nginx-ingress.yaml

# Copyright (c) 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Eclipse Public License 2.0 which is available at
# http://www.eclipse.org/legal/epl-2.0
#
# SPDX-License-Identifier: EPL-2.0
{{- if .Values.ingress.controller.enabled -}}
---
apiVersion: v1
kind: Namespace
metadata:
  name: "{{ .Values.ingress.controller.namespace }}"
  labels:
    name: "{{ .Values.ingress.controller.namespace }}"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-node-health-check-conf
  namespace: "{{ .Values.ingress.controller.namespace }}"
data:
  nginx-node-health-check.conf: |
    # config for health check container running together with the ingress controller
    worker_processes 1;

    events {
      worker_connections 1024;
    }

    http {
      charset utf-8;

      server {
        listen 8080;
        server_name localhost;

        location /healthz {
          add_header Content-Type text-plain;
          return 200 'ok';
        }

      }
    }

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.namespace }}"
  name: "{{ .Values.ingress.controller.namespace }}"
  namespace: "{{ .Values.ingress.controller.namespace }}"
spec:
  selector:
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
  ports:
    - name: tcp
      port: 80
      protocol: TCP

---
apiVersion: v1
kind: Service
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxIngressVersion }}"
  name: nginx-ingress-controller-admission
  namespace: "{{ .Values.ingress.controller.namespace }}"
spec:
  ports:
    - appProtocol: https
      name: https-webhook
      port: 443
      targetPort: webhook
  selector:
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
  type: ClusterIP
  
---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-configuration
  namespace: "{{ .Values.ingress.controller.namespace }}"
data:
  worker-processes: "auto"
  max-worker-connections: "0" # 0 will use the value of max-worker-open-files
  max-worker-open-files: "0" # the default of 0 means "max open files (system's limit) / worker-processes - 1024"
  server-tokens: "False"
  use-gzip: "True"
  gzip-level: "6"
  gzip-types: "text/plain text/css text/js text/xml text/javascript application/javascript application/x-javascript application/json application/xml application/xml+rss"
  location-snippet: |
    more_set_headers "Strict-Transport-Security: max-age=31536000; includeSubDomains";
    more_set_headers 'X-Content-Type-Options: "nosniff"';
    more_set_headers 'X-Frame-Options: "SAMEORIGIN"';
    more_set_headers 'X-XSS-Protection: "1; mode=block"';
    default_type application/octet-stream;
    gzip_disable "msie6";
    gzip_min_length 1100;
    gzip_buffers 16 8k;
    gzip_proxied any;
    gunzip on;
    gzip_static always;
    gzip_vary on;

    tcp_nopush on;

    # timeouts are configured slightly higher than gateway read-timeout of 60 seconds
    send_timeout 70; # seconds, default: 60

    # ignore X-Original-URI in the request
    proxy_hide_header X-Original-URI;
    proxy_set_header X-Original-URI $request_uri;

    # set ditto-specific forwarded headers
    proxy_set_header        X-Forwarded-User              $remote_user;
    proxy_set_header        x-ditto-pre-authenticated     "nginx:$remote_user";

  proxy-connect-timeout: "10" # seconds, default: 60
  # timeouts are configured slightly higher than gateway read-timeout of 60 seconds
  proxy-send-timeout: "70" # seconds, default: 60
  proxy-read-timeout: "70" # seconds, default: 60
  # will try another upstream if an error or timeout occurred during the connection
  # or if the upstream returns 502 response
  proxy-next-upstream: "error timeout http_502"
  # will retry up to 4 times to find another upstream to connect to
  proxy-next-upstream-tries: "4"
  # will try for max. 50s to find another upstream to connect to
  proxy-next-upstream-timeout: "50"
  client-header-buffer-size: "8k" # allow longer URIs + headers (default: 1k)
  large-client-header-buffers: "4 16k"
  keep-alive: "75" #seconds, default: 75
  log-format-upstream: '$remote_addr - "$remote_user" [$time_local] "$host" "$request" $status $bytes_sent "$upstream_addr" "$http_referer" "$http_user_agent" "$http_origin" "$http_content_type"'
  use-forwarded-headers: "True"
  http-snippet: |
    charset utf-8;
    sendfile on;

    # timeouts are configured slightly higher than gateway read-timeout of 60 seconds
    send_timeout 70; # seconds, default: 60

    merge_slashes off; # allow multiple slashes for CRS Authentication

---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: tcp-services
  namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: udp-services
  namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-serviceaccount
  namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: v1
kind: ServiceAccount
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission
  namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-role
  namespace: "{{ .Values.ingress.controller.namespace }}"
rules:
  - apiGroups:
      - ""
    resources:
      - namespaces
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - configmaps
      - pods
      - secrets
      - endpoints
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resourceNames:
      - ingress-controller-leader
    resources:
      - configmaps
    verbs:
      - get
      - update
  - apiGroups:
      - ""
    resources:
      - configmaps
    verbs:
      - create
  - apiGroups:
      - coordination.k8s.io
    resourceNames:
      - ingress-controller-leader
    resources:
      - leases
    verbs:
      - get
      - update
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - create
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - list
      - watch
      - get

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission
  namespace: "{{ .Values.ingress.controller.namespace }}"
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - get
      - create

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: "{{ .Values.ingress.controller.namespace }}-clusterrole"
rules:
  - apiGroups:
      - ""
    resources:
      - configmaps
      - endpoints
      - nodes
      - pods
      - secrets
      - namespaces
    verbs:
      - list
      - watch
  - apiGroups:
      - coordination.k8s.io
    resources:
      - leases
    verbs:
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - nodes
    verbs:
      - get
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingresses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - ""
    resources:
      - events
    verbs:
      - create
      - patch
  - apiGroups:
    - networking.k8s.io
    resources:
      - ingresses/status
    verbs:
      - update
  - apiGroups:
      - networking.k8s.io
    resources:
      - ingressclasses
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - discovery.k8s.io
    resources:
      - endpointslices
    verbs:
      - list
      - watch
      - get

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission
rules:
  - apiGroups:
      - admissionregistration.k8s.io
    resources:
      - validatingwebhookconfigurations
    verbs:
      - get
      - update

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-role-binding
  namespace: "{{ .Values.ingress.controller.namespace }}"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: nginx-ingress-role
subjects:
- kind: ServiceAccount
  name: nginx-ingress-serviceaccount
  namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission
  namespace: "{{ .Values.ingress.controller.namespace }}"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: nginx-ingress-admission
subjects:
  - kind: ServiceAccount
    name: nginx-ingress-admission
    namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: "{{ .Values.ingress.controller.namespace }}-clusterrole-binding"
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: "{{ .Values.ingress.controller.namespace }}-clusterrole"
subjects:
- kind: ServiceAccount
  name: nginx-ingress-serviceaccount
  namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: nginx-ingress-admission
subjects:
  - kind: ServiceAccount
    name: nginx-ingress-admission
    namespace: "{{ .Values.ingress.controller.namespace }}"

---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 1000000
globalDefault: false
description: "This priority class is used for the things and gateway service pods only."

---
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-controller
  namespace: "{{ .Values.ingress.controller.namespace }}"
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
      app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  minReadySeconds: 10
  revisionHistoryLimit: 5
  template:
    metadata:
      labels:
        app.kubernetes.io/component: controller
        app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
        app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
      annotations:
        prometheus.io/port: "10254"
        prometheus.io/scrape: "true"
        checksum/nginx-auth: {{ include (print $.Template.BasePath "/nginx-ingress-auth.yaml") . | sha256sum }}
    spec:
      priorityClassName: high-priority
      serviceAccountName: nginx-ingress-serviceaccount
      dnsPolicy: ClusterFirst
      nodeSelector:
        ingress.node: "master"
      terminationGracePeriodSeconds: 100
      imagePullSecrets:
        - name: acr-secret
      securityContext:
        fsGroup: 101
        supplementalGroups: [101]
        seccompProfile:
          type: RuntimeDefault
      topologySpreadConstraints:
        - maxSkew: {{ .Values.ingress.controller.topologySpreadConstraints.maxSkew }}
          topologyKey: {{ .Values.ingress.controller.topologySpreadConstraints.topologyKey }}
          whenUnsatisfiable: {{ .Values.ingress.controller.topologySpreadConstraints.whenUnsatisfiable }}
          labelSelector:
            matchLabels:
              app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
      containers:
      - name: nginx-node-health-check
        image: docker.io/library/nginx:{{ .Values.ingress.controller.nginxVersion }}
        imagePullPolicy: Always
        ports:
        - name: healthz-port
          containerPort: 8080
          hostPort: 31005
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 15
          timeoutSeconds: 6
          successThreshold: 1
          failureThreshold: 4
        readinessProbe:
          httpGet:
            path: /healthz
            port: 8080
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 2
          failureThreshold: 3
          successThreshold: 1
        volumeMounts:
          - name: nginx-node-health-check-conf
            mountPath: /etc/nginx/nginx.conf
            subPath: nginx-node-health-check.conf
      - name: nginx-ingress-controller
        image: registry.k8s.io/ingress-nginx/controller:{{ .Values.ingress.controller.nginxIngressVersion }}
        imagePullPolicy: IfNotPresent
        args:
        - /nginx-ingress-controller
        - --publish-service=$(POD_NAMESPACE)/{{ .Values.ingress.controller.namespace }}
        - --election-id=ingress-controller-leader
        - --controller-class=k8s.io/{{ .Values.ingress.controller.namespace }}
        - --ingress-class={{ .Values.ingress.className }}
        - --configmap=$(POD_NAMESPACE)/nginx-configuration
        - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
        - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
        - --shutdown-grace-period=65
        - --validating-webhook=:8443
        - --validating-webhook-certificate=/usr/local/certificates/cert
        - --validating-webhook-key=/usr/local/certificates/key
        securityContext:
          capabilities:
            drop:
            - ALL
            add:
            - NET_BIND_SERVICE
          # www-data -> 101
          runAsUser: 101
          runAsGroup: 101
          runAsNonRoot: true
          allowPrivilegeEscalation: true
          seccompProfile:
            type: RuntimeDefault
        lifecycle:
          preStop:
            exec:
              command: ["sleep", "95"]
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: POD_NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: LD_PRELOAD
          value: /usr/local/lib/libmimalloc.so
        ports:
        - name: http
          containerPort: 80
          hostPort: 30005
        - name: https
          containerPort: 443
          protocol: TCP
        - name: health
          containerPort: 10254
        - name: webhook
          containerPort: 8443
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 15
          timeoutSeconds: 6
          successThreshold: 1
          failureThreshold: 4
        readinessProbe:
          httpGet:
            path: /healthz
            port: 10254
            scheme: HTTP
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 2
          failureThreshold: 3
          successThreshold: 1
        resources:
          requests:
            cpu: "0.75"
            memory: "1024Mi"
        volumeMounts:
          - mountPath: /usr/local/certificates/
            name: webhook-cert
            readOnly: true
      volumes:
        - name: nginx-node-health-check-conf
          configMap:
            name: nginx-node-health-check-conf
        - name: webhook-cert
          secret:
            secretName: nginx-ingress-admission
---
apiVersion: batch/v1
kind: Job
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission-create
  namespace: "{{ .Values.ingress.controller.namespace }}"
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/component: admission-webhook
        app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
        app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
        app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
        app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
      name: nginx-ingress-admission-create
    spec:
      containers:
        - args:
            - create
            - --host=nginx-ingress-controller-admission.$(POD_NAMESPACE).svc
            - --namespace=$(POD_NAMESPACE)
            - --secret-name=nginx-ingress-admission
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f
          imagePullPolicy: IfNotPresent
          name: create
          securityContext:
            allowPrivilegeEscalation: false
      nodeSelector:
        kubernetes.io/os: linux
      restartPolicy: OnFailure
      securityContext:
        fsGroup: 2000
        runAsNonRoot: true
        runAsUser: 2000
      serviceAccountName: nginx-ingress-admission

---
apiVersion: batch/v1
kind: Job
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission-patch
  namespace: "{{ .Values.ingress.controller.namespace }}"
spec:
  template:
    metadata:
      labels:
        app.kubernetes.io/component: admission-webhook
        app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
        app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
        app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
        app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
      name: nginx-ingress-admission-patch
    spec:
      containers:
        - args:
            - patch
            - --webhook-name=nginx-ingress-admission-{{ .Values.ingress.controller.namespace }}
            - --namespace=$(POD_NAMESPACE)
            - --patch-mutating=false
            - --secret-name=nginx-ingress-admission
            - --patch-failure-policy=Fail
          env:
            - name: POD_NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
          image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343@sha256:39c5b2e3310dc4264d638ad28d9d1d96c4cbb2b2dcfb52368fe4e3c63f61e10f
          imagePullPolicy: IfNotPresent
          name: patch
          securityContext:
            allowPrivilegeEscalation: false
      nodeSelector:
        kubernetes.io/os: linux
      restartPolicy: OnFailure
      securityContext:
        fsGroup: 2000
        runAsNonRoot: true
        runAsUser: 2000
      serviceAccountName: nginx-ingress-admission

---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: "{{ .Values.ingress.className }}"
spec:
  controller: k8s.io/{{ .Values.ingress.controller.namespace }}

---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
  labels:
    app.kubernetes.io/component: admission-webhook
    app.kubernetes.io/instance: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/name: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/part-of: "{{ .Values.ingress.controller.namespace }}"
    app.kubernetes.io/version: "{{ .Values.ingress.controller.nginxVersion }}"
  name: nginx-ingress-admission-{{ .Values.ingress.controller.namespace }}
webhooks:
  - admissionReviewVersions:
      - v1
    clientConfig:
      service:
        name: nginx-ingress-controller-admission
        namespace: "{{ .Values.ingress.controller.namespace }}"
        path: /networking/v1/ingresses
    failurePolicy: Fail
    matchPolicy: Equivalent
    name: validate.nginx.ingress.kubernetes.io
    rules:
      - apiGroups:
          - networking.k8s.io
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - ingresses
    sideEffects: None
{{- end }}