dsk-dev kubespray 이동
This commit is contained in:
ByeonJungHun
@@ -0,0 +1,6 @@
|
||||
# See the OWNERS docs at https://go.k8s.io/owners
|
||||
|
||||
approvers:
|
||||
- kubespray-approvers
|
||||
reviewers:
|
||||
- kubespray-reviewers
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
alb_ingress_controller_namespace: kube-system
|
||||
alb_ingress_aws_region: "us-east-1"
|
||||
|
||||
# Enables logging on all outbound requests sent to the AWS API.
|
||||
# If logging is desired, set to true.
|
||||
alb_ingress_aws_debug: "false"
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
|
||||
- name: ALB Ingress Controller | Create addon dir
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/addons/alb_ingress"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
|
||||
- name: ALB Ingress Controller | Create manifests
|
||||
template:
|
||||
src: "{{ item.file }}.j2"
|
||||
dest: "{{ kube_config_dir }}/addons/alb_ingress/{{ item.file }}"
|
||||
mode: 0644
|
||||
with_items:
|
||||
- { name: alb-ingress-clusterrole, file: alb-ingress-clusterrole.yml, type: clusterrole }
|
||||
- { name: alb-ingress-clusterrolebinding, file: alb-ingress-clusterrolebinding.yml, type: clusterrolebinding }
|
||||
- { name: alb-ingress-ns, file: alb-ingress-ns.yml, type: ns }
|
||||
- { name: alb-ingress-sa, file: alb-ingress-sa.yml, type: sa }
|
||||
- { name: alb-ingress-deploy, file: alb-ingress-deploy.yml, type: deploy }
|
||||
register: alb_ingress_manifests
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: ALB Ingress Controller | Apply manifests
|
||||
kube:
|
||||
name: "{{ item.item.name }}"
|
||||
namespace: "{{ alb_ingress_controller_namespace }}"
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
resource: "{{ item.item.type }}"
|
||||
filename: "{{ kube_config_dir }}/addons/alb_ingress/{{ item.item.file }}"
|
||||
state: "latest"
|
||||
with_items: "{{ alb_ingress_manifests.results }}"
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: alb-ingress
|
||||
namespace: {{ alb_ingress_controller_namespace }}
|
||||
rules:
|
||||
- apiGroups: ["", "extensions"]
|
||||
resources: ["configmaps", "endpoints", "nodes", "pods", "secrets", "events", "ingresses", "ingresses/status", "services"]
|
||||
verbs: ["list", "create", "get", "update", "watch", "patch"]
|
||||
- apiGroups: ["", "extensions"]
|
||||
resources: ["nodes", "pods", "secrets", "services", "namespaces"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: alb-ingress
|
||||
namespace: {{ alb_ingress_controller_namespace }}
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: alb-ingress
|
||||
namespace: {{ alb_ingress_controller_namespace }}
|
||||
roleRef:
|
||||
kind: ClusterRole
|
||||
name: alb-ingress
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
@@ -0,0 +1,74 @@
|
||||
# Application Load Balancer (ALB) Ingress Controller Deployment Manifest.
|
||||
# This manifest details sensible defaults for deploying an ALB Ingress Controller.
|
||||
# GitHub: https://github.com/coreos/alb-ingress-controller
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: alb-ingress-controller
|
||||
labels:
|
||||
k8s-app: alb-ingress-controller
|
||||
# Namespace the ALB Ingress Controller should run in. Does not impact which
|
||||
# namespaces it's able to resolve ingress resource for. For limiting ingress
|
||||
# namespace scope, see --watch-namespace.
|
||||
namespace: {{ alb_ingress_controller_namespace }}
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: alb-ingress-controller
|
||||
strategy:
|
||||
rollingUpdate:
|
||||
maxSurge: 1
|
||||
maxUnavailable: 1
|
||||
type: RollingUpdate
|
||||
template:
|
||||
metadata:
|
||||
creationTimestamp: null
|
||||
labels:
|
||||
k8s-app: alb-ingress-controller
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
# Limit the namespace where this ALB Ingress Controller deployment will
|
||||
# resolve ingress resources. If left commented, all namespaces are used.
|
||||
#- --watch-namespace=your-k8s-namespace
|
||||
|
||||
# Setting the ingress-class flag below will ensure that only ingress resources with the
|
||||
# annotation kubernetes.io/ingress.class: "alb" are respected by the controller. You may
|
||||
# choose any class you'd like for this controller to respect.
|
||||
- --ingress-class=alb
|
||||
# Name of your cluster. Used when naming resources created
|
||||
# by the ALB Ingress Controller, providing distinction between
|
||||
# clusters.
|
||||
- --cluster-name={{ cluster_name }}
|
||||
|
||||
# Enables logging on all outbound requests sent to the AWS API.
|
||||
# If logging is desired, set to true.
|
||||
# - ---aws-api-debug
|
||||
{% if alb_ingress_aws_debug %}
|
||||
- --aws-api-debug
|
||||
{% endif %}
|
||||
# Maximum number of times to retry the aws calls.
|
||||
# defaults to 10.
|
||||
# - --aws-max-retries=10
|
||||
|
||||
# AWS region this ingress controller will operate in.
|
||||
# If unspecified, it will be discovered from ec2metadata.
|
||||
# List of regions: http://docs.aws.amazon.com/general/latest/gr/rande.html#vpc_region
|
||||
{% if alb_ingress_aws_region is defined %}
|
||||
- --aws-region={{ alb_ingress_aws_region }}
|
||||
{% endif %}
|
||||
|
||||
image: "{{ alb_ingress_image_repo }}:{{ alb_ingress_image_tag }}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: server
|
||||
resources: {}
|
||||
terminationMessagePath: /dev/termination-log
|
||||
dnsPolicy: ClusterFirst
|
||||
restartPolicy: Always
|
||||
securityContext: {}
|
||||
terminationGracePeriodSeconds: 30
|
||||
{% if rbac_enabled %}
|
||||
serviceAccountName: alb-ingress
|
||||
{% endif %}
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ alb_ingress_controller_namespace }}
|
||||
labels:
|
||||
name: {{ alb_ingress_controller_namespace }}
|
||||
@@ -0,0 +1,6 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: alb-ingress
|
||||
namespace: {{ alb_ingress_controller_namespace }}
|
||||
@@ -0,0 +1,10 @@
|
||||
---
|
||||
cert_manager_namespace: "cert-manager"
|
||||
cert_manager_user: 1001
|
||||
cert_manager_tolerations: []
|
||||
cert_manager_affinity: {}
|
||||
cert_manager_nodeselector: {}
|
||||
|
||||
## Change leader election namespace when deploying on GKE Autopilot that forbid the changes on kube-system namespace.
|
||||
## See https://github.com/jetstack/cert-manager/issues/3717
|
||||
cert_manager_leader_election_namespace: kube-system
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
|
||||
- name: Cert Manager | Remove legacy addon dir and manifests
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/addons/cert_manager"
|
||||
state: absent
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
tags:
|
||||
- upgrade
|
||||
|
||||
- name: Cert Manager | Remove legacy namespace
|
||||
command: >
|
||||
{{ kubectl }} delete namespace {{ cert_manager_namespace }}
|
||||
ignore_errors: true # noqa ignore-errors
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
tags:
|
||||
- upgrade
|
||||
|
||||
- name: Cert Manager | Create addon dir
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/addons/cert_manager"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Cert Manager | Templates list
|
||||
set_fact:
|
||||
cert_manager_templates:
|
||||
- { name: cert-manager, file: cert-manager.yml, type: all }
|
||||
- { name: cert-manager.crds, file: cert-manager.crds.yml, type: crd }
|
||||
|
||||
- name: Cert Manager | Create manifests
|
||||
template:
|
||||
src: "{{ item.file }}.j2"
|
||||
dest: "{{ kube_config_dir }}/addons/cert_manager/{{ item.file }}"
|
||||
mode: 0644
|
||||
with_items: "{{ cert_manager_templates }}"
|
||||
register: cert_manager_manifests
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: Cert Manager | Apply manifests
|
||||
kube:
|
||||
name: "{{ item.item.name }}"
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
resource: "{{ item.item.type }}"
|
||||
filename: "{{ kube_config_dir }}/addons/cert_manager/{{ item.item.file }}"
|
||||
state: "latest"
|
||||
with_items: "{{ cert_manager_manifests.results }}"
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,20 @@
|
||||
---
|
||||
ingress_nginx_namespace: "ingress-nginx"
|
||||
ingress_nginx_host_network: false
|
||||
ingress_publish_status_address: ""
|
||||
ingress_nginx_nodeselector:
|
||||
kubernetes.io/os: "linux"
|
||||
ingress_nginx_tolerations: []
|
||||
ingress_nginx_insecure_port: 80
|
||||
ingress_nginx_secure_port: 443
|
||||
ingress_nginx_metrics_port: 10254
|
||||
ingress_nginx_configmap: {}
|
||||
ingress_nginx_configmap_tcp_services: {}
|
||||
ingress_nginx_configmap_udp_services: {}
|
||||
ingress_nginx_extra_args: []
|
||||
ingress_nginx_termination_grace_period_seconds: 300
|
||||
# ingress_nginx_class: nginx
|
||||
ingress_nginx_webhook_enabled: false
|
||||
ingress_nginx_webhook_job_ttl: 1800
|
||||
|
||||
ingress_nginx_probe_initial_delay_seconds: 10
|
||||
@@ -0,0 +1,60 @@
|
||||
---
|
||||
|
||||
- name: NGINX Ingress Controller | Create addon dir
|
||||
file:
|
||||
path: "{{ kube_config_dir }}/addons/ingress_nginx"
|
||||
state: directory
|
||||
owner: root
|
||||
group: root
|
||||
mode: 0755
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: NGINX Ingress Controller | Templates list
|
||||
set_fact:
|
||||
ingress_nginx_templates:
|
||||
- { name: 00-namespace, file: 00-namespace.yml, type: ns }
|
||||
- { name: cm-ingress-nginx, file: cm-ingress-nginx.yml, type: cm }
|
||||
- { name: cm-tcp-services, file: cm-tcp-services.yml, type: cm }
|
||||
- { name: cm-udp-services, file: cm-udp-services.yml, type: cm }
|
||||
- { name: sa-ingress-nginx, file: sa-ingress-nginx.yml, type: sa }
|
||||
- { name: clusterrole-ingress-nginx, file: clusterrole-ingress-nginx.yml, type: clusterrole }
|
||||
- { name: clusterrolebinding-ingress-nginx, file: clusterrolebinding-ingress-nginx.yml, type: clusterrolebinding }
|
||||
- { name: role-ingress-nginx, file: role-ingress-nginx.yml, type: role }
|
||||
- { name: rolebinding-ingress-nginx, file: rolebinding-ingress-nginx.yml, type: rolebinding }
|
||||
- { name: ds-ingress-nginx-controller, file: ds-ingress-nginx-controller.yml, type: ds }
|
||||
ingress_nginx_templates_for_webhook:
|
||||
- { name: admission-webhook-configuration, file: admission-webhook-configuration.yml, type: sa }
|
||||
- { name: sa-admission-webhook, file: sa-admission-webhook.yml, type: sa }
|
||||
- { name: clusterrole-admission-webhook, file: clusterrole-admission-webhook.yml, type: clusterrole }
|
||||
- { name: clusterrolebinding-admission-webhook, file: clusterrolebinding-admission-webhook.yml, type: clusterrolebinding }
|
||||
- { name: role-admission-webhook, file: role-admission-webhook.yml, type: role }
|
||||
- { name: rolebinding-admission-webhook, file: rolebinding-admission-webhook.yml, type: rolebinding }
|
||||
- { name: admission-webhook-job, file: admission-webhook-job.yml, type: job }
|
||||
|
||||
- name: NGINX Ingress Controller | Append extra templates to NGINX Ingress Templates list for webhook
|
||||
set_fact:
|
||||
ingress_nginx_templates: "{{ ingress_nginx_templates + ingress_nginx_templates_for_webhook }}"
|
||||
when: ingress_nginx_webhook_enabled
|
||||
|
||||
- name: NGINX Ingress Controller | Create manifests
|
||||
template:
|
||||
src: "{{ item.file }}.j2"
|
||||
dest: "{{ kube_config_dir }}/addons/ingress_nginx/{{ item.file }}"
|
||||
mode: 0644
|
||||
with_items: "{{ ingress_nginx_templates }}"
|
||||
register: ingress_nginx_manifests
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
|
||||
- name: NGINX Ingress Controller | Apply manifests
|
||||
kube:
|
||||
name: "{{ item.item.name }}"
|
||||
namespace: "{{ ingress_nginx_namespace }}"
|
||||
kubectl: "{{ bin_dir }}/kubectl"
|
||||
resource: "{{ item.item.type }}"
|
||||
filename: "{{ kube_config_dir }}/addons/ingress_nginx/{{ item.item.file }}"
|
||||
state: "latest"
|
||||
with_items: "{{ ingress_nginx_manifests.results }}"
|
||||
when:
|
||||
- inventory_hostname == groups['kube_control_plane'][0]
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
name: {{ ingress_nginx_namespace }}
|
||||
@@ -0,0 +1,29 @@
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission
|
||||
webhooks:
|
||||
- admissionReviewVersions:
|
||||
- v1
|
||||
clientConfig:
|
||||
service:
|
||||
name: ingress-nginx-controller-admission
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
path: /networking/v1/ingresses
|
||||
failurePolicy: Fail
|
||||
matchPolicy: Equivalent
|
||||
name: validate.nginx.ingress.kubernetes.io
|
||||
rules:
|
||||
- apiGroups:
|
||||
- networking.k8s.io
|
||||
apiVersions:
|
||||
- v1
|
||||
operations:
|
||||
- CREATE
|
||||
- UPDATE
|
||||
resources:
|
||||
- ingresses
|
||||
sideEffects: None
|
||||
@@ -0,0 +1,86 @@
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission-create
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission-create
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- create
|
||||
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --secret-name=ingress-nginx-admission
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: "{{ ingress_nginx_kube_webhook_certgen_imae_repo }}:{{ ingress_nginx_kube_webhook_certgen_imae_tag }}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: create
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 2000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
ttlSecondsAfterFinished: {{ ingress_nginx_webhook_job_ttl }}
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission-patch
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
spec:
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission-patch
|
||||
spec:
|
||||
containers:
|
||||
- args:
|
||||
- patch
|
||||
- --webhook-name=ingress-nginx-admission
|
||||
- --namespace=$(POD_NAMESPACE)
|
||||
- --patch-mutating=false
|
||||
- --secret-name=ingress-nginx-admission
|
||||
- --patch-failure-policy=Fail
|
||||
env:
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
image: "{{ ingress_nginx_kube_webhook_certgen_imae_repo }}:{{ ingress_nginx_kube_webhook_certgen_imae_tag }}"
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
name: patch
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
nodeSelector:
|
||||
kubernetes.io/os: linux
|
||||
restartPolicy: OnFailure
|
||||
securityContext:
|
||||
fsGroup: 2000
|
||||
runAsNonRoot: true
|
||||
runAsUser: 2000
|
||||
serviceAccountName: ingress-nginx-admission
|
||||
ttlSecondsAfterFinished: {{ ingress_nginx_webhook_job_ttl }}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission
|
||||
rules:
|
||||
- apiGroups:
|
||||
- admissionregistration.k8s.io
|
||||
resources:
|
||||
- validatingwebhookconfigurations
|
||||
verbs:
|
||||
- get
|
||||
- update
|
||||
@@ -0,0 +1,36 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "endpoints", "nodes", "pods", "secrets"]
|
||||
verbs: ["list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["nodes"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingresses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
- apiGroups: ["extensions","networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["list", "watch"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
@@ -0,0 +1,16 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
{% if ingress_nginx_configmap %}
|
||||
data:
|
||||
{{ ingress_nginx_configmap | to_nice_yaml | indent(2) }}
|
||||
{%- endif %}
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: tcp-services
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
{% if ingress_nginx_configmap_tcp_services %}
|
||||
data:
|
||||
{{ ingress_nginx_configmap_tcp_services | to_nice_yaml | indent(2) }}
|
||||
{%- endif %}
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: udp-services
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
{% if ingress_nginx_configmap_udp_services %}
|
||||
data:
|
||||
{{ ingress_nginx_configmap_udp_services | to_nice_yaml | indent(2) }}
|
||||
{%- endif %}
|
||||
@@ -0,0 +1,141 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: DaemonSet
|
||||
metadata:
|
||||
name: ingress-nginx-controller
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
annotations:
|
||||
prometheus.io/port: "10254"
|
||||
prometheus.io/scrape: "true"
|
||||
spec:
|
||||
serviceAccountName: ingress-nginx
|
||||
terminationGracePeriodSeconds: {{ ingress_nginx_termination_grace_period_seconds }}
|
||||
{% if ingress_nginx_host_network %}
|
||||
hostNetwork: true
|
||||
dnsPolicy: ClusterFirstWithHostNet
|
||||
{% endif %}
|
||||
{% if ingress_nginx_nodeselector %}
|
||||
nodeSelector:
|
||||
{{ ingress_nginx_nodeselector | to_nice_yaml | indent(width=8) }}
|
||||
{%- endif %}
|
||||
{% if ingress_nginx_tolerations %}
|
||||
tolerations:
|
||||
{{ ingress_nginx_tolerations | to_nice_yaml(indent=2) | indent(width=8) }}
|
||||
{% endif %}
|
||||
priorityClassName: {% if ingress_nginx_namespace == 'kube-system' %}system-node-critical{% else %}k8s-cluster-critical{% endif %}{{''}}
|
||||
containers:
|
||||
- name: ingress-nginx-controller
|
||||
image: {{ ingress_nginx_controller_image_repo }}:{{ ingress_nginx_controller_image_tag }}
|
||||
imagePullPolicy: {{ k8s_image_pull_policy }}
|
||||
lifecycle:
|
||||
preStop:
|
||||
exec:
|
||||
command:
|
||||
- /wait-shutdown
|
||||
args:
|
||||
- /nginx-ingress-controller
|
||||
- --configmap=$(POD_NAMESPACE)/ingress-nginx
|
||||
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
|
||||
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
|
||||
- --annotations-prefix=nginx.ingress.kubernetes.io
|
||||
{% if ingress_nginx_class is defined %}
|
||||
- --ingress-class={{ ingress_nginx_class }}
|
||||
{% else %}
|
||||
- --watch-ingress-without-class=true
|
||||
{% endif %}
|
||||
{% if ingress_nginx_host_network %}
|
||||
- --report-node-internal-ip-address
|
||||
{% endif %}
|
||||
{% if ingress_publish_status_address != "" %}
|
||||
- --publish-status-address={{ ingress_publish_status_address }}
|
||||
{% endif %}
|
||||
{% for extra_arg in ingress_nginx_extra_args %}
|
||||
- {{ extra_arg }}
|
||||
{% endfor %}
|
||||
{% if ingress_nginx_webhook_enabled %}
|
||||
- --validating-webhook=:8443
|
||||
- --validating-webhook-certificate=/usr/local/certificates/cert
|
||||
- --validating-webhook-key=/usr/local/certificates/key
|
||||
{% endif %}
|
||||
securityContext:
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
add:
|
||||
- NET_BIND_SERVICE
|
||||
# www-data -> 101
|
||||
runAsUser: 101
|
||||
allowPrivilegeEscalation: true
|
||||
env:
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
- name: POD_NAMESPACE
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.namespace
|
||||
- name: LD_PRELOAD
|
||||
value: /usr/local/lib/libmimalloc.so
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
hostPort: {{ ingress_nginx_insecure_port }}
|
||||
- name: https
|
||||
containerPort: 443
|
||||
hostPort: {{ ingress_nginx_secure_port }}
|
||||
- name: metrics
|
||||
containerPort: 10254
|
||||
{% if not ingress_nginx_host_network %}
|
||||
hostPort: {{ ingress_nginx_metrics_port }}
|
||||
{% endif %}
|
||||
{% if ingress_nginx_webhook_enabled %}
|
||||
- name: webhook
|
||||
containerPort: 8443
|
||||
protocol: TCP
|
||||
{% endif %}
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: {{ ingress_nginx_probe_initial_delay_seconds }}
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: 10254
|
||||
scheme: HTTP
|
||||
initialDelaySeconds: {{ ingress_nginx_probe_initial_delay_seconds }}
|
||||
periodSeconds: 10
|
||||
timeoutSeconds: 5
|
||||
successThreshold: 1
|
||||
failureThreshold: 3
|
||||
{% if ingress_nginx_webhook_enabled %}
|
||||
volumeMounts:
|
||||
- mountPath: /usr/local/certificates/
|
||||
name: webhook-cert
|
||||
readOnly: true
|
||||
{% endif %}
|
||||
{% if ingress_nginx_webhook_enabled %}
|
||||
volumes:
|
||||
- name: webhook-cert
|
||||
secret:
|
||||
secretName: ingress-nginx-admission
|
||||
{% endif %}
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- secrets
|
||||
verbs:
|
||||
- get
|
||||
- create
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["namespaces"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps", "pods", "secrets", "endpoints"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["services"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses", "ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: ["extensions", "networking.k8s.io"]
|
||||
resources: ["ingresses/status"]
|
||||
verbs: ["update"]
|
||||
- apiGroups: ["networking.k8s.io"]
|
||||
resources: ["ingressclasses"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
# Defaults to "<election-id>-<ingress-class>"
|
||||
# Here: "<ingress-controller-leader>-<nginx>"
|
||||
# This has to be adapted if you change either parameter
|
||||
# when launching the nginx-ingress-controller.
|
||||
resourceNames: [{% if ingress_class is defined %}"ingress-controller-leader-{{ ingress_nginx_class | default('nginx') }}"{% else %}"ingress-controller-leader"{% endif %}]
|
||||
verbs: ["get", "update"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
# Defaults to "<election-id>-<ingress-class>"
|
||||
# Here: "<ingress-controller-leader>-<nginx>"
|
||||
# This has to be adapted if you change either parameter
|
||||
# when launching the nginx-ingress-controller.
|
||||
resourceNames: [{% if ingress_class is defined %}"ingress-controller-leader-{{ ingress_nginx_class | default('nginx') }}"{% else %}"ingress-controller-leader"{% endif %}]
|
||||
verbs: ["get", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
verbs: ["create", "update"]
|
||||
- apiGroups: [""]
|
||||
resources: ["events"]
|
||||
verbs: ["create", "patch"]
|
||||
- apiGroups: ["policy"]
|
||||
resourceNames: ["ingress-nginx"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
verbs: ["use"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
# Defaults to "<election-id>-<ingress-class>"
|
||||
# Here: "<ingress-controller-leader>-<nginx>"
|
||||
# This has to be adapted if you change either parameter
|
||||
# when launching the nginx-ingress-controller.
|
||||
resourceNames: [{% if ingress_class is defined %}"ingress-controller-leader-{{ ingress_nginx_class | default('nginx') }}"{% else %}"ingress-controller-leader"{% endif %}]
|
||||
verbs: ["get", "update"]
|
||||
- apiGroups: ["coordination.k8s.io"]
|
||||
resources: ["leases"]
|
||||
verbs: ["create"]
|
||||
- apiGroups: ["discovery.k8s.io"]
|
||||
resources: ["endpointslices"]
|
||||
verbs: ["get", "list", "watch"]
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
name: ingress-nginx-admission
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx-admission
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx-admission
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
@@ -0,0 +1,17 @@
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-nginx
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-nginx
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ingress-nginx-admission
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
@@ -0,0 +1,9 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ingress-nginx
|
||||
namespace: {{ ingress_nginx_namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: ingress-nginx
|
||||
app.kubernetes.io/part-of: ingress-nginx
|
||||
@@ -0,0 +1,22 @@
|
||||
---
|
||||
dependencies:
|
||||
- role: kubernetes-apps/ingress_controller/ingress_nginx
|
||||
when: ingress_nginx_enabled
|
||||
tags:
|
||||
- apps
|
||||
- ingress-controller
|
||||
- ingress-nginx
|
||||
|
||||
- role: kubernetes-apps/ingress_controller/cert_manager
|
||||
when: cert_manager_enabled
|
||||
tags:
|
||||
- apps
|
||||
- ingress-controller
|
||||
- cert-manager
|
||||
|
||||
- role: kubernetes-apps/ingress_controller/alb_ingress_controller
|
||||
when: ingress_alb_enabled
|
||||
tags:
|
||||
- apps
|
||||
- ingress-controller
|
||||
- ingress_alb
|
||||
Reference in New Issue
Block a user