1. apiVersion: v1
    2. kind: Namespace
    3. metadata:
    4.   name: ingress-nginx
    5.   labels:
    6.     app.kubernetes.io/name: ingress-nginx
    7.     app.kubernetes.io/instance: ingress-nginx
    9. ---
    10. # Source: ingress-nginx/templates/controller-serviceaccount.yaml
    11. apiVersion: v1
    12. kind: ServiceAccount
    13. metadata:
    14.   labels:
    15.     helm.sh/chart: ingress-nginx-2.11.1
    16.     app.kubernetes.io/name: ingress-nginx
    17.     app.kubernetes.io/instance: ingress-nginx
    18.     app.kubernetes.io/version: 0.34.1
    19.     app.kubernetes.io/managed-by: Helm
    20.     app.kubernetes.io/component: controller
    21.   name: ingress-nginx
    22.   namespace: ingress-nginx
    23. ---
    24. # Source: ingress-nginx/templates/controller-configmap.yaml
    25. apiVersion: v1
    26. kind: ConfigMap
    27. metadata:
    28.   labels:
    29.     helm.sh/chart: ingress-nginx-2.11.1
    30.     app.kubernetes.io/name: ingress-nginx
    31.     app.kubernetes.io/instance: ingress-nginx
    32.     app.kubernetes.io/version: 0.34.1
    33.     app.kubernetes.io/managed-by: Helm
    34.     app.kubernetes.io/component: controller
    35.   name: ingress-nginx-controller
    36.   namespace: ingress-nginx
    37. data:
    38. ---
    39. # Source: ingress-nginx/templates/clusterrole.yaml
    40. apiVersion: rbac.authorization.k8s.io/v1
    41. kind: ClusterRole
    42. metadata:
    43.   labels:
    44.     helm.sh/chart: ingress-nginx-2.11.1
    45.     app.kubernetes.io/name: ingress-nginx
    46.     app.kubernetes.io/instance: ingress-nginx
    47.     app.kubernetes.io/version: 0.34.1
    48.     app.kubernetes.io/managed-by: Helm
    49.   name: ingress-nginx
    50.   namespace: ingress-nginx
    51. rules:
    52.   - apiGroups:
    53.       - ''
    54.     resources:
    55.       - configmaps
    56.       - endpoints
    57.       - nodes
    58.       - pods
    59.       - secrets
    60.     verbs:
    61.       - list
    62.       - watch
    63.   - apiGroups:
    64.       - ''
    65.     resources:
    66.       - nodes
    67.     verbs:
    68.       - get
    69.   - apiGroups:
    70.       - ''
    71.     resources:
    72.       - services
    73.     verbs:
    74.       - get
    75.       - list
    76.       - update
    77.       - watch
    78.   - apiGroups:
    79.       - extensions
    80.       - networking.k8s.io   # k8s 1.14+
    81.     resources:
    82.       - ingresses
    83.     verbs:
    84.       - get
    85.       - list
    86.       - watch
    87.   - apiGroups:
    88.       - ''
    89.     resources:
    90.       - events
    91.     verbs:
    92.       - create
    93.       - patch
    94.   - apiGroups:
    95.       - extensions
    96.       - networking.k8s.io   # k8s 1.14+
    97.     resources:
    98.       - ingresses/status
    99.     verbs:
    100.       - update
    101.   - apiGroups:
    102.       - networking.k8s.io   # k8s 1.14+
    103.     resources:
    104.       - ingressclasses
    105.     verbs:
    106.       - get
    107.       - list
    108.       - watch
    109. ---
    110. # Source: ingress-nginx/templates/clusterrolebinding.yaml
    111. apiVersion: rbac.authorization.k8s.io/v1
    112. kind: ClusterRoleBinding
    113. metadata:
    114.   labels:
    115.     helm.sh/chart: ingress-nginx-2.11.1
    116.     app.kubernetes.io/name: ingress-nginx
    117.     app.kubernetes.io/instance: ingress-nginx
    118.     app.kubernetes.io/version: 0.34.1
    119.     app.kubernetes.io/managed-by: Helm
    120.   name: ingress-nginx
    121.   namespace: ingress-nginx
    122. roleRef:
    123.   apiGroup: rbac.authorization.k8s.io
    124.   kind: ClusterRole
    125.   name: ingress-nginx
    126. subjects:
    127.   - kind: ServiceAccount
    128.     name: ingress-nginx
    129.     namespace: ingress-nginx
    130. ---
    131. # Source: ingress-nginx/templates/controller-role.yaml
    132. apiVersion: rbac.authorization.k8s.io/v1
    133. kind: Role
    134. metadata:
    135.   labels:
    136.     helm.sh/chart: ingress-nginx-2.11.1
    137.     app.kubernetes.io/name: ingress-nginx
    138.     app.kubernetes.io/instance: ingress-nginx
    139.     app.kubernetes.io/version: 0.34.1
    140.     app.kubernetes.io/managed-by: Helm
    141.     app.kubernetes.io/component: controller
    142.   name: ingress-nginx
    143.   namespace: ingress-nginx
    144. rules:
    145.   - apiGroups:
    146.       - ''
    147.     resources:
    148.       - namespaces
    149.     verbs:
    150.       - get
    151.   - apiGroups:
    152.       - ''
    153.     resources:
    154.       - configmaps
    155.       - pods
    156.       - secrets
    157.       - endpoints
    158.     verbs:
    159.       - get
    160.       - list
    161.       - watch
    162.   - apiGroups:
    163.       - ''
    164.     resources:
    165.       - services
    166.     verbs:
    167.       - get
    168.       - list
    169.       - update
    170.       - watch
    171.   - apiGroups:
    172.       - extensions
    173.       - networking.k8s.io   # k8s 1.14+
    174.     resources:
    175.       - ingresses
    176.     verbs:
    177.       - get
    178.       - list
    179.       - watch
    180.   - apiGroups:
    181.       - extensions
    182.       - networking.k8s.io   # k8s 1.14+
    183.     resources:
    184.       - ingresses/status
    185.     verbs:
    186.       - update
    187.   - apiGroups:
    188.       - networking.k8s.io   # k8s 1.14+
    189.     resources:
    190.       - ingressclasses
    191.     verbs:
    192.       - get
    193.       - list
    194.       - watch
    195.   - apiGroups:
    196.       - ''
    197.     resources:
    198.       - configmaps
    199.     resourceNames:
    200.       - ingress-controller-leader-nginx
    201.     verbs:
    202.       - get
    203.       - update
    204.   - apiGroups:
    205.       - ''
    206.     resources:
    207.       - configmaps
    208.     verbs:
    209.       - create
    210.   - apiGroups:
    211.       - ''
    212.     resources:
    213.       - endpoints
    214.     verbs:
    215.       - create
    216.       - get
    217.       - update
    218.   - apiGroups:
    219.       - ''
    220.     resources:
    221.       - events
    222.     verbs:
    223.       - create
    224.       - patch
    225. ---
    226. # Source: ingress-nginx/templates/controller-rolebinding.yaml
    227. apiVersion: rbac.authorization.k8s.io/v1
    228. kind: RoleBinding
    229. metadata:
    230.   labels:
    231.     helm.sh/chart: ingress-nginx-2.11.1
    232.     app.kubernetes.io/name: ingress-nginx
    233.     app.kubernetes.io/instance: ingress-nginx
    234.     app.kubernetes.io/version: 0.34.1
    235.     app.kubernetes.io/managed-by: Helm
    236.     app.kubernetes.io/component: controller
    237.   name: ingress-nginx
    238.   namespace: ingress-nginx
    239. roleRef:
    240.   apiGroup: rbac.authorization.k8s.io
    241.   kind: Role
    242.   name: ingress-nginx
    243. subjects:
    244.   - kind: ServiceAccount
    245.     name: ingress-nginx
    246.     namespace: ingress-nginx
    247. ---
    248. # Source: ingress-nginx/templates/controller-service-webhook.yaml
    249. apiVersion: v1
    250. kind: Service
    251. metadata:
    252.   labels:
    253.     helm.sh/chart: ingress-nginx-2.11.1
    254.     app.kubernetes.io/name: ingress-nginx
    255.     app.kubernetes.io/instance: ingress-nginx
    256.     app.kubernetes.io/version: 0.34.1
    257.     app.kubernetes.io/managed-by: Helm
    258.     app.kubernetes.io/component: controller
    259.   name: ingress-nginx-controller-admission
    260.   namespace: ingress-nginx
    261. spec:
    262.   type: ClusterIP
    263.   ports:
    264.     - name: https-webhook
    265.       port: 443
    266.       targetPort: webhook
    267.   selector:
    268.     app.kubernetes.io/name: ingress-nginx
    269.     app.kubernetes.io/instance: ingress-nginx
    270.     app.kubernetes.io/component: controller
    271. ---
    272. # Source: ingress-nginx/templates/controller-service.yaml
    273. apiVersion: v1
    274. kind: Service
    275. metadata:
    276.   labels:
    277.     helm.sh/chart: ingress-nginx-2.11.1
    278.     app.kubernetes.io/name: ingress-nginx
    279.     app.kubernetes.io/instance: ingress-nginx
    280.     app.kubernetes.io/version: 0.34.1
    281.     app.kubernetes.io/managed-by: Helm
    282.     app.kubernetes.io/component: controller
    283.   name: ingress-nginx-controller
    284.   namespace: ingress-nginx
    285. spec:
    286.   type: NodePort
    287.   ports:
    288.     - name: http
    289.       port: 80
    290.       protocol: TCP
    291.       targetPort: http
    292.     - name: https
    293.       port: 443
    294.       protocol: TCP
    295.       targetPort: https
    296.   selector:
    297.     app.kubernetes.io/name: ingress-nginx
    298.     app.kubernetes.io/instance: ingress-nginx
    299.     app.kubernetes.io/component: controller
    300. ---
    301. # Source: ingress-nginx/templates/controller-deployment.yaml
    302. apiVersion: apps/v1
    303. kind: Deployment
    304. metadata:
    305.   labels:
    306.     helm.sh/chart: ingress-nginx-2.11.1
    307.     app.kubernetes.io/name: ingress-nginx
    308.     app.kubernetes.io/instance: ingress-nginx
    309.     app.kubernetes.io/version: 0.34.1
    310.     app.kubernetes.io/managed-by: Helm
    311.     app.kubernetes.io/component: controller
    312.   name: ingress-nginx-controller
    313.   namespace: ingress-nginx
    314. spec:
    315.   selector:
    316.     matchLabels:
    317.       app.kubernetes.io/name: ingress-nginx
    318.       app.kubernetes.io/instance: ingress-nginx
    319.       app.kubernetes.io/component: controller
    320.   revisionHistoryLimit: 10
    321.   minReadySeconds: 0
    322.   template:
    323.     metadata:
    324.       labels:
    325.         app.kubernetes.io/name: ingress-nginx
    326.         app.kubernetes.io/instance: ingress-nginx
    327.         app.kubernetes.io/component: controller
    328.     spec:
    329.       dnsPolicy: ClusterFirst
    330.       containers:
    331.         - name: controller
    332.           image: quay.mirrors.ustc.edu.cn/kubernetes-ingress-controller/nginx-ingress-controller:0.33.0
    333.           imagePullPolicy: IfNotPresent
    334.           lifecycle:
    335.             preStop:
    336.               exec:
    337.                 command:
    338.                   - /wait-shutdown
    339.           args:
    340.             - /nginx-ingress-controller
    341.             - --election-id=ingress-controller-leader
    342.             - --ingress-class=nginx
    343.             - --configmap=ingress-nginx/ingress-nginx-controller
    344.             - --validating-webhook=:8443
    345.             - --validating-webhook-certificate=/usr/local/certificates/cert
    346.             - --validating-webhook-key=/usr/local/certificates/key
    347.           securityContext:
    348.             capabilities:
    349.               drop:
    350.                 - ALL
    351.               add:
    352.                 - NET_BIND_SERVICE
    353.             runAsUser: 101
    354.             allowPrivilegeEscalation: true
    355.           env:
    356.             - name: POD_NAME
    357.               valueFrom:
    358.                 fieldRef:
    359.                   fieldPath: metadata.name
    360.             - name: POD_NAMESPACE
    361.               valueFrom:
    362.                 fieldRef:
    363.                   fieldPath: metadata.namespace
    364.           livenessProbe:
    365.             httpGet:
    366.               path: /healthz
    367.               port: 10254
    368.               scheme: HTTP
    369.             initialDelaySeconds: 10
    370.             periodSeconds: 10
    371.             timeoutSeconds: 1
    372.             successThreshold: 1
    373.             failureThreshold: 5
    374.           readinessProbe:
    375.             httpGet:
    376.               path: /healthz
    377.               port: 10254
    378.               scheme: HTTP
    379.             initialDelaySeconds: 10
    380.             periodSeconds: 10
    381.             timeoutSeconds: 1
    382.             successThreshold: 1
    383.             failureThreshold: 3
    384.           ports:
    385.             - name: http
    386.               containerPort: 80
    387.               protocol: TCP
    388.             - name: https
    389.               containerPort: 443
    390.               protocol: TCP
    391.             - name: webhook
    392.               containerPort: 8443
    393.               protocol: TCP
    394.           volumeMounts:
    395.             - name: webhook-cert
    396.               mountPath: /usr/local/certificates/
    397.               readOnly: true
    398.           resources:
    399.             requests:
    400.               cpu: 100m
    401.               memory: 90Mi
    402.       serviceAccountName: ingress-nginx
    403.       terminationGracePeriodSeconds: 300
    404.       volumes:
    405.         - name: webhook-cert
    406.           secret:
    407.             secretName: ingress-nginx-admission
    408. ---
    409. # Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
    410. # before changing this value, check the required kubernetes version
    411. # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
    412. apiVersion: admissionregistration.k8s.io/v1
    413. kind: ValidatingWebhookConfiguration
    414. metadata:
    415.   labels:
    416.     helm.sh/chart: ingress-nginx-2.11.1
    417.     app.kubernetes.io/name: ingress-nginx
    418.     app.kubernetes.io/instance: ingress-nginx
    419.     app.kubernetes.io/version: 0.34.1
    420.     app.kubernetes.io/managed-by: Helm
    421.     app.kubernetes.io/component: admission-webhook
    422.   name: ingress-nginx-admission
    423.   namespace: ingress-nginx
    424. webhooks:
    425.   - name: validate.nginx.ingress.kubernetes.io
    426.     rules:
    427.       - apiGroups:
    428.           - extensions
    429.           - networking.k8s.io
    430.         apiVersions:
    431.           - v1beta1
    432.         operations:
    433.           - CREATE
    434.           - UPDATE
    435.         resources:
    436.           - ingresses
    437.     failurePolicy: Fail
    438.     sideEffects: None
    439.     admissionReviewVersions:
    440.       - v1
    441.       - v1beta1
    442.     clientConfig:
    443.       service:
    444.         namespace: ingress-nginx
    445.         name: ingress-nginx-controller-admission
    446.         path: /extensions/v1beta1/ingresses
    447. ---
    448. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml
    449. apiVersion: rbac.authorization.k8s.io/v1
    450. kind: ClusterRole
    451. metadata:
    452.   name: ingress-nginx-admission
    453.   annotations:
    454.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    455.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    456.   labels:
    457.     helm.sh/chart: ingress-nginx-2.11.1
    458.     app.kubernetes.io/name: ingress-nginx
    459.     app.kubernetes.io/instance: ingress-nginx
    460.     app.kubernetes.io/version: 0.34.1
    461.     app.kubernetes.io/managed-by: Helm
    462.     app.kubernetes.io/component: admission-webhook
    463.   namespace: ingress-nginx
    464. rules:
    465.   - apiGroups:
    466.       - admissionregistration.k8s.io
    467.     resources:
    468.       - validatingwebhookconfigurations
    469.     verbs:
    470.       - get
    471.       - update
    472. ---
    473. # Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
    474. apiVersion: rbac.authorization.k8s.io/v1
    475. kind: ClusterRoleBinding
    476. metadata:
    477.   name: ingress-nginx-admission
    478.   annotations:
    479.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    480.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    481.   labels:
    482.     helm.sh/chart: ingress-nginx-2.11.1
    483.     app.kubernetes.io/name: ingress-nginx
    484.     app.kubernetes.io/instance: ingress-nginx
    485.     app.kubernetes.io/version: 0.34.1
    486.     app.kubernetes.io/managed-by: Helm
    487.     app.kubernetes.io/component: admission-webhook
    488.   namespace: ingress-nginx
    489. roleRef:
    490.   apiGroup: rbac.authorization.k8s.io
    491.   kind: ClusterRole
    492.   name: ingress-nginx-admission
    493. subjects:
    494.   - kind: ServiceAccount
    495.     name: ingress-nginx-admission
    496.     namespace: ingress-nginx
    497. ---
    498. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
    499. apiVersion: batch/v1
    500. kind: Job
    501. metadata:
    502.   name: ingress-nginx-admission-create
    503.   annotations:
    504.     helm.sh/hook: pre-install,pre-upgrade
    505.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    506.   labels:
    507.     helm.sh/chart: ingress-nginx-2.11.1
    508.     app.kubernetes.io/name: ingress-nginx
    509.     app.kubernetes.io/instance: ingress-nginx
    510.     app.kubernetes.io/version: 0.34.1
    511.     app.kubernetes.io/managed-by: Helm
    512.     app.kubernetes.io/component: admission-webhook
    513.   namespace: ingress-nginx
    514. spec:
    515.   template:
    516.     metadata:
    517.       name: ingress-nginx-admission-create
    518.       labels:
    519.         helm.sh/chart: ingress-nginx-2.11.1
    520.         app.kubernetes.io/name: ingress-nginx
    521.         app.kubernetes.io/instance: ingress-nginx
    522.         app.kubernetes.io/version: 0.34.1
    523.         app.kubernetes.io/managed-by: Helm
    524.         app.kubernetes.io/component: admission-webhook
    525.     spec:
    526.       containers:
    527.         - name: create
    528.           image: docker.io/jettech/kube-webhook-certgen:v1.2.2
    529.           imagePullPolicy: IfNotPresent
    530.           args:
    531.             - create
    532.             - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.ingress-nginx.svc
    533.             - --namespace=ingress-nginx
    534.             - --secret-name=ingress-nginx-admission
    535.       restartPolicy: OnFailure
    536.       serviceAccountName: ingress-nginx-admission
    537.       securityContext:
    538.         runAsNonRoot: true
    539.         runAsUser: 2000
    540. ---
    541. # Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
    542. apiVersion: batch/v1
    543. kind: Job
    544. metadata:
    545.   name: ingress-nginx-admission-patch
    546.   annotations:
    547.     helm.sh/hook: post-install,post-upgrade
    548.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    549.   labels:
    550.     helm.sh/chart: ingress-nginx-2.11.1
    551.     app.kubernetes.io/name: ingress-nginx
    552.     app.kubernetes.io/instance: ingress-nginx
    553.     app.kubernetes.io/version: 0.34.1
    554.     app.kubernetes.io/managed-by: Helm
    555.     app.kubernetes.io/component: admission-webhook
    556.   namespace: ingress-nginx
    557. spec:
    558.   template:
    559.     metadata:
    560.       name: ingress-nginx-admission-patch
    561.       labels:
    562.         helm.sh/chart: ingress-nginx-2.11.1
    563.         app.kubernetes.io/name: ingress-nginx
    564.         app.kubernetes.io/instance: ingress-nginx
    565.         app.kubernetes.io/version: 0.34.1
    566.         app.kubernetes.io/managed-by: Helm
    567.         app.kubernetes.io/component: admission-webhook
    568.     spec:
    569.       containers:
    570.         - name: patch
    571.           image: docker.io/jettech/kube-webhook-certgen:v1.2.2
    572.           imagePullPolicy: IfNotPresent
    573.           args:
    574.             - patch
    575.             - --webhook-name=ingress-nginx-admission
    576.             - --namespace=ingress-nginx
    577.             - --patch-mutating=false
    578.             - --secret-name=ingress-nginx-admission
    579.             - --patch-failure-policy=Fail
    580.       restartPolicy: OnFailure
    581.       serviceAccountName: ingress-nginx-admission
    582.       securityContext:
    583.         runAsNonRoot: true
    584.         runAsUser: 2000
    585. ---
    586. # Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
    587. apiVersion: rbac.authorization.k8s.io/v1
    588. kind: Role
    589. metadata:
    590.   name: ingress-nginx-admission
    591.   annotations:
    592.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    593.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    594.   labels:
    595.     helm.sh/chart: ingress-nginx-2.11.1
    596.     app.kubernetes.io/name: ingress-nginx
    597.     app.kubernetes.io/instance: ingress-nginx
    598.     app.kubernetes.io/version: 0.34.1
    599.     app.kubernetes.io/managed-by: Helm
    600.     app.kubernetes.io/component: admission-webhook
    601.   namespace: ingress-nginx
    602. rules:
    603.   - apiGroups:
    604.       - ''
    605.     resources:
    606.       - secrets
    607.     verbs:
    608.       - get
    609.       - create
    610. ---
    611. # Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
    612. apiVersion: rbac.authorization.k8s.io/v1
    613. kind: RoleBinding
    614. metadata:
    615.   name: ingress-nginx-admission
    616.   annotations:
    617.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    618.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    619.   labels:
    620.     helm.sh/chart: ingress-nginx-2.11.1
    621.     app.kubernetes.io/name: ingress-nginx
    622.     app.kubernetes.io/instance: ingress-nginx
    623.     app.kubernetes.io/version: 0.34.1
    624.     app.kubernetes.io/managed-by: Helm
    625.     app.kubernetes.io/component: admission-webhook
    626.   namespace: ingress-nginx
    627. roleRef:
    628.   apiGroup: rbac.authorization.k8s.io
    629.   kind: Role
    630.   name: ingress-nginx-admission
    631. subjects:
    632.   - kind: ServiceAccount
    633.     name: ingress-nginx-admission
    634.     namespace: ingress-nginx
    635. ---
    636. # Source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml
    637. apiVersion: v1
    638. kind: ServiceAccount
    639. metadata:
    640.   name: ingress-nginx-admission
    641.   annotations:
    642.     helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
    643.     helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
    644.   labels:
    645.     helm.sh/chart: ingress-nginx-2.11.1
    646.     app.kubernetes.io/name: ingress-nginx
    647.     app.kubernetes.io/instance: ingress-nginx
    648.     app.kubernetes.io/version: 0.34.1
    649.     app.kubernetes.io/managed-by: Helm
    650.     app.kubernetes.io/component: admission-webhook
    651.   namespace: ingress-nginx