Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(helm): update chart ingress-nginx to 4.9.0 #6

Merged
merged 1 commit into from
Dec 27, 2023
Merged

feat(helm): update chart ingress-nginx to 4.9.0 #6

merged 1 commit into from
Dec 27, 2023

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 27, 2023 •
edited
Loading

Mend Renovate

This PR contains the following updates:

Package Update Change
ingress-nginx minor 4.7.1 -> 4.9.0

Release Notes

kubernetes/ingress-nginx (ingress-nginx)

v4.8.3

Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer

v4.8.2

v4.8.1

v4.8.0

Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer

v4.7.3

Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer

v4.7.2

Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot force-pushed the renovate/ingress-nginx-4.x branch from d1e4f12 to be2183e Compare December 27, 2023 22:53
@github-actions GitHub Actions
Copy link

github-actions bot commented Dec 27, 2023 •
edited
Loading 

--- kubernetes/apps/ingress/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: ingress/nginx-internal

+++ kubernetes/apps/ingress/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: ingress/nginx-internal

@@ -13,13 +13,13 @@

     spec:
       chart: ingress-nginx
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      version: 4.7.1
+      version: 4.9.0
   install:
     remediation:
       retries: 3
   interval: 30m
   maxHistory: 2
   uninstall:
--- kubernetes/apps/ingress/nginx/external Kustomization: flux-system/nginx-external HelmRelease: ingress/nginx-external

+++ kubernetes/apps/ingress/nginx/external Kustomization: flux-system/nginx-external HelmRelease: ingress/nginx-external

@@ -13,13 +13,13 @@

     spec:
       chart: ingress-nginx
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      version: 4.7.1
+      version: 4.9.0
   install:
     remediation:
       retries: 3
   interval: 30m
   maxHistory: 2
   uninstall:

@renovate renovate bot force-pushed the renovate/ingress-nginx-4.x branch from be2183e to 4636a52 Compare December 27, 2023 23:02
@github-actions GitHub Actions
Copy link 

--- HelmRelease: ingress/nginx-external Deployment: ingress/nginx-external-controller

+++ HelmRelease: ingress/nginx-external Deployment: ingress/nginx-external-controller

@@ -30,13 +30,13 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: controller
     spec:
       dnsPolicy: ClusterFirst
       containers:
       - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd
+        image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
@@ -50,19 +50,23 @@

         - --configmap=$(POD_NAMESPACE)/nginx-external-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
         - --default-ssl-certificate=ingress/${SECRET_DOMAIN/./-}-production-tls
         securityContext:
+          runAsNonRoot: true
+          runAsUser: 101
+          allowPrivilegeEscalation: false
+          seccompProfile:
+            type: RuntimeDefault
           capabilities:
             drop:
             - ALL
             add:
             - NET_BIND_SERVICE
-          runAsUser: 101
-          allowPrivilegeEscalation: true
+          readOnlyRootFilesystem: false
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: POD_NAMESPACE
--- HelmRelease: ingress/nginx-external Deployment: ingress/nginx-external-defaultbackend

+++ HelmRelease: ingress/nginx-external Deployment: ingress/nginx-external-defaultbackend

@@ -21,25 +21,29 @@

   minReadySeconds: 0
   template:
     metadata:
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/instance: nginx-external
+        app.kubernetes.io/part-of: ingress-nginx
+        app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: default-backend
     spec:
       containers:
       - name: ingress-nginx-default-backend
         image: ghcr.io/tarampampam/error-pages:2.26.0
         imagePullPolicy: IfNotPresent
         securityContext:
+          runAsNonRoot: true
+          runAsUser: 65534
+          allowPrivilegeEscalation: false
+          seccompProfile:
+            type: RuntimeDefault
           capabilities:
             drop:
             - ALL
-          runAsUser: 65534
-          runAsNonRoot: true
-          allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
         env:
         - name: TEMPLATE_NAME
           value: lost-in-space
         - name: SHOW_DETAILS
           value: 'false'
--- HelmRelease: ingress/nginx-external ValidatingWebhookConfiguration: ingress/nginx-external-admission

+++ HelmRelease: ingress/nginx-external ValidatingWebhookConfiguration: ingress/nginx-external-admission

@@ -25,14 +25,14 @@

   failurePolicy: Fail
   sideEffects: None
   admissionReviewVersions:
   - v1
   clientConfig:
     service:
+      name: nginx-external-controller-admission
       namespace: ingress
-      name: nginx-external-controller-admission
       path: /networking/v1/ingresses
   objectSelector:
     matchExpressions:
     - key: ingress-class
       operator: In
       values:
--- HelmRelease: ingress/nginx-external Job: ingress/nginx-external-admission-create

+++ HelmRelease: ingress/nginx-external Job: ingress/nginx-external-admission-create

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: create
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=nginx-external-controller-admission,nginx-external-controller-admission.$(POD_NAMESPACE).svc
         - --namespace=$(POD_NAMESPACE)
         - --secret-name=nginx-external-admission
@@ -37,15 +37,19 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-external-admission
       nodeSelector:
         kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
 
--- HelmRelease: ingress/nginx-external Job: ingress/nginx-external-admission-patch

+++ HelmRelease: ingress/nginx-external Job: ingress/nginx-external-admission-patch

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: patch
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=nginx-external-admission
         - --namespace=$(POD_NAMESPACE)
         - --patch-mutating=false
@@ -39,15 +39,19 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-external-admission
       nodeSelector:
         kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
 
--- HelmRelease: ingress/nginx-internal Deployment: ingress/nginx-internal-controller

+++ HelmRelease: ingress/nginx-internal Deployment: ingress/nginx-internal-controller

@@ -30,13 +30,13 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: controller
     spec:
       dnsPolicy: ClusterFirst
       containers:
       - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.8.1@sha256:e5c4824e7375fcf2a393e1c03c293b69759af37a9ca6abdb91b13d78a93da8bd
+        image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
@@ -50,19 +50,23 @@

         - --configmap=$(POD_NAMESPACE)/nginx-internal-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
         - --default-ssl-certificate=ingress/${SECRET_DOMAIN/./-}-production-tls
         securityContext:
+          runAsNonRoot: true
+          runAsUser: 101
+          allowPrivilegeEscalation: false
+          seccompProfile:
+            type: RuntimeDefault
           capabilities:
             drop:
             - ALL
             add:
             - NET_BIND_SERVICE
-          runAsUser: 101
-          allowPrivilegeEscalation: true
+          readOnlyRootFilesystem: false
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: POD_NAMESPACE
--- HelmRelease: ingress/nginx-internal Deployment: ingress/nginx-internal-defaultbackend

+++ HelmRelease: ingress/nginx-internal Deployment: ingress/nginx-internal-defaultbackend

@@ -21,25 +21,29 @@

   minReadySeconds: 0
   template:
     metadata:
       labels:
         app.kubernetes.io/name: ingress-nginx
         app.kubernetes.io/instance: nginx-internal
+        app.kubernetes.io/part-of: ingress-nginx
+        app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: default-backend
     spec:
       containers:
       - name: ingress-nginx-default-backend
         image: ghcr.io/tarampampam/error-pages:2.26.0
         imagePullPolicy: IfNotPresent
         securityContext:
+          runAsNonRoot: true
+          runAsUser: 65534
+          allowPrivilegeEscalation: false
+          seccompProfile:
+            type: RuntimeDefault
           capabilities:
             drop:
             - ALL
-          runAsUser: 65534
-          runAsNonRoot: true
-          allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
         env:
         - name: TEMPLATE_NAME
           value: lost-in-space
         - name: SHOW_DETAILS
           value: 'false'
--- HelmRelease: ingress/nginx-internal ValidatingWebhookConfiguration: ingress/nginx-internal-admission

+++ HelmRelease: ingress/nginx-internal ValidatingWebhookConfiguration: ingress/nginx-internal-admission

@@ -25,14 +25,14 @@

   failurePolicy: Fail
   sideEffects: None
   admissionReviewVersions:
   - v1
   clientConfig:
     service:
+      name: nginx-internal-controller-admission
       namespace: ingress
-      name: nginx-internal-controller-admission
       path: /networking/v1/ingresses
   objectSelector:
     matchExpressions:
     - key: ingress-class
       operator: In
       values:
--- HelmRelease: ingress/nginx-internal Job: ingress/nginx-internal-admission-create

+++ HelmRelease: ingress/nginx-internal Job: ingress/nginx-internal-admission-create

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: create
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
         imagePullPolicy: IfNotPresent
         args:
         - create
         - --host=nginx-internal-controller-admission,nginx-internal-controller-admission.$(POD_NAMESPACE).svc
         - --namespace=$(POD_NAMESPACE)
         - --secret-name=nginx-internal-admission
@@ -37,15 +37,19 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
       nodeSelector:
         kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
 
--- HelmRelease: ingress/nginx-internal Job: ingress/nginx-internal-admission-patch

+++ HelmRelease: ingress/nginx-internal Job: ingress/nginx-internal-admission-patch

@@ -23,13 +23,13 @@

         app.kubernetes.io/part-of: ingress-nginx
         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: admission-webhook
     spec:
       containers:
       - name: patch
-        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20230407@sha256:543c40fd093964bc9ab509d3e791f9989963021f1e9e4c9c7b6700b02bfb227b
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
         imagePullPolicy: IfNotPresent
         args:
         - patch
         - --webhook-name=nginx-internal-admission
         - --namespace=$(POD_NAMESPACE)
         - --patch-mutating=false
@@ -39,15 +39,19 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
       nodeSelector:
         kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000

@npawelek npawelek merged commit c64c82e into main Dec 27, 2023
3 checks passed
@renovate renovate bot deleted the renovate/ingress-nginx-4.x branch December 27, 2023 23:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@npawelek npawelek

Labels
area/kubernetes renovate/helm type/minor
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@npawelek