chore: update ingress-nginx

2024-04-18 00:58:58 +02:00 · 2024-04-18 00:58:58 +02:00 · d0f421d7f8
parent a606a9c8f9
commit d0f421d7f8
19 changed files with 77 additions and 64 deletions
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
@ -8,10 +8,10 @@ metadata:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
@ -8,10 +8,10 @@ metadata:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
@ -22,4 +22,4 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: ingress-nginx-admission
-    namespace: "default"
+    namespace: default
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
@ -9,10 +9,10 @@ metadata:
    "helm.sh/hook": pre-install,pre-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
@ -21,17 +21,17 @@ spec:
    metadata:
      name: ingress-nginx-admission-create
      labels:
-        helm.sh/chart: ingress-nginx-4.7.1
+        helm.sh/chart: ingress-nginx-4.10.0
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: "1.8.1"
+        app.kubernetes.io/version: "1.10.0"
        app.kubernetes.io/part-of: ingress-nginx
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: admission-webhook
    spec:
      containers:
        - name: create
-          image: "registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b"
+          image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.0@sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
          imagePullPolicy: IfNotPresent
          args:
            - create
@ -45,11 +45,15 @@ spec:
                  fieldPath: metadata.namespace
          securityContext: 
            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65532
+            seccompProfile:
+              type: RuntimeDefault
      restartPolicy: OnFailure
      serviceAccountName: ingress-nginx-admission
      nodeSelector: 
        kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
@ -9,10 +9,10 @@ metadata:
    "helm.sh/hook": post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
@ -21,17 +21,17 @@ spec:
    metadata:
      name: ingress-nginx-admission-patch
      labels:
-        helm.sh/chart: ingress-nginx-4.7.1
+        helm.sh/chart: ingress-nginx-4.10.0
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: "1.8.1"
+        app.kubernetes.io/version: "1.10.0"
        app.kubernetes.io/part-of: ingress-nginx
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: admission-webhook
    spec:
      containers:
        - name: patch
-          image: "registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b"
+          image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.0@sha256:44d1d0e9f19c63f58b380c5fddaca7cf22c7cee564adeff365225a5df5ef3334
          imagePullPolicy: IfNotPresent
          args:
            - patch
@ -47,11 +47,15 @@ spec:
                  fieldPath: metadata.namespace
          securityContext: 
            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 65532
+            seccompProfile:
+              type: RuntimeDefault
      restartPolicy: OnFailure
      serviceAccountName: ingress-nginx-admission
      nodeSelector: 
        kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
@ -9,10 +9,10 @@ metadata:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
@ -9,10 +9,10 @@ metadata:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
@ -23,4 +23,4 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: ingress-nginx-admission
-    namespace: "default"
+    namespace: default
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
@ -9,10 +9,10 @@ metadata:
    "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
--- a/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
@ -7,10 +7,10 @@ kind: ValidatingWebhookConfiguration
 metadata:
  annotations:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: admission-webhook
@ -34,6 +34,6 @@ webhooks:
      - v1
    clientConfig:
      service:
-        namespace: "default"
        name: ingress-nginx-controller-admission
+        namespace: default
        path: /networking/v1/ingresses
--- a/deploy/base/inflated/ingress-nginx/templates/clusterrole.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/clusterrole.yaml
@ -4,10 +4,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
  name: ingress-nginx
--- a/deploy/base/inflated/ingress-nginx/templates/clusterrolebinding.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/clusterrolebinding.yaml
@ -4,10 +4,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
  name: ingress-nginx
@ -18,4 +18,4 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: ingress-nginx
-    namespace: "default"
+    namespace: default
--- a/deploy/base/inflated/ingress-nginx/templates/controller-configmap.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-configmap.yaml
@ -4,14 +4,14 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
  name: ingress-nginx-controller
  namespace: default
 data:
-  allow-snippet-annotations: "true"
+  allow-snippet-annotations: "false"
--- a/deploy/base/inflated/ingress-nginx/templates/controller-deployment.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-deployment.yaml
@ -4,10 +4,10 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
@ -25,10 +25,10 @@ spec:
  template:
    metadata:
      labels:
-        helm.sh/chart: ingress-nginx-4.7.1
+        helm.sh/chart: ingress-nginx-4.10.0
        app.kubernetes.io/name: ingress-nginx
        app.kubernetes.io/instance: ingress-nginx
-        app.kubernetes.io/version: "1.8.1"
+        app.kubernetes.io/version: "1.10.0"
        app.kubernetes.io/part-of: ingress-nginx
        app.kubernetes.io/managed-by: Helm
        app.kubernetes.io/component: controller
@ -36,14 +36,14 @@ spec:
      dnsPolicy: ClusterFirst
      containers:
        - name: controller
-          image: "registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd"
+          image: registry.k8s.io/ingress-nginx/controller:v1.10.0@sha256:42b3f0e5d0846876b1791cd3afeb5f1cbbe4259d6f35651dcc1b5c980925379c
          imagePullPolicy: IfNotPresent
          lifecycle: 
            preStop:
              exec:
                command:
                - /wait-shutdown
-          args:
+          args: 
            - /nginx-ingress-controller
            - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
            - --election-id=ingress-nginx-leader
@ -54,13 +54,17 @@ spec:
            - --validating-webhook-certificate=/usr/local/certificates/cert
            - --validating-webhook-key=/usr/local/certificates/key
          securityContext: 
+            runAsNonRoot: true
+            runAsUser: 101
+            allowPrivilegeEscalation: false
+            seccompProfile: 
+              type: RuntimeDefault
            capabilities:
              drop:
              - ALL
              add:
              - NET_BIND_SERVICE
-            runAsUser: 101
-            allowPrivilegeEscalation: true
+            readOnlyRootFilesystem: false
          env:
            - name: POD_NAME
              valueFrom:
--- a/deploy/base/inflated/ingress-nginx/templates/controller-ingressclass.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-ingressclass.yaml
@ -6,10 +6,10 @@ apiVersion: networking.k8s.io/v1
 kind: IngressClass
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
--- a/deploy/base/inflated/ingress-nginx/templates/controller-role.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-role.yaml
@ -4,10 +4,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
@ -47,6 +47,7 @@ rules:
      - get
      - list
      - watch
+  # Omit Ingress status permissions if `--update-status` is disabled.
  - apiGroups:
      - networking.k8s.io
    resources:
--- a/deploy/base/inflated/ingress-nginx/templates/controller-rolebinding.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-rolebinding.yaml
@ -4,10 +4,10 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
@ -20,4 +20,4 @@ roleRef:
 subjects:
  - kind: ServiceAccount
    name: ingress-nginx
-    namespace: "default"
+    namespace: default
--- a/deploy/base/inflated/ingress-nginx/templates/controller-service-metrics.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-service-metrics.yaml
@ -7,10 +7,10 @@ metadata:
    prometheus.io/port: "10254"
    prometheus.io/scrape: "true"
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
--- a/deploy/base/inflated/ingress-nginx/templates/controller-service-webhook.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-service-webhook.yaml
@ -4,10 +4,10 @@ apiVersion: v1
 kind: Service
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
--- a/deploy/base/inflated/ingress-nginx/templates/controller-service.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-service.yaml
@ -5,10 +5,10 @@ kind: Service
 metadata:
  annotations:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller
--- a/deploy/base/inflated/ingress-nginx/templates/controller-serviceaccount.yaml
+++ b/deploy/base/inflated/ingress-nginx/templates/controller-serviceaccount.yaml
@ -4,10 +4,10 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
  labels:
-    helm.sh/chart: ingress-nginx-4.7.1
+    helm.sh/chart: ingress-nginx-4.10.0
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/version: "1.8.1"
+    app.kubernetes.io/version: "1.10.0"
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/component: controller