ingress-nginx

Helm chart

Last changed

Request a free trial

Contact our team to test out this Helm chart and related images for free. Please also indicate any other images you would like to evaluate.

Tag:

## nginx configuration

## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md

global:

image:

# -- Registry host to pull images from.

registry: cgr.dev

## Overrides for generated resource names

# See templates/_helpers.tpl

# nameOverride:

# fullnameOverride:

# -- Override the deployment namespace; defaults to .Release.Namespace

namespaceOverride: ""

## Labels to apply to all resources

commonLabels: {}

# scmhash: abc123

# myLabel: aakkmd

controller:

enableAnnotationValidations: true

image:

## Keep false as default for now!

chroot: false

# registry: registry.k8s.io

image: scratch-images/test-tmp/ingress-nginx-controller

## for backwards compatibility consider setting the full image url via the repository value below

## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail

## repository:

tag: 1.15.8-r10-nginx.1.27

digest: sha256:55a5abf77a19d7051734f8f92fdb49ba697161383adad5c7ecb674ecef6bd5f6

digestChroot: ""

pullPolicy: IfNotPresent

runAsNonRoot: true

# -- This value must not be changed using the official image.

# uid=101(www-data) gid=82(www-data) groups=82(www-data)

runAsUser: 101

# -- This value must not be changed using the official image.

# uid=101(www-data) gid=82(www-data) groups=82(www-data)

runAsGroup: 82

allowPrivilegeEscalation: false

seccompProfile:

type: RuntimeDefault

readOnlyRootFilesystem: false

# -- Configures the controller container name

containerName: controller

# -- Configures the ports that the nginx-controller listens on

containerPort:

http: 80

https: 443

# -- Global configuration passed to the ConfigMap consumed by the controller. Values may contain Helm templates.

# Ref.: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/

config: {}

# -- Annotations to be added to the controller config configuration configmap.

configAnnotations: {}

# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers

proxySetHeaders: {}

# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers

addHeaders: {}

# -- Optionally customize the pod dnsConfig.

dnsConfig: {}

# -- Optionally customize the pod hostAliases.

hostAliases: []

# - ip: 127.0.0.1

# hostnames:

# - foo.local

# - bar.local

# - ip: 10.1.2.3

# hostnames:

# - foo.remote

# - bar.remote

# -- Optionally customize the pod hostname.

hostname: {}

# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.

# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller

# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.

dnsPolicy: ClusterFirst

# -- Instruct the kubelet to use the named RuntimeClass to run the pod

runtimeClassName: ""

# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network

# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply

reportNodeInternalIp: false

# -- Process Ingress objects without ingressClass annotation/ingressClassName field

# Overrides value for --watch-ingress-without-class flag of the controller binary

# Defaults to false

watchIngressWithoutClass: false

# -- Process IngressClass per name (additionally as per spec.controller).

ingressClassByName: false

# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto"

# Defaults to false

enableTopologyAwareRouting: false

# -- This configuration disable Nginx Controller Leader Election

disableLeaderElection: false

# -- Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s)

electionTTL: ""

# -- This configuration defines if Ingress Controller should allow users to set

100

# their own *-snippet annotations, otherwise this is forbidden / dropped

101

# when users add those annotations.

102

# Global snippets in ConfigMap are still respected

103

allowSnippetAnnotations: false

104

# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),

105

# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920

106

# is merged

107

hostNetwork: false

108

## Use host ports 80 and 443

109

## Disabled by default

110

hostPort:

111

# -- Enable 'hostPort' or not

112

enabled: false

113

ports:

114

# -- 'hostPort' http port

115

http: 80

116

# -- 'hostPort' https port

117

https: 443

118

# NetworkPolicy for controller component.

119

networkPolicy:

120

# -- Enable 'networkPolicy' or not

121

enabled: false

122

# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'

123

electionID: ""

124

# -- This section refers to the creation of the IngressClass resource.

125

# IngressClasses are immutable and cannot be changed after creation.

126

# We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required.

127

ingressClassResource:

128

# -- Name of the IngressClass

129

130

# -- Create the IngressClass or not

131

enabled: true

132

# -- If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation.

133

# Ingress creation gets rejected if there are multiple default IngressClasses.

134

# Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class

135

default: false

136

# -- Annotations to be added to the IngressClass resource.

137

annotations: {}

138

# -- Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value.

139

# This value is also being set as the `--controller-class` argument of this Ingress Controller.

140

# Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class

141

controllerValue: k8s.io/ingress-nginx

142

# -- Aliases of this IngressClass. Creates copies with identical settings but the respective alias as name.

143

# Useful for development environments with only one Ingress Controller but production-like Ingress resources.

144

# `default` gets enabled on the original IngressClass only.

145

aliases: []

146

# aliases:

147

# - nginx-alias-1

148

# - nginx-alias-2

149

# -- A link to a custom resource containing additional configuration for the controller.

150

# This is optional if the controller consuming this IngressClass does not require additional parameters.

151

# Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class

152

parameters: {}

153

# parameters:

154

# apiGroup: k8s.example.com

155

# kind: IngressParameters

156

# name: external-lb

157

# -- For backwards compatibility with ingress.class annotation, use ingressClass.

158

# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation

159

ingressClass: nginx

160

# -- Labels to add to the pod container metadata

161

podLabels: {}

162

# key: value

163

164

# -- Security context for controller pods

165

podSecurityContext: {}

166

# -- sysctls for controller pods

167

## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/

168

sysctls: {}

169

# sysctls:

170

# "net.core.somaxconn": "8192"

171

# -- Security context for controller containers

172

containerSecurityContext: {}

173

# -- Allows customization of the source of the IP address or FQDN to report

174

# in the ingress status field. By default, it reads the information provided

175

# by the service. If disable, the status field reports the IP address of the

176

# node or nodes where an ingress controller pod is running.

177

publishService:

178

# -- Enable 'publishService' or not

179

enabled: true

180

# -- Allows overriding of the publish service to bind to

181

# Must be <namespace>/<service_name>

182

pathOverride: ""

183

# Limit the scope of the controller to a specific namespace

184

scope:

185

# -- Enable 'scope' or not

186

enabled: false

187

# -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)

188

namespace: ""

189

# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels

190

# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.

191

namespaceSelector: ""

192

# -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)

193

configMapNamespace: ""

194

tcp:

195

# -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)

196

configMapNamespace: ""

197

# -- Annotations to be added to the tcp config configmap

198

annotations: {}

199

udp:

200

# -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)

201

configMapNamespace: ""

202

# -- Annotations to be added to the udp config configmap

203

annotations: {}

204

# -- Maxmind license key to download GeoLite2 Databases.

205

## https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/

206

maxmindLicenseKey: ""

207

# -- Additional command line arguments to pass to Ingress-Nginx Controller

208

# E.g. to specify the default SSL certificate you can use

209

extraArgs: {}

210

## extraArgs:

211

## default-ssl-certificate: "<namespace>/<secret_name>"

212

## time-buckets: "0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10"

213

## length-buckets: "10,20,30,40,50,60,70,80,90,100"

214

## size-buckets: "10,100,1000,10000,100000,1e+06,1e+07"

215

216

# -- Additional environment variables to set

217

extraEnvs: []

218

# extraEnvs:

219

# - name: FOO

220

# valueFrom:

221

# secretKeyRef:

222

# key: FOO

223

# name: secret-resource

224

225

# -- Use a `DaemonSet` or `Deployment`

226

kind: Deployment

227

# -- Annotations to be added to the controller Deployment or DaemonSet

228

229

annotations: {}

230

# keel.sh/pollSchedule: "@every 60m"

231

232

# -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels

233

234

labels: {}

235

# keel.sh/policy: patch

236

# keel.sh/trigger: poll

237

238

# -- The update strategy to apply to the Deployment or DaemonSet

239

240

updateStrategy: {}

241

# rollingUpdate:

242

# maxUnavailable: 1

243

# type: RollingUpdate

244

245

# -- Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed.

246

# Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds

247

progressDeadlineSeconds: 0

248

# -- `minReadySeconds` to avoid killing pods before we are ready

249

250

minReadySeconds: 0

251

# -- Node tolerations for server scheduling to nodes with taints

252

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/

253

254

tolerations: []

255

# - key: "key"

256

# operator: "Equal|Exists"

257

# value: "value"

258

# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"

259

260

# -- Affinity and anti-affinity rules for server scheduling to nodes

261

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

262

263

affinity: {}

264

# # An example of preferred pod anti-affinity, weight is in the range 1-100

265

# podAntiAffinity:

266

# preferredDuringSchedulingIgnoredDuringExecution:

267

# - weight: 100

268

# podAffinityTerm:

269

# labelSelector:

270

# matchExpressions:

271

# - key: app.kubernetes.io/name

272

# operator: In

273

# values:

274

# - '{{ include "ingress-nginx.name" . }}'

275

# - key: app.kubernetes.io/instance

276

# operator: In

277

# values:

278

# - '{{ .Release.Name }}'

279

# - key: app.kubernetes.io/component

280

# operator: In

281

# values:

282

# - controller

283

# topologyKey: kubernetes.io/hostname

284

285

# # An example of required pod anti-affinity

286

# podAntiAffinity:

287

# requiredDuringSchedulingIgnoredDuringExecution:

288

# - labelSelector:

289

# matchExpressions:

290

# - key: app.kubernetes.io/name

291

# operator: In

292

# values:

293

# - '{{ include "ingress-nginx.name" . }}'

294

# - key: app.kubernetes.io/instance

295

# operator: In

296

# values:

297

# - '{{ .Release.Name }}'

298

# - key: app.kubernetes.io/component

299

# operator: In

300

# values:

301

# - controller

302

# topologyKey: kubernetes.io/hostname

303

304

# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.

305

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

306

307

topologySpreadConstraints: []

308

# - labelSelector:

309

# matchLabels:

310

# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'

311

# app.kubernetes.io/instance: '{{ .Release.Name }}'

312

# app.kubernetes.io/component: controller

313

# matchLabelKeys:

314

# - pod-template-hash

315

# topologyKey: topology.kubernetes.io/zone

316

# maxSkew: 1

317

# whenUnsatisfiable: ScheduleAnyway

318

# - labelSelector:

319

# matchLabels:

320

# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'

321

# app.kubernetes.io/instance: '{{ .Release.Name }}'

322

# app.kubernetes.io/component: controller

323

# matchLabelKeys:

324

# - pod-template-hash

325

# topologyKey: kubernetes.io/hostname

326

# maxSkew: 1

327

# whenUnsatisfiable: ScheduleAnyway

328

329

# -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready

330

## wait up to five minutes for the drain of connections

331

332

terminationGracePeriodSeconds: 300

333

# -- Node labels for controller pod assignment

334

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

335

336

nodeSelector:

337

kubernetes.io/os: linux

338

## Liveness and readiness probe values

339

## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes

340

341

## startupProbe:

342

## httpGet:

343

## # should match container.healthCheckPath

344

## path: "/healthz"

345

## port: 10254

346

## scheme: HTTP

347

## initialDelaySeconds: 5

348

## periodSeconds: 5

349

## timeoutSeconds: 2

350

## successThreshold: 1

351

## failureThreshold: 5

352

livenessProbe:

353

httpGet:

354

# should match container.healthCheckPath

355

path: "/healthz"

356

port: 10254

357

scheme: HTTP

358

initialDelaySeconds: 10

359

periodSeconds: 10

360

timeoutSeconds: 1

361

successThreshold: 1

362

failureThreshold: 5

363

readinessProbe:

364

httpGet:

365

# should match container.healthCheckPath

366

path: "/healthz"

367

port: 10254

368

scheme: HTTP

369

initialDelaySeconds: 10

370

periodSeconds: 10

371

timeoutSeconds: 1

372

successThreshold: 1

373

failureThreshold: 3

374

# -- Path of the health check endpoint. All requests received on the port defined by

375

# the healthz-port parameter are forwarded internally to this path.

376

healthCheckPath: "/healthz"

377

# -- Address to bind the health check endpoint.

378

# It is better to set this option to the internal node address

379

# if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.

380

healthCheckHost: ""

381

# -- Annotations to be added to controller pods

382

383

podAnnotations: {}

384

replicaCount: 1

385

# -- Minimum available pods set in PodDisruptionBudget.

386

# Define either 'minAvailable' or 'maxUnavailable', never both.

387

minAvailable: 1

388

# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.

389

# maxUnavailable: 1

390

# -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.

391

# Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/

392

unhealthyPodEvictionPolicy: ""

393

## Define requests resources to avoid probe issues due to CPU utilization in busy nodes

394

## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903

395

## Ideally, there should be no limits.

396

## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/

397

resources:

398

## limits:

399

## cpu: 100m

400

## memory: 90Mi

401

requests:

402

cpu: 100m

403

memory: 90Mi

404

# -- Resize policy for controller containers.

405

# Ref: https://kubernetes.io/docs/tasks/configure-pod-container/resize-container-resources

406

resizePolicy: []

407

# - resourceName: cpu

408

# restartPolicy: NotRequired

409

# - resourceName: memory

410

# restartPolicy: RestartContainer

411

# Mutually exclusive with keda autoscaling

412

autoscaling:

413

enabled: false

414

annotations: {}

415

minReplicas: 1

416

maxReplicas: 11

417

targetCPUUtilizationPercentage: 50

418

targetMemoryUtilizationPercentage: 50

419

behavior: {}

420

# scaleDown:

421

# stabilizationWindowSeconds: 300

422

# policies:

423

# - type: Pods

424

# value: 1

425

# periodSeconds: 180

426

# scaleUp:

427

# stabilizationWindowSeconds: 300

428

# policies:

429

# - type: Pods

430

# value: 2

431

# periodSeconds: 60

432

autoscalingTemplate: []

433

# Custom or additional autoscaling metrics

434

# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics

435

# - type: Pods

436

# pods:

437

# metric:

438

# name: nginx_ingress_controller_nginx_process_requests_total

439

# target:

440

# type: AverageValue

441

# averageValue: 10000m

442

443

# Mutually exclusive with hpa autoscaling

444

keda:

445

apiVersion: "keda.sh/v1alpha1"

446

## apiVersion changes with keda 1.x vs 2.x

447

## 2.x = keda.sh/v1alpha1

448

## 1.x = keda.k8s.io/v1alpha1

449

enabled: false

450

minReplicas: 1

451

maxReplicas: 11

452

pollingInterval: 30

453

cooldownPeriod: 300

454

# fallback:

455

# failureThreshold: 3

456

# replicas: 11

457

restoreToOriginalReplicaCount: false

458

scaledObject:

459

annotations: {}

460

# Custom annotations for ScaledObject resource

461

# annotations:

462

# key: value

463

triggers: []

464

# - type: prometheus

465

# metadata:

466

# serverAddress: http://<prometheus-host>:9090

467

# metricName: http_requests_total

468

# threshold: '100'

469

# query: sum(rate(http_requests_total{deployment="my-deployment"}[2m]))

470

471

behavior: {}

472

# scaleDown:

473

# stabilizationWindowSeconds: 300

474

# policies:

475

# - type: Pods

476

# value: 1

477

# periodSeconds: 180

478

# scaleUp:

479

# stabilizationWindowSeconds: 300

480

# policies:

481

# - type: Pods

482

# value: 2

483

# periodSeconds: 60

484

# -- Enable mimalloc as a drop-in replacement for malloc.

485

## ref: https://github.com/microsoft/mimalloc

486

487

enableMimalloc: true

488

## Override NGINX template

489

customTemplate:

490

configMapName: ""

491

configMapKey: ""

492

service:

493

# -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.

494

enabled: true

495

external:

496

# -- Enable the external controller service or not. Useful for internal-only deployments.

497

enabled: true

498

# -- Labels to be added to the external controller service.

499

labels: {}

500

# -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.

501

annotations: {}

502

# -- Labels to be added to both controller services.

503

labels: {}

504

# -- Type of the external controller service.

505

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

506

type: LoadBalancer

507

# -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.

508

# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.

509

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address

510

clusterIP: ""

511

# -- Pre-defined cluster internal IP addresses of the external controller service. Take care of collisions with existing services.

512

# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.

513

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address

514

clusterIPs: []

515

# -- List of node IP addresses at which the external controller service is available.

516

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

517

externalIPs: []

518

# -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.

519

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer

520

loadBalancerIP: ""

521

# -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.

522

loadBalancerSourceRanges: []

523

# -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.

524

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class

525

loadBalancerClass: ""

526

# -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.

527

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation

528

# allocateLoadBalancerNodePorts: true

529

530

# -- External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it.

531

# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

532

externalTrafficPolicy: ""

533

# -- Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".

534

# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity

535

sessionAffinity: ""

536

# -- Specifies the health check node port (numeric port number) for the external controller service.

537

# If not specified, the service controller allocates a port from your cluster's node port range.

538

# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

539

# healthCheckNodePort: 0

540

541

# -- Traffic distribution policy of the external controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client.

542

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution

543

trafficDistribution: ""

544

# -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.

545

# Fields `ipFamilies` and `clusterIP` depend on the value of this field.

546

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

547

ipFamilyPolicy: SingleStack

548

# -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.

549

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

550

ipFamilies:

551

- IPv4

552

# -- Enable the HTTP listener on both controller services or not.

553

enableHttp: true

554

# -- Enable the HTTPS listener on both controller services or not.

555

enableHttps: true

556

ports:

557

# -- Port the external HTTP listener is published with.

558

http: 80

559

# -- Port the external HTTPS listener is published with.

560

https: 443

561

targetPorts:

562

# -- Port of the ingress controller the external HTTP listener is mapped to.

563

http: http

564

# -- Port of the ingress controller the external HTTPS listener is mapped to.

565

https: https

566

# -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.

567

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

568

appProtocol: true

569

nodePorts:

570

# -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.

571

http: ""

572

# -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.

573

https: ""

574

# -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.

575

# Example:

576

# tcp:

577

# 8080: 30080

578

tcp: {}

579

# -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.

580

# Example:

581

# udp:

582

# 53: 30053

583

udp: {}

584

internal:

585

# -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.

586

enabled: false

587

# -- Labels to be added to the internal controller service.

588

labels: {}

589

# -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.

590

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer

591

annotations: {}

592

# -- Type of the internal controller service.

593

# Defaults to the value of `controller.service.type`.

594

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types

595

type: ""

596

# -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.

597

# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.

598

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address

599

clusterIP: ""

600

# -- Pre-defined cluster internal IP addresses of the internal controller service. Take care of collisions with existing services.

601

# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.

602

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address

603

clusterIPs: []

604

# -- List of node IP addresses at which the internal controller service is available.

605

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

606

externalIPs: []

607

# -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.

608

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer

609

loadBalancerIP: ""

610

# -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.

611

loadBalancerSourceRanges: []

612

# -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.

613

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class

614

loadBalancerClass: ""

615

# -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.

616

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation

617

# allocateLoadBalancerNodePorts: true

618

619

# -- External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it.

620

# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

621

externalTrafficPolicy: ""

622

# -- Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".

623

# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity

624

sessionAffinity: ""

625

# -- Specifies the health check node port (numeric port number) for the internal controller service.

626

# If not specified, the service controller allocates a port from your cluster's node port range.

627

# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

628

# healthCheckNodePort: 0

629

630

# -- Traffic distribution policy of the internal controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client.

631

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution

632

trafficDistribution: ""

633

# -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.

634

# Fields `ipFamilies` and `clusterIP` depend on the value of this field.

635

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

636

ipFamilyPolicy: SingleStack

637

# -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.

638

# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services

639

ipFamilies:

640

- IPv4

641

ports: {}

642

# -- Port the internal HTTP listener is published with.

643

# Defaults to the value of `controller.service.ports.http`.

644

# http: 80

645

# -- Port the internal HTTPS listener is published with.

646

# Defaults to the value of `controller.service.ports.https`.

647

# https: 443

648

649

targetPorts: {}

650

# -- Port of the ingress controller the internal HTTP listener is mapped to.

651

# Defaults to the value of `controller.service.targetPorts.http`.

652

# http: http

653

# -- Port of the ingress controller the internal HTTPS listener is mapped to.

654

# Defaults to the value of `controller.service.targetPorts.https`.

655

# https: https

656

657

# -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.

658

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol

659

appProtocol: true

660

nodePorts:

661

# -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.

662

http: ""

663

# -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.

664

https: ""

665

# -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.

666

# Example:

667

# tcp:

668

# 8080: 30080

669

tcp: {}

670

# -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.

671

# Example:

672

# udp:

673

# 53: 30053

674

udp: {}

675

# shareProcessNamespace enables process namespace sharing within the pod.

676

# This can be used for example to signal log rotation using `kill -USR1` from a sidecar.

677

shareProcessNamespace: false

678

# -- Additional containers to be added to the controller pod.

679

# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.

680

extraContainers: []

681

# - name: my-sidecar

682

# image: nginx:latest

683

# - name: lemonldap-ng-controller

684

# image: lemonldapng/lemonldap-ng-controller:0.2.0

685

# args:

686

# - /lemonldap-ng-controller

687

# - --alsologtostderr

688

# - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration

689

# env:

690

# - name: POD_NAME

691

# valueFrom:

692

# fieldRef:

693

# fieldPath: metadata.name

694

# - name: POD_NAMESPACE

695

# valueFrom:

696

# fieldRef:

697

# fieldPath: metadata.namespace

698

# volumeMounts:

699

# - name: copy-portal-skins

700

# mountPath: /srv/var/lib/lemonldap-ng/portal/skins

701

702

# -- Additional volumeMounts to the controller main container.

703

extraVolumeMounts: []

704

# - name: copy-portal-skins

705

# mountPath: /var/lib/lemonldap-ng/portal/skins

706

707

# -- Additional volumes to the controller pod.

708

extraVolumes: []

709

# - name: copy-portal-skins

710

# emptyDir: {}

711

712

# -- Containers, which are run before the app containers are started. Values may contain Helm templates.

713

extraInitContainers: []

714

# - name: init-myservice

715

# image: busybox

716

# command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']

717

# - name: init-dynamic

718

# image: busybox

719

# command:

720

# - sh

721

# - -c

722

# - echo "Release={{ .Release.Name }} Namespace={{ .Release.Namespace }}"

723

724

# -- Modules, which are mounted into the core nginx image.

725

extraModules: []

726

# - name: mytestmodule

727

# image:

728

# # registry: registry.k8s.io

729

# image: ingress-nginx/mytestmodule

730

# ## for backwards compatibility consider setting the full image url via the repository value below

731

# ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail

732

# ## repository:

733

# tag: "v1.0.0"

734

# digest: ""

735

# distroless: false

736

# containerSecurityContext:

737

# runAsNonRoot: true

738

# runAsUser: <user-id>

739

# runAsGroup: <group-id>

740

# allowPrivilegeEscalation: false

741

# seccompProfile:

742

# type: RuntimeDefault

743

# capabilities:

744

# drop:

745

# - ALL

746

# readOnlyRootFilesystem: true

747

# resources: {}

748

749

# The image must contain a `/usr/local/bin/init_module.sh` executable, which

750

# will be executed as initContainers, to move its config files within the

751

# mounted volume.

752

753

admissionWebhooks:

754

755

annotations: {}

756

# ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem".

757

758

## Additional annotations to the admission webhooks.

759

## These annotations will be added to the ValidatingWebhookConfiguration and

760

## the Jobs Spec of the admission webhooks.

761

enabled: true

762

# -- Additional environment variables to set

763

extraEnvs: []

764

# extraEnvs:

765

# - name: FOO

766

# valueFrom:

767

# secretKeyRef:

768

# key: FOO

769

# name: secret-resource

770

# -- Admission Webhook failure policy to use

771

failurePolicy: Fail

772

# timeoutSeconds: 10

773

port: 8443

774

certificate: "/usr/local/certificates/cert"

775

key: "/usr/local/certificates/key"

776

namespaceSelector: {}

777

objectSelector: {}

778

# -- Labels to be added to admission webhooks

779

labels: {}

780

service:

781

annotations: {}

782

# clusterIP: ""

783

externalIPs: []

784

# loadBalancerIP: ""

785

loadBalancerSourceRanges: []

786

servicePort: 443

787

type: ClusterIP

788

createSecretJob:

789

790

# -- Seconds after the job finishes before it is eligible to be automatically deleted. If the field is set to 0, the Job will be eligible to be automatically deleted immediately after it finishes.

791

ttlSecondsAfterFinished: 0

792

# -- Deadline in seconds for the job to complete. Must be greater than 0 to enforce. If unset or 0, no deadline is enforced.

793

activeDeadlineSeconds: 0

794

# -- Security context for secret creation containers

795

securityContext:

796

runAsNonRoot: true

797

runAsUser: 65532

798

runAsGroup: 65532

799

allowPrivilegeEscalation: false

800

seccompProfile:

801

type: RuntimeDefault

802

capabilities:

803

drop:

804

- ALL

805

readOnlyRootFilesystem: true

806

resources: {}

807

# limits:

808

# cpu: 10m

809

# memory: 20Mi

810

# requests:

811

# cpu: 10m

812

# memory: 20Mi

813

# -- Volume mounts for secret creation containers

814

volumeMounts: []

815

# - name: certs

816

# mountPath: /etc/webhook/certs

817

# readOnly: true

818

# -- Volumes for secret creation pod

819

volumes: []

820

# - name: certs

821

# secret:

822

# secretName: my-webhook-secret

823

patchWebhookJob:

824

825

# -- Seconds after the job finishes before it is eligible to be automatically deleted. If the field is set to 0, the Job will be eligible to be automatically deleted immediately after it finishes.

826

ttlSecondsAfterFinished: 0

827

# -- Deadline in seconds for the job to complete. Must be greater than 0 to enforce. If unset or 0, no deadline is enforced.

828

activeDeadlineSeconds: 0

829

# -- Security context for webhook patch containers

830

securityContext:

831

runAsNonRoot: true

832

runAsUser: 65532

833

runAsGroup: 65532

834

allowPrivilegeEscalation: false

835

seccompProfile:

836

type: RuntimeDefault

837

capabilities:

838

drop:

839

- ALL

840

readOnlyRootFilesystem: true

841

resources: {}

842

# -- Volume mounts for webhook patch containers

843

volumeMounts: []

844

# - name: certs

845

# mountPath: /etc/webhook/certs

846

# readOnly: true

847

# -- Volumes for webhook patch pod

848

volumes: []

849

# - name: certs

850

# secret:

851

# secretName: my-webhook-secret

852

patch:

853

enabled: true

854

image:

855

# registry: registry.k8s.io

856

image: scratch-images/test-tmp/kube-webhook-certgen

857

## for backwards compatibility consider setting the full image url via the repository value below

858

## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail

859

## repository:

860

tag: 1.15.8-r10

861

digest: sha256:99df4526d0c504c11b5f1a5577be6dcea42ab5d027c3f07a19e7b649e3e220a4

862

pullPolicy: IfNotPresent

863

# -- Provide a priority class name to the webhook patching job

864

865

priorityClassName: ""

866

# -- Instruct the kubelet to use the named RuntimeClass to run the pod

867

runtimeClassName: ""

868

podAnnotations: {}

869

# NetworkPolicy for webhook patch

870

networkPolicy:

871

# -- Enable 'networkPolicy' or not

872

enabled: false

873

nodeSelector:

874

kubernetes.io/os: linux

875

tolerations: []

876

# -- Labels to be added to patch job resources

877

labels: {}

878

# -- Security context for secret creation & webhook patch pods

879

securityContext: {}

880

# -- Admission webhook patch job RBAC

881

rbac:

882

# -- Create RBAC or not

883

create: true

884

# -- Admission webhook patch job service account

885

serviceAccount:

886

# -- Create a service account or not

887

create: true

888

# -- Custom service account name

889

890

# -- Auto-mount service account token or not

891

automountServiceAccountToken: true

892

# Use certmanager to generate webhook certs

893

certManager:

894

enabled: false

895

# self-signed root certificate

896

rootCert:

897

# default to be 5y

898

duration: ""

899

# -- Revision history limit of the root certificate.

900

# Ref.: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec

901

revisionHistoryLimit: 0

902

admissionCert:

903

# default to be 1y

904

duration: ""

905

# -- Revision history limit of the webhook certificate.

906

# Ref.: https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec

907

revisionHistoryLimit: 0

908

# issuerRef:

909

# name: "issuer"

910

# kind: "ClusterIssuer"

911

metrics:

912

port: 10254

913

portName: metrics

914

# if this port is changed, change healthz-port: in extraArgs: accordingly

915

enabled: false

916

service:

917

# -- Enable the metrics service or not.

918

enabled: true

919

annotations: {}

920

# prometheus.io/scrape: "true"

921

# prometheus.io/port: "10254"

922

# -- Labels to be added to the metrics service resource

923

labels: {}

924

# clusterIP: ""

925

926

# -- List of IP addresses at which the stats-exporter service is available

927

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

928

929

externalIPs: []

930

# loadBalancerIP: ""

931

loadBalancerSourceRanges: []

932

servicePort: 10254

933

type: ClusterIP

934

# externalTrafficPolicy: ""

935

# nodePort: ""

936

serviceMonitor:

937

enabled: false

938

additionalLabels: {}

939

# -- Annotations to be added to the ServiceMonitor.

940

annotations: {}

941

## The label to use to retrieve the job name from.

942

## jobLabel: "app.kubernetes.io/name"

943

namespace: ""

944

namespaceSelector: {}

945

## Default: scrape .Release.Namespace or namespaceOverride only

946

## To scrape all, use the following:

947

## namespaceSelector:

948

## any: true

949

scrapeInterval: 30s

950

# -- Timeout after which the scrape is ended. Not being set if empty and therefore defaults to the global Prometheus scrape timeout.

951

scrapeTimeout: ""

952

# honorLabels: true

953

targetLabels: []

954

relabelings: []

955

metricRelabelings: []

956

# -- Per-scrape limit on number of labels that will be accepted for a sample.

957

labelLimit: 0

958

# -- Per-scrape limit on length of labels name that will be accepted for a sample.

959

labelNameLengthLimit: 0

960

# -- Per-scrape limit on length of labels value that will be accepted for a sample.

961

labelValueLengthLimit: 0

962

# -- Defines a per-scrape limit on the number of scraped samples that will be accepted.

963

sampleLimit: 0

964

# -- Defines a limit on the number of scraped targets that will be accepted.

965

targetLimit: 0

966

prometheusRule:

967

enabled: false

968

additionalLabels: {}

969

# -- Annotations to be added to the PrometheusRule.

970

annotations: {}

971

# namespace: ""

972

rules: []

973

# # These are just examples rules, please adapt them to your needs

974

# - alert: NGINXConfigFailed

975

# expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0

976

# for: 1s

977

# labels:

978

# severity: critical

979

# annotations:

980

# description: bad ingress config - nginx config test failed

981

# summary: uninstall the latest ingress changes to allow config reloads to resume

982

# # By default a fake self-signed certificate is generated as default and

983

# # it is fine if it expires. If `--default-ssl-certificate` flag is used

984

# # and a valid certificate passed please do not filter for `host` label!

985

# # (i.e. delete `{host!="_"}` so also the default SSL certificate is

986

# # checked for expiration)

987

# - alert: NGINXCertificateExpiry

988

# expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!="_"}) by (host) - time()) < 604800

989

# for: 1s

990

# labels:

991

# severity: critical

992

# annotations:

993

# description: ssl certificate(s) will expire in less then a week

994

# summary: renew expiring certificates to avoid downtime

995

# - alert: NGINXTooMany500s

996

# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5

997

# for: 1m

998

# labels:

999

# severity: warning

1000

# annotations:

1001

# description: Too many 5XXs

1002

# summary: More than 5% of all requests returned 5XX, this requires your attention

1003

# - alert: NGINXTooMany400s

1004

# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5

1005

# for: 1m

1006

# labels:

1007

# severity: warning

1008

# annotations:

1009

# description: Too many 4XXs

1010

# summary: More than 5% of all requests returned 4XX, this requires your attention

1011

# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:

1012

# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds

1013

# to 300, allowing the draining of connections up to five minutes.

1014

# If the active connections end before that, the pod will terminate gracefully at that time.

1015

# To effectively take advantage of this feature, the Configmap feature

1016

# worker-shutdown-timeout new value is 240s instead of 10s.

1017

1018

lifecycle:

1019

preStop:

1020

exec:

1021

command:

1022

- /wait-shutdown

1023

priorityClassName: ""

1024

# -- Rollback limit

1025

1026

revisionHistoryLimit: 10

1027

## Default 404 backend

1028

1029

defaultBackend:

1030

1031

enabled: false

1032

1033

image:

1034

# registry: registry.k8s.io

1035

image: scratch-images/test-tmp/ingress-nginx-custom-error-pages

1036

## for backwards compatibility consider setting the full image url via the repository value below

1037

## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail

1038

## repository:

1039

tag: 1.15.8-r10

1040

pullPolicy: IfNotPresent

1041

runAsNonRoot: true

1042

# nobody user -> uid 65534

1043

runAsUser: 65534

1044

runAsGroup: 65534

1045

allowPrivilegeEscalation: false

1046

seccompProfile:

1047

type: RuntimeDefault

1048

readOnlyRootFilesystem: true

1049

digest: sha256:7ec0de57920d79762c4a79bd3b7d45c5aa6799c64e7b2a22b8ade7aaa476e64a

1050

extraArgs: {}

1051

serviceAccount:

1052

create: true

1053

1054

automountServiceAccountToken: true

1055

# -- Additional environment variables to set for defaultBackend pods

1056

extraEnvs: []

1057

port: 8080

1058

## Readiness and liveness probes for default backend

1059

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/

1060

1061

livenessProbe:

1062

failureThreshold: 3

1063

initialDelaySeconds: 30

1064

periodSeconds: 10

1065

successThreshold: 1

1066

timeoutSeconds: 5

1067

readinessProbe:

1068

failureThreshold: 6

1069

initialDelaySeconds: 0

1070

periodSeconds: 5

1071

successThreshold: 1

1072

timeoutSeconds: 5

1073

# -- The update strategy to apply to the Deployment or DaemonSet

1074

1075

updateStrategy: {}

1076

# rollingUpdate:

1077

# maxUnavailable: 1

1078

# type: RollingUpdate

1079

1080

# -- `minReadySeconds` to avoid killing pods before we are ready

1081

1082

minReadySeconds: 0

1083

# -- Node tolerations for server scheduling to nodes with taints

1084

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/

1085

1086

tolerations: []

1087

# - key: "key"

1088

# operator: "Equal|Exists"

1089

# value: "value"

1090

# effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"

1091

1092

# -- Affinity and anti-affinity rules for server scheduling to nodes

1093

## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity

1094

affinity: {}

1095

# # An example of preferred pod anti-affinity, weight is in the range 1-100

1096

# podAntiAffinity:

1097

# preferredDuringSchedulingIgnoredDuringExecution:

1098

# - weight: 100

1099

# podAffinityTerm:

1100

# labelSelector:

1101

# matchExpressions:

1102

# - key: app.kubernetes.io/name

1103

# operator: In

1104

# values:

1105

# - '{{ include "ingress-nginx.name" . }}'

1106

# - key: app.kubernetes.io/instance

1107

# operator: In

1108

# values:

1109

# - '{{ .Release.Name }}'

1110

# - key: app.kubernetes.io/component

1111

# operator: In

1112

# values:

1113

# - default-backend

1114

# topologyKey: kubernetes.io/hostname

1115

1116

# # An example of required pod anti-affinity

1117

# podAntiAffinity:

1118

# requiredDuringSchedulingIgnoredDuringExecution:

1119

# - labelSelector:

1120

# matchExpressions:

1121

# - key: app.kubernetes.io/name

1122

# operator: In

1123

# values:

1124

# - '{{ include "ingress-nginx.name" . }}'

1125

# - key: app.kubernetes.io/instance

1126

# operator: In

1127

# values:

1128

# - '{{ .Release.Name }}'

1129

# - key: app.kubernetes.io/component

1130

# operator: In

1131

# values:

1132

# - default-backend

1133

# topologyKey: kubernetes.io/hostname

1134

1135

# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.

1136

# Ref.: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/

1137

topologySpreadConstraints: []

1138

# - labelSelector:

1139

# matchLabels:

1140

# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'

1141

# app.kubernetes.io/instance: '{{ .Release.Name }}'

1142

# app.kubernetes.io/component: default-backend

1143

# matchLabelKeys:

1144

# - pod-template-hash

1145

# topologyKey: topology.kubernetes.io/zone

1146

# maxSkew: 1

1147

# whenUnsatisfiable: ScheduleAnyway

1148

# - labelSelector:

1149

# matchLabels:

1150

# app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'

1151

# app.kubernetes.io/instance: '{{ .Release.Name }}'

1152

# app.kubernetes.io/component: default-backend

1153

# matchLabelKeys:

1154

# - pod-template-hash

1155

# topologyKey: kubernetes.io/hostname

1156

# maxSkew: 1

1157

# whenUnsatisfiable: ScheduleAnyway

1158

# -- Security context for default backend pods

1159

podSecurityContext: {}

1160

# -- Security context for default backend containers

1161

containerSecurityContext: {}

1162

# -- Labels to add to the pod container metadata

1163

podLabels: {}

1164

# key: value

1165

1166

# -- Node labels for default backend pod assignment

1167

## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/

1168

1169

nodeSelector:

1170

kubernetes.io/os: linux

1171

# -- Annotations to be added to default backend pods

1172

1173

podAnnotations: {}

1174

replicaCount: 1

1175

# -- Minimum available pods set in PodDisruptionBudget.

1176

# Define either 'minAvailable' or 'maxUnavailable', never both.

1177

minAvailable: 1

1178

# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.

1179

# maxUnavailable: 1

1180

# -- Eviction policy for unhealthy pods guarded by PodDisruptionBudget.

1181

# Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/

1182

unhealthyPodEvictionPolicy: ""

1183

resources: {}

1184

# limits:

1185

# cpu: 10m

1186

# memory: 20Mi

1187

# requests:

1188

# cpu: 10m

1189

# memory: 20Mi

1190

1191

extraVolumeMounts: []

1192

## Additional volumeMounts to the default backend container.

1193

# - name: copy-portal-skins

1194

# mountPath: /var/lib/lemonldap-ng/portal/skins

1195

1196

extraVolumes: []

1197

## Additional volumes to the default backend pod.

1198

# - name: copy-portal-skins

1199

# emptyDir: {}

1200

1201

extraConfigMaps: []

1202

## Additional configmaps to the default backend pod.

1203

# - name: my-extra-configmap-1

1204

# labels:

1205

# type: config-1

1206

# data:

1207

# extra_file_1.html: |

1208

#

1209

# - name: my-extra-configmap-2

1210

# labels:

1211

# type: config-2

1212

# data:

1213

# extra_file_2.html: |

1214

#

1215

1216

autoscaling:

1217

annotations: {}

1218

enabled: false

1219

minReplicas: 1

1220

maxReplicas: 2

1221

targetCPUUtilizationPercentage: 50

1222

targetMemoryUtilizationPercentage: 50

1223

# NetworkPolicy for default backend component.

1224

networkPolicy:

1225

# -- Enable 'networkPolicy' or not

1226

enabled: false

1227

service:

1228

annotations: {}

1229

# clusterIP: ""

1230

# -- Pre-defined cluster internal IP addresses of the default backend service. Take care of collisions with existing services.

1231

# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.

1232

# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address

1233

clusterIPs: []

1234

# -- List of IP addresses at which the default backend service is available

1235

## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips

1236

1237

externalIPs: []

1238

# loadBalancerIP: ""

1239

loadBalancerSourceRanges: []

1240

servicePort: 80

1241

type: ClusterIP

1242

priorityClassName: ""

1243

# -- Instruct the kubelet to use the named RuntimeClass to run the pod

1244

runtimeClassName: ""

1245

# -- Labels to be added to the default backend resources

1246

labels: {}

1247

## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266

1248

rbac:

1249

create: true

1250

scope: false

1251

serviceAccount:

1252

create: true

1253

1254

automountServiceAccountToken: true

1255

# -- Annotations for the controller service account

1256

annotations: {}

1257

# -- Optional array of imagePullSecrets containing private registry credentials

1258

## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

1259

imagePullSecrets: []

1260

# - name: secretName

1261

1262

# -- TCP service key-value pairs

1263

## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md

1264

1265

tcp: {}

1266

# "8080": "default/example-tcp-svc:9000"

1267

1268

# -- UDP service key-value pairs

1269

## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md

1270

1271

udp: {}

1272

# "53": "kube-system/kube-dns:53"

1273

1274

# -- Prefix for TCP and UDP ports names in ingress controller service

1275

## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration

1276

portNamePrefix: ""

1277

# -- (string) A base64-encoded Diffie-Hellman parameter.

1278

# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`

1279

## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param

1280

dhParam: ""

1281

The trusted source for open source

Talk to an expert

Privacy

Terms

© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.

ingress-nginx

The trusted source for open source

Product

Solutions

Customers

Resources

Company