Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(helm): update ingress-nginx ( 4.11.3 → 4.12.0 ) #1757

Closed
wants to merge 1 commit into from
Closed

feat(helm): update ingress-nginx ( 4.11.3 → 4.12.0 ) #1757

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 30, 2024

This PR contains the following updates:

Package Update Change
ingress-nginx minor 4.11.3 -> 4.12.0

Release Notes

kubernetes/ingress-nginx (ingress-nginx)

v4.12.0

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.12.0
  • CI: Fix chart testing. (#​12258)
  • Update Ingress-Nginx version controller-v1.12.0

Full Changelog: kubernetes/ingress-nginx@helm-chart-4.11.0...helm-chart-4.12.0

v4.11.4

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.11.4
  • CI: Fix chart testing. (#​12259)
  • Update Ingress-Nginx version controller-v1.11.4

Full Changelog: kubernetes/ingress-nginx@helm-chart-4.11.3...helm-chart-4.11.4

Configuration

📅 Schedule: Branch creation - "on monday,on wednesday,on friday" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from martinohmann as a code owner December 30, 2024 19:48
@github-actions github-actions bot added area/kubernetes Changes made in the kubernetes directory cluster/main labels Dec 30, 2024
@github-actions GitHub Actions
Copy link

kustomization changes in kubernetes/main

--- kubernetes/main/apps/networking/nginx/external Kustomization: flux-system/nginx-external HelmRelease: networking/nginx-external

+++ kubernetes/main/apps/networking/nginx/external Kustomization: flux-system/nginx-external HelmRelease: networking/nginx-external

@@ -13,13 +13,13 @@

     spec:
       chart: ingress-nginx
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      version: 4.11.3
+      version: 4.12.0
   dependsOn:
   - name: cloudflared
     namespace: networking
   install:
     remediation:
       retries: 3
--- kubernetes/main/apps/networking/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: networking/nginx-internal

+++ kubernetes/main/apps/networking/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: networking/nginx-internal

@@ -13,13 +13,13 @@

     spec:
       chart: ingress-nginx
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      version: 4.11.3
+      version: 4.12.0
   install:
     remediation:
       retries: 3
   interval: 2h
   maxHistory: 2
   uninstall:

@github-actions GitHub Actions
Copy link

helmrelease changes in kubernetes/main

--- HelmRelease: networking/nginx-internal Deployment: networking/nginx-internal-controller

+++ HelmRelease: networking/nginx-internal Deployment: networking/nginx-internal-controller

@@ -28,13 +28,13 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: controller
     spec:
       dnsPolicy: ClusterFirst
       containers:
       - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.11.3@sha256:d56f135b6462cfc476447cfe564b83a45e8bb7da2774963b00d12161112270b7
+        image: registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
@@ -46,16 +46,18 @@

         - --controller-class=k8s.io/internal
         - --ingress-class=nginx
         - --configmap=$(POD_NAMESPACE)/nginx-internal-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
+        - --enable-metrics=true
         - --default-ssl-certificate=networking/18b-haus-production-tls
         securityContext:
           runAsNonRoot: true
           runAsUser: 101
+          runAsGroup: 82
           allowPrivilegeEscalation: false
           seccompProfile:
             type: RuntimeDefault
           capabilities:
             drop:
             - ALL
--- HelmRelease: networking/nginx-internal Deployment: networking/nginx-internal-default-backend

+++ HelmRelease: networking/nginx-internal Deployment: networking/nginx-internal-default-backend

@@ -32,12 +32,13 @@

       - name: ingress-nginx-default-backend
         image: ghcr.io/tarampampam/error-pages:3.3.1
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsNonRoot: true
           runAsUser: 65534
+          runAsGroup: 65534
           allowPrivilegeEscalation: false
           seccompProfile:
             type: RuntimeDefault
           capabilities:
             drop:
             - ALL
--- HelmRelease: networking/nginx-internal ServiceMonitor: networking/nginx-internal-controller

+++ HelmRelease: networking/nginx-internal ServiceMonitor: networking/nginx-internal-controller

@@ -8,17 +8,17 @@

     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/instance: nginx-internal
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
 spec:
-  endpoints:
-  - port: metrics
-    interval: 30s
   namespaceSelector:
     any: true
   selector:
     matchLabels:
       app.kubernetes.io/name: ingress-nginx
       app.kubernetes.io/instance: nginx-internal
       app.kubernetes.io/component: controller
+  endpoints:
+  - port: metrics
+    interval: 30s
 
--- HelmRelease: networking/nginx-internal Job: networking/nginx-internal-admission-create

+++ HelmRelease: networking/nginx-internal Job: networking/nginx-internal-admission-create

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: create
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.4@sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=nginx-internal-controller-admission,nginx-internal-controller-admission.$(POD_NAMESPACE).svc
         - --namespace=$(POD_NAMESPACE)
         - --secret-name=nginx-internal-admission
@@ -41,12 +41,13 @@

         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+          runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
--- HelmRelease: networking/nginx-internal Job: networking/nginx-internal-admission-patch

+++ HelmRelease: networking/nginx-internal Job: networking/nginx-internal-admission-patch

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: patch
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.4@sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=nginx-internal-admission
         - --namespace=$(POD_NAMESPACE)
         - --patch-mutating=false
@@ -43,12 +43,13 @@

         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+          runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
--- HelmRelease: networking/nginx-external Deployment: networking/nginx-external-controller

+++ HelmRelease: networking/nginx-external Deployment: networking/nginx-external-controller

@@ -28,13 +28,13 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: controller
     spec:
       dnsPolicy: ClusterFirst
       containers:
       - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.11.3@sha256:d56f135b6462cfc476447cfe564b83a45e8bb7da2774963b00d12161112270b7
+        image: registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
@@ -46,16 +46,18 @@

         - --controller-class=k8s.io/external
         - --ingress-class=nginx
         - --configmap=$(POD_NAMESPACE)/nginx-external-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
+        - --enable-metrics=true
         - --default-ssl-certificate=networking/18b-haus-production-tls
         securityContext:
           runAsNonRoot: true
           runAsUser: 101
+          runAsGroup: 82
           allowPrivilegeEscalation: false
           seccompProfile:
             type: RuntimeDefault
           capabilities:
             drop:
             - ALL
--- HelmRelease: networking/nginx-external Deployment: networking/nginx-external-default-backend

+++ HelmRelease: networking/nginx-external Deployment: networking/nginx-external-default-backend

@@ -32,12 +32,13 @@

       - name: ingress-nginx-default-backend
         image: ghcr.io/tarampampam/error-pages:3.3.1
         imagePullPolicy: IfNotPresent
         securityContext:
           runAsNonRoot: true
           runAsUser: 65534
+          runAsGroup: 65534
           allowPrivilegeEscalation: false
           seccompProfile:
             type: RuntimeDefault
           capabilities:
             drop:
             - ALL
--- HelmRelease: networking/nginx-external ServiceMonitor: networking/nginx-external-controller

+++ HelmRelease: networking/nginx-external ServiceMonitor: networking/nginx-external-controller

@@ -8,17 +8,17 @@

     app.kubernetes.io/name: ingress-nginx
     app.kubernetes.io/instance: nginx-external
     app.kubernetes.io/part-of: ingress-nginx
     app.kubernetes.io/managed-by: Helm
     app.kubernetes.io/component: controller
 spec:
-  endpoints:
-  - port: metrics
-    interval: 30s
   namespaceSelector:
     any: true
   selector:
     matchLabels:
       app.kubernetes.io/name: ingress-nginx
       app.kubernetes.io/instance: nginx-external
       app.kubernetes.io/component: controller
+  endpoints:
+  - port: metrics
+    interval: 30s
 
--- HelmRelease: networking/nginx-external Job: networking/nginx-external-admission-create

+++ HelmRelease: networking/nginx-external Job: networking/nginx-external-admission-create

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: create
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.4@sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=nginx-external-controller-admission,nginx-external-controller-admission.$(POD_NAMESPACE).svc
         - --namespace=$(POD_NAMESPACE)
         - --secret-name=nginx-external-admission
@@ -41,12 +41,13 @@

         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+          runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-external-admission
--- HelmRelease: networking/nginx-external Job: networking/nginx-external-admission-patch

+++ HelmRelease: networking/nginx-external Job: networking/nginx-external-admission-patch

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: patch
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.4.4@sha256:a9f03b34a3cbfbb26d103a14046ab2c5130a80c3d69d526ff8063d2b37b9fd3f
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.5.0@sha256:aaafd456bda110628b2d4ca6296f38731a3aaf0bf7581efae824a41c770a8fc4
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=nginx-external-admission
         - --namespace=$(POD_NAMESPACE)
         - --patch-mutating=false
@@ -43,12 +43,13 @@

         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop:
             - ALL
           readOnlyRootFilesystem: true
+          runAsGroup: 65532
           runAsNonRoot: true
           runAsUser: 65532
           seccompProfile:
             type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-external-admission

@martinohmann
Copy link
Owner

This breaks ingresses for the same hostname but with different paths.

Here backrest and filebrowser have additional authentication paths defined via the authentik-outpost-proxy ingress, but they don't get assigned an address, which implies that ingress-nginx never registers them correctly.

❯ kubectl get ing -A

NAMESPACE     NAME                               CLASS      HOSTS                                    ADDRESS          PORTS     AGE
default       backrest                           internal   backrest.18b.haus                                         80, 443   48d
default       filebrowser                        internal   filebrowser.18b.haus                                      80, 443   19m
default       minio                              internal   minio.18b.haus,s3.storage.18b.haus       192.168.40.150   80, 443   261d
default       zot                                internal   registry.18b.haus                        192.168.40.150   80, 443   249d
flux-system   weave-gitops                       internal   gitops.storage.18b.haus                  192.168.40.150   80, 443   13d
identity      authentik-outpost-proxy            internal   backrest.18b.haus,filebrowser.18b.haus   192.168.40.150   80, 443   7d18h
monitoring    kube-prometheus-stack-prometheus   internal   prometheus.storage.18b.haus              192.168.40.150   80, 443   257d

I will need some time to debug this.

@renovate renovate bot deleted the renovate/main-ingress-nginx-4.x branch January 3, 2025 08:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@martinohmann martinohmann Awaiting requested review from martinohmann martinohmann is a code owner

Assignees
No one assigned
Labels
area/kubernetes Changes made in the kubernetes directory cluster/main hold renovate/helm type/minor
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@martinohmann