8000 Allow securityContext and podSecurityContext to be configurable via h… · nginx/kubernetes-ingress@f876663 · GitHub
[go: up one dir, main page]
Skip to content

Commit f876663

Browse files
vepatelvepatel
authored
Allow securityContext and podSecurityContext to be configurable via helm parameters (#5084)
1 parent ffdcf0f commit f876663

File tree

7 files changed

+102
-20
lines changed

7 files changed

+102
-20
lines changed

‎charts/nginx-ingress/README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -379,8 +379,11 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
379379
|`controller.volumeMounts` | The volumeMounts of the Ingress Controller pods. | [] |
380380
|`controller.initContainers` | InitContainers for the Ingress Controller pods. | [] |
381381
|`controller.extraContainers` | Extra (eg. sidecar) containers for the Ingress Controller pods. | [] |
382+
|`controller.podSecurityContext`| The SecurityContext for Ingress Controller pods. | "seccompProfile": {"type": "RuntimeDefault"} |
383+
|`controller.securityContext`| The SecurityContext for Ingress Controller container. | {} |
384+
|`controller.initContainerSecurityContext`| The SecurityContext for Ingress Controller init container when `readOnlyRootFilesystem` is enabled by either setting `controller.securityContext.readOnlyRootFilesystem` or `controller.readOnlyRootFilesystem`to `true`. | {} |
382385
|`controller.resources` | The resources of the Ingress Controller pods. | requests: cpu=100m,memory=128Mi |
383-
|`controller.initContainerResources` | The resources of the init container which is used when `controller.readOnlyRootFilesystem` is set to `true` | requests: cpu=100m,memory=128Mi |
386+
|`controller.initContainerResources` | The resources of the init container which is used when `readOnlyRootFilesystem` is enabled by either setting `controller.securityContext.readOnlyRootFilesystem` or `controller.readOnlyRootFilesystem`to `true`. | requests: cpu=100m,memory=128Mi |
384387
|`controller.replicaCount` | The number of replicas of the Ingress Controller deployment. | 1 |
385388
|`controller.ingressClass.name` | A class of the Ingress Controller. An IngressClass resource with the name equal to the class must be deployed. Otherwise, the Ingress Controller will fail to start. The Ingress Controller only processes resources that belong to its class - i.e. have the "ingressClassName" field resource equal to the class. The Ingress Controller processes all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the "ingressClassName" field for all versions of Kubernetes. | nginx |
386389
|`controller.ingressClass.create` | Creates a new IngressClass object with the name `controller.ingressClass.name`. Set to `false` to use an existing ingressClass created using `kubectl` with the same name. If you use `helm upgrade`, do not change the values from the previous release as helm will delete IngressClass objects managed by helm. If you are upgrading from a release earlier than 3.4.2, do not set the value to false. | true |
@@ -465,7 +468,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
465468
|`controller.disableIPV6` | Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack. | false |
466469
|`controller.defaultHTTPListenerPort` | Sets the port for the HTTP `default_server` listener. | 80 |
467470
|`controller.defaultHTTPSListenerPort` | Sets the port for the HTTPS `default_server` listener. | 443 |
468-
|`controller.readOnlyRootFilesystem` | Configure root filesystem as read-only and add volumes for temporary data. | false |
471+
|`controller.readOnlyRootFilesystem` | Configure root filesystem as read-only and add volumes for temporary data. Three major releases after 3.5.x this argument will be moved permanently to the `controller.securityContext` section. | false |
469472
|`controller.enableSSLDynamicReload` | Enable lazy loading for SSL Certificates. | true |
470473
|`controller.enableTelemetryReporting` | Enable telemetry reporting. | true |
471474
|`rbac.create` | Configures RBAC. | true |

‎charts/nginx-ingress/templates/_helpers.tpl‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,17 @@ Expand image name.
134134
{{- printf "%s-%s" (include "nginx-ingress.fullname" .) "prometheus-service" -}}
135135
{{- end -}}
136136

137+
{{/*
138+
return if readOnlyRootFilesystem is enabled or not.
139+
*/}}
140+
{{- define "nginx-ingress.readOnlyRootFilesystem" -}}
141+
{{- if or .Values.controller.readOnlyRootFilesystem (and .Values.controller.securityContext .Values.controller.securityContext.readOnlyRootFilesystem) -}}
142+
true
143+
{{- else -}}
144+
false
145+
{{- end -}}
146+
{{- end -}}
147+
137148
{{/*
138149
Build the args for the service binary.
139150
*/}}

‎charts/nginx-ingress/templates/controller-daemonset.yaml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,7 @@ spec:
4040
serviceAccountName: {{ include "nginx-ingress.serviceAccountName" . }}
4141
automountServiceAccountToken: true
4242
securityContext:
43-
seccompProfile:
44-
type: RuntimeDefault
43+
{{ toYaml .Values.controller.podSecurityContext | indent 8 }}
4544
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
4645
{{- if .Values.controller.nodeSelector }}
4746
nodeSelector:
@@ -55,10 +54,10 @@ spec:
5554
affinity:
5655
{{ toYaml .Values.controller.affinity | indent 8 }}
5756
{{- end }}
58-
{{- if or .Values.controller.readOnlyRootFilesystem .Values.controller.volumes }}
57+
{{- if or (eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" ) .Values.controller.volumes }}
5958
volumes:
6059
{{- end }}
61-
{{- if .Values.controller.readOnlyRootFilesystem }}
60+
{{- if eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" }}
6261
- name: nginx-etc
6362
emptyDir: {}
6463
- name: nginx-cache
@@ -117,6 +116,10 @@ spec:
117116
periodSeconds: 1
118117
initialDelaySeconds: {{ .Values.controller.readyStatus.initialDelaySeconds }}
119118
{{- end }}
119+
{{- if .Values.controller.securityContext }}
120+
securityContext:
121+
{{ toYaml .Values.controller.securityContext | indent 10 }}
122+
{{- else }}
120123
securityContext:
121124
allowPrivilegeEscalation: false
122125
readOnlyRootFilesystem: {{ .Values.controller.readOnlyRootFilesystem }}
@@ -127,10 +130,11 @@ spec:
127130
- ALL
128131
add:
129132
- NET_BIND_SERVICE
130-
{{- if or .Values.controller.readOnlyRootFilesystem .Values.controller.volumeMounts }}
133+
{{- end }}
134+
{{- if or (eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" ) .Values.controller.volumeMounts }}
131135
volumeMounts:
132136
{{- end }}
133-
{{- if .Values.controller.readOnlyRootFilesystem }}
137+
{{- if eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" }}
134138
- mountPath: /etc/nginx
135139
name: nginx-etc
136140
- mountPath: /var/cache/nginx
@@ -168,10 +172,10 @@ spec:
168172
{{- if .Values.controller.extraContainers }}
169173
{{ toYaml .Values.controller.extraContainers | nindent 6 }}
170174
{{- end }}
171-
{{- if or .Values.controller.readOnlyRootFilesystem .Values.controller.initContainers }}
175+
{{- if or (eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" ) .Values.controller.initContainers }}
172176
initContainers:
173177
{{- end }}
174-
{{- if .Values.controller.readOnlyRootFilesystem }}
178+
{{- if eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" }}
175179
- name: init-{{ include "nginx-ingress.name" . }}
176180
image: {{ include "nginx-ingress.image" . }}
177181
imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
@@ -180,6 +184,10 @@ spec:
180184
resources:
181185
{{ toYaml .Values.controller.initContainerResources | indent 10 }}
182186
{{- end }}
187+
{{- if .Values.controller.initContainerSecurityConte E18F xt }}
188+
securityContext:
189+
{{ toYaml .Values.controller.initContainerSecurityContext | indent 10 }}
190+
{{- else }}
183191
securityContext:
184192
allowPrivilegeEscalation: false
185193
readOnlyRootFilesystem: true
@@ -188,6 +196,7 @@ spec:
188196
capabilities:
189197
drop:
190198
- ALL
199+
{{- end }}
191200
volumeMounts:
192201
- mountPath: /mnt/etc
193202
name: nginx-etc

‎charts/nginx-ingress/templates/controller-deployment.yaml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -56,10 +56,10 @@ spec:
5656
topologySpreadConstraints:
5757
{{ toYaml .Values.controller.topologySpreadConstraints | indent 8 }}
5858
{{- end }}
59-
{{- if or .Values.controller.readOnlyRootFilesystem .Values.controller.volumes }}
59+
{{- if or (eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true") .Values.controller.volumes }}
6060
volumes:
6161
{{- end }}
62-
{{- if .Values.controller.readOnlyRootFilesystem }}
62+
{{- if eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" }}
6363
- name: nginx-etc
6464
emptyDir: {}
6565
- name: nginx-cache
@@ -78,8 +78,7 @@ spec:
7878
serviceAccountName: {{ include "nginx-ingress.serviceAccountName" . }}
7979
automountServiceAccountToken: true
8080
securityContext:
81-
seccompProfile:
82-
type: RuntimeDefault
81+
{{ toYaml .Values.controller.podSecurityContext | indent 8 }}
8382
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
8483
hostNetwork: {{ .Values.controller.hostNetwork }}
8584
dnsPolicy: {{ .Values.controller.dnsPolicy }}
@@ -126,6 +125,10 @@ spec:
126125
{{- end }}
127126
resources:
128127
{{ toYaml .Values.controller.resources | indent 10 }}
128+
{{- if .Values.controller.securityContext }}
129+
securityContext:
130+
{{ toYaml .Values.controller.securityContext | indent 10 }}
131+
{{- else }}
129132
securityContext:
130133
allowPrivilegeEscalation: false
131134
readOnlyRootFilesystem: {{ .Values.controller.readOnlyRootFilesystem }}
@@ -136,10 +139,11 @@ spec:
136139
- ALL
137140
add:
138141
- NET_BIND_SERVICE
139-
{{- if or .Values.controller.readOnlyRootFilesystem .Values.controller.volumeMounts }}
142+
{{- end }}
143+
{{- if or ( eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" ) .Values.controller.volumeMounts }}
140144
volumeMounts:
141145
{{- end }}
142-
{{- if .Values.controller.readOnlyRootFilesystem }}
146+
{{- if eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" }}
143147
- mountPath: /etc/nginx
144148
name: nginx-etc
145149
- mountPath: /var/cache/nginx
@@ -175,10 +179,10 @@ spec:
175179
{{- if .Values.controller.extraContainers }}
176180
{{ toYaml .Values.controller.extraContainers | nindent 6 }}
177181
{{- end }}
178-
{{- if or .Values.controller.readOnlyRootFilesystem .Values.controller.initContainers }}
182+
{{- if or ( eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" ) .Values.controller.initContainers }}
179183
initContainers:
180184
{{- end }}
181-
{{- if .Values.controller.readOnlyRootFilesystem }}
185+
{{- if eq (include "nginx-ingress.readOnlyRootFilesystem" .) "true" }}
182186
- name: init-{{ include "nginx-ingress.name" . }}
183187
image: {{ include "nginx-ingress.image" . }}
184188
imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
@@ -187,6 +191,10 @@ spec:
187191
resources:
188192
{{ toYaml .Values.controller.initContainerResources | indent 10 }}
189193
{{- end }}
194+
{{- if .Values.controller.initContainerSecurityContext }}
195+
securityContext:
196+
{{ toYaml .Values.controller.initContainerSecurityContext | indent 10 }}
197+
{{- else }}
190198
securityContext:
191199
allowPrivilegeEscalation: false
192200
readOnlyRootFilesystem: true
@@ -195,6 +203,7 @@ spec:
195203
capabilities:
196204
drop:
197205
- ALL
206+
{{- end }}
198207
volumeMounts:
199208
- mountPath: /mnt/etc
200209
name: nginx-etc

‎charts/nginx-ingress/values.schema.json‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -508,6 +508,24 @@
508508
"title": "The terminationGracePeriodSeconds Schema",
509509
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.29.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodSpec/properties/terminationGracePeriodSeconds"
510510
},
511+
"podSecurityContext": {
512+
"type": "object",
513+
"default": {},
514+
"title": "The podSecurityContext Schema",
515+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.29.0/_definitions.json#/definitions/io.k8s.api.core.v1.PodSecurityContext"
516+
},
517+
"securityContext": {
518+
"type": "object",
519+
"default": {},
520+
"title": "The securityContext Schema",
521+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.29.0/_definitions.json#/definitions/io.k8s.api.core.v1.SecurityContext"
522+
},
523+
"initContainerSecurityContext": {
524+
"type": "object",
525+
"default": {},
526+
"title": "The initContainerSecurityContext Schema",
527+
"$ref": "https://raw.githubusercontent.com/nginxinc/kubernetes-json-schema/master/v1.29.0/_definitions.json#/definitions/io.k8s.api.core.v1.SecurityContext"
528+
},
511529
"resources": {
512530
"type": "object",
513531
"default": {},
@@ -1455,6 +1473,13 @@
14551473
},
14561474
"nodeSelector": {},
14571475
"terminationGracePeriodSeconds": 30,
1476+
"podSecurityContext": {
1477+
"seccompProfile": {
1478+
"type": "RuntimeDefault"
1479+
}
1480+
},
1481+
"securityContext": {},
1482+
"initContainerSecurityContext": {},
14581483
"resources": {
14591484
"requests": {
14601485
"cpu": "100m",

‎charts/nginx-ingress/values.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,26 @@ controller:
167167
# cpu: 1
168168
# memory: 1Gi
169169

170+
## The security context for the Ingress Controller pods.
171+
podSecurityContext:
172+
seccompProfile:
173+
type: RuntimeDefault
174+
175+
## The security context for the Ingress Controller containers.
176+
securityContext: {} # Remove curly brackets before adding values
177+
# allowPrivilegeEscalation: true
178+
# readOnlyRootFilesystem: true
179+
# runAsUser: 101 #nginx
180+
# runAsNonRoot: true
181+
# capabilities:
182+
# drop:
183+
# - ALL
184+
# add:
185+
# - NET_BIND_SERVICE
186+
187+
## The security context for the Ingress Controller init container which is used when readOnlyRootFilesystem is set to true.
188+
initContainerSecurityContext: {}
189+
170190
## The resources for the Ingress Controller init container which is used when readOnlyRootFilesystem is set to true.
171191
initContainerResources:
172192
requests:
@@ -460,6 +480,8 @@ controller:
460480
defaultHTTPSListenerPort: 443
461481

462482
## Configure root filesystem as read-only and add volumes for temporary data.
483+
## Three major releases after 3.5.x this argument will be moved to the `securityContext` section.
484+
## This value will not be used if `controller.securityContext` is set
463485
readOnlyRootFilesystem: false
464486

465487
## Enable dynamic reloading of certificates

‎docs/content/installation/installing-nic/installation-with-helm.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -342,8 +342,11 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
342342
| **controller.volumeMounts** | The volumeMounts of the Ingress Controller pods. | [] |
343343
| **controller.initContainers** | InitContainers for the Ingress Controller pods. | [] |
344344
| **controller.extraContainers** | Extra (eg. sidecar) containers for the Ingress Controller pods. | [] |
345+
| **controller.podSecurityContext**| The SecurityContext for Ingress Controller pods. | "seccompProfile": {"type": "RuntimeDefault"} |
346+
| **controller.securityContext** | The SecurityContext for Ingress Controller container. | {} |
347+
| **controller.initContainerSecurityContext** | The SecurityContext for Ingress Controller init container when `readOnlyRootFilesystem` is enabled by either setting `controller.securityContext.readOnlyRootFilesystem` or `controller.readOnlyRootFilesystem`to `true`. | {} |
345348
| **controller.resources** | The resources of the Ingress Controller pods. | requests: cpu=100m,memory=128Mi |
346-
| **controller.initContainerResources** | The resources of the init container which is used when `controller.readOnlyRootFilesystem` is set to `true` | requests: cpu=100m,memory=128Mi |
349+
| **controller.initContainerResources** | The resources of the init container which is used when `readOnlyRootFilesystem` is enabled by either setting `controller.securityContext.readOnlyRootFilesystem` or `controller.readOnlyRootFilesystem`to `true`. | requests: cpu=100m,memory=128Mi |
347350
| **controller.replicaCount** | The number of replicas of the Ingress Controller deployment. | 1 |
348351
| **controller.ingressClass.name** | A class of the Ingress Controller. An IngressClass resource with the name equal to the class must be deployed. Otherwise, the Ingress Controller will fail to start. The Ingress Controller only processes resources that belong to its class - i.e. have the "ingressClassName" field resource equal to the class. The Ingress Controller processes all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the "ingressClassName" field for all versions of Kubernetes. | nginx |
349352
| **controller.ingressClass.create** | Creates a new IngressClass object with the name `controller.ingressClass.name`. Set to `false` to use an existing ingressClass created using `kubectl` with the same name. If you use `helm upgrade`, do not change the values from the previous release as helm will delete IngressClass objects managed by helm. If you are upgrading from a release earlier than 3.4.2, do not set the value to false. | true |
@@ -428,7 +431,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
428431
| **controller.disableIPV6** | Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack. | false |
429432
| **controller.defaultHTTPListenerPort** | Sets the port for the HTTP `default_server` listener. | 80 |
430433
| **controller.defaultHTTPSListenerPort** | Sets the port for the HTTPS `default_server` listener. | 443 |
431-
| **controller.readOnlyRootFilesystem** | Configure root filesystem as read-only and add volumes for temporary data. | false |
434+
| **controller.readOnlyRootFilesystem** | Configure root filesystem as read-only and add volumes for temporary data. Three major releases after 3.5.x this argument will be moved permanently to the `controller.securityContext` section. | false |
432435
| **controller.enableSSLDynamicReload** | Enable lazy loading for SSL Certificates. | true |
433436
| **rbac.create** | Configures RBAC. | true |
434437
| **prometheus.create** | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |

0 commit comments

Comments
 (0)
0