This is an automated email from the ASF dual-hosted git repository. sciabarracom pushed a commit to branch 0.9.0 in repository https://gitbox.apache.org/repos/asf/openserverless-task.git
commit 76a2e5f312da2c96079b9818f5d186313b96e411 Author: Build OpenServerless <[email protected]> AuthorDate: Sun Sep 20 12:40:35 2026 +0000 updating ingress --- cloud/aks/ingress-deploy.yaml | 94 ++++++++++++++++++++++-------------- cloud/aks/opsfile.yml | 2 +- cloud/eks/ingress-deploy.yaml | 109 +++++++++++++++++++++++------------------- cloud/eks/opsfile.yml | 2 +- cloud/gke/ingress-deploy.yaml | 94 ++++++++++++++++++++++-------------- cloud/gke/opsfile.yml | 2 +- cloud/k3s/opsfile.yml | 2 +- config/opsfile.yml | 2 +- prereq.yml | 2 +- tests/opsfile.yml | 4 +- 10 files changed, 182 insertions(+), 131 deletions(-) diff --git a/cloud/aks/ingress-deploy.yaml b/cloud/aks/ingress-deploy.yaml index 7e32ac4..a3360a9 100644 --- a/cloud/aks/ingress-deploy.yaml +++ b/cloud/aks/ingress-deploy.yaml @@ -15,7 +15,6 @@ # specific language governing permissions and limitations # under the License. # ---- apiVersion: v1 kind: Namespace metadata: @@ -33,11 +32,12 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx --- apiVersion: v1 +automountServiceAccountToken: true kind: ServiceAccount metadata: labels: @@ -45,7 +45,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -57,7 +57,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -147,7 +147,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -166,7 +166,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx rules: - apiGroups: @@ -248,7 +248,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission rules: - apiGroups: @@ -267,7 +267,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -287,7 +287,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -306,7 +306,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -325,7 +325,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -337,8 +337,7 @@ subjects: namespace: ingress-nginx --- apiVersion: v1 -data: - allow-snippet-annotations: "true" +data: null kind: ConfigMap metadata: labels: @@ -346,7 +345,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -358,7 +357,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -391,7 +390,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -414,7 +413,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -436,8 +435,9 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 spec: + automountServiceAccountToken: true containers: - args: - /nginx-ingress-controller @@ -460,7 +460,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -503,13 +503,18 @@ spec: cpu: 100m memory: 90Mi securityContext: - allowPrivilegeEscalation: true + allowPrivilegeEscalation: false capabilities: add: - NET_BIND_SERVICE drop: - ALL + readOnlyRootFilesystem: false + runAsGroup: 82 + runAsNonRoot: true runAsUser: 101 + seccompProfile: + type: RuntimeDefault volumeMounts: - mountPath: /usr/local/certificates/ name: webhook-cert @@ -532,7 +537,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -543,9 +548,10 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-create spec: + automountServiceAccountToken: true containers: - args: - create @@ -557,19 +563,25 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd imagePullPolicy: IfNotPresent name: create securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure - securityContext: - fsGroup: 2000 - runAsNonRoot: true - runAsUser: 2000 serviceAccountName: ingress-nginx-admission + ttlSecondsAfterFinished: 0 --- apiVersion: batch/v1 kind: Job @@ -579,7 +591,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -590,9 +602,10 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-patch spec: + automountServiceAccountToken: true containers: - args: - patch @@ -606,19 +619,25 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd imagePullPolicy: IfNotPresent name: patch securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure - securityContext: - fsGroup: 2000 - runAsNonRoot: true - runAsUser: 2000 serviceAccountName: ingress-nginx-admission + ttlSecondsAfterFinished: 0 --- apiVersion: networking.k8s.io/v1 kind: IngressClass @@ -628,7 +647,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -641,7 +660,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: @@ -651,6 +670,7 @@ webhooks: name: ingress-nginx-controller-admission namespace: ingress-nginx path: /networking/v1/ingresses + port: 443 failurePolicy: Fail matchPolicy: Equivalent name: validate.nginx.ingress.kubernetes.io @@ -664,4 +684,4 @@ webhooks: - UPDATE resources: - ingresses - sideEffects: None \ No newline at end of file + sideEffects: None diff --git a/cloud/aks/opsfile.yml b/cloud/aks/opsfile.yml index 2322067..3c2d0af 100644 --- a/cloud/aks/opsfile.yml +++ b/cloud/aks/opsfile.yml @@ -37,7 +37,7 @@ tasks: update-yaml: cmds: - - curl -L "https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/cloud/deploy.yaml"; >ingress-deploy.yaml + - curl -L "https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/cloud/deploy.yaml"; >ingress-deploy.yaml kubeconfig: desc: extract the kubeconfig to access diff --git a/cloud/eks/ingress-deploy.yaml b/cloud/eks/ingress-deploy.yaml index 970f693..8c90f0f 100644 --- a/cloud/eks/ingress-deploy.yaml +++ b/cloud/eks/ingress-deploy.yaml @@ -14,21 +14,7 @@ # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. - -# Copyright 2022 The cert-manager Authors. # -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. ---- apiVersion: v1 kind: Namespace metadata: @@ -46,11 +32,12 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx --- apiVersion: v1 +automountServiceAccountToken: true kind: ServiceAccount metadata: labels: @@ -58,7 +45,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -70,7 +57,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -160,7 +147,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -179,7 +166,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx rules: - apiGroups: @@ -261,7 +248,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission rules: - apiGroups: @@ -280,7 +267,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -300,7 +287,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -319,7 +306,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -338,7 +325,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -350,8 +337,7 @@ subjects: namespace: ingress-nginx --- apiVersion: v1 -data: - allow-snippet-annotations: "true" +data: null kind: ConfigMap metadata: labels: @@ -359,7 +345,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -375,7 +361,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -408,7 +394,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -431,7 +417,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -442,6 +428,10 @@ spec: app.kubernetes.io/component: controller app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx + strategy: + rollingUpdate: + maxUnavailable: 1 + type: RollingUpdate template: metadata: labels: @@ -449,8 +439,9 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 spec: + automountServiceAccountToken: true containers: - args: - /nginx-ingress-controller @@ -473,7 +464,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.7.1@sha256:7244b95ea47bddcb8267c1e625fb163fc183ef55448855e3ac52a7b260a60407 + image: registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -516,13 +507,18 @@ spec: cpu: 100m memory: 90Mi securityContext: - allowPrivilegeEscalation: true + allowPrivilegeEscalation: false capabilities: add: - NET_BIND_SERVICE drop: - ALL + readOnlyRootFilesystem: false + runAsGroup: 82 + runAsNonRoot: true runAsUser: 101 + seccompProfile: + type: RuntimeDefault volumeMounts: - mountPath: /usr/local/certificates/ name: webhook-cert @@ -545,7 +541,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -556,9 +552,10 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-create spec: + automountServiceAccountToken: true containers: - args: - create @@ -570,19 +567,25 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd imagePullPolicy: IfNotPresent name: create securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure - securityContext: - fsGroup: 2000 - runAsNonRoot: true - runAsUser: 2000 serviceAccountName: ingress-nginx-admission + ttlSecondsAfterFinished: 0 --- apiVersion: batch/v1 kind: Job @@ -592,7 +595,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -603,9 +606,10 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-patch spec: + automountServiceAccountToken: true containers: - args: - patch @@ -619,19 +623,25 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230312-helm-chart-4.5.2-28-g66a760794@sha256:01d181618f270f2a96c04006f33b2699ad3ccb02da48d0f89b22abce084b292f + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd imagePullPolicy: IfNotPresent name: patch securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure - securityContext: - fsGroup: 2000 - runAsNonRoot: true - runAsUser: 2000 serviceAccountName: ingress-nginx-admission + ttlSecondsAfterFinished: 0 --- apiVersion: networking.k8s.io/v1 kind: IngressClass @@ -641,7 +651,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -654,7 +664,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.7.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: @@ -664,6 +674,7 @@ webhooks: name: ingress-nginx-controller-admission namespace: ingress-nginx path: /networking/v1/ingresses + port: 443 failurePolicy: Fail matchPolicy: Equivalent name: validate.nginx.ingress.kubernetes.io diff --git a/cloud/eks/opsfile.yml b/cloud/eks/opsfile.yml index d0d5e20..d7877b0 100644 --- a/cloud/eks/opsfile.yml +++ b/cloud/eks/opsfile.yml @@ -43,7 +43,7 @@ tasks: update-yaml: cmds: - - curl -L "https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/aws/deploy.yaml"; >ingress-deploy.yaml + - curl -L "https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/aws/deploy.yaml"; >ingress-deploy.yaml wait: #desc: util wait for objects - user OBJECT= to specify what diff --git a/cloud/gke/ingress-deploy.yaml b/cloud/gke/ingress-deploy.yaml index 7e32ac4..a3360a9 100644 --- a/cloud/gke/ingress-deploy.yaml +++ b/cloud/gke/ingress-deploy.yaml @@ -15,7 +15,6 @@ # specific language governing permissions and limitations # under the License. # ---- apiVersion: v1 kind: Namespace metadata: @@ -33,11 +32,12 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx --- apiVersion: v1 +automountServiceAccountToken: true kind: ServiceAccount metadata: labels: @@ -45,7 +45,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx --- @@ -57,7 +57,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx rules: @@ -147,7 +147,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx rules: @@ -166,7 +166,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx rules: - apiGroups: @@ -248,7 +248,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission rules: - apiGroups: @@ -267,7 +267,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx namespace: ingress-nginx roleRef: @@ -287,7 +287,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission namespace: ingress-nginx roleRef: @@ -306,7 +306,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx roleRef: apiGroup: rbac.authorization.k8s.io @@ -325,7 +325,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission roleRef: apiGroup: rbac.authorization.k8s.io @@ -337,8 +337,7 @@ subjects: namespace: ingress-nginx --- apiVersion: v1 -data: - allow-snippet-annotations: "true" +data: null kind: ConfigMap metadata: labels: @@ -346,7 +345,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx --- @@ -358,7 +357,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -391,7 +390,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller-admission namespace: ingress-nginx spec: @@ -414,7 +413,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-controller namespace: ingress-nginx spec: @@ -436,8 +435,9 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 spec: + automountServiceAccountToken: true containers: - args: - /nginx-ingress-controller @@ -460,7 +460,7 @@ spec: fieldPath: metadata.namespace - name: LD_PRELOAD value: /usr/local/lib/libmimalloc.so - image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd + image: registry.k8s.io/ingress-nginx/controller:v1.15.1@sha256:594ceea76b01c592858f803f9ff4d2cb40542cae2060410b2c95f75907d659e1 imagePullPolicy: IfNotPresent lifecycle: preStop: @@ -503,13 +503,18 @@ spec: cpu: 100m memory: 90Mi securityContext: - allowPrivilegeEscalation: true + allowPrivilegeEscalation: false capabilities: add: - NET_BIND_SERVICE drop: - ALL + readOnlyRootFilesystem: false + runAsGroup: 82 + runAsNonRoot: true runAsUser: 101 + seccompProfile: + type: RuntimeDefault volumeMounts: - mountPath: /usr/local/certificates/ name: webhook-cert @@ -532,7 +537,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-create namespace: ingress-nginx spec: @@ -543,9 +548,10 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-create spec: + automountServiceAccountToken: true containers: - args: - create @@ -557,19 +563,25 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd imagePullPolicy: IfNotPresent name: create securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure - securityContext: - fsGroup: 2000 - runAsNonRoot: true - runAsUser: 2000 serviceAccountName: ingress-nginx-admission + ttlSecondsAfterFinished: 0 --- apiVersion: batch/v1 kind: Job @@ -579,7 +591,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-patch namespace: ingress-nginx spec: @@ -590,9 +602,10 @@ spec: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission-patch spec: + automountServiceAccountToken: true containers: - args: - patch @@ -606,19 +619,25 @@ spec: valueFrom: fieldRef: fieldPath: metadata.namespace - image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b + image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.6.9@sha256:01038e7de14b78d702d2849c3aad72fd25903c4765af63cf16aa3398f5d5f2dd imagePullPolicy: IfNotPresent name: patch securityContext: allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsGroup: 65532 + runAsNonRoot: true + runAsUser: 65532 + seccompProfile: + type: RuntimeDefault nodeSelector: kubernetes.io/os: linux restartPolicy: OnFailure - securityContext: - fsGroup: 2000 - runAsNonRoot: true - runAsUser: 2000 serviceAccountName: ingress-nginx-admission + ttlSecondsAfterFinished: 0 --- apiVersion: networking.k8s.io/v1 kind: IngressClass @@ -628,7 +647,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: nginx spec: controller: k8s.io/ingress-nginx @@ -641,7 +660,7 @@ metadata: app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/name: ingress-nginx app.kubernetes.io/part-of: ingress-nginx - app.kubernetes.io/version: 1.8.1 + app.kubernetes.io/version: 1.15.1 name: ingress-nginx-admission webhooks: - admissionReviewVersions: @@ -651,6 +670,7 @@ webhooks: name: ingress-nginx-controller-admission namespace: ingress-nginx path: /networking/v1/ingresses + port: 443 failurePolicy: Fail matchPolicy: Equivalent name: validate.nginx.ingress.kubernetes.io @@ -664,4 +684,4 @@ webhooks: - UPDATE resources: - ingresses - sideEffects: None \ No newline at end of file + sideEffects: None diff --git a/cloud/gke/opsfile.yml b/cloud/gke/opsfile.yml index 20aa874..13329b5 100644 --- a/cloud/gke/opsfile.yml +++ b/cloud/gke/opsfile.yml @@ -43,7 +43,7 @@ tasks: update-yaml: cmds: - - curl -L "https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/cloud/deploy.yaml"; >ingress-deploy.yaml + - curl -L "https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/cloud/deploy.yaml"; >ingress-deploy.yaml kubeconfig: desc: extract kubeconfig to access diff --git a/cloud/k3s/opsfile.yml b/cloud/k3s/opsfile.yml index dee82af..e7b352a 100644 --- a/cloud/k3s/opsfile.yml +++ b/cloud/k3s/opsfile.yml @@ -19,7 +19,7 @@ version: "3" vars: # temporary.... - K3S_VERSION: "v1.27.7-rc1+k3s2" + K3S_VERSION: "v1.36.4+k3s1" SSH: "ssh -oStrictHostKeyChecking=no" env: diff --git a/config/opsfile.yml b/config/opsfile.yml index 25daa64..92d4788 100644 --- a/config/opsfile.yml +++ b/config/opsfile.yml @@ -420,7 +420,7 @@ tasks: MSG: "EKS Kubernetes Version" VAR: "EKS_KUBERNETES_VERSION" VAL: "{{.__kubever}}" - DEF: "1.25" + DEF: "1.34" - config -d | rg AWS_ - config -d | rg EKS_ diff --git a/prereq.yml b/prereq.yml index 8978a5b..692f536 100644 --- a/prereq.yml +++ b/prereq.yml @@ -136,7 +136,7 @@ tasks: k3sup: desc: download k3sup vars: - VERSION: 0.13.12 + VERSION: 0.13.13 BASE: "https://github.com/alexellis/k3sup/releases/download/{{.VERSION}}"; FILE: sh: | diff --git a/tests/opsfile.yml b/tests/opsfile.yml index 8549147..22e5fcf 100644 --- a/tests/opsfile.yml +++ b/tests/opsfile.yml @@ -64,11 +64,11 @@ tasks: silent: true desc: k3sup test cmds: - - k3sup version | rg 0.13.6 + - k3sup version | rg 0.13.13 rg: silent: true desc: ripgrep test cmds: - rg --version | rg 14.1.0 - +
