diff --git a/kubernetes/servicemesh/applications/ingress-nginx/cluster-role-binding.yaml b/kubernetes/servicemesh/applications/ingress-nginx/cluster-role-binding.yaml new file mode 100644 index 0000000..ecc8fa8 --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/cluster-role-binding.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRoleBinding +metadata: + name: nginx-ingress-clusterrole-nisa-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: nginx-ingress-clusterrole +subjects: + - kind: ServiceAccount + name: nginx-ingress-serviceaccount + namespace: ingress-nginx diff --git a/kubernetes/servicemesh/applications/ingress-nginx/cluster-role.yaml b/kubernetes/servicemesh/applications/ingress-nginx/cluster-role.yaml new file mode 100644 index 0000000..72d22cb --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/cluster-role.yaml @@ -0,0 +1,53 @@ +apiVersion: rbac.authorization.k8s.io/v1beta1 +kind: ClusterRole +metadata: + name: nginx-ingress-clusterrole +rules: + - apiGroups: + - "" + resources: + - configmaps + - endpoints + - nodes + - pods + - secrets + verbs: + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - apiGroups: + - "" + resources: + - services + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - "extensions" + - "networking.k8s.io" + resources: + - ingresses + verbs: + - get + - list + - watch + - apiGroups: + - "extensions" + - "networking.k8s.io" + resources: + - ingresses/status + verbs: + - update \ No newline at end of file diff --git a/kubernetes/servicemesh/applications/ingress-nginx/configMap.yaml b/kubernetes/servicemesh/applications/ingress-nginx/configMap.yaml new file mode 100644 index 0000000..5f41172 --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/configMap.yaml @@ -0,0 +1,35 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: nginx-configuration + namespace: ingress-nginx + labels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx +data: + client-body-buffer-size: 60k + client-header-buffer-size: 16k + error-log-level: warn + http2-max-field-size: 16k + large-client-header-buffers: 4 16k + log-format-escape-json: "true" + log-format-upstream: '{"time":"$time_iso8601","remote_addr":"$remote_addr","proxy_protocol_addr":"$proxy_protocol_addr","proxy_protocol_port":"$proxy_protocol_port","x_forward_for":"$proxy_add_x_forwarded_for","remote_user":"$remote_user","host":"$host","request_method":"$request_method","request_uri":"$request_uri","server_protocol":"$server_protocol","status":$status,"request_time":$request_time,"request_length":$request_length,"bytes_sent":$bytes_sent,"upstream_name":"$proxy_upstream_name","upstream_addr":"$upstream_addr","upstream_uri":"$uri","upstream_response_length":$upstream_response_length,"upstream_response_time":$upstream_response_time,"upstream_status":$upstream_status,"http_referrer":"$http_referer","http_user_agent":"$http_user_agent","http_cookie":"$http_cookie"}' + location-snippet: "include /etc/nginx/custom-snippets/location-custom.conf;" +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: tcp-services + namespace: ingress-nginx + labels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: udp-services + namespace: ingress-nginx + labels: + app.kubernetes.io/name: ingress-nginx + app.kubernetes.io/part-of: ingress-nginx \ No newline at end of file diff --git a/kubernetes/servicemesh/applications/ingress-nginx/custom-snippets.configmap.yaml b/kubernetes/servicemesh/applications/ingress-nginx/custom-snippets.configmap.yaml new file mode 100644 index 0000000..da8ef5a --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/custom-snippets.configmap.yaml @@ -0,0 +1,37 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: custom-snippets + namespace: ingress-nginx +data: + location-custom.conf: | + set $globalcors ""; + + if ($http_origin ~* '^(http|https)?://(localhost(:[0-9]+)?)$') { + set $globalcors "true"; + } + + if ($request_method = 'OPTIONS') { + set $globalcors "${globalcors}options"; + } + + if ($globalcors = "trueoptions") { + add_header 'Access-Control-Allow-Origin' "$http_origin"; + add_header 'Access-Control-Allow-Credentials' 'true'; + add_header 'Access-Control-Allow-Methods' 'GET, POST, HEAD, PUT, DELETE, OPTIONS'; + add_header 'Access-Control-Allow-Headers' 'X-CSRF-Token,Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With'; + add_header 'Access-Control-Max-Age' 1728000; + add_header 'Content-Type' 'text/plain charset=UTF-8'; + add_header 'Content-Length' 0; + + return 204; + } + + if ($request_method ~* "(GET|POST|HEAD)") { + add_header "Access-Control-Allow-Origin" "$http_origin"; + add_header 'Access-Control-Allow-Credentials' 'true'; + add_header 'Access-Control-Allow-Headers' 'X-CSRF-Token,Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With'; + add_header 'X-Frame-Options' 'sameorigin'; + } + +--- \ No newline at end of file diff --git a/kubernetes/servicemesh/applications/ingress-nginx/deployment.yaml b/kubernetes/servicemesh/applications/ingress-nginx/deployment.yaml new file mode 100644 index 0000000..ea7ce2f --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/deployment.yaml @@ -0,0 +1,77 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: nginx-ingress-controller + namespace: ingress-nginx +spec: + replicas: 2 + selector: + matchLabels: + app: nginx-ingress + template: + metadata: + labels: + app: nginx-ingress + annotations: + prometheus.io/port: "10254" + prometheus.io/scrape: "true" + spec: + serviceAccountName: nginx-ingress-serviceaccount + containers: + - name: nginx-ingress-controller + image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.25.1 + args: + - /nginx-ingress-controller + - --configmap=$(POD_NAMESPACE)/nginx-configuration + - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services + - --udp-services-configmap=$(POD_NAMESPACE)/udp-services + - --publish-service=$(POD_NAMESPACE)/ingress-nginx + - --annotations-prefix=nginx.ingress.kubernetes.io + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - ALL + add: + - NET_BIND_SERVICE + runAsUser: 33 + volumeMounts: + - name: custom-snippets + mountPath: /etc/nginx/custom-snippets/ + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + ports: + - name: http + containerPort: 80 + - name: https + containerPort: 443 + livenessProbe: + failureThreshold: 3 + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 10 + readinessProbe: + failureThreshold: 3 + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 10 + volumes: + - name: custom-snippets + configMap: + name: custom-snippets diff --git a/kubernetes/servicemesh/applications/ingress-nginx/namespace.yaml b/kubernetes/servicemesh/applications/ingress-nginx/namespace.yaml new file mode 100644 index 0000000..bc9ce85 --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: ingress-nginx \ No newline at end of file diff --git a/kubernetes/servicemesh/applications/ingress-nginx/service-account.yaml b/kubernetes/servicemesh/applications/ingress-nginx/service-account.yaml new file mode 100644 index 0000000..666f700 --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/service-account.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: nginx-ingress-serviceaccount + namespace: ingress-nginx \ No newline at end of file diff --git a/kubernetes/servicemesh/applications/ingress-nginx/service.yaml b/kubernetes/servicemesh/applications/ingress-nginx/service.yaml new file mode 100644 index 0000000..64e8f62 --- /dev/null +++ b/kubernetes/servicemesh/applications/ingress-nginx/service.yaml @@ -0,0 +1,17 @@ +kind: Service +apiVersion: v1 +metadata: + name: ingress-nginx + namespace: ingress-nginx +spec: + externalTrafficPolicy: Local + selector: + app: nginx-ingress + type: LoadBalancer + ports: + - name: http + port: 80 + targetPort: http + - name: https + port: 443 + targetPort: https \ No newline at end of file