feat(helm): update ingress-nginx ( 4.8.3 → 4.9.0 )

[bot-ross]

This PR contains the following updates:

Package	Update	Change
ingress-nginx	minor	4.8.3 -> 4.9.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[bot-ross]

--- kubernetes/storage HelmRelease: network/nginx-internal Deployment: network/nginx-internal-controller

+++ kubernetes/storage HelmRelease: network/nginx-internal Deployment: network/nginx-internal-controller

@@ -28,13 +28,13 @@

         app.kubernetes.io/managed-by: Helm
         app.kubernetes.io/component: controller
     spec:
       dnsPolicy: ClusterFirst
       containers:
       - name: controller
-        image: registry.k8s.io/ingress-nginx/controller:v1.9.4@sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
+        image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
         imagePullPolicy: IfNotPresent
         lifecycle:
           preStop:
             exec:
               command:
               - /wait-shutdown
@@ -47,19 +47,23 @@

         - --configmap=$(POD_NAMESPACE)/nginx-internal-controller
         - --validating-webhook=:8443
         - --validating-webhook-certificate=/usr/local/certificates/cert
         - --validating-webhook-key=/usr/local/certificates/key
         - --default-ssl-certificate=network/turbo-ac-tls
         securityContext:
+          runAsNonRoot: true
+          runAsUser: 101
+          allowPrivilegeEscalation: false
+          seccompProfile:
+            type: RuntimeDefault
           capabilities:
             drop:
             - ALL
             add:
             - NET_BIND_SERVICE
-          runAsUser: 101
-          allowPrivilegeEscalation: true
+          readOnlyRootFilesystem: false
         env:
         - name: POD_NAME
           valueFrom:
             fieldRef:
               fieldPath: metadata.name
         - name: POD_NAMESPACE
--- kubernetes/storage HelmRelease: network/nginx-internal ValidatingWebhookConfiguration: network/nginx-internal-admission

+++ kubernetes/storage HelmRelease: network/nginx-internal ValidatingWebhookConfiguration: network/nginx-internal-admission

@@ -25,14 +25,14 @@

   failurePolicy: Fail
   sideEffects: None
   admissionReviewVersions:
   - v1
   clientConfig:
     service:
+      name: nginx-internal-controller-admission
       namespace: network
-      name: nginx-internal-controller-admission
       path: /networking/v1/ingresses
   objectSelector:
     matchExpressions:
     - key: ingress-class
       operator: In
       values:
--- kubernetes/storage HelmRelease: network/nginx-internal NetworkPolicy: network/nginx-internal-admission

+++ kubernetes/storage HelmRelease: network/nginx-internal NetworkPolicy: network/nginx-internal-admission

@@ -1,27 +0,0 @@

----
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: nginx-internal-admission
-  namespace: network
-  annotations:
-    helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade
-    helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded
-  labels:
-    app.kubernetes.io/name: ingress-nginx
-    app.kubernetes.io/instance: nginx-internal
-    app.kubernetes.io/part-of: ingress-nginx
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: admission-webhook
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: ingress-nginx
-      app.kubernetes.io/instance: nginx-internal
-      app.kubernetes.io/component: admission-webhook
-  policyTypes:
-  - Ingress
-  - Egress
-  egress:
-  - {}
-
--- kubernetes/storage HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-create

+++ kubernetes/storage HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-create

@@ -37,15 +37,19 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
       nodeSelector:
         kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
 
--- kubernetes/storage HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-patch

+++ kubernetes/storage HelmRelease: network/nginx-internal Job: network/nginx-internal-admission-patch

@@ -39,15 +39,19 @@

         - name: POD_NAMESPACE
           valueFrom:
             fieldRef:
               fieldPath: metadata.namespace
         securityContext:
           allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: true
+          runAsNonRoot: true
+          runAsUser: 65532
+          seccompProfile:
+            type: RuntimeDefault
       restartPolicy: OnFailure
       serviceAccountName: nginx-internal-admission
       nodeSelector:
         kubernetes.io/os: linux
-      securityContext:
-        fsGroup: 2000
-        runAsNonRoot: true
-        runAsUser: 2000
 

[bot-ross]

--- kubernetes/storage/apps/network/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: network/nginx-internal

+++ kubernetes/storage/apps/network/nginx/internal Kustomization: flux-system/nginx-internal HelmRelease: network/nginx-internal

@@ -13,13 +13,13 @@

     spec:
       chart: ingress-nginx
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
         namespace: flux-system
-      version: 4.8.3
+      version: 4.9.0
   install:
     remediation:
       retries: 3
   interval: 30m
   uninstall:
     keepHistory: false