Skip to content

Commit 9da6e8d

Browse files
drootdroot
authored
added ingress-nginx kpt package (#3380)
* added ingress-nginx package-example
1 parent 0a443c5 commit 9da6e8d

22 files changed

+730
-0
lines changed

‎package-examples/ingress-nginx/Kptfile

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: kpt.dev/v1
2+
kind: Kptfile
3+
metadata:
4+
name: ingress-nginx
5+
annotations:
6+
config.kubernetes.io/local-config: "true"
7+
info:
8+
description: sample description

‎package-examples/ingress-nginx/README.md

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# ingress-nginx
2+
3+
## Description
4+
5+
Nginx Ingress Controller package
6+
7+
## Usage
8+
9+
### Fetch the package
10+
11+
```sh
12+
kpt pkg get git@github.com:googlecontainertools/kpt.git/package-examples/ingress-nginx ingress-nginx
13+
```
14+
15+
### View package content
16+
17+
```sh
18+
19+
kpt pkg tree ingress-nginx
20+
21+
```
22+
23+
### Apply the package
24+
25+
```sh
26+
27+
kpt live init ingress-nginx
28+
kpt live apply ingress-nginx --reconcile-timeout=2m --output=table
29+
30+
```
31+
32+
### How was this package created
33+
34+
```sh
35+
36+
# download the static manifests from the github releases
37+
wget -O ingress-nginx.yaml https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.3.0/deploy/static/provider/cloud/deploy.yaml
38+
39+
```
40+
41+
Starlark function to add `app.kubernetes.io/component` label if it doesn't exists.
42+
43+
```yaml
44+
45+
## default-label.yaml
46+
47+
apiVersion: fn.kpt.dev/v1alpha1
48+
kind: StarlarkRun
49+
metadata:
50+
name: set-cluster-label
51+
annotations:
52+
source: |
53+
# set the component label to cluster if not specified
54+
def setlabel(resources):
55+
for resource in resources:
56+
curr_labels = resource.get("metadata").get("labels")
57+
if "app.kubernetes.io/component" not in curr_labels:
58+
resource["metadata"]["labels"]["app.kubernetes.io/component"] = "controller"
59+
setlabel(ctx.resource_list["items"])
60+
```
61+
62+
Create the package
63+
64+
```sh
65+
66+
mkdir ingress-nginx
67+
kpt pkg init ingress-nginx
68+
69+
cat ingress-nginx.yaml |kpt fn eval - -o unwrap -i starlark:v0.4.3 --fn-config default-label.yaml| kubectl-slice --template '{{ index "app.kubernetes.io/component" .metadata.labels }}/{{.kind | lower}}-{{.metadata.name|dottodash}}.yaml' -o ingress-nginx --dry-run
70+
71+
```

‎package-examples/ingress-nginx/admission-webhook/clusterrole-ingress-nginx-admission.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRole
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission
11+
rules:
12+
- apiGroups:
13+
- admissionregistration.k8s.io
14+
resources:
15+
- validatingwebhookconfigurations
16+
verbs:
17+
- get
18+
- update
19+

‎package-examples/ingress-nginx/admission-webhook/clusterrolebinding-ingress-nginx-admission.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: ClusterRoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission
11+
roleRef:
12+
apiGroup: rbac.authorization.k8s.io
13+
kind: ClusterRole
14+
name: ingress-nginx-admission
15+
subjects:
16+
- kind: ServiceAccount
17+
name: ingress-nginx-admission
18+
namespace: ingress-nginx
19+

‎package-examples/ingress-nginx/admission-webhook/job-ingress-nginx-admission-create.yaml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission-create
11+
namespace: ingress-nginx
12+
spec:
13+
template:
14+
metadata:
15+
labels:
16+
app.kubernetes.io/component: admission-webhook
17+
app.kubernetes.io/instance: ingress-nginx
18+
app.kubernetes.io/name: ingress-nginx
19+
app.kubernetes.io/part-of: ingress-nginx
20+
app.kubernetes.io/version: 1.3.0
21+
name: ingress-nginx-admission-create
22+
spec:
23+
containers:
24+
- args:
25+
- create
26+
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
27+
- --namespace=$(POD_NAMESPACE)
28+
- --secret-name=ingress-nginx-admission
29+
env:
30+
- name: POD_NAMESPACE
31+
valueFrom:
32+
fieldRef:
33+
fieldPath: metadata.namespace
34+
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660
35+
imagePullPolicy: IfNotPresent
36+
name: create
37+
securityContext:
38+
allowPrivilegeEscalation: false
39+
nodeSelector:
40+
kubernetes.io/os: linux
41+
restartPolicy: OnFailure
42+
securityContext:
43+
fsGroup: 2000
44+
runAsNonRoot: true
45+
runAsUser: 2000
46+
serviceAccountName: ingress-nginx-admission
47+

‎package-examples/ingress-nginx/admission-webhook/job-ingress-nginx-admission-patch.yaml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
apiVersion: batch/v1
2+
kind: Job
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission-patch
11+
namespace: ingress-nginx
12+
spec:
13+
template:
14+
metadata:
15+
labels:
16+
app.kubernetes.io/component: admission-webhook
17+
app.kubernetes.io/instance: ingress-nginx
18+
app.kubernetes.io/name: ingress-nginx
19+
app.kubernetes.io/part-of: ingress-nginx
20+
app.kubernetes.io/version: 1.3.0
21+
name: ingress-nginx-admission-patch
22+
spec:
23+
containers:
24+
- args:
25+
- patch
26+
- --webhook-name=ingress-nginx-admission
27+
- --namespace=$(POD_NAMESPACE)
28+
- --patch-mutating=false
29+
- --secret-name=ingress-nginx-admission
30+
- --patch-failure-policy=Fail
31+
env:
32+
- name: POD_NAMESPACE
33+
valueFrom:
34+
fieldRef:
35+
fieldPath: metadata.namespace
36+
image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660
37+
imagePullPolicy: IfNotPresent
38+
name: patch
39+
securityContext:
40+
allowPrivilegeEscalation: false
41+
nodeSelector:
42+
kubernetes.io/os: linux
43+
restartPolicy: OnFailure
44+
securityContext:
45+
fsGroup: 2000
46+
runAsNonRoot: true
47+
runAsUser: 2000
48+
serviceAccountName: ingress-nginx-admission
49+

‎package-examples/ingress-nginx/admission-webhook/role-ingress-nginx-admission.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: Role
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission
11+
namespace: ingress-nginx
12+
rules:
13+
- apiGroups:
14+
- ""
15+
resources:
16+
- secrets
17+
verbs:
18+
- get
19+
- create
20+

‎package-examples/ingress-nginx/admission-webhook/rolebinding-ingress-nginx-admission.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: rbac.authorization.k8s.io/v1
2+
kind: RoleBinding
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission
11+
namespace: ingress-nginx
12+
roleRef:
13+
apiGroup: rbac.authorization.k8s.io
14+
kind: Role
15+
name: ingress-nginx-admission
16+
subjects:
17+
- kind: ServiceAccount
18+
name: ingress-nginx-admission
19+
namespace: ingress-nginx
20+

‎package-examples/ingress-nginx/admission-webhook/serviceaccount-ingress-nginx-admission.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission
11+
namespace: ingress-nginx
12+

‎package-examples/ingress-nginx/admission-webhook/validatingwebhookconfiguration-ingress-nginx-admission.yaml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
apiVersion: admissionregistration.k8s.io/v1
2+
kind: ValidatingWebhookConfiguration
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: admission-webhook
6+
app.kubernetes.io/instance: ingress-nginx
7+
app.kubernetes.io/name: ingress-nginx
8+
app.kubernetes.io/part-of: ingress-nginx
9+
app.kubernetes.io/version: 1.3.0
10+
name: ingress-nginx-admission
11+
webhooks:
12+
- admissionReviewVersions:
13+
- v1
14+
clientConfig:
15+
service:
16+
name: ingress-nginx-controller-admission
17+
namespace: ingress-nginx
18+
path: /networking/v1/ingresses
19+
failurePolicy: Fail
20+
matchPolicy: Equivalent
21+
name: validate.nginx.ingress.kubernetes.io
22+
rules:
23+
- apiGroups:
24+
- networking.k8s.io
25+
apiVersions:
26+
- v1
27+
operations:
28+
- CREATE
29+
- UPDATE
30+
resources:
31+
- ingresses
32+
sideEffects: None
33+

0 commit comments

Comments
 (0)