys:
# - pod-template-hash
# topologyKey: topology.kubernetes.io/zone
# maxSkew: 1
# whenUnsatisfiable: ScheduleAnyway
@ -1098,8 +1071,6 @@ defaultBackend:
# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
# app.kubernetes.io/instance: '{{ .Release.Name }}'
# app.kubernetes.io/component: default-backend
# matchLabelKeys:
# - pod-template-hash
# topologyKey: kubernetes.io/hostname
# maxSkew: 1
# whenUnsatisfiable: ScheduleAnyway
@ -1121,13 +1092,7 @@ defaultBackend:
podAnnotations: {}
replicaCount: 1
# -- Minimum available pods set in PodDisruptionBudget.
# Define either 'minAvailable' or 'maxUnavailable', never both.
minAvailable: 1
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
# maxUnavailable: 1
# -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.
# Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/
unhealthyPodEvictionPolicy: ""
resources: {}
# limits:
# cpu: 10m
@ -1175,10 +1140,6 @@ defaultBackend:
service:
annotations: {}
# clusterIP: ""
# -- Pre-defined cluster internal IP addresses of the default backend service. Take care of collisions with existing services.
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
clusterIPs: []
# -- List of IP addresses at which the default backend service is available
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
@ -1195,6 +1156,10 @@ defaultBackend:
rbac:
create: true
scope: false
## If true, create & use Pod Security Policy resources
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
podSecurityPolicy:
enabled: false
serviceAccount:
create: true
name: ""

View file

@ -2,9 +2,9 @@ options:
# Ignore Prow provided substitutions.
substitution_option: ALLOW_LOOSE
steps:
- name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20250116-2a05ea7e3d
- name: gcr.io/k8s-staging-test-infra/gcb-docker-gcloud:v20240718-5ef92b5c36
env:
- REGISTRY=us-central1-docker.pkg.dev/k8s-staging-images/ingress-nginx
- REGISTRY=gcr.io/k8s-staging-ingress-nginx
- REPO_INFO=https://github.com/kubernetes/ingress-nginx
- COMMIT_SHA=${_PULL_BASE_SHA}
- BUILD_ID=${BUILD_ID}

View file

@ -66,7 +66,7 @@ func main() {
mc := metric.NewDummyCollector()
if conf.EnableMetrics {
// TODO: Ingress class is not a part of dataplane anymore
mc, err = metric.NewCollector(conf.MetricsPerHost, conf.MetricsPerUndefinedHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.MetricsBucketFactor, conf.MetricsMaxBuckets, conf.ExcludeSocketMetrics)
mc, err = metric.NewCollector(conf.MetricsPerHost, conf.ReportStatusClasses, reg, conf.IngressClassConfiguration.Controller, *conf.MetricsBuckets, conf.ExcludeSocketMetrics)
if err != nil {
klog.Fatalf("Error creating prometheus collector: %v", err)
}

Some files were not shown because too many files have changed in this diff Show more