| apiVersion: v1 |
| kind: ServiceAccount |
| metadata: |
| name: nginx-ingress-{{ juju_application }}-serviceaccount |
| --- |
| apiVersion: rbac.authorization.k8s.io/v1beta1 |
| kind: ClusterRole |
| metadata: |
| name: nginx-ingress-{{ juju_application }}-clusterrole |
| rules: |
| - apiGroups: |
| - "" |
| resources: |
| - configmaps |
| - endpoints |
| - nodes |
| - pods |
| - secrets |
| verbs: |
| - list |
| - watch |
| - apiGroups: |
| - "" |
| resources: |
| - nodes |
| verbs: |
| - get |
| - apiGroups: |
| - "" |
| resources: |
| - services |
| verbs: |
| - get |
| - list |
| - watch |
| - apiGroups: |
| - "extensions" |
| resources: |
| - ingresses |
| verbs: |
| - get |
| - list |
| - watch |
| - apiGroups: |
| - "" |
| resources: |
| - events |
| verbs: |
| - create |
| - patch |
| - apiGroups: |
| - "extensions" |
| resources: |
| - ingresses/status |
| verbs: |
| - update |
| --- |
| apiVersion: rbac.authorization.k8s.io/v1beta1 |
| kind: Role |
| metadata: |
| name: nginx-ingress-{{ juju_application }}-role |
| rules: |
| - apiGroups: |
| - "" |
| resources: |
| - configmaps |
| - pods |
| - secrets |
| - namespaces |
| verbs: |
| - get |
| - apiGroups: |
| - "" |
| resources: |
| - configmaps |
| resourceNames: |
| # Defaults to "<election-id>-<ingress-class>" |
| # Here: "<ingress-controller-leader>-<nginx>" |
| # This has to be adapted if you change either parameter |
| # when launching the nginx-ingress-controller. |
| - "ingress-controller-leader-nginx" |
| verbs: |
| - get |
| - update |
| - apiGroups: |
| - "" |
| resources: |
| - configmaps |
| verbs: |
| - create |
| - apiGroups: |
| - "" |
| resources: |
| - endpoints |
| verbs: |
| - get |
| - create |
| - update |
| --- |
| apiVersion: rbac.authorization.k8s.io/v1beta1 |
| kind: RoleBinding |
| metadata: |
| name: nginx-ingress-role-nisa-{{ juju_application }}-binding |
| roleRef: |
| apiGroup: rbac.authorization.k8s.io |
| kind: Role |
| name: nginx-ingress-{{ juju_application }}-role |
| subjects: |
| - kind: ServiceAccount |
| name: nginx-ingress-{{ juju_application }}-serviceaccount |
| --- |
| apiVersion: rbac.authorization.k8s.io/v1beta1 |
| kind: ClusterRoleBinding |
| metadata: |
| name: nginx-ingress-clusterrole-nisa-{{ juju_application }}-binding |
| roleRef: |
| apiGroup: rbac.authorization.k8s.io |
| kind: ClusterRole |
| name: nginx-ingress-{{ juju_application }}-clusterrole |
| subjects: |
| - kind: ServiceAccount |
| name: nginx-ingress-{{ juju_application }}-serviceaccount |
| namespace: default |
| --- |
| apiVersion: v1 |
| kind: ConfigMap |
| metadata: |
| name: nginx-load-balancer-{{ juju_application }}-conf |
| --- |
| apiVersion: {{ daemonset_api_version }} |
| kind: DaemonSet |
| metadata: |
| name: nginx-ingress-{{ juju_application }}-controller |
| labels: |
| juju-application: nginx-ingress-{{ juju_application }} |
| spec: |
| selector: |
| matchLabels: |
| name: nginx-ingress-{{ juju_application }} |
| template: |
| metadata: |
| labels: |
| name: nginx-ingress-{{ juju_application }} |
| spec: |
| nodeSelector: |
| juju-application: {{ juju_application }} |
| terminationGracePeriodSeconds: 60 |
| # hostPort doesn't work with CNI, so we have to use hostNetwork instead |
| # see https://github.com/kubernetes/kubernetes/issues/23920 |
| hostNetwork: true |
| serviceAccountName: nginx-ingress-{{ juju_application }}-serviceaccount |
| containers: |
| - image: {{ ingress_image }} |
| name: nginx-ingress-{{ juju_application }} |
| livenessProbe: |
| httpGet: |
| path: /healthz |
| port: 10254 |
| scheme: HTTP |
| initialDelaySeconds: 30 |
| timeoutSeconds: 5 |
| # use downward API |
| env: |
| - name: POD_NAME |
| valueFrom: |
| fieldRef: |
| fieldPath: metadata.name |
| - name: POD_NAMESPACE |
| valueFrom: |
| fieldRef: |
| fieldPath: metadata.namespace |
| ports: |
| - containerPort: 80 |
| - containerPort: 443 |
| args: |
| - /nginx-ingress-controller |
| - --default-backend-service=$(POD_NAMESPACE)/default-http-backend |
| - --configmap=$(POD_NAMESPACE)/nginx-load-balancer-conf |
| - --enable-ssl-chain-completion={{ ssl_chain_completion }} |