Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update default backend to add TLS >=1.2 support #9166

Open
wants to merge 21 commits into
base: main
Choose a base branch
from
Open

Update default backend to add TLS >=1.2 support #9166

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
c4d559a
Add configmap for custom message in default backend
JJotah Oct 15, 2022
d3f8f06
Updating default-backend-deployment to use the new configmap and images
JJotah Oct 15, 2022
8e9c000
Update values yaml file due security reasons in default backend
JJotah Oct 15, 2022
10e3e6f
Update chart.yaml with new changes
JJotah Oct 15, 2022
80b5022
Update values.yaml file with the new changes
JJotah Oct 15, 2022
d9ed1c4
Update Changelog due security issue TLS < 1.2
JJotah Oct 15, 2022
ad86933
update values with new conf for lint
JJotah Oct 15, 2022
794bc39
Update README with helm-docs
JJotah Oct 15, 2022
76d38c8
Merge branch 'kubernetes:main' into main
JJotah Oct 18, 2022
cf4dfe3
Update Chart.yaml file
JJotah Oct 18, 2022
cad6312
Update README with helm-docs
JJotah Oct 18, 2022
57abe3d
Updating default-backend-deployment to make it sure in security terms
JJotah Oct 18, 2022
343fee0
Update default-backend-service with new non-root port
JJotah Oct 18, 2022
a790354
Update default values file
JJotah Oct 18, 2022
6f5782f
Add new conf for non-root user in default-backend pod
JJotah Oct 18, 2022
13af0cc
Update default values.yaml file
JJotah Oct 18, 2022
65847da
Update changelog because is not needed by release notes
JJotah Oct 19, 2022
5dce391
Use same version that were using for ingress
JJotah Oct 19, 2022
bec234e
Update README due nginx version
JJotah Oct 19, 2022
67d5283
Set as false the DefaultBackend by default
JJotah Oct 19, 2022
687e5ff
Update README due values defaultBackend to false
JJotah Oct 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 22 additions & 5 deletions charts/ingress-nginx/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,20 +435,37 @@ Kubernetes: `>=1.20.0-0`
| defaultBackend.autoscaling.targetCPUUtilizationPercentage | int | `50` | |
| defaultBackend.autoscaling.targetMemoryUtilizationPercentage | int | `50` | |
| defaultBackend.containerSecurityContext | object | `{}` | Security Context policies for controller main container. See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls # |
| defaultBackend.defaultBackendMessage | string | `"Default Backend - 404"` | |
| defaultBackend.enabled | bool | `false` | |
| defaultBackend.existingPsp | string | `""` | Use an existing PSP instead of creating one |
| defaultBackend.extraArgs | object | `{}` | |
| defaultBackend.extraEnvs | list | `[]` | Additional environment variables to set for defaultBackend pods |
| defaultBackend.extraVolumeMounts | list | `[]` | |
| defaultBackend.extraVolumes | list | `[]` | |
| defaultBackend.extraVolumeMounts[0].mountPath | string | `"/usr/share/nginx/html/index.html"` | |
| defaultBackend.extraVolumeMounts[0].name | string | `"config"` | |
| defaultBackend.extraVolumeMounts[0].readOnly | bool | `true` | |
| defaultBackend.extraVolumeMounts[0].subPath | string | `"index.html"` | |
| defaultBackend.extraVolumeMounts[1].mountPath | string | `"/var/cache/nginx/"` | |
| defaultBackend.extraVolumeMounts[1].name | string | `"nginx-empty"` | |
| defaultBackend.extraVolumeMounts[2].mountPath | string | `"/var/run/"` | |
| defaultBackend.extraVolumeMounts[2].name | string | `"nginx-run"` | |
| defaultBackend.extraVolumeMounts[3].mountPath | string | `"/etc/nginx/conf.d/default.conf"` | |
| defaultBackend.extraVolumeMounts[3].name | string | `"nginx-conf"` | |
| defaultBackend.extraVolumeMounts[3].subPath | string | `"default.conf"` | |
| defaultBackend.extraVolumes[0].configMap.name | string | `"default-backend-message-configmap"` | |
| defaultBackend.extraVolumes[0].name | string | `"config"` | |
| defaultBackend.extraVolumes[1].emptyDir | object | `{}` | |
| defaultBackend.extraVolumes[1].name | string | `"nginx-empty"` | |
| defaultBackend.extraVolumes[2].emptyDir | object | `{}` | |
| defaultBackend.extraVolumes[2].name | string | `"nginx-run"` | |
| defaultBackend.extraVolumes[3].configMap.name | string | `"default-backend-nginx-conf-configmap"` | |
| defaultBackend.extraVolumes[3].name | string | `"nginx-conf"` | |
| defaultBackend.image.allowPrivilegeEscalation | bool | `false` | |
| defaultBackend.image.image | string | `"defaultbackend-amd64"` | |
| defaultBackend.image.pullPolicy | string | `"IfNotPresent"` | |
| defaultBackend.image.readOnlyRootFilesystem | bool | `true` | |
| defaultBackend.image.registry | string | `"registry.k8s.io"` | |
| defaultBackend.image.repository | string | `"nginx"` | |
| defaultBackend.image.runAsNonRoot | bool | `true` | |
| defaultBackend.image.runAsUser | int | `65534` | |
| defaultBackend.image.tag | string | `"1.5"` | |
| defaultBackend.image.tag | string | `"1.19.10-alpine"` | |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we use the last nginx version?

| defaultBackend.labels | object | `{}` | Labels to be added to the default backend resources |
| defaultBackend.livenessProbe.failureThreshold | int | `3` | |
| defaultBackend.livenessProbe.initialDelaySeconds | int | `30` | |
Expand Down
19 changes: 19 additions & 0 deletions charts/ingress-nginx/templates/default-backend-configmap-nginxconf.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
apiVersion: v1
data:
default.conf: |
server {
listen {{ .Values.defaultBackend.port }};
listen [::]:{{ .Values.defaultBackend.port }};
server_name localhost;
location / {
root /usr/share/nginx/html;
index index.html index.htm;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root /usr/share/nginx/html;
}
}
kind: ConfigMap
metadata:
name: default-backend-nginx-conf-configmap
10 changes: 10 additions & 0 deletions charts/ingress-nginx/templates/default-backend-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
apiVersion: v1
data:
index.html: |
<h1>{{ .Values.defaultBackend.defaultBackendMessage }}</h1>
kind: ConfigMap
metadata:
labels:
{{- include "ingress-nginx.labels" . | nindent 4 }}
name: default-backend-message-configmap
namespace: {{ .Release.Namespace }}
4 changes: 2 additions & 2 deletions charts/ingress-nginx/templates/default-backend-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ spec:
{{- end }}
livenessProbe:
httpGet:
path: /healthz
path: /
port: {{ .Values.defaultBackend.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.defaultBackend.livenessProbe.initialDelaySeconds }}
Expand All @@ -83,7 +83,7 @@ spec:
failureThreshold: {{ .Values.defaultBackend.livenessProbe.failureThreshold }}
readinessProbe:
httpGet:
path: /healthz
path: /
port: {{ .Values.defaultBackend.port }}
scheme: HTTP
initialDelaySeconds: {{ .Values.defaultBackend.readinessProbe.initialDelaySeconds }}
Expand Down
2 changes: 1 addition & 1 deletion charts/ingress-nginx/templates/default-backend-service.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ spec:
- name: http
port: {{ .Values.defaultBackend.service.servicePort }}
protocol: TCP
targetPort: http
targetPort: {{ .Values.defaultBackend.port }}
{{- if semverCompare ">=1.20" .Capabilities.KubeVersion.Version }}
appProtocol: http
{{- end }}
Expand Down
37 changes: 31 additions & 6 deletions charts/ingress-nginx/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -772,19 +772,21 @@ defaultBackend:

name: defaultbackend
image:
registry: registry.k8s.io
image: defaultbackend-amd64
repository: nginx
tag: 1.19.10-alpine
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here, let's use latest nginx version (not :latest, but v1.22 etc)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets go ahead and use
cgr.dev/chainguard/nginx:1.23.1@sha256:310f9a01fc3e7a9410ae7ea1d9cac5add66d3f95d081efa6693a829e1b6aaa70

## for backwards compatibility consider setting the full image url via the repository value below
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
## repository:
tag: "1.5"
pullPolicy: IfNotPresent
# nobody user -> uid 65534
runAsUser: 65534
runAsNonRoot: true
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false

# Default Backend Message to show
defaultBackendMessage: "Default Backend - 404"

# -- Use an existing PSP instead of creating one
existingPsp: ""

Expand All @@ -797,6 +799,7 @@ defaultBackend:
# -- Additional environment variables to set for defaultBackend pods
extraEnvs: []

# Port to Open in the Default Backend Container > 1000 (NON ROOT PORT)
port: 8080

## Readiness and liveness probes for default backend
Expand All @@ -814,7 +817,6 @@ defaultBackend:
periodSeconds: 5
successThreshold: 1
timeoutSeconds: 5

# -- Node tolerations for server scheduling to nodes with taints
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
##
Expand Down Expand Up @@ -864,12 +866,35 @@ defaultBackend:
# cpu: 10m
# memory: 20Mi

extraVolumeMounts: []
extraVolumeMounts:
- name: config
mountPath: "/usr/share/nginx/html/index.html"
subPath: index.html
readOnly: true
- mountPath: /var/cache/nginx/
name: nginx-empty
- mountPath: /var/run/
name: nginx-run
- name: nginx-conf
mountPath: "/etc/nginx/conf.d/default.conf"
subPath: default.conf

## Additional volumeMounts to the default backend container.
# - name: copy-portal-skins
# mountPath: /var/lib/lemonldap-ng/portal/skins

extraVolumes: []
extraVolumes:
- name: config
configMap:
name: default-backend-message-configmap
- name: nginx-empty
emptyDir: {}
- name: nginx-run
emptyDir: {}
- name: nginx-conf
configMap:
name: default-backend-nginx-conf-configmap

## Additional volumes to the default backend pod.
# - name: copy-portal-skins
# emptyDir: {}
Expand Down