Skip to content

Commit 244391d

Browse files
ciarams87ciarams87
committed
Add conditional to RBAC and generate new manifests
1 parent 949c08e commit 244391d

File tree

8 files changed

+617
-29
lines changed

8 files changed

+617
-29
lines changed

‎Makefile

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -81,18 +81,17 @@ generate-crds: ## Generate CRDs and Go types using kubebuilder
8181
go run sigs.k8s.io/controller-tools/cmd/controller-gen object paths=./apis/...
8282

8383
.PHONY: generate-manifests
84-
generate-manifests: generate-manifests-plus ## Generate manifests using Helm.
84+
generate-manifests: ## Generate manifests using Helm.
8585
cp $(CHART_DIR)/crds/* $(MANIFEST_DIR)/crds/
8686
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-gateway.yaml
87+
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginx.plus=true --set nginx.image.repository=$(NGINX_PLUS_PREFIX) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-plus-gateway.yaml
88+
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginxGateway.gwAPIExperimentalFeatures.enable=true -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-gateway-experimental.yaml
89+
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginxGateway.gwAPIExperimentalFeatures.enable=true --set nginx.plus=true --set nginx.image.repository=$(NGINX_PLUS_PREFIX) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-plus-gateway-experimental.yaml
8790
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set metrics.enable=false -n nginx-gateway -s templates/deployment.yaml > conformance/provisioner/static-deployment.yaml
8891
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/loadbalancer.yaml
8992
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set service.annotations.'service\.beta\.kubernetes\.io\/aws-load-balancer-type'="nlb" -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/loadbalancer-aws-nlb.yaml
9093
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) --set service.type=NodePort --set service.externalTrafficPolicy="" -n nginx-gateway -s templates/service.yaml > $(strip $(MANIFEST_DIR))/service/nodeport.yaml
9194

92-
.PHONY: generate-manifests-plus
93-
generate-manifests-plus: ## Generate manifests using Helm for NGINX Plus.
94-
helm template nginx-gateway $(CHART_DIR) $(HELM_TEMPLATE_COMMON_ARGS) $(HELM_TEMPLATE_EXTRA_ARGS_FOR_ALL_MANIFESTS_FILE) --set nginx.plus=true --set nginx.image.repository=$(NGINX_PLUS_PREFIX) -n nginx-gateway | cat $(strip $(MANIFEST_DIR))/namespace.yaml - > $(strip $(MANIFEST_DIR))/nginx-plus-gateway.yaml
95-
9695
.PHONY: crds-release-file
9796
crds-release-file: ## Generate combined crds file for releases
9897
scripts/combine-crds.sh

‎deploy/helm-chart/templates/rbac.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,9 @@ rules:
3232
- namespaces
3333
- services
3434
- secrets
35+
{{- if .Values.nginxGateway.gwAPIExperimentalFeatures.enable }}
3536
- configmaps
37+
{{- end }}
3638
verbs:
3739
- list
3840
- watch
@@ -77,7 +79,9 @@ rules:
7779
- gateways
7880
- httproutes
7981
- referencegrants
82+
{{- if .Values.nginxGateway.gwAPIExperimentalFeatures.enable }}
8083
- backendtlspolicies
84+
{{- end }}
8185
verbs:
8286
- list
8387
- watch
@@ -87,7 +91,9 @@ rules:
8791
- httproutes/status
8892
- gateways/status
8993
- gatewayclasses/status
94+
{{- if .Values.nginxGateway.gwAPIExperimentalFeatures.enable }}
9095
- backendtlspolicies/status
96+
{{- end }}
9197
verbs:
9298
- update
9399
- apiGroups:

‎deploy/manifests/nginx-gateway-experimental.yaml

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: nginx-gateway
5+
---
6+
# Source: nginx-gateway-fabric/templates/rbac.yaml
7+
apiVersion: v1
8+
kind: ServiceAccount
9+
metadata:
10+
name: nginx-gateway
11+
namespace: nginx-gateway
12+
labels:
13+
app.kubernetes.io/name: nginx-gateway
14+
app.kubernetes.io/instance: nginx-gateway
15+
app.kubernetes.io/version: "edge"
16+
annotations:
17+
{}
18+
---
19+
# Source: nginx-gateway-fabric/templates/rbac.yaml
20+
apiVersion: rbac.authorization.k8s.io/v1
21+
kind: ClusterRole
22+
metadata:
23+
name: nginx-gateway
24+
labels:
25+
app.kubernetes.io/name: nginx-gateway
26+
app.kubernetes.io/instance: nginx-gateway
27+
app.kubernetes.io/version: "edge"
28+
rules:
29+
- apiGroups:
30+
- ""
31+
resources:
32+
- namespaces
33+
- services
34+
- secrets
35+
- configmaps
36+
verbs:
37+
- list
38+
- watch
39+
# FIXME(bjee19): make nodes, pods, replicasets permission dependent on telemetry being enabled.
40+
# https://github.com/nginxinc/nginx-gateway-fabric/issues/1317.
41+
- apiGroups:
42+
- ""
43+
resources:
44+
- pods
45+
verbs:
46+
- get
47+
- apiGroups:
48+
- ""
49+
resources:
50+
- nodes
51+
verbs:
52+
- list
53+
- apiGroups:
54+
- ""
55+
resources:
56+
- events
57+
verbs:
58+
- create
59+
- patch
60+
- apiGroups:
61+
- apps
62+
resources:
63+
- replicasets
64+
verbs:
65+
- get
66+
- apiGroups:
67+
- discovery.k8s.io
68+
resources:
69+
- endpointslices
70+
verbs:
71+
- list
72+
- watch
73+
- apiGroups:
74+
- gateway.networking.k8s.io
75+
resources:
76+
- gatewayclasses
77+
- gateways
78+
- httproutes
79+
- referencegrants
80+
- backendtlspolicies
81+
verbs:
82+
- list
83+
- watch
84+
- apiGroups:
85+
- gateway.networking.k8s.io
86+
resources:
87+
- httproutes/status
88+
- gateways/status
89+
- gatewayclasses/status
90+
- backendtlspolicies/status
91+
verbs:
92+
- update
93+
- apiGroups:
94+
- gateway.nginx.org
95+
resources:
96+
- nginxgateways
97+
verbs:
98+
- get
99+
- list
100+
- watch
101+
- apiGroups:
102+
- gateway.nginx.org
103+
resources:
104+
- nginxgateways/status
105+
verbs:
106+
- update
107+
- apiGroups:
108+
- coordination.k8s.io
109+
resources:
110+
- leases
111+
verbs:
112+
- create
113+
- get
114+
- update
115+
- apiGroups:
116+
- apiextensions.k8s.io
117+
resources:
118+
- customresourcedefinitions
119+
verbs:
120+
- list
121+
- watch
122+
---
123+
# Source: nginx-gateway-fabric/templates/rbac.yaml
124+
apiVersion: rbac.authorization.k8s.io/v1
125+
kind: ClusterRoleBinding
126+
metadata:
127+
name: nginx-gateway
128+
labels:
129+
app.kubernetes.io/name: nginx-gateway
130+
app.kubernetes.io/instance: nginx-gateway
131+
app.kubernetes.io/version: "edge"
132+
roleRef:
133+
apiGroup: rbac.authorization.k8s.io
134+
kind: ClusterRole
135+
name: nginx-gateway
136+
subjects:
137+
- kind: ServiceAccount
138+
name: nginx-gateway
139+
namespace: nginx-gateway
140+
---
141+
# Source: nginx-gateway-fabric/templates/deployment.yaml
142+
apiVersion: apps/v1
143+
kind: Deployment
144+
metadata:
145+
name: nginx-gateway
146+
namespace: nginx-gateway
147+
labels:
148+
app.kubernetes.io/name: nginx-gateway
149+
app.kubernetes.io/instance: nginx-gateway
150+
app.kubernetes.io/version: "edge"
151+
spec:
152+
replicas: 1
153+
selector:
154+
matchLabels:
155+
app.kubernetes.io/name: nginx-gateway
156+
app.kubernetes.io/instance: nginx-gateway
157+
template:
158+
metadata:
159+
labels:
160+
app.kubernetes.io/name: nginx-gateway
161+
app.kubernetes.io/instance: nginx-gateway
162+
annotations:
163+
prometheus.io/scrape: "true"
164+
prometheus.io/port: "9113"
165+
spec:
166+
containers:
167+
- args:
168+
- static-mode
169+
- --gateway-ctlr-name=gateway.nginx.org/nginx-gateway-controller
170+
- --gatewayclass=nginx
171+
- --config=nginx-gateway-config
172+
- --service=nginx-gateway
173+
- --metrics-port=9113
174+
- --health-port=8081
175+
- --leader-election-lock-name=nginx-gateway-leader-election
176+
- --gateway-api-experimental-features
177+
env:
178+
- name: POD_IP
179+
valueFrom:
180+
fieldRef:
181+
fieldPath: status.podIP
182+
- name: POD_NAMESPACE
183+
valueFrom:
184+
fieldRef:
185+
fieldPath: metadata.namespace
186+
- name: POD_NAME
187+
valueFrom:
188+
fieldRef:
189+
fieldPath: metadata.name
190+
image: ghcr.io/nginxinc/nginx-gateway-fabric:edge
191+
imagePullPolicy: Always
192+
name: nginx-gateway
193+
ports:
194+
- name: metrics
195+
containerPort: 9113
196+
- name: health
197+
containerPort: 8081
198+
readinessProbe:
199+
httpGet:
200+
path: /readyz
201+
port: health
202+
initialDelaySeconds: 3
203+
periodSeconds: 1
204+
securityContext:
205+
allowPrivilegeEscalation: false
206+
capabilities:
207+
add:
208+
- KILL
209+
drop:
210+
- ALL
211+
readOnlyRootFilesystem: true
212+
runAsUser: 102
213+
runAsGroup: 1001
214+
volumeMounts:
215+
- name: nginx-conf
216+
mountPath: /etc/nginx/conf.d
217+
- name: nginx-secrets
218+
mountPath: /etc/nginx/secrets
219+
- name: nginx-run
220+
mountPath: /var/run/nginx
221+
- image: ghcr.io/nginxinc/nginx-gateway-fabric/nginx:edge
222+
imagePullPolicy: Always
223+
name: nginx
224+
ports:
225+
- containerPort: 80
226+
name: http
227+
- containerPort: 443
228+
name: https
229+
securityContext:
230+
capabilities:
231+
add:
232+
- NET_BIND_SERVICE
233+
drop:
234+
- ALL
235+
readOnlyRootFilesystem: true
236+
runAsUser: 101
237+
runAsGroup: 1001
238+
volumeMounts:
239+
- name: nginx-conf
240+
mountPath: /etc/nginx/conf.d
241+
- name: nginx-secrets
242+
mountPath: /etc/nginx/secrets
243+
- name: nginx-run
244+
mountPath: /var/run/nginx
245+
- name: nginx-cache
246+
mountPath: /var/cache/nginx
247+
- name: nginx-lib
248+
mountPath: /var/lib/nginx
249+
terminationGracePeriodSeconds: 30
250+
serviceAccountName: nginx-gateway
251+
shareProcessNamespace: true
252+
securityContext:
253+
fsGroup: 1001
254+
runAsNonRoot: true
255+
volumes:
256+
- name: nginx-conf
257+
emptyDir: {}
258+
- name: nginx-secrets
259+
emptyDir: {}
260+
- name: nginx-run
261+
emptyDir: {}
262+
- name: nginx-cache
263+
emptyDir: {}
264+
- name: nginx-lib
265+
emptyDir: {}
266+
---
267+
# Source: nginx-gateway-fabric/templates/gatewayclass.yaml
268+
apiVersion: gateway.networking.k8s.io/v1
269+
kind: GatewayClass
270+
metadata:
271+
name: nginx
272+
labels:
273+
app.kubernetes.io/name: nginx-gateway
274+
app.kubernetes.io/instance: nginx-gateway
275+
app.kubernetes.io/version: "edge"
276+
spec:
277+
controllerName: gateway.nginx.org/nginx-gateway-controller
278+
---
279+
# Source: nginx-gateway-fabric/templates/nginxgateway.yaml
280+
apiVersion: gateway.nginx.org/v1alpha1
281+
kind: NginxGateway
282+
metadata:
283+
name: nginx-gateway-config
284+
namespace: nginx-gateway
285+
labels:
286+
app.kubernetes.io/name: nginx-gateway
287+
app.kubernetes.io/instance: nginx-gateway
288+
app.kubernetes.io/version: "edge"
289+
spec:
290+
logging:
291+
level: info

‎deploy/manifests/nginx-gateway.yaml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ rules:
3232
- namespaces
3333
- services
3434
- secrets
35-
- configmaps
3635
verbs:
3736
- list
3837
- watch
@@ -77,7 +76,6 @@ rules:
7776
- gateways
7877
- httproutes
7978
- referencegrants
80-
- backendtlspolicies
8179
verbs:
8280
- list
8381
- watch
@@ -87,7 +85,6 @@ rules:
8785
- httproutes/status
8886
- gateways/status
8987
- gatewayclasses/status
90-
- backendtlspolicies/status
9188
verbs:
9289
- update
9390
- apiGroups:

0 commit comments

Comments
 (0)