initial commit

nginx-ingress-proxy.yaml

@@ -0,0 +1,171 @@
+# config/100-serviceaccount.yaml
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: nginx-ingress-proxy
+  namespace: ingress-nginx
+# config/200-rolebinding.yaml
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: nginx-ingress-proxy
+  namespace: ingress-nginx
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: nginx-ingress-proxy
+subjects:
+- kind: ServiceAccount
+  name: nginx-ingress-proxy
+# config/200-role.yaml
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: nginx-ingress-proxy
+  namespace: ingress-nginx
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  resourceNames: ["nginx-ingress-proxy-config"]
+  verbs: ["get"]
+- apiGroups: ["policy"]
+  resources: ["podsecuritypolicies"]
+  resourceNames: ["nginx-ingress-proxy"]
+  verbs: ["use"]
+# config/300-psp.yaml
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: nginx-ingress-proxy
+  annotations:
+    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
+    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
+    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
+    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
+spec:
+  allowedCapabilities:
+  - SETUID
+  - SETGID
+  - NET_BIND_SERVICE
+  requiredDropCapabilities: ["ALL"]
+  privileged: false
+  allowPrivilegeEscalation: false
+  readOnlyRootFilesystem: false
+  volumes:
+  - 'secret'
+  - 'configMap'
+  hostNetwork: true
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'RunAsAny'
+  fsGroup:
+    rule: 'RunAsAny'
+  hostPorts:
+  - min: 80
+    max: 443
+# config/deployment.yaml
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx-ingress-proxy
+  namespace: ingress-nginx
+  labels:
+    app: nginx-ingress-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nginx-ingress-proxy
+  template:
+    metadata:
+      labels:
+        app: nginx-ingress-proxy
+    spec:
+      serviceAccountName: nginx-ingress-proxy
+      nodeSelector:
+        kubernetes.io/hostname: MASTERNODE
+      tolerations:
+      - operator: Exists
+        effect: NoSchedule
+      containers:
+      - name: nginx
+        image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
+        volumeMounts:
+        - name: nginx-ingress-proxy-config
+          mountPath: /etc/nginx
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop: ["ALL"]
+            add:
+            - SETUID
+            - SETGID
+            - NET_BIND_SERVICE
+        ports:
+        - name: http
+          containerPort: 80
+          hostPort: 80
+          protocol: TCP
+        - name: https
+          containerPort: 443
+          hostPort: 443
+          protocol: TCP
+      volumes:
+      - name: nginx-ingress-proxy-config
+        configMap:
+          name: nginx-ingress-proxy-config
+# config/nginx-configmap.yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-ingress-proxy-config
+  namespace: ingress-nginx
+data:
+  nginx.conf: |
+    user nginx;
+    worker_processes auto;
+    events {
+      worker_connections  1024;
+    }
+    stream {
+      upstream stream_backend_80 {
+        server ingress-nginx.ingress-nginx.svc:80;
+      }
+      upstream stream_backend_443 {
+        server ingress-nginx.ingress-nginx.svc:443;
+      }
+      server {
+        listen 80;
+        proxy_pass stream_backend_80;
+        proxy_protocol on;
+      }
+      server {
+        listen 443;
+        proxy_pass stream_backend_443;
+        proxy_protocol on;
+      }
+    }
+# config/nginx-configuration.yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nginx-configuration
+  namespace: ingress-nginx
+  labels:
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+data:
+  server-tokens: "false"
+  use-proxy-protocol: "true"