Update NGINX Ingress Controller to 3.6.0

nginxinc · Jun 26, 2024 · 8875f5d · 8875f5d
1 parent 294abe5
commit 8875f5d
Show file tree

Hide file tree

Showing 21 changed files with 2,676 additions and 2,202 deletions.
diff --git a/bundle/manifests/nginx-ingress-operator.clusterserviceversion.yaml b/bundle/manifests/nginx-ingress-operator.clusterserviceversion.yaml
@@ -77,7 +77,7 @@ metadata:
               "image": {
                 "pullPolicy": "IfNotPresent",
                 "repository": "nginx/nginx-ingress",
-                "tag": "3.5.2-ubi"
+                "tag": "3.6.0-ubi"
               },
               "includeYear": false,
               "ingressClass": {

diff --git a/config/samples/charts_v1alpha1_nginxingress.yaml b/config/samples/charts_v1alpha1_nginxingress.yaml
@@ -35,7 +35,7 @@ spec:
     customPorts: []
     image:
       repository: nginx/nginx-ingress
-      tag: "3.5.2-ubi"
+      tag: "3.6.0-ubi"
       # digest: "sha256:CHANGEME"
       pullPolicy: IfNotPresent
     lifecycle: {}

diff --git a/docs/nginx-ingress-controller.md b/docs/nginx-ingress-controller.md
@@ -47,7 +47,7 @@ spec:
     customPorts: []
     image:
       repository: nginx/nginx-ingress
-      tag: "3.5.2-ubi"
+      tag: "3.6.0-ubi"
       # digest: "sha256:CHANGEME"
       pullPolicy: IfNotPresent
     lifecycle: {}

diff --git a/examples/deployment-oss-min/nginx-ingress-controller.yaml b/examples/deployment-oss-min/nginx-ingress-controller.yaml
@@ -11,7 +11,7 @@ spec:
     image:
       pullPolicy: IfNotPresent
       repository: nginx/nginx-ingress
-      tag: 3.5.2-ubi
+      tag: 3.6.0-ubi
     ingressClass:
       name: nginx
     kind: deployment

diff --git a/examples/deployment-plus-min/nginx-ingress-controller.yaml b/examples/deployment-plus-min/nginx-ingress-controller.yaml
@@ -11,7 +11,7 @@ spec:
     image:
       pullPolicy: IfNotPresent
       repository: nginx/nginx-ingress
-      tag: 3.5.2-ubi
+      tag: 3.6.0-ubi
     ingressClass:
       name: nginx
     kind: deployment

diff --git a/helm-charts/nginx-ingress/Chart.yaml b/helm-charts/nginx-ingress/Chart.yaml
@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: 3.5.2
+appVersion: 3.6.0
 description: NGINX Ingress Controller
 home: https://github.com/nginxinc/kubernetes-ingress
-icon: https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.5.2/charts/nginx-ingress/chart-icon.png
+icon: https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.6.0/charts/nginx-ingress/chart-icon.png
 keywords:
 - ingress
 - nginx
@@ -12,6 +12,6 @@ maintainers:
   name: nginxinc
 name: nginx-ingress
 sources:
-- https://github.com/nginxinc/kubernetes-ingress/tree/v3.5.2/charts/nginx-ingress
+- https://github.com/nginxinc/kubernetes-ingress/tree/v3.6.0/charts/nginx-ingress
 type: application
-version: 1.2.2
+version: 1.3.0
diff --git a/helm-charts/nginx-ingress/README.md b/helm-charts/nginx-ingress/README.md
@@ -2,7 +2,7 @@
 
 ## Introduction
 
-This chart deploys the NGINX Ingress Controller in your Kubernetes cluster.
+This chart deploys NGINX Ingress Controller in your Kubernetes cluster.
 
 ## Prerequisites
 
@@ -51,10 +51,10 @@ kubectl apply -f crds/
 Alternatively, CRDs can be upgraded without pulling the chart by running:
 
 ```console
-kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.5.2/deploy/crds.yaml
+kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.6.0/deploy/crds.yaml
 ```
 
-In the above command, `v3.5.2` represents the version of NGINX Ingress Controller release rather than the Helm chart version.
+In the above command, `v3.6.0` represents the version of NGINX Ingress Controller release rather than the Helm chart version.
 
 > **Note**
 >
@@ -87,14 +87,14 @@ To install the chart with the release name my-release (my-release is the name th
 For NGINX:
 
 ```console
-helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.2.2
+helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.3.0
 ```
 
 For NGINX Plus: (assuming you have pushed the Ingress Controller image `nginx-plus-ingress` to your private registry
 `myregistry.example.com`)
 
 ```console
-helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.2.2 --set controller.image.repository=myregistry.example.com/nginx-plus-ingress --set controller.nginxplus=true
+helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.3.0 --set controller.image.repository=myregistry.example.com/nginx-plus-ingress --set controller.nginxplus=true
 ```
 
 This will install the latest `edge` version of the Ingress Controller from GitHub Container Registry. If you prefer to
@@ -109,7 +109,7 @@ CRDs](#upgrading-the-crds).
 To upgrade the release `my-release`:
 
 ```console
-helm upgrade my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.2.2
+helm upgrade my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.3.0
 ```
 
 ### Uninstalling the Chart
@@ -150,7 +150,7 @@ upgrading/deleting the CRDs.
 1. Pull the chart sources:
 
     ```console
-    helm pull oci://ghcr.io/nginxinc/charts/nginx-ingress --untar --version 1.2.2
+    helm pull oci://ghcr.io/nginxinc/charts/nginx-ingress --untar --version 1.3.0
     ```
 
 2. Change your working directory to nginx-ingress:
@@ -236,7 +236,7 @@ The steps you should follow depend on the Helm release name:
     Selector:               app=nginx-ingress-nginx-ingress
     ```
 
-2. Checkout the latest available tag using `git checkout v3.5.2`
+2. Checkout the latest available tag using `git checkout v3.6.0`
 
 3. Navigate to `/kubernates-ingress/charts/nginx-ingress`
 
@@ -288,7 +288,7 @@ reviewing its events:
     Selector:               app=<helm_release_name>-nginx-ingress
     ```
 
-2. Checkout the latest available tag using `git checkout v3.5.2`
+2. Checkout the latest available tag using `git checkout v3.6.0`
 
 3. Navigate to `/kubernates-ingress/charts/nginx-ingress`
 
@@ -355,7 +355,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.logLevel` | The log level of the Ingress Controller. | 1 |
 |`controller.image.digest` | The image digest of the Ingress Controller. | None |
 |`controller.image.repository` | The image repository of the Ingress Controller. | nginx/nginx-ingress |
-|`controller.image.tag` | The tag of the Ingress Controller image. | 3.5.2 |
+|`controller.image.tag` | The tag of the Ingress Controller image. | 3.6.0 |
 |`controller.image.pullPolicy` | The pull policy for the Ingress Controller image. | IfNotPresent |
 |`controller.lifecycle` | The lifecycle of the Ingress Controller pods. | {} |
 |`controller.customConfigMap` | The name of the custom ConfigMap used by the Ingress Controller. If set, then the default config is ignored. | "" |
@@ -386,7 +386,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.initContainerResources` | The resources of the init container which is used when `readOnlyRootFilesystem` is enabled by either setting `controller.securityContext.readOnlyRootFilesystem` or `controller.readOnlyRootFilesystem`to `true`. | requests: cpu=100m,memory=128Mi |
 |`controller.replicaCount` | The number of replicas of the Ingress Controller deployment. | 1 |
 |`controller.ingressClass.name` | A class of the Ingress Controller. An IngressClass resource with the name equal to the class must be deployed. Otherwise, the Ingress Controller will fail to start. The Ingress Controller only processes resources that belong to its class - i.e. have the "ingressClassName" field resource equal to the class. The Ingress Controller processes all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the "ingressClassName" field for all versions of Kubernetes. | nginx |
-|`controller.ingressClass.create` | Creates a new IngressClass object with the name `controller.ingressClass.name`. Set to `false` to use an existing ingressClass created using `kubectl` with the same name. If you use `helm upgrade`, do not change the values from the previous release as helm will delete IngressClass objects managed by helm. If you are upgrading from a release earlier than 3.5.2, do not set the value to false. | true |
+|`controller.ingressClass.create` | Creates a new IngressClass object with the name `controller.ingressClass.name`. Set to `false` to use an existing ingressClass created using `kubectl` with the same name. If you use `helm upgrade`, do not change the values from the previous release as helm will delete IngressClass objects managed by helm. If you are upgrading from a release earlier than 3.6.0, do not set the value to false. | true |
 |`controller.ingressClass.setAsDefaultIngress` | New Ingresses without an `"ingressClassName"` field specified will be assigned the class specified in `controller.ingressClass.name`. Requires `controller.ingressClass.create`. | false |
 |`controller.watchNamespace` | Comma separated list of namespaces the Ingress Controller should watch for resources. By default the Ingress Controller watches all namespaces. Mutually exclusive with `controller.watchNamespaceLabel`. Please note that if configuring multiple namespaces using the Helm cli `--set` option, the string needs to wrapped in double quotes and the commas escaped using a backslash - e.g. `--set controller.watchNamespace="default\,nginx-ingress"`. | "" |
 |`controller.watchNamespaceLabel` | Configures the Ingress Controller to watch only those namespaces with label foo=bar. By default the Ingress Controller watches all namespaces. Mutually exclusive with `controller.watchNamespace`. | "" |
@@ -443,6 +443,20 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.pod.annotations` | The annotations of the Ingress Controller pod. | {} |
 |`controller.pod.extraLabels` | The additional extra labels of the Ingress Controller pod. | {} |
 |`controller.appprotect.enable` | Enables the App Protect WAF module in the Ingress Controller. | false |
+|`controller.appprotect.v5` | Enables App Protect WAF v5. | false |
+|`controller.appprotect.volumes` | Volumes for App Protect WAF v5. | [{"name": "app-protect-bd-config", "emptyDir": {}},{"name": "app-protect-config", "emptyDir": {}},{"name": "app-protect-bundles", "emptyDir": {}}] |
+|`controller.appprotect.enforcer.host` | Host that the App Protect WAF v5 Enforcer runs on. | "127.0.0.1" |
+|`controller.appprotect.enforcer.port` | Port that the App Protect WAF v5 Enforcer runs on. | 50000 |
+|`controller.appprotect.enforcer.image` | The image repository of the App Protect WAF v5 Enforcer. | private-registry.nginx.com/nap/waf-enforcer |
+|`controller.appprotect.enforcer.tag` | The tag of the App Protect WAF v5 Enforcer. | "5.2.0" |
+|`controller.appprotect.enforcer.digest` | The digest of the App Protect WAF v5 Enforcer. Takes precedence over tag if set. | "5.2.0" |
+|`controller.appprotect.enforcer.pullPolicy` | The pull policy for the App Protect WAF v5 Enforcer image. | "5.2.0" |
+|`controller.appprotect.enforcer.securityContext` | The security context for App Protect WAF v5 Enforcer container. | {} |
+|`controller.appprotect.configManager.image` | The image repository of the App Protect WAF v5 Configuration Manager. | private-registry.nginx.com/nap/waf-config-mgr |
+|`controller.appprotect.configManager.tag` | The tag of the App Protect WAF v5 Configuration Manager. | "5.2.0" |
+|`controller.appprotect.configManager.digest` | The digest of the App Protect WAF v5 Configuration Manager. Takes precedence over tag if set. | "5.2.0" |
+|`controller.appprotect.configManager.pullPolicy` | The pull policy for the App Protect WAF v5 Configuration Manager image. | "5.2.0" |
+|`controller.appprotect.configManager.securityContext` | The security context for App Protect WAF v5 Configuration Manager container. | {"allowPrivilegeEscalation":false,"runAsUser":101,"runAsNonRoot":true,"capabilities":{"drop":["all"]}} |
 |`controller.appprotectdos.enable` | Enables the App Protect DoS module in the Ingress Controller. | false |
 |`controller.appprotectdos.debug` | Enable debugging for App Protect DoS. | false |
 |`controller.appprotectdos.maxDaemons` | Max number of ADMD instances. | 1 |
@@ -473,6 +487,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.telemetryReporting.enable` | Enable telemetry reporting. | true |
 |`controller.enableWeightChangesDynamicReload` | Enable weight changes without reloading the NGINX configuration. May require increasing `map_hash_bucket_size`, `map_hash_max_size`, `variable_hash_bucket_size`, and `variable_hash_max_size` in the [ConfigMap](https://docs.nginx.com/nginx-ingress-controller/configuration/global-configuration/configmap-resource/) if there are many two-way splits. Requires `controller.nginxplus` | false |
 |`rbac.create` | Configures RBAC. | true |
+|`rbac.clusterrole.create` | Configures creation of ClusterRole. Creation can be disabled when more fine-grained control over RBAC is required. For example when controller.watchNamespace is used. | true |
 |`prometheus.create` | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
 |`prometheus.port` | Configures the port to scrape the metrics. | 9113 |
 |`prometheus.scheme` | Configures the HTTP scheme to use for connections to the Prometheus endpoint. | http |

diff --git a/helm-charts/nginx-ingress/crds/appprotect.f5.com_aplogconfs.yaml b/helm-charts/nginx-ingress/crds/appprotect.f5.com_aplogconfs.yaml
@@ -2,8 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.10.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.13.0
   name: aplogconfs.appprotect.f5.com
 spec:
   group: appprotect.f5.com
@@ -15,66 +14,70 @@ spec:
   preserveUnknownFields: false
   scope: Namespaced
   versions:
-    - name: v1beta1
-      schema:
-        openAPIV3Schema:
-          description: APLogConf is the Schema for the APLogConfs API
-          properties:
-            apiVersion:
-              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
-              type: string
-            kind:
-              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
-              type: string
-            metadata:
-              type: object
-            spec:
-              description: APLogConfSpec defines the desired state of APLogConf
-              properties:
-                content:
-                  properties:
-                    escaping_characters:
-                      items:
-                        properties:
-                          from:
-                            type: string
-                          to:
-                            type: string
-                        type: object
-                      type: array
-                    format:
-                      enum:
-                        - splunk
-                        - arcsight
-                        - default
-                        - user-defined
-                        - grpc
-                      type: string
-                    format_string:
-                      type: string
-                    list_delimiter:
-                      type: string
-                    list_prefix:
-                      type: string
-                    list_suffix:
-                      type: string
-                    max_message_size:
-                      pattern: ^([1-9]|[1-5][0-9]|6[0-4])k$
-                      type: string
-                    max_request_size:
-                      pattern: ^([1-9]|[1-9][0-9]|[1-9][0-9]{2}|1[0-9]{3}|20[1-3][0-9]|204[1-8]|any)$
-                      type: string
-                  type: object
-                filter:
-                  properties:
-                    request_type:
-                      enum:
-                        - all
-                        - illegal
-                        - blocked
-                      type: string
-                  type: object
-              type: object
-          type: object
-      served: true
-      storage: true
+  - name: v1beta1
+    schema:
+      openAPIV3Schema:
+        description: APLogConf is the Schema for the APLogConfs API
+        properties:
+          apiVersion:
+            description: 'APIVersion defines the versioned schema of this representation
+              of an object. Servers should convert recognized schemas to the latest
+              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            type: string
+          kind:
+            description: 'Kind is a string value representing the REST resource this
+              object represents. Servers may infer this from the endpoint the client
+              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: APLogConfSpec defines the desired state of APLogConf
+            properties:
+              content:
+                properties:
+                  escaping_characters:
+                    items:
+                      properties:
+                        from:
+                          type: string
+                        to:
+                          type: string
+                      type: object
+                    type: array
+                  format:
+                    enum:
+                    - splunk
+                    - arcsight
+                    - default
+                    - user-defined
+                    - grpc
+                    type: string
+                  format_string:
+                    type: string
+                  list_delimiter:
+                    type: string
+                  list_prefix:
+                    type: string
+                  list_suffix:
+                    type: string
+                  max_message_size:
+                    pattern: ^([1-9]|[1-5][0-9]|6[0-4])k$
+                    type: string
+                  max_request_size:
+                    pattern: ^([1-9]|[1-9][0-9]|[1-9][0-9]{2}|[1-9][0-9]{3}|10[0-2][0-9][0-9]|[1-9]k|10k|any)$
+                    type: string
+                type: object
+              filter:
+                properties:
+                  request_type:
+                    enum:
+                    - all
+                    - illegal
+                    - blocked
+                    type: string
+                type: object
+            type: object
+        type: object
+    served: true
+    storage: true