DevFW-CICD/ingress-nginx-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ingress-nginx-helm/charts/ingress-nginx/templates
History
Marco Ebert 8b026f42d5
Chart: Tighten securityContexts and Pod Security Policies. (#10491) 
* Values: Fix docs of `controller.podSecurityContext` & `controller.sysctls`.

* Values: Add missing `controller.containerSecurityContext`.

Already in use, but has never been added to values.

* Values: Fix docs of `defaultBackend.podSecurityContext` & `defaultBackend.containerSecurityContext`.

* Helpers: Rename `controller.containerSecurityContext` to `ingress-nginx.controller.containerSecurityContext`.

Due to alignment with other templates.

* Helpers: Improve `extraModules`.

- Make `command` a multiline list.
- Fix `toYaml` usage.
- Remove `toYaml` where not necessary.

* Helpers: Move `ingress-nginx.defaultBackend.fullname`.

* Helpers: Add `ingress-nginx.defaultBackend.containerSecurityContext`.

Extracts the default backend `securityContext` into a template, as for the controller.

* Controller: Fix indentation of `controller.podSecurityContext` & `controller.sysctls`.

* Controller: Improve `controller.extraModules` & `controller.opentelemetry`.

- Add `controller.extraModules.distroless` & `controller.extraModules.resources`.
- Add `controller.opentelemetry.name` & `controller.opentelemetry.distroless`.
- Align `extraModules` inclusion for `controller.extraModules` & `controller.opentelemetry`.
- Remove redundant whitespaces.

* Controller/PSP: Align indentation.

* Controller/PSP: Remove quotes.

* Controller/PSP: Improve comments.

* Controller/PSP: Reorder fields.

See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy.

* Admission Webhooks: Fix indentation of `controller.admissionWebhooks.patch.securityContext`.

* Admission Webhooks/PSP: Align indentation.

* Admission Webhooks/PSP: Reorder fields.

* Admission Webhooks/PSP: Align condition.

* Admission Webhooks/ClusterRole: Align PSP rule.

* Default Backend/PSP: Align indentation.

* Default Backend/PSP: Reorder fields.

See https://v1-24.docs.kubernetes.io/docs/concepts/security/pod-security-policy.

* Values: Tighten `controller.image`.

Due to recent changes, the controller image can be run without privilege escalation:

- https://github.com/kubernetes/ingress-nginx/issues/8499
- https://github.com/kubernetes/ingress-nginx/pull/7449

* Values: Tighten `controller.extraModules.containerSecurityContext`.

* Values: Tighten `controller.opentelemetry.containerSecurityContext`.

* Values: Tighten `controller.admissionWebhooks.*.securityContext`.

Moves the pod `securityContext` to the containers to not interfere with injected containers.

* Values: Tighten `defaultBackend.image`.
2023-11-07 18:52:36 +01:00
..
admission-webhooks Chart: Tighten securityContexts and Pod Security Policies. (#10491) 2023-11-07 18:52:36 +01:00
_helpers.tpl Chart: Tighten securityContexts and Pod Security Policies. (#10491) 2023-11-07 18:52:36 +01:00
_params.tpl Implement annotation validation (#9673) 2023-07-21 20:32:07 -07:00
clusterrole.yaml feat: switch from endpoints to endpointslices (#8890) 2022-09-23 12:38:04 -07:00
clusterrolebinding.yaml Chart: Improve #10539. (#10565) 2023-11-01 22:59:56 +01:00
controller-configmap-addheaders.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-configmap-proxyheaders.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-configmap-tcp.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-configmap-udp.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-configmap.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-daemonset.yaml Chart: Tighten securityContexts and Pod Security Policies. (#10491) 2023-11-07 18:52:36 +01:00
controller-deployment.yaml Chart: Tighten securityContexts and Pod Security Policies. (#10491) 2023-11-07 18:52:36 +01:00
controller-hpa.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-ingressclass.yaml Release v1 (#7470) 2021-08-21 13:42:00 -07:00
controller-keda.yaml Chart: Improve #10539. (#10565) 2023-11-01 22:59:56 +01:00
controller-networkpolicy.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-poddisruptionbudget.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-prometheusrules.yaml Chart: Improve #10539. (#10565) 2023-11-01 22:59:56 +01:00
controller-psp.yaml Chart: Tighten securityContexts and Pod Security Policies. (#10491) 2023-11-07 18:52:36 +01:00
controller-role.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-rolebinding.yaml Chart: Improve #10539. (#10565) 2023-11-01 22:59:56 +01:00
controller-secret.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-service-internal.yaml chart: allow setting allocateLoadBalancerNodePorts (#10585) 2023-11-02 22:45:46 +01:00
controller-service-metrics.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-service-webhook.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-service.yaml chart: allow setting allocateLoadBalancerNodePorts (#10585) 2023-11-02 22:45:46 +01:00
controller-serviceaccount.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
controller-servicemonitor.yaml Chart: Improve #10539. (#10565) 2023-11-01 22:59:56 +01:00
default-backend-deployment.yaml Chart: Tighten securityContexts and Pod Security Policies. (#10491) 2023-11-07 18:52:36 +01:00
default-backend-hpa.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
default-backend-networkpolicy.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
default-backend-poddisruptionbudget.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
default-backend-psp.yaml Chart: Tighten securityContexts and Pod Security Policies. (#10491) 2023-11-07 18:52:36 +01:00
default-backend-role.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
default-backend-rolebinding.yaml Chart: Improve #10539. (#10565) 2023-11-01 22:59:56 +01:00
default-backend-service.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
default-backend-serviceaccount.yaml feat: add namespace overrides (#10539) 2023-10-24 19:53:46 +02:00
NOTES.txt Chart: Fix pod selectors in NOTES.txt. (#10617) 2023-11-07 18:46:40 +01:00