deploy nginx ingress to internal cluster

cluster/ingress-nginx/Chart.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v2
+name: ingress-nginx-umbrella
+description: A helm chart to include ingress-nginx with values
+type: application
+version: 0.1.0
+appVersion: 0.1.0
+
+dependencies:
+- name: ingress-nginx
+  version: v1.13.0
+  repository: https://charts.jetstack.io
+  alias: ingress-nginx
+  condition: ingress-nginx.enabled

cluster/ingress-nginx/base/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- subscription.yaml
+# Deploy cluster resources
+- scc.yaml
+- namespace.yaml
+- pvcs.yaml

cluster/ingress-nginx/base/namespace.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  labels:
+    kubernetes.io/metadata.name: nginx-ingress
+    name: nginx-ingress
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+  name: nginx-ingress
+spec:
+  finalizers:
+  - kubernetes

cluster/ingress-nginx/base/nginx-ingress-operator.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nginx-ingress-operator
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  destination:
+    name: in-cluster
+    namespace: nginx-ingress-operator
+  project: default
+  source:
+    path: cluster-applications/nginx-ingress-operator
+    repoURL: git@github.com:rblundon/MK-Labs.git
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: argocd
+  ignoreDifferences:
+  - group: apps
+    kind: Deployment
+    jsonPointers:
+    - /spec/replicas

cluster/ingress-nginx/base/pvcs.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nginx-cache
+  namespace: nginx-ingress
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: synology-nfs

cluster/ingress-nginx/base/scc.yaml

@@ -0,0 +1,44 @@
+---
+kind: SecurityContextConstraints
+apiVersion: security.openshift.io/v1
+metadata:
+  name: nginx-ingress-admin
+  annotations:
+    kubernetes.io/description: nginx-ingress-admin allows nginx-ingress to
+      use the level of capabilities it requires, while forcing all processes
+      to run as UID 101 as reflected in the official docker images.
+allowPrivilegeEscalation: false
+allowPrivilegedContainer: true
+runAsUser:
+  type: MustRunAs
+  uid: 101
+seLinuxContext:
+  type: MustRunAs
+fsGroup:
+  type: MustRunAs
+supplementalGroups:
+  type: MustRunAs
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+readOnlyRootFilesystem: false
+seccompProfiles:
+- runtime/default
+volumes:
+- configMap
+- downwardAPI
+- emptyDir
+- persistentVolumeClaim
+- projected
+- secret
+allowedCapabilities:
+- NET_BIND_SERVICE
+defaultAddCapabilities:
+- NET_BIND_SERVICE
+requiredDropCapabilities:
+- ALL
+users:
+- 'system:serviceaccount:*:nginx-ingress'
+groups: []

cluster/ingress-nginx/base/subscription.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: nginx-ingress-operator
+  namespace: openshift-operators
+spec:
+  channel: alpha
+  installPlanApproval: Automatic #Manual
+  name: nginx-ingress-operator
+  source: certified-operators
+  sourceNamespace: openshift-marketplace

cluster/ingress-nginx/overlays/external/ingresscontroller.yaml

@@ -0,0 +1,96 @@
+---
+kind: NginxIngress
+apiVersion: charts.nginx.org/v1alpha1
+metadata:
+  name: nginxingress-external
+  namespace: nginx-ingress-external
+spec:
+#  routeSelector:
+#    matchLabels:
+#      type: external-ingress
+  controller:
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: nginx-external
+              app.kubernetes.io/name: nginx-external
+          topologyKey: kubernetes.io/hostname
+    config:
+      entries:
+        http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m
+          max_size=10g inactive=60m use_temp_path=off;
+        log-format-escaping: json
+        log-format: |-
+          {
+            "msec": "$msec",
+            "connection": "$connection",
+            "connection_requests": "$connection_requests",
+            "pid": "$pid",
+            "request_id": "$request_id",
+            "request_length": "$request_length",
+            "remote_addr": "$remote_addr",
+            "remote_user": "$remote_user",
+            "remote_port": "$remote_port",
+            "time_local": "$time_local",
+            "time_iso8601": "$time_iso8601",
+            "request": "$request",
+            "request_uri": "$request_uri",
+            "args": "$args",
+            "status": "$status",
+            "body_bytes_sent": "$body_bytes_sent",
+            "bytes_sent": "$bytes_sent",
+            "http_referer": "$http_referer",
+            "http_user_agent": "$http_user_agent",
+            "http_x_forwarded_for": "$http_x_forwarded_for",
+            "http_host": "$http_host",
+            "server_name": "$server_name",
+            "request_time": "$request_time",
+            "upstream": "$upstream_addr",
+            "upstream_connect_time": "$upstream_connect_time",
+            "upstream_header_time": "$upstream_header_time",
+            "upstream_response_time": "$upstream_response_time",
+            "upstream_response_length": "$upstream_response_length",
+            "upstream_cache_status": "$upstream_cache_status",
+            "ssl_protocol": "$ssl_protocol",
+            "ssl_cipher": "$ssl_cipher",
+            "scheme": "$scheme",
+            "request_method": "$request_method",
+            "server_protocol": "$server_protocol",
+            "pipe": "$pipe",
+            "gzip_ratio": "$gzip_ratio",
+            "http_cf_ray": "$http_cf_ray"
+          }
+    enableCustomResources: true
+    enableTLSPassthrough: true
+    enableSnippets: true
+    image:
+      pullPolicy: IfNotPresent
+      repository: nginx/nginx-ingress
+      tag: 3.7.0-ubi
+    ingressClass:
+      create: true
+      name: nginx-external
+      setAsDefaultIngress: true
+    replicaCount: 2
+    reportIngressStatus:
+      annotations: {}
+      enable: true
+      enableLeaderElection: true
+      ingressLink: ''
+      leaderElectionLockName: external-ingress-leader
+    service:
+      externalTrafficPolicy: Local
+      loadBalancerIP: 10.1.82.0
+    prometheus:
+      create: true
+    serviceMonitor:
+      create: true
+    volumes:
+    - name: nginx-cache
+      persistentVolumeClaim:
+        claimName: nginx-cache-external
+    volumeMounts:
+    - name: nginx-cache
+      mountPath: /var/cache/nginx

cluster/ingress-nginx/overlays/external/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- ../../base

cluster/ingress-nginx/overlays/internal/ingresscontroller.yaml

@@ -0,0 +1,96 @@
+---
+kind: NginxIngress
+apiVersion: charts.nginx.org/v1alpha1
+metadata:
+  name: nginxingress-internal
+  namespace: nginx-ingress-internal
+spec:
+  routeSelector:
+    matchLabels:
+      type: internal-ingress
+  controller:
+    affinity:
+      podAntiAffinity:
+        requiredDuringSchedulingIgnoredDuringExecution:
+        - labelSelector:
+            matchLabels:
+              app.kubernetes.io/instance: nginx-internal
+              app.kubernetes.io/name: nginx-internal
+          topologyKey: kubernetes.io/hostname
+    config:
+      entries:
+        http-snippets: proxy_cache_path /tmp/nginx_cache levels=1:2 keys_zone=static-cache:10m
+          max_size=10g inactive=60m use_temp_path=off;
+        log-format-escaping: json
+        log-format: |-
+          {
+            "msec": "$msec",
+            "connection": "$connection",
+            "connection_requests": "$connection_requests",
+            "pid": "$pid",
+            "request_id": "$request_id",
+            "request_length": "$request_length",
+            "remote_addr": "$remote_addr",
+            "remote_user": "$remote_user",
+            "remote_port": "$remote_port",
+            "time_local": "$time_local",
+            "time_iso8601": "$time_iso8601",
+            "request": "$request",
+            "request_uri": "$request_uri",
+            "args": "$args",
+            "status": "$status",
+            "body_bytes_sent": "$body_bytes_sent",
+            "bytes_sent": "$bytes_sent",
+            "http_referer": "$http_referer",
+            "http_user_agent": "$http_user_agent",
+            "http_x_forwarded_for": "$http_x_forwarded_for",
+            "http_host": "$http_host",
+            "server_name": "$server_name",
+            "request_time": "$request_time",
+            "upstream": "$upstream_addr",
+            "upstream_connect_time": "$upstream_connect_time",
+            "upstream_header_time": "$upstream_header_time",
+            "upstream_response_time": "$upstream_response_time",
+            "upstream_response_length": "$upstream_response_length",
+            "upstream_cache_status": "$upstream_cache_status",
+            "ssl_protocol": "$ssl_protocol",
+            "ssl_cipher": "$ssl_cipher",
+            "scheme": "$scheme",
+            "request_method": "$request_method",
+            "server_protocol": "$server_protocol",
+            "pipe": "$pipe",
+            "gzip_ratio": "$gzip_ratio",
+            "http_cf_ray": "$http_cf_ray"
+          }
+    enableCustomResources: true
+    enableTLSPassthrough: true
+    enableSnippets: true
+    image:
+      pullPolicy: IfNotPresent
+      repository: nginx/nginx-ingress
+      tag: 3.7.0-ubi
+    ingressClass:
+      create: true
+      name: nginx-internal
+      setAsDefaultIngress: false
+    replicaCount: 2
+    reportIngressStatus:
+      annotations: {}
+      enable: true
+      enableLeaderElection: true
+      ingressLink: ''
+      leaderElectionLockName: internal-ingress-leader
+    service:
+      externalTrafficPolicy: Local
+      loadBalancerIP: 10.1.82.2
+    prometheus:
+      create: true
+    serviceMonitor:
+      create: true
+    volumes:
+    - name: nginx-cache
+      persistentVolumeClaim:
+        claimName: nginx-cache-internal
+    volumeMounts:
+    - name: nginx-cache
+      mountPath: /var/cache/nginx

cluster/ingress-nginx/overlays/internal/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+- ../../base

cluster/ingress-nginx/values-internal.yaml

@@ -0,0 +1,6 @@
+---
+## nginx configuration
+## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md
+
+ingress-nginx:
+  enabled: true