added repo
This commit is contained in:
Your Name
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,6 @@
|
||||
apiVersion: v2
|
||||
appVersion: 2.0.1
|
||||
description: Deepfence Router - Helm chart for Kubernetes
|
||||
name: deepfence-router
|
||||
type: application
|
||||
version: 2.0.1
|
||||
@@ -0,0 +1,109 @@
|
||||
# Helm chart for Deepfence Console - Router Service
|
||||
|
||||
- [Install deepfence-router helm chart](#install-deepfence-router-helm-chart)
|
||||
- [Delete deepfence-router helm chart](#delete-deepfence-router-helm-chart)
|
||||
|
||||
### Install deepfence-router helm chart
|
||||
**Quick start**
|
||||
|
||||
```bash
|
||||
helm install deepfence-router deepfence-router
|
||||
```
|
||||
|
||||
**Detailed setup**
|
||||
|
||||
- Create values file
|
||||
```bash
|
||||
helm show values deepfence-router > deepfence_router_values.yaml
|
||||
```
|
||||
- Set cloud provider
|
||||
```yaml
|
||||
# Cloud Provider: aws, azure, gcp, ibm_cloud, open_stack
|
||||
# cloudProvider is required to set appropriate LoadBalancer annotations
|
||||
cloudProvider: "aws"
|
||||
```
|
||||
- Set management console port (default: 443)
|
||||
```yaml
|
||||
# Configure port for browser / agents
|
||||
managementConsolePort: "443"
|
||||
```
|
||||
- Static IP address is recommended in production. Static public ip should be created in the same region/zone/resource group as the cluster.
|
||||
- AWS:
|
||||
- Use `awsEipAllocations` field. Create same number of elastic ip addresses as the number of subnets.
|
||||
- Azure and Google Cloud:
|
||||
- Use `loadBalancerIP` field.
|
||||
- Self managed kubernetes:
|
||||
- Use `externalIPs`. Details [here](https://kubernetes.io/docs/concepts/services-networking/service/#external-ips).
|
||||
- If ip address is not set, kubernetes (cloud managed) will create an ip address, which will be deleted if helm chart is deleted or if `deepfence-router` service is deleted.
|
||||
|
||||
##### LoadBalancer
|
||||
- By default, LoadBalancer will be `external`
|
||||
- This can be changed to `internal` if all agents can access management console using internal ip address and user has set up ssh tunneling for port 443 from local desktop.
|
||||
```yaml
|
||||
service:
|
||||
name: deepfence-router
|
||||
type: LoadBalancer
|
||||
# Using static ip address for load balancer
|
||||
# - Google Cloud: https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
|
||||
# loadBalancerIP: "1.2.3.4"
|
||||
# - Azure: https://docs.microsoft.com/en-us/azure/aks/static-ip
|
||||
# loadBalancerIP: "1.2.3.4"
|
||||
loadBalancerIP: ""
|
||||
# - AWS: (v1.16+) https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html#kubernetes-1.16
|
||||
# Static ip for NLB: awsEipAllocations: "eipalloc-0123456789abcdefg,eipalloc-0123456789hijklmn"
|
||||
awsEipAllocations: ""
|
||||
# LoadBalancer type: external or internal
|
||||
loadBalancerType: "external"
|
||||
# If loadBalancerType is "external", we recommend setting loadBalancerSourceRanges to the ip address / CIDR ranges
|
||||
# of your laptop's ip or corporate CIDR range. If this is set empty, ports 443 and 80 will be open to the public internet.
|
||||
# Example: ["143.231.0.0/16","210.57.79.18/32"]
|
||||
loadBalancerSourceRanges: []
|
||||
# ACM SSL certificate for AWS Classic LoadBalancer (This cannot be set if awsEipAllocations is set)
|
||||
# https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/
|
||||
# Example: "arn:aws:acm:{region}:{user id}:certificate/{id}"
|
||||
awsLoadBalancerAcmArn: ""
|
||||
# externalIPs: When kubernetes is not cloud managed, add public ip addresses of kubernetes nodes to externalIPs
|
||||
externalIPs: []
|
||||
externalTrafficPolicy: "Cluster"
|
||||
```
|
||||
- Agent service
|
||||
```yaml
|
||||
# User can create separate k8s service for agents if required.
|
||||
# One use case for this is to deploy external load balancer for browser access and internal load balancer for agent communication.
|
||||
createSeparateServiceForAgents: "false"
|
||||
```
|
||||
### Delete deepfence-router helm chart
|
||||
Deepfence router load balancer will get deleted. If static ip was not setup, load balancer ip/dns will be deleted.
|
||||
|
||||
```bash
|
||||
# helm 2
|
||||
helm delete --purge deepfence-router
|
||||
|
||||
# helm 3
|
||||
helm delete deepfence-router
|
||||
```
|
||||
|
||||
### Using Nginx Ingress Controller
|
||||
If using the Nginx Ingress Controller instead, the service type can be specified as `Ingress`.
|
||||
```yaml
|
||||
service:
|
||||
name: deepfence-router
|
||||
type: Ingress
|
||||
...
|
||||
```
|
||||
|
||||
Additionally, the Nginx Ingress Controller needs to be installed as specified [here](https://kubernetes.github.io/ingress-nginx/deploy/) based on the cloud provider.
|
||||
|
||||
For example, you can use either `helm` or `kubectl` commands for installing on AWS.
|
||||
|
||||
Helm Command:
|
||||
```
|
||||
helm upgrade --install ingress-nginx ingress-nginx \
|
||||
--repo https://kubernetes.github.io/ingress-nginx \
|
||||
--namespace ingress-nginx --create-namespace
|
||||
```
|
||||
Kubectl Command:
|
||||
```
|
||||
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.2.0/deploy/static/provider/aws/deploy.yaml
|
||||
```
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
|
||||
kubectl get service -n {{ .Values.namespace }} {{ .Values.service.name }}
|
||||
|
||||
{{- if contains "NodePort" .Values.service.type }}
|
||||
export NODE_PORT=$(kubectl get --namespace {{ .Values.namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ .Values.service.name }})
|
||||
export NODE_IP=$(kubectl get nodes --namespace {{ .Values.namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
|
||||
echo "https://$NODE_IP:$NODE_PORT"
|
||||
{{- else if contains "LoadBalancer" .Values.service.type }}
|
||||
{{- if .Values.service.loadBalancerIP }}
|
||||
echo "https://{{ .Values.service.loadBalancerIP }}"
|
||||
{{- else }}
|
||||
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
|
||||
You can watch the status of by running 'kubectl get --namespace {{ .Values.namespace }} svc -w {{ .Values.service.name }}'
|
||||
export LOAD_BALANCER_IP=$(kubectl get svc --namespace {{ .Values.namespace }} {{ .Values.service.name }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
|
||||
echo "https://$LOAD_BALANCER_IP"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
@@ -0,0 +1,52 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "deepfence-router.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "deepfence-router.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "deepfence-router.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "deepfence-router.labels" -}}
|
||||
helm.sh/chart: {{ include "deepfence-router.chart" . }}
|
||||
{{ include "deepfence-router.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "deepfence-router.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "deepfence-router.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if eq .Values.service.type "Ingress" }}
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: deepfence-router-ingress
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.ingress.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
ingressClassName: {{ required "ingress class name is required" .Values.ingress.class }}
|
||||
rules:
|
||||
- http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: Prefix
|
||||
backend:
|
||||
service:
|
||||
name: {{ .Values.service.name }}
|
||||
port:
|
||||
number: 443
|
||||
{{- with .Values.ingress.host }}
|
||||
host: {{ . }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
{{- if .Values.createSeparateServiceForAgents }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Values.agentService.name }}
|
||||
labels:
|
||||
app: deepfence-router
|
||||
{{- include "deepfence-router.labels" . | nindent 4 }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.agentService.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.agentService.externalIPs }}
|
||||
externalIPs:
|
||||
{{ toYaml .Values.agentService.externalIPs | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.agentService.loadBalancerIP }}
|
||||
loadBalancerIP: "{{ .Values.agentService.loadBalancerIP }}"
|
||||
{{- end }}
|
||||
{{- if .Values.agentService.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{ toYaml .Values.agentService.loadBalancerSourceRanges | indent 4 }}
|
||||
{{- end }}
|
||||
externalTrafficPolicy: "{{ .Values.agentService.externalTrafficPolicy }}"
|
||||
type: {{ .Values.agentService.type }}
|
||||
selector:
|
||||
name: {{ .Values.service.name }}
|
||||
ports:
|
||||
- name: https-port
|
||||
port: {{ required "managementConsolePort is required" .Values.managementConsolePort }}
|
||||
protocol: TCP
|
||||
targetPort: 443
|
||||
- name: http-port
|
||||
port: 80
|
||||
protocol: TCP
|
||||
targetPort: 80
|
||||
{{- end }}
|
||||
@@ -0,0 +1,62 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: {{ .Values.service.name }}
|
||||
labels:
|
||||
app: deepfence-router
|
||||
{{- include "deepfence-router.labels" . | nindent 4 }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.service.annotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
{{- if .Values.service.externalIPs }}
|
||||
externalIPs:
|
||||
{{ toYaml .Values.service.externalIPs | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if .Values.service.loadBalancerIP }}
|
||||
loadBalancerIP: "{{ .Values.service.loadBalancerIP }}"
|
||||
{{- end }}
|
||||
{{- if .Values.service.loadBalancerSourceRanges }}
|
||||
loadBalancerSourceRanges:
|
||||
{{ toYaml .Values.service.loadBalancerSourceRanges | indent 4 }}
|
||||
{{- end }}
|
||||
{{- if eq "LoadBalancer" .Values.service.type }}
|
||||
externalTrafficPolicy: "{{ .Values.service.externalTrafficPolicy }}"
|
||||
{{- end }}
|
||||
{{- if eq "Ingress" .Values.service.type }}
|
||||
type: ClusterIP
|
||||
{{- else }}
|
||||
type: {{ .Values.service.type }}
|
||||
{{- end }}
|
||||
selector:
|
||||
name: {{ .Values.service.name }}
|
||||
ports:
|
||||
- name: https-port
|
||||
port: {{ required "managementConsolePort is required" .Values.managementConsolePort }}
|
||||
protocol: TCP
|
||||
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "Ingress") }}
|
||||
targetPort: 443
|
||||
{{- end }}
|
||||
{{- if eq .Values.service.type "NodePort"}}
|
||||
{{- if .Values.service.nodePortHttps }}
|
||||
nodePort: {{ .Values.service.nodePortHttps }}
|
||||
{{- else }}
|
||||
nodePort: 30007
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
- name: http-port
|
||||
port: 80
|
||||
protocol: TCP
|
||||
{{- if or (eq .Values.service.type "LoadBalancer") (eq .Values.service.type "Ingress") }}
|
||||
targetPort: 80
|
||||
{{- end }}
|
||||
{{- if eq .Values.service.type "NodePort" }}
|
||||
{{- if .Values.service.nodePortHttp }}
|
||||
nodePort: {{ .Values.service.nodePortHttp }}
|
||||
{{- else }}
|
||||
nodePort: 30008
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,173 @@
|
||||
# Default values for deepfence-router.
|
||||
# This is a YAML-formatted file.
|
||||
# Declare variables to be passed into your templates.
|
||||
|
||||
nameOverride: ""
|
||||
fullnameOverride: ""
|
||||
|
||||
# Configure port for browser / agents
|
||||
managementConsolePort: "443"
|
||||
|
||||
service:
|
||||
name: deepfence-console-router
|
||||
# Select the type of service to be used.
|
||||
# When exposing the service in an on premisses Kubernetes cluster, select NodePort as type
|
||||
# Also, possible to use Ingress as type when ingress controller is installed
|
||||
type: LoadBalancer # LoadBalancer/NodePort/Ingress/ClusterIP
|
||||
# NodePort configuration. Only used when the service type is NodePort
|
||||
nodePortHttps: ""
|
||||
nodePortHttp: ""
|
||||
# Using static ip address for load balancer
|
||||
# - Google Cloud: https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
|
||||
# loadBalancerIP: "1.2.3.4"
|
||||
# - Azure: https://docs.microsoft.com/en-us/azure/aks/static-ip
|
||||
# loadBalancerIP: "1.2.3.4"
|
||||
loadBalancerIP: ""
|
||||
# If loadBalancerType is "external", we recommend setting loadBalancerSourceRanges
|
||||
# to the ip address / CIDR ranges of your laptop's ip or corporate CIDR range.
|
||||
# If this is set empty, ports 443 and 80 will be open to the public internet.
|
||||
# Example: ["143.231.0.0/16","210.57.79.18/32"]
|
||||
loadBalancerSourceRanges: []
|
||||
|
||||
# externalIPs: When kubernetes is not cloud managed, add public ip addresses of kubernetes nodes to externalIPs
|
||||
externalIPs: []
|
||||
externalTrafficPolicy: "Cluster"
|
||||
|
||||
annotations:
|
||||
## aws
|
||||
## as default aws creates classic load balancer, to change to nlb use below annotation
|
||||
## https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support
|
||||
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
|
||||
|
||||
## Static ip for NLB
|
||||
## https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html
|
||||
## Example: "eipalloc-0123456789abcdefg,eipalloc-0123456789hijklmn"
|
||||
# service.beta.kubernetes.io/aws-load-balancer-eip-allocations: ""
|
||||
|
||||
## ACM SSL certificate for AWS Classic LoadBalancer
|
||||
## This cannot be set if aws-load-balancer-eip-allocations is set
|
||||
## https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
|
||||
## https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/
|
||||
## Example: "arn:aws:acm:{region}:{user id}:certificate/{id}"
|
||||
# service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ""
|
||||
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "https"
|
||||
# service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
|
||||
|
||||
## if internal load balancer is required
|
||||
## set this based on cloud provider
|
||||
|
||||
## aws
|
||||
## https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
# service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
||||
|
||||
## azure
|
||||
# service.beta.kubernetes.io/azure-load-balancer-internal: "true"
|
||||
|
||||
## gcp
|
||||
# networking.gke.io/load-balancer-type: "Internal"
|
||||
# cloud.google.com/load-balancer-type: "Internal"
|
||||
# cloud.google.com/app-protocols: '{"https-port":"HTTPS","http-port":"HTTP"}'
|
||||
|
||||
## ibm cloud
|
||||
# service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "private"
|
||||
|
||||
## openstack
|
||||
# service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
|
||||
|
||||
|
||||
# User can create separate k8s service for agents if required.
|
||||
# One use case for this is to deploy external load balancer for browser access for management console and internal load balancer for agent communication.
|
||||
createSeparateServiceForAgents: false
|
||||
|
||||
agentService:
|
||||
# Configuration service accessed by agents
|
||||
name: deepfence-agent-router
|
||||
type: LoadBalancer # LoadBalancer/NodePort/Ingress/ClusterIP
|
||||
# Using static ip address for load balancer
|
||||
# - Google Cloud: https://cloud.google.com/kubernetes-engine/docs/tutorials/configuring-domain-name-static-ip
|
||||
# loadBalancerIP: "1.2.3.4"
|
||||
# - Azure: https://docs.microsoft.com/en-us/azure/aks/static-ip
|
||||
# loadBalancerIP: "1.2.3.4"
|
||||
loadBalancerIP: ""
|
||||
# If loadBalancerType is "external", we recommend setting loadBalancerSourceRanges to the ip address / CIDR ranges
|
||||
# of your laptop's ip or corporate CIDR range. If this is set empty, ports 443 and 80 will be open to the public internet.
|
||||
# Example: ["143.231.0.0/16","210.57.79.18/32"]
|
||||
loadBalancerSourceRanges: []
|
||||
# externalIPs: When kubernetes is not cloud managed, add public ip addresses of kubernetes nodes to externalIPs
|
||||
externalIPs: []
|
||||
externalTrafficPolicy: "Cluster"
|
||||
|
||||
annotations:
|
||||
## aws
|
||||
## as default aws creates classic load balancer, to change to nlb use below annotation
|
||||
## https://kubernetes.io/docs/concepts/services-networking/service/#aws-nlb-support
|
||||
service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
|
||||
|
||||
## Static ip for NLB
|
||||
## https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html
|
||||
## Example: "eipalloc-0123456789abcdefg,eipalloc-0123456789hijklmn"
|
||||
# service.beta.kubernetes.io/aws-load-balancer-eip-allocations: ""
|
||||
|
||||
## ACM SSL certificate for AWS Classic LoadBalancer
|
||||
## This cannot be set if aws-load-balancer-eip-allocations is set
|
||||
## https://kubernetes.io/docs/concepts/services-networking/service/#ssl-support-on-aws
|
||||
## https://aws.amazon.com/premiumsupport/knowledge-center/terminate-https-traffic-eks-acm/
|
||||
## Example: "arn:aws:acm:{region}:{user id}:certificate/{id}"
|
||||
# service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ""
|
||||
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "https"
|
||||
# service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
|
||||
|
||||
## https://kubernetes.io/docs/concepts/services-networking/service/#other-elb-annotations
|
||||
## if internal load balancer is required
|
||||
## set this based on cloud provider
|
||||
|
||||
## aws
|
||||
## https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
|
||||
# service.beta.kubernetes.io/aws-load-balancer-internal: "true"
|
||||
|
||||
## azure
|
||||
# service.beta.kubernetes.io/azure-load-balancer-internal: "true"
|
||||
|
||||
## gcp
|
||||
# networking.gke.io/load-balancer-type: "Internal"
|
||||
# cloud.google.com/load-balancer-type: "Internal"
|
||||
# cloud.google.com/app-protocols: '{"https-port":"HTTPS","http-port":"HTTP"}'
|
||||
|
||||
## ibm cloud
|
||||
# service.kubernetes.io/ibm-load-balancer-cloud-provider-ip-type: "private"
|
||||
|
||||
## openstack
|
||||
# service.beta.kubernetes.io/openstack-internal-load-balancer: "true"
|
||||
|
||||
|
||||
# ingress configuration for console
|
||||
ingress:
|
||||
## name of the ingress class for ingress provider installed on the cluster, cannot be empty
|
||||
## Example: nginx
|
||||
class: nginx
|
||||
## host example: threat.example.com
|
||||
host: ""
|
||||
## annotations to customize ingress
|
||||
annotations:
|
||||
## nginx ingress annotations
|
||||
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
|
||||
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||
nginx.ingress.kubernetes.io/proxy-body-size: 200m
|
||||
|
||||
## gke ingress
|
||||
# kubernetes.io/ingress.class: gce
|
||||
## use the below annotation to attach gke managed certificate
|
||||
## https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs#gcloud
|
||||
# networking.gke.io/managed-certificates: <managed certificate name>
|
||||
|
||||
## aws alb annotations
|
||||
## aws load balancer controller needs to be installed on the cluster for these annotations to work
|
||||
## documentation aws load balancer controller https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/ingress/annotations/
|
||||
# alb.ingress.kubernetes.io/actions.ssl-redirect: '{"Type": "redirect", "RedirectConfig": { "Protocol": "HTTPS", "Port": "443", "StatusCode": "HTTP_301"}}'
|
||||
# alb.ingress.kubernetes.io/backend-protocol: HTTPS
|
||||
## arn of the certificate available on aws certificate manager
|
||||
# alb.ingress.kubernetes.io/certificate-arn: ""
|
||||
# alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}, {"HTTP":80}]'
|
||||
# alb.ingress.kubernetes.io/scheme: internet-facing
|
||||
# alb.ingress.kubernetes.io/target-group-attributes: stickiness.enabled=true,stickiness.lb_cookie.duration_seconds=3600
|
||||
# alb.ingress.kubernetes.io/target-type: ip
|
||||
Reference in New Issue
Block a user