actualized for kubespray version 2.28.0

2025-06-15 20:25:45 +03:00
parent c819d4f51f
commit c2df2abc78
366 changed files with 9939 additions and 40388 deletions
--- a/kubespray/project/roles/kubernetes-apps/ingress_controller/alb_ingress_controller/OWNERS
+++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/alb_ingress_controller/OWNERS
@@ -1,6 +0,0 @@
-# See the OWNERS docs at https://go.k8s.io/owners
-
-approvers:
-  - kubespray-approvers
-reviewers:
-  - kubespray-reviewers
--- a/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.crds.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.crds.yml.j2
--- a/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/cert_manager/templates/cert-manager.yml.j2
@@ -422,7 +422,9 @@ rules:
  - apiGroups: ["cert-manager.io"]
    resources: ["signers"]
    verbs: ["approve"]
-    resourceNames: ["issuers.cert-manager.io/*", "clusterissuers.cert-manager.io/*"]
+    resourceNames:
+    - "issuers.cert-manager.io/*"
+    - "clusterissuers.cert-manager.io/*"
 ---
 # Source: cert-manager/deploy/charts/cert-manager/templates/rbac.yaml
 # Permission to:
@@ -921,9 +923,7 @@ spec:
            capabilities:
              drop:
              - ALL
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
+            readOnlyRootFilesystem: true
 {% if cert_manager_tolerations %}
      tolerations:
        {{ cert_manager_tolerations | to_nice_yaml(indent=2) | indent(width=8) }}
@@ -1009,9 +1009,7 @@ spec:
            capabilities:
              drop:
              - ALL
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
+            readOnlyRootFilesystem: true
          env:
          - name: POD_NAMESPACE
            valueFrom:
@@ -1029,6 +1027,16 @@ spec:
          - name: NO_PROXY
            value: "{{ cert_manager_no_proxy }}"
 {% endif %}
+          livenessProbe:
+            httpGet:
+              port: http-healthz
+              path: /livez
+              scheme: HTTP
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 15
+            successThreshold: 1
+            failureThreshold: 8
 {% if cert_manager_trusted_internal_ca is defined %}
          volumeMounts:
          - mountPath: /etc/ssl/certs/internal-ca.pem
@@ -1138,9 +1146,7 @@ spec:
            capabilities:
              drop:
              - ALL
-            runAsNonRoot: true
-            seccompProfile:
-              type: RuntimeDefault
+            readOnlyRootFilesystem: true
          env:
          - name: POD_NAMESPACE
            valueFrom:
@@ -1189,20 +1195,18 @@ webhooks:
    rules:
      - apiGroups:
          - "cert-manager.io"
-          - "acme.cert-manager.io"
        apiVersions:
          - "v1"
        operations:
          - CREATE
-          - UPDATE
        resources:
-          - "*/*"
+          - "certificaterequests"
    admissionReviewVersions: ["v1"]
    # This webhook only accepts v1 cert-manager resources.
    # Equivalent matchPolicy ensures that non-v1 resource requests are sent to
    # this webhook (after the resources have been converted to v1).
    matchPolicy: Equivalent
-    timeoutSeconds: 10
+    timeoutSeconds: 30
    failurePolicy: Fail
    # Only include 'sideEffects' field in Kubernetes 1.12+
    sideEffects: None
@@ -1229,8 +1233,8 @@ webhooks:
  - name: webhook.cert-manager.io
    namespaceSelector:
      matchExpressions:
-      - key: "cert-manager.io/disable-validation"
-        operator: "NotIn"
+      - key: cert-manager.io/disable-validation
+        operator: NotIn
        values:
        - "true"
    rules:
@@ -1249,7 +1253,7 @@ webhooks:
    # Equivalent matchPolicy ensures that non-v1 resource requests are sent to
    # this webhook (after the resources have been converted to v1).
    matchPolicy: Equivalent
-    timeoutSeconds: 10
+    timeoutSeconds: 30
    failurePolicy: Fail
    sideEffects: None
    clientConfig:
--- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/defaults/main.yml
+++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/defaults/main.yml
@@ -4,7 +4,9 @@ ingress_nginx_host_network: false
 ingress_nginx_service_type: LoadBalancer
 ingress_nginx_service_nodeport_http: ""
 ingress_nginx_service_nodeport_https: ""
+ingress_nginx_service_annotations: {}
 ingress_publish_status_address: ""
+ingress_nginx_publish_service: "{{ ingress_nginx_namespace }}/ingress-nginx"
 ingress_nginx_nodeselector:
  kubernetes.io/os: "linux"
 ingress_nginx_tolerations: []
--- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/admission-webhook-configuration.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/admission-webhook-configuration.yml.j2
@@ -13,6 +13,7 @@ webhooks:
      name: ingress-nginx-controller-admission
      namespace: {{ ingress_nginx_namespace }}
      path: /networking/v1/ingresses
+      port: 443
  failurePolicy: Fail
  matchPolicy: Equivalent
  name: validate.nginx.ingress.kubernetes.io
--- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2
@@ -30,15 +30,18 @@ spec:
        - /init_module
        image: {{ ingress_nginx_opentelemetry_image_repo }}:{{ ingress_nginx_opentelemetry_image_tag }}
        securityContext:
-          runAsNonRoot: true
-          runAsUser: 65532
          allowPrivilegeEscalation: false
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false
+          runAsGroup: 82
+          runAsNonRoot: true
+          runAsUser: 101
          seccompProfile:
            type: RuntimeDefault
-          capabilities:
-            drop:
-              - ALL
-          readOnlyRootFilesystem: true
        volumeMounts:
        - mountPath: /modules_mount
          name: modules
@@ -76,11 +79,12 @@ spec:
 {% if ingress_nginx_without_class %}
            - --watch-ingress-without-class=true
 {% endif %}
-{% if ingress_nginx_host_network %}
-            - --report-node-internal-ip-address
-{% endif %}
 {% if ingress_publish_status_address != "" %}
            - --publish-status-address={{ ingress_publish_status_address }}
+{% elif ingress_nginx_host_network %}
+            - --report-node-internal-ip-address
+{% elif ingress_nginx_publish_service != "" %}
+            - --publish-service={{ ingress_nginx_publish_service }}
 {% endif %}
 {% for extra_arg in ingress_nginx_extra_args %}
            - {{ extra_arg }}
@@ -122,6 +126,26 @@ spec:
 {% if not ingress_nginx_host_network %}
              hostPort: {{ ingress_nginx_metrics_port }}
 {% endif %}
+{% if ingress_nginx_configmap_tcp_services %}
+{% for port in ingress_nginx_configmap_tcp_services.keys() %}
+            - name: tcp-port-{{ port }}
+              containerPort: "{{ port | int }}"
+              protocol: TCP
+{% if not ingress_nginx_host_network %}
+              hostPort: "{{ port | int }}"
+{% endif %}
+{% endfor %}
+{% endif %}
+{% if ingress_nginx_configmap_udp_services %}
+{% for port in ingress_nginx_configmap_udp_services.keys() %}
+            - name: udp-port-{{ port }}
+              containerPort: "{{ port | int }}"
+              protocol: UDP
+{% if not ingress_nginx_host_network %}
+              hostPort: "{{ port | int }}"
+{% endif %}
+{% endfor %}
+{% endif %}
 {% if ingress_nginx_webhook_enabled %}
            - name: webhook
              containerPort: 8443
--- a/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/svc-ingress-nginx.yml.j2
+++ b/kubespray/project/roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/svc-ingress-nginx.yml.j2
@@ -7,6 +7,10 @@ metadata:
  labels:
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
+{% if ingress_nginx_service_annotations %}
+  annotations:
+    {{ ingress_nginx_service_annotations | to_nice_yaml(indent=2, width=1337) | indent(width=4) }}
+{% endif %}
 spec:
  type: {{ ingress_nginx_service_type }}
  ports:
@@ -23,6 +27,22 @@ spec:
      protocol: TCP
 {% if (ingress_nginx_service_type == 'NodePort' or ingress_nginx_service_type == 'LoadBalancer') and ingress_nginx_service_nodeport_https %}
      nodePort: {{ingress_nginx_service_nodeport_https | int}}
+{% endif %}
+{% if ingress_nginx_configmap_tcp_services %}
+{% for port in ingress_nginx_configmap_tcp_services.keys() %}
+    - name: tcp-port-{{ port }}
+      port: "{{ port | int }}"
+      targetPort: "{{ port | int }}"
+      protocol: TCP
+{% endfor %}
+{% endif %}
+{% if ingress_nginx_configmap_udp_services %}
+{% for port in ingress_nginx_configmap_udp_services.keys() %}
+    - name: udp-port-{{ port }}
+      port: "{{ port | int }}"
+      targetPort: "{{ port | int }}"
+      protocol: UDP
+{% endfor %}
 {% endif %}
  selector:
    app.kubernetes.io/name: ingress-nginx