deploy nginx ingress to internal cluster

cluster/ingress-nginx/base/kustomization.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+commonAnnotations:
+  argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+
+resources:
+# Operator deployment
+- subscription.yaml
+# Deploy cluster resources
+- scc.yaml
+- namespace.yaml
+- pvcs.yaml

cluster/ingress-nginx/base/namespace.yaml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+  labels:
+    kubernetes.io/metadata.name: nginx-ingress
+    name: nginx-ingress
+    argocd.argoproj.io/managed-by: openshift-gitops-operator
+  name: nginx-ingress
+spec:
+  finalizers:
+  - kubernetes

cluster/ingress-nginx/base/nginx-ingress-operator.yaml

@@ -0,0 +1,33 @@
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nginx-ingress-operator
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  destination:
+    name: in-cluster
+    namespace: nginx-ingress-operator
+  project: default
+  source:
+    path: cluster-applications/nginx-ingress-operator
+    repoURL: git@github.com:rblundon/MK-Labs.git
+    targetRevision: HEAD
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - RespectIgnoreDifferences=true
+    - CreateNamespace=true
+    managedNamespaceMetadata:
+      labels:
+        argocd.argoproj.io/managed-by: argocd
+  ignoreDifferences:
+  - group: apps
+    kind: Deployment
+    jsonPointers:
+    - /spec/replicas

cluster/ingress-nginx/base/pvcs.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nginx-cache
+  namespace: nginx-ingress
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: synology-nfs

cluster/ingress-nginx/base/scc.yaml

@@ -0,0 +1,44 @@
+---
+kind: SecurityContextConstraints
+apiVersion: security.openshift.io/v1
+metadata:
+  name: nginx-ingress-admin
+  annotations:
+    kubernetes.io/description: nginx-ingress-admin allows nginx-ingress to
+      use the level of capabilities it requires, while forcing all processes
+      to run as UID 101 as reflected in the official docker images.
+allowPrivilegeEscalation: false
+allowPrivilegedContainer: true
+runAsUser:
+  type: MustRunAs
+  uid: 101
+seLinuxContext:
+  type: MustRunAs
+fsGroup:
+  type: MustRunAs
+supplementalGroups:
+  type: MustRunAs
+allowHostNetwork: false
+allowHostPID: false
+allowHostPorts: false
+allowHostDirVolumePlugin: false
+allowHostIPC: false
+readOnlyRootFilesystem: false
+seccompProfiles:
+- runtime/default
+volumes:
+- configMap
+- downwardAPI
+- emptyDir
+- persistentVolumeClaim
+- projected
+- secret
+allowedCapabilities:
+- NET_BIND_SERVICE
+defaultAddCapabilities:
+- NET_BIND_SERVICE
+requiredDropCapabilities:
+- ALL
+users:
+- 'system:serviceaccount:*:nginx-ingress'
+groups: []

cluster/ingress-nginx/base/subscription.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: nginx-ingress-operator
+  namespace: openshift-operators
+spec:
+  channel: alpha
+  installPlanApproval: Automatic #Manual
+  name: nginx-ingress-operator
+  source: certified-operators
+  sourceNamespace: openshift-marketplace