added istio ingress proxy
This commit is contained in:
parent
7dd7d19df5
commit
0659c44499
18 changed files with 415 additions and 51 deletions
21
README.md
21
README.md
|
|
@ -1,25 +1,38 @@
|
|||
# nginx-ingress-proxy
|
||||
# ingress-proxy
|
||||
|
||||
This is an ingress proxy to direct traffic to the ingress controller in small cloud environments without the need for a load balancer.
|
||||
|
||||
This proxy runs in the host network of the kubernetes master on the ports `80` and `443`.
|
||||
|
||||
Traffic is then redirected to the nginx ingress controller using the proxy protocol.
|
||||
Traffic is then redirected to the ingress controller using the proxy protocol.
|
||||
|
||||
## Usage
|
||||
|
||||
**Note:** replace `MASTERNODE` with the hostname of your master node.
|
||||
**Note:** replace `my-master` with the hostname of your master node.
|
||||
|
||||
### Ingress-Nginx
|
||||
|
||||
```
|
||||
curl -s -O https://git.giftfish.de/ston1th/nginx-ingress-proxy/raw/branch/master/nginx-ingress-proxy.yaml
|
||||
curl -s -O https://git.giftfish.de/ston1th/ingress-proxy/raw/branch/master/nginx-ingress-proxy.yaml
|
||||
|
||||
sed -i 's/MASTERNODE/my-master/' nginx-ingress-proxy.yaml
|
||||
|
||||
kubectl apply -f nginx-ingress-proxy.yaml
|
||||
```
|
||||
|
||||
### Istio Ingress Gateway
|
||||
|
||||
```
|
||||
curl -s -O https://git.giftfish.de/ston1th/ingress-proxy/raw/branch/master/istio-ingress-proxy.yaml
|
||||
|
||||
sed -i 's/MASTERNODE/my-master/' istio-ingress-proxy.yaml
|
||||
|
||||
kubectl apply -f istio-ingress-proxy.yaml
|
||||
```
|
||||
|
||||
## Cleanup
|
||||
|
||||
```
|
||||
kubectl delete -f nginx-ingress-proxy.yaml
|
||||
kubectl delete -f istio-ingress-proxy.yaml
|
||||
```
|
||||
|
|
|
|||
16
build.sh
16
build.sh
|
|
@ -1,7 +1,11 @@
|
|||
#!/bin/sh
|
||||
file=nginx-ingress-proxy.yaml
|
||||
rm -f $file 2>/dev/null
|
||||
for f in $(ls config/*.yaml); do
|
||||
echo "# $f" >> $file
|
||||
cat $f >> $file
|
||||
done
|
||||
build() {
|
||||
local file="$1-ingress-proxy.yaml"
|
||||
rm -f $file 2>/dev/null
|
||||
for f in $(ls config/$1/*.yaml); do
|
||||
echo "# $f" >> $file
|
||||
cat $f >> $file
|
||||
done
|
||||
}
|
||||
build nginx
|
||||
build istio
|
||||
|
|
|
|||
6
config/istio/100-serviceaccount.yaml
Normal file
6
config/istio/100-serviceaccount.yaml
Normal file
|
|
@ -0,0 +1,6 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
15
config/istio/200-role.yaml
Normal file
15
config/istio/200-role.yaml
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["ingress-proxy-config"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
resourceNames: ["ingress-proxy"]
|
||||
verbs: ["use"]
|
||||
13
config/istio/200-rolebinding.yaml
Normal file
13
config/istio/200-rolebinding.yaml
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-proxy
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-proxy
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
51
config/istio/deployment.yaml
Normal file
51
config/istio/deployment.yaml
Normal file
|
|
@ -0,0 +1,51 @@
|
|||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
labels:
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ingress-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
serviceAccountName: ingress-proxy
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: MASTERNODE
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
|
||||
volumeMounts:
|
||||
- name: ingress-proxy-config
|
||||
mountPath: /etc/nginx
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
add:
|
||||
- SETUID
|
||||
- SETGID
|
||||
- NET_BIND_SERVICE
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
hostPort: 80
|
||||
protocol: TCP
|
||||
- name: https
|
||||
containerPort: 443
|
||||
hostPort: 443
|
||||
protocol: TCP
|
||||
volumes:
|
||||
- name: ingress-proxy-config
|
||||
configMap:
|
||||
name: ingress-proxy-config
|
||||
31
config/istio/ingress-proxy-configmap.yaml
Normal file
31
config/istio/ingress-proxy-configmap.yaml
Normal file
|
|
@ -0,0 +1,31 @@
|
|||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
data:
|
||||
nginx.conf: |
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
stream {
|
||||
upstream stream_backend_80 {
|
||||
server istio-ingressgateway.istio-system.svc:80;
|
||||
}
|
||||
upstream stream_backend_443 {
|
||||
server istio-ingressgateway.istio-system.svc:443;
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
proxy_pass stream_backend_80;
|
||||
proxy_protocol on;
|
||||
}
|
||||
server {
|
||||
listen 443;
|
||||
proxy_pass stream_backend_443;
|
||||
proxy_protocol on;
|
||||
}
|
||||
}
|
||||
18
config/istio/istio-proxy-protocol.yaml
Normal file
18
config/istio/istio-proxy-protocol.yaml
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: proxy-protocol
|
||||
namespace: istio-system
|
||||
spec:
|
||||
workloadSelector:
|
||||
labels:
|
||||
istio: ingressgateway
|
||||
configPatches:
|
||||
- applyTo: LISTENER
|
||||
patch:
|
||||
operation: MERGE
|
||||
value:
|
||||
listener_filters:
|
||||
- name: envoy.listener.proxy_protocol
|
||||
- name: envoy.listener.tls_inspector
|
||||
|
|
@ -2,5 +2,5 @@
|
|||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
|
|
@ -2,14 +2,14 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["nginx-ingress-proxy-config"]
|
||||
resourceNames: ["ingress-proxy-config"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
resourceNames: ["nginx-ingress-proxy"]
|
||||
resourceNames: ["ingress-proxy"]
|
||||
verbs: ["use"]
|
||||
|
|
@ -2,12 +2,12 @@
|
|||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
36
config/nginx/300-psp.yaml
Normal file
36
config/nginx/300-psp.yaml
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
---
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
spec:
|
||||
allowedCapabilities:
|
||||
- SETUID
|
||||
- SETGID
|
||||
- NET_BIND_SERVICE
|
||||
requiredDropCapabilities: ["ALL"]
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
volumes:
|
||||
- 'secret'
|
||||
- 'configMap'
|
||||
hostNetwork: true
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'RunAsAny'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'RunAsAny'
|
||||
fsGroup:
|
||||
rule: 'RunAsAny'
|
||||
hostPorts:
|
||||
- min: 80
|
||||
max: 443
|
||||
|
|
@ -2,21 +2,21 @@
|
|||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app: nginx-ingress-proxy
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nginx-ingress-proxy
|
||||
app: ingress-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx-ingress-proxy
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
serviceAccountName: nginx-ingress-proxy
|
||||
serviceAccountName: ingress-proxy
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: MASTERNODE
|
||||
tolerations:
|
||||
|
|
@ -26,7 +26,7 @@ spec:
|
|||
- name: nginx
|
||||
image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
|
||||
volumeMounts:
|
||||
- name: nginx-ingress-proxy-config
|
||||
- name: ingress-proxy-config
|
||||
mountPath: /etc/nginx
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -46,6 +46,6 @@ spec:
|
|||
hostPort: 443
|
||||
protocol: TCP
|
||||
volumes:
|
||||
- name: nginx-ingress-proxy-config
|
||||
- name: ingress-proxy-config
|
||||
configMap:
|
||||
name: nginx-ingress-proxy-config
|
||||
name: ingress-proxy-config
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-ingress-proxy-config
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
data:
|
||||
nginx.conf: |
|
||||
177
istio-ingress-proxy.yaml
Normal file
177
istio-ingress-proxy.yaml
Normal file
|
|
@ -0,0 +1,177 @@
|
|||
# config/istio/100-serviceaccount.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
# config/istio/200-rolebinding.yaml
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: ingress-proxy
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ingress-proxy
|
||||
# config/istio/200-role.yaml
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["ingress-proxy-config"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
resourceNames: ["ingress-proxy"]
|
||||
verbs: ["use"]
|
||||
# config/istio/300-psp.yaml
|
||||
---
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
|
||||
spec:
|
||||
allowedCapabilities:
|
||||
- SETUID
|
||||
- SETGID
|
||||
- NET_BIND_SERVICE
|
||||
requiredDropCapabilities: ["ALL"]
|
||||
privileged: false
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: false
|
||||
volumes:
|
||||
- 'secret'
|
||||
- 'configMap'
|
||||
hostNetwork: true
|
||||
hostIPC: false
|
||||
hostPID: false
|
||||
runAsUser:
|
||||
rule: 'RunAsAny'
|
||||
seLinux:
|
||||
rule: 'RunAsAny'
|
||||
supplementalGroups:
|
||||
rule: 'RunAsAny'
|
||||
fsGroup:
|
||||
rule: 'RunAsAny'
|
||||
hostPorts:
|
||||
- min: 80
|
||||
max: 443
|
||||
# config/istio/deployment.yaml
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
labels:
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: ingress-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
serviceAccountName: ingress-proxy
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: MASTERNODE
|
||||
tolerations:
|
||||
- operator: Exists
|
||||
effect: NoSchedule
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
|
||||
volumeMounts:
|
||||
- name: ingress-proxy-config
|
||||
mountPath: /etc/nginx
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
add:
|
||||
- SETUID
|
||||
- SETGID
|
||||
- NET_BIND_SERVICE
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 80
|
||||
hostPort: 80
|
||||
protocol: TCP
|
||||
- name: https
|
||||
containerPort: 443
|
||||
hostPort: 443
|
||||
protocol: TCP
|
||||
volumes:
|
||||
- name: ingress-proxy-config
|
||||
configMap:
|
||||
name: ingress-proxy-config
|
||||
# config/istio/ingress-proxy-configmap.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: ingress-proxy
|
||||
namespace: istio-system
|
||||
data:
|
||||
nginx.conf: |
|
||||
user nginx;
|
||||
worker_processes auto;
|
||||
events {
|
||||
worker_connections 1024;
|
||||
}
|
||||
stream {
|
||||
upstream stream_backend_80 {
|
||||
server istio-ingressgateway.istio-system.svc:80;
|
||||
}
|
||||
upstream stream_backend_443 {
|
||||
server istio-ingressgateway.istio-system.svc:443;
|
||||
}
|
||||
server {
|
||||
listen 80;
|
||||
proxy_pass stream_backend_80;
|
||||
proxy_protocol on;
|
||||
}
|
||||
server {
|
||||
listen 443;
|
||||
proxy_pass stream_backend_443;
|
||||
proxy_protocol on;
|
||||
}
|
||||
}
|
||||
# config/istio/istio-proxy-protocol.yaml
|
||||
---
|
||||
apiVersion: networking.istio.io/v1alpha3
|
||||
kind: EnvoyFilter
|
||||
metadata:
|
||||
name: proxy-protocol
|
||||
namespace: istio-system
|
||||
spec:
|
||||
workloadSelector:
|
||||
labels:
|
||||
istio: ingressgateway
|
||||
configPatches:
|
||||
- applyTo: LISTENER
|
||||
patch:
|
||||
operation: MERGE
|
||||
value:
|
||||
listener_filters:
|
||||
- name: envoy.listener.proxy_protocol
|
||||
- name: envoy.listener.tls_inspector
|
||||
|
|
@ -1,46 +1,46 @@
|
|||
# config/100-serviceaccount.yaml
|
||||
# config/nginx/100-serviceaccount.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
# config/200-rolebinding.yaml
|
||||
# config/nginx/200-rolebinding.yaml
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: nginx-ingress-proxy
|
||||
# config/200-role.yaml
|
||||
name: ingress-proxy
|
||||
# config/nginx/200-role.yaml
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
rules:
|
||||
- apiGroups: [""]
|
||||
resources: ["configmaps"]
|
||||
resourceNames: ["nginx-ingress-proxy-config"]
|
||||
resourceNames: ["ingress-proxy-config"]
|
||||
verbs: ["get"]
|
||||
- apiGroups: ["policy"]
|
||||
resources: ["podsecuritypolicies"]
|
||||
resourceNames: ["nginx-ingress-proxy"]
|
||||
resourceNames: ["ingress-proxy"]
|
||||
verbs: ["use"]
|
||||
# config/300-psp.yaml
|
||||
# config/nginx/300-psp.yaml
|
||||
---
|
||||
apiVersion: policy/v1beta1
|
||||
kind: PodSecurityPolicy
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
|
||||
apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
|
||||
|
|
@ -72,26 +72,26 @@ spec:
|
|||
hostPorts:
|
||||
- min: 80
|
||||
max: 443
|
||||
# config/deployment.yaml
|
||||
# config/nginx/deployment.yaml
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nginx-ingress-proxy
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
labels:
|
||||
app: nginx-ingress-proxy
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nginx-ingress-proxy
|
||||
app: ingress-proxy
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx-ingress-proxy
|
||||
app: ingress-proxy
|
||||
spec:
|
||||
serviceAccountName: nginx-ingress-proxy
|
||||
serviceAccountName: ingress-proxy
|
||||
nodeSelector:
|
||||
kubernetes.io/hostname: MASTERNODE
|
||||
tolerations:
|
||||
|
|
@ -101,7 +101,7 @@ spec:
|
|||
- name: nginx
|
||||
image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
|
||||
volumeMounts:
|
||||
- name: nginx-ingress-proxy-config
|
||||
- name: ingress-proxy-config
|
||||
mountPath: /etc/nginx
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
|
|
@ -121,15 +121,15 @@ spec:
|
|||
hostPort: 443
|
||||
protocol: TCP
|
||||
volumes:
|
||||
- name: nginx-ingress-proxy-config
|
||||
- name: ingress-proxy-config
|
||||
configMap:
|
||||
name: nginx-ingress-proxy-config
|
||||
# config/nginx-configmap.yaml
|
||||
name: ingress-proxy-config
|
||||
# config/nginx/ingress-proxy-configmap.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: nginx-ingress-proxy-config
|
||||
name: ingress-proxy
|
||||
namespace: ingress-nginx
|
||||
data:
|
||||
nginx.conf: |
|
||||
|
|
@ -156,7 +156,7 @@ data:
|
|||
proxy_protocol on;
|
||||
}
|
||||
}
|
||||
# config/nginx-configuration.yaml
|
||||
# config/nginx/nginx-configuration.yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue