# config/nginx/100-serviceaccount.yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ingress-proxy
  namespace: ingress-nginx
# config/nginx/200-rolebinding.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ingress-proxy
  namespace: ingress-nginx
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ingress-proxy
subjects:
- kind: ServiceAccount
  name: ingress-proxy
# config/nginx/200-role.yaml
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ingress-proxy
  namespace: ingress-nginx
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["ingress-proxy-config"]
  verbs: ["get"]
- apiGroups: ["policy"]
  resources: ["podsecuritypolicies"]
  resourceNames: ["ingress-proxy"]
  verbs: ["use"]
# config/nginx/300-psp.yaml
---
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: ingress-proxy
  annotations:
    seccomp.security.alpha.kubernetes.io/allowedProfileNames: 'docker/default,runtime/default'
    apparmor.security.beta.kubernetes.io/allowedProfileNames: 'runtime/default'
    seccomp.security.alpha.kubernetes.io/defaultProfileName: 'runtime/default'
    apparmor.security.beta.kubernetes.io/defaultProfileName: 'runtime/default'
spec:
  allowedCapabilities:
  - SETUID
  - SETGID
  - NET_BIND_SERVICE
  requiredDropCapabilities: ["ALL"]
  privileged: false
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: false
  volumes:
  - 'secret'
  - 'configMap'
  hostNetwork: true
  hostIPC: false
  hostPID: false
  runAsUser:
    rule: 'RunAsAny'
  seLinux:
    rule: 'RunAsAny'
  supplementalGroups:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'
  hostPorts:
  - min: 80
    max: 443
# config/nginx/deployment.yaml
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-proxy
  namespace: ingress-nginx
  labels:
    app: ingress-proxy
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ingress-proxy
  template:
    metadata:
      labels:
        app: ingress-proxy
    spec:
      serviceAccountName: ingress-proxy
      nodeSelector:
        kubernetes.io/hostname: MASTERNODE
      tolerations:
      - operator: Exists
        effect: NoSchedule
      containers:
      - name: nginx
        image: nginx@sha256:2911ad2d54f4cf4dc7ad21af122c1eefce16836a34be751c63351ca1fb452d57 # nginx:mainline-alpine
        volumeMounts:
        - name: ingress-proxy
          mountPath: /etc/nginx
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
            add:
            - SETUID
            - SETGID
            - NET_BIND_SERVICE
        ports:
        - name: http
          containerPort: 80
          hostPort: 80
          protocol: TCP
        - name: https
          containerPort: 443
          hostPort: 443
          protocol: TCP
      volumes:
      - name: ingress-proxy
        configMap:
          name: ingress-proxy
# config/nginx/ingress-proxy-configmap.yaml
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-proxy
  namespace: ingress-nginx
data:
  nginx.conf: |
    user nginx;
    worker_processes auto;
    events {
      worker_connections  1024;
    }
    stream {
      upstream stream_backend_80 {
        server ingress-nginx.ingress-nginx.svc:80;
      }
      upstream stream_backend_443 {
        server ingress-nginx.ingress-nginx.svc:443;
      }
      server {
        listen 80;
        proxy_pass stream_backend_80;
        proxy_protocol on;
      }
      server {
        listen 443;
        proxy_pass stream_backend_443;
        proxy_protocol on;
      }
    }
# config/nginx/nginx-configuration.yaml
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-configuration
  namespace: ingress-nginx
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
data:
  server-tokens: "false"
  use-proxy-protocol: "true"