refactor: extract ingress-nginx to minimal-base, provision to OVH

deploy/base/kustomization.yaml

@@ -1,26 +1,6 @@
 ---
 resources:
 - ../minimal-base
-# ingress-nginx
-- inflated/ingress-nginx/templates/controller-deployment.yaml
-- inflated/ingress-nginx/templates/controller-serviceaccount.yaml
-- inflated/ingress-nginx/templates/controller-rolebinding.yaml
-- inflated/ingress-nginx/templates/controller-ingressclass.yaml
-- inflated/ingress-nginx/templates/controller-service-metrics.yaml
-- inflated/ingress-nginx/templates/clusterrole.yaml
-- inflated/ingress-nginx/templates/controller-service.yaml
-- inflated/ingress-nginx/templates/controller-service-webhook.yaml
-- inflated/ingress-nginx/templates/controller-role.yaml
-- inflated/ingress-nginx/templates/controller-configmap.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
-- inflated/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
-- inflated/ingress-nginx/templates/clusterrolebinding.yaml
 # Prometheus
 - inflated/prometheus/charts/prometheus-node-exporter/templates/daemonset.yaml
 - inflated/prometheus/charts/prometheus-node-exporter/templates/serviceaccount.yaml

deploy/minimal-base/kustomization.yaml

@@ -11,3 +11,23 @@ resources:
 - inflated/metrics-server/templates/service.yaml
 - inflated/metrics-server/templates/clusterrole.yaml
 - inflated/metrics-server/templates/clusterrolebinding.yaml
+# ingress-nginx
+- inflated/ingress-nginx/templates/controller-deployment.yaml
+- inflated/ingress-nginx/templates/controller-serviceaccount.yaml
+- inflated/ingress-nginx/templates/controller-rolebinding.yaml
+- inflated/ingress-nginx/templates/controller-ingressclass.yaml
+- inflated/ingress-nginx/templates/controller-service-metrics.yaml
+- inflated/ingress-nginx/templates/clusterrole.yaml
+- inflated/ingress-nginx/templates/controller-service.yaml
+- inflated/ingress-nginx/templates/controller-service-webhook.yaml
+- inflated/ingress-nginx/templates/controller-role.yaml
+- inflated/ingress-nginx/templates/controller-configmap.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
+- inflated/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
+- inflated/ingress-nginx/templates/clusterrolebinding.yaml

deploy/prod-ovh/deploy-ingress-nginx.yaml

@@ -0,0 +1,16 @@
+---
+- op: replace
+  path: /spec/template/spec/containers/0/args/1
+  value: "--publish-service=$(POD_NAMESPACE)/prod-ingress-nginx-controller"
+- op: replace
+  path: /spec/template/spec/containers/0/args/5
+  value: "--configmap=$(POD_NAMESPACE)/prod-ingress-nginx-controller"
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: "--tcp-services-configmap=$(POD_NAMESPACE)/prod-ingress-nginx-tcp-services"
+- op: add
+  path: /spec/template/spec/containers/0/args/-
+  value: "--default-ssl-certificate=$(POD_NAMESPACE)/prod-ingress-tls"
+- op: replace
+  path: /spec/template/spec/volumes/0/secret/secretName
+  value: prod-ingress-nginx-admission

deploy/prod-ovh/job-ingress-nginx-admission-create.yaml

@@ -0,0 +1,7 @@
+---
+- op: replace
+  path: /spec/template/spec/containers/0/args/1
+  value: "--host=prod-ingress-nginx-controller-admission,prod-ingress-nginx-controller-admission.$(POD_NAMESPACE).svc"
+- op: replace
+  path: /spec/template/spec/containers/0/args/3
+  value: "--secret-name=prod-ingress-nginx-admission"

deploy/prod-ovh/job-ingress-nginx-admission-patch.yaml

@@ -0,0 +1,7 @@
+---
+- op: replace
+  path: /spec/template/spec/containers/0/args/1
+  value: "--webhook-name=prod-ingress-nginx-admission"
+- op: replace
+  path: /spec/template/spec/containers/0/args/4
+  value: "--secret-name=prod-ingress-nginx-admission"

deploy/prod-ovh/kustomization.yaml

@@ -2,3 +2,25 @@
 namePrefix: prod-
 resources:
 - ../minimal-base
+
+patches:
+# Patch the ingress-nginx deployment to allow it to use a service with a
+# namePrefix. See https://github.com/kubernetes/ingress-nginx/issues/2599#issuecomment-601170289.
+- target:
+    kind: Deployment
+    name: ingress-nginx-controller
+  path: deploy-ingress-nginx.yaml
+
+# Patch the ingress-nginx-admission-create job to reference its webhook with a
+# namePrefix.
+- target:
+    kind: Job
+    name: ingress-nginx-admission-create
+  path: job-ingress-nginx-admission-create.yaml
+
+# Patch the ingress-nginx-admission-patch job to reference its webhook with a
+# namePrefix.
+- target:
+    kind: Job
+    name: ingress-nginx-admission-patch
+  path: job-ingress-nginx-admission-patch.yaml