Improve Helm Chart

Several improvements to Helm Chart necessary for any production
environment

The Helm Chart now supports:
* RBAC
* ConfigMap
* Replica
* NodePort and LoadBalancer Services
* Custom IC Args

Update Chart files
Follow best practices
Update Documentation
Fix IBM ICP bugs

helm-chart/Chart.yaml

@@ -1,13 +1,15 @@
 name: nginx-ingress
-version: 0.0.1
-appVersion: 0.0.1
+version: 0.1.0
+appVersion: 1.2.0
 description: NGINX Ingress Controller
-sources: 
+sources:
   - https://github.com/nginxinc/kubernetes-ingress/tree/master/helm-chart
 keywords:
   - ingress
   - nginx
 maintainers:
   - name: Damian Curry
     email: [email protected]
+  - name: Dean Coakley
+    email: [email protected]
 

helm-chart/README.md

@@ -2,36 +2,48 @@
 
 ## Introduction
 
-This chart deploys the NGINX Ingress controller in your Kubernetes cluster. 
+This chart deploys the NGINX Ingress controller in your Kubernetes cluster.
 
 ## Prerequisites
 
   - Kubernetes 1.6+.
-  - If you’d like to use NGINX Plus, you need to build your own Docker image and push it to your private registry by following the instructions from [here](../nginx-controller/README.md).
+  - Helm 2.8.x+.
+  - Git.
+  - If you’d like to use NGINX Plus:
+    - Build an Ingress controller image with NGINX Plus and push it to your private registry by following the instructions from [here](../nginx-controller/README.md).
+    - Update the `controller.image.repository` field of the `values-plus.yaml` accordingly.
 
 ## Installing the Chart
 
-To install the chart with the release name my-release:
+1. Clone the Ingress controller repo:
+    ```
+    $ git clone [email protected]:nginxinc/kubernetes-ingress.git
+    ```
+2. Change your working directory to /helm-chart:
+    ```
+    $ cd kubernetes-ingress/helm-chart
+    ```
+3. To install the chart with the release name my-release (my-release is the name that you choose):
 
-For NGINX: 
-```console
-$ git clone [email protected]:nginxinc/kubernetes-ingress.git
-$ helm install --name my-release kubernetes-ingress/helm-chart/
-```
+    For NGINX:
+    ```
+    $ helm install --name my-release .
+    ```
 
-For NGINX Plus:
-```console
-$ git clone [email protected]:nginxinc/kubernetes-ingress.git
-$ helm install --name my-release -f kubernetes-ingress/helm-chart/values-plus.yaml kubernetes-ingress/helm-chart/
-```
+    For NGINX Plus:
+    ```
+    $ helm install --name my-release -f values-plus.yaml .
+    ```
 
-The command deploys the Ingress controller in your Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.
+    The command deploys the Ingress controller in your Kubernetes cluster in the default configuration. The configuration section lists the parameters that can be configured during installation.
 
-> **Tip**: List all releases using helm list
+    When deploying the Ingress controller, make sure to use your own TLS certificate and key for the default server rather than the default pre-generated ones. Read the [Configuration](#Configuration) section below to see how to configure a TLS certificate and key for the default server. Note that the default server returns the Not Found page with the 404 status code for all requests for domains for which there are no Ingress rules defined.
+
+> **Tip**: List all releases using `helm list`
 
 ## Uninstalling the Chart
 
-To uninstall/delete the my-release
+To uninstall/delete the release `my-release`
 
 ```console
 $ helm delete my-release
@@ -47,23 +59,31 @@ Parameter | Description | Default
 --- | --- | ---
 `controller.name` | The name of the Ingress controller daemon set or deployment. | nginx-ingress
 `controller.kind` | The kind of the Ingress controller installation - deployment or daemonset. | deployment
-`controller.nginxplus` | Should NGINX Plus be deployed. | false
-`controller.hostNetwork` | If the nginx deployment / daemonset should run on the host's network namespace. | false
+`controller.nginxplus` | Deploys the Ingress controller for NGINX Plus. | false
+`controller.hostNetwork` | Enables the Ingress controller pods to use the host's network namespace. | false
 `controller.image.repository` | The image repository of the Ingress controller. | nginx/nginx-ingress
 `controller.image.tag` | The tag of the Ingress controller image. | 1.2.0
 `controller.image.pullPolicy` | The pull policy for the Ingress controller image. | IfNotPresent
 `controller.config.entries` | The entries of the ConfigMap for customizing NGINX configuration. | { }
-`controller.defaultTLS.cert` | The TLS certificate for the default HTTPS server. | None
-`controller.defaultTLS.key` | The  TLS key for the default HTTPS server. | None
-`controller.nodeselector` | The node selectorlabels for pod assignment for the Ingress controller pods. | { }
+`controller.defaultTLS.cert` | The base64-encoded TLS certificate for the default HTTPS server. If not specified, a pre-generated self-signed certificate is used. **Note:** It is recommended that you specify your own certificate. | A pre-generated self-signed certificate.
+`controller.defaultTLS.key` | The base64-encoded TLS key for the default HTTPS server. **Note:** If not specified, a pre-generated key is used. It is recommended that you specify your own key. | A pre-generated key.
+`controller.defaultTLS.secret` | The secret with a TLS certificate and key for the default HTTPS server. The value must follow the following format: `<namespace>/<name>`. Used as an alternative to specifiying a certifcate and key using `controller.defaultTLS.cert` and `controller.defaultTLS.key` parameters. | None
+`controller.nodeSelector` | The node selector for pod assignment for the Ingress controller pods. | { }
 `controller.terminationGracePeriodSeconds` | The termination grace period of the Ingress controller pod. | 30
-`controller.tolerations` | The tolerations required for the IBM Cloud Platform installation. | None
-
-
-
-## Limitations
-
-This is a preview version of our helm chart. It has limitations including support for cloud installations (except for the IBM Cloud Platform) and RBAC.  This version is not suitable for using in production environments.
-
-
+`controller.tolerations` | The tolerations required for the IBM Cloud Private installation. | None
+`controller.replicaCount` | The number of replicas of the Ingress controller deployment. | 1
+`controller.service.create` | Creates a service to expose the Ingress controller pods. | true
+`controller.service.type` | The type of service to create for the Ingress controller. | LoadBalancer
+`controller.service.externalTrafficPolicy` | The externalTrafficPolicy of the service. The value Local preserves the client source IP. | Local
+`controller.service.annotations` | The annotations of the Ingress controller service. | {}
+`controller.serviceAccountName` | The serviceAccountName of the Ingress controller pods. Used for RBAC. | nginx-ingress
+`rbac.create` | Configures RBAC. | true
+
+Example:
+```
+$ cd kubernetes-ingress/helm-chart
+$ helm install --name my-release . --set controller.replicaCount=5
+```
 
+## Notes
+* The values-icp.yaml file is used for deploying the Ingress controller on IBM Cloud Private. See the [blog post](https://www.nginx.com/blog/nginx-ingress-controller-ibm-cloud-private/) for more details.

helm-chart/templates/NOTES.txt

@@ -0,0 +1 @@
+The NGINX Ingress Controller has been installed.

helm-chart/templates/controller-configmap.yaml

@@ -2,6 +2,11 @@ apiVersion: v1
 kind: ConfigMap
 metadata:
   name: nginx-config
+  labels:
+    app: {{ .Values.controller.name | trunc 63 }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
 data:
 {{- if .Values.controller.config.entries }}
 {{ toYaml .Values.controller.config.entries | indent 2 }}

helm-chart/templates/controller-daemonset.yaml

@@ -2,21 +2,26 @@
 apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
-  name: {{ .Values.controller.name }}
+  name: {{ .Values.controller.name | trunc 63 }}
+  labels:
+    app: {{ .Values.controller.name | trunc 63 }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
 spec:
-  selector: 
-    matchLabels: 
-      app: nginx-ingress
+  selector:
+    matchLabels:
+      app: {{ .Values.controller.name | trunc 63 }}
   template:
     metadata:
       labels:
-        app: nginx-ingress
+        app: {{ .Values.controller.name | trunc 63 }}
     spec:
 {{- if .Values.controller.serviceAccountName }}
       serviceAccountName: {{ .Values.controller.serviceAccountName }}
 {{- end }}
-      terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds | default 30 }}
-{{- if .Values.controller.nodeselector }}
+      terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
+{{- if .Values.controller.nodeSelector }}
       nodeSelector:
 {{ toYaml .Values.controller.nodeSelector | indent 8 }}
 {{- end }}
@@ -30,7 +35,7 @@ spec:
 {{- end }}
       hostNetwork: {{ .Values.controller.hostNetwork }}
       containers:
-      - name: {{ .Values.controller.name }}
+      - name: {{ .Values.controller.name | trunc 63 }}
         image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
         imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
         ports:
@@ -46,9 +51,25 @@ spec:
             fieldRef:
               fieldPath: metadata.namespace
         args:
-{{- if eq .Values.controller.nginxplus "true" }}
+{{- if .Values.controller.nginxplus }}
           - -nginx-plus
 {{- end }}
           - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
+{{- if .Values.controller.defaultTLS.secret }}
+          - -default-server-tls-secret={{ .Values.controller.defaultTLS.secret }}
+{{ else }}
           - -default-server-tls-secret=$(POD_NAMESPACE)/default-server-secret
-{{- end }}
+{{- end }}
+{{- if .Values.controller.ingressClass }}
+          - -ingress-class={{ .Values.controller.ingressClass }}
+{{- end }}
+{{- if .Values.controller.useIngressClassOnly }}
+          - -use-ingress-class-only={{ .Values.controller.useIngressClassOnly }}
+{{- end }}
+{{- if .Values.controller.watchNamespace }}
+          - -watch-namespace={{ .Values.controller.watchNamespace }}
+{{- end }}
+{{- if .Values.controller.healthStatus }}
+          - -health-status
+{{- end }}
+{{- end }}

helm-chart/templates/controller-deployment.yaml

@@ -2,24 +2,29 @@
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
-  name: {{ .Values.controller.name }}
+  name: {{ .Values.controller.name | trunc 63 }}
+  labels:
+    app: {{ .Values.controller.name | trunc 63 }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
 spec:
-  replicas: {{ .Values.controller.replicacount | default 1 }}
+  replicas: {{ .Values.controller.replicaCount }}
   selector:
     matchLabels:
-      app: nginx-ingress
+      app: {{ .Values.controller.name | trunc 63 }}
   template:
     metadata:
       labels:
-        app: nginx-ingress
+        app: {{ .Values.controller.name | trunc 63 }}
     spec:
 {{- if .Values.controller.serviceAccountName }}
       serviceAccountName: {{ .Values.controller.serviceAccountName }}
 {{- end }}
       hostNetwork: {{ .Values.controller.hostNetwork }}
       containers:
       - image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
-        name: {{ .Values.controller.name }}
+        name: {{ .Values.controller.name | trunc 63 }}
         imagePullPolicy: "{{ .Values.controller.image.pullPolicy }}"
         ports:
         - name: http
@@ -32,9 +37,25 @@ spec:
             fieldRef:
               fieldPath: metadata.namespace
         args:
-{{- if eq .Values.controller.nginxplus "true" }}
+{{- if .Values.controller.nginxplus }}
           - -nginx-plus
 {{- end }}
           - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
+{{- if .Values.controller.defaultTLS.secret }}
+          - -default-server-tls-secret={{ .Values.controller.defaultTLS.secret }}
+{{ else }}
           - -default-server-tls-secret=$(POD_NAMESPACE)/default-server-secret
-{{- end }}
+{{- end }}
+{{- if .Values.controller.ingressClass }}
+          - -ingress-class={{ .Values.controller.ingressClass }}
+{{- end }}
+{{- if .Values.controller.useIngressClassOnly }}
+          - -use-ingress-class-only={{ .Values.controller.useIngressClassOnly }}
+{{- end }}
+{{- if .Values.controller.watchNamespace }}
+          - -watch-namespace={{ .Values.controller.watchNamespace }}
+{{- end }}
+{{- if .Values.controller.healthStatus }}
+          - -health-status
+{{- end }}
+{{- end }}

helm-chart/templates/controller-secret.yaml

@@ -1,8 +1,15 @@
+{{ if not .Values.controller.defaultTLS.secret }}
 apiVersion: v1
 kind: Secret
 metadata:
   name: default-server-secret
+  labels:
+    app: {{ .Values.controller.name | trunc 63 }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
 type: Opaque
 data:
-  tls.crt: {{ .Values.controller.defaultTLS.cert | default "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURTVENDQWpHZ0F3SUJBZ0lKQUs5L2NDNWZocDJHTUEwR0NTcUdTSWIzRFFFQkJRVUFNQ0V4SHpBZEJnTlYKQkFNVEZrNUhTVTVZU1c1bmNtVnpjME52Ym5SeWIyeHNaWEl3SGhjTk1UY3dPRE14TVRBeE16UTRXaGNOTVRndwpPRE14TVRBeE16UTRXakFoTVI4d0hRWURWUVFERXhaT1IwbE9XRWx1WjNKbGMzTkRiMjUwY205c2JHVnlNSUlCCklqQU5CZ2txaGtpRzl3MEJBUUVGQUFPQ0FROEFNSUlCQ2dLQ0FRRUF0bXhhMDhadExIaWxleWhOUWN5OUl4ankKWTBYdy9CRmZvM3duMDRsSXRoaGRxbkZ3NTZIVG1RVjIvbnEyRUxMdTNoejNjc3Urc3M5WFEzL3BrbXVwTEE5TApuaVVRZFVNcER4VlE1VFFKRW5CanJ5aXc4RWFlcEp4NUNCYVB5V3ZSZkpPb0pFSW56ZmNaYnE4OEVmQklYOHdtClFCa0xlcnFTVmRYWjBXR3FINVVQVlVZMVBqZXBqSXAyZ0NvbDRMUjM1aHRlSk9OMmZVTEF6cmRGMDBDT092WGsKUzgwRGw5eHdoUkVwVWVySGNuNXZod3BJazNkY3FNS3BxWTY2elF3dStMcFJEM3ZVWjR0eC9VYnlUdStkMkdhVwpWaG1RLy85RmtzUzVBS1d2ZXkrK3pPUTFDZTAxNzhDU0hRYXRDaWFuU2lTT3lwakZtTUZ0N1Mra25pbm9Xd0lECkFRQUJvNEdETUlHQU1CMEdBMVVkRGdRV0JCUlFUODVHRzV6a0QxV3FNSzZvOW8xWWFqUVBXVEJSQmdOVkhTTUUKU2pCSWdCUlFUODVHRzV6a0QxV3FNSzZvOW8xWWFqUVBXYUVscENNd0lURWZNQjBHQTFVRUF4TVdUa2RKVGxoSgpibWR5WlhOelEyOXVkSEp2Ykd4bGNvSUpBSzkvY0M1ZmhwMkdNQXdHQTFVZEV3UUZNQU1CQWY4d0RRWUpLb1pJCmh2Y05BUUVGQlFBRGdnRUJBSTIxcXpDN0lIYTEzblNvRkMxVFdtSUZydjQ2L2hRSFRjSFhxazRXZW16Z3VwVW8Kdmp0R05DVFlaR1VtL3RZY1FobDZvOXVJZlV5N3NlVS9OeWVCWHpOdGFiQUczQUIzanREVUJySy9xeVJ5cDZjRApIL0MzNmd5VFh3OGJxYVdOSzg0VGhYOVg2MFVFNVE2NzFUQUJMbk9paEhKUVVxTHdRc1VkdEkxRHBQb1BOOFlWCm5YQVl1RXJKWTVRckhzdHZoOFNZM2xoV3BSOWJ0eTVySldweUhIM3NDL1lHN2lFam5TUXp2LzdhK3cxTW1RQ0EKTk1wQnFvdzJKZkdveklyV2JvcFBVR2lmZ2szSjBKT24rcnA4RDRVc1lvNEo4Y3RvVk5qUFdmeU9zczB6ZWZ2aQpyUmVEUDdJOXc5THF1eERIRUhzeUpMUXN0MzNlQWlna1FBQU9zMUU9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K" }}
-  tls.key: {{ .Values.controller.defaultTLS.key | default "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBdG14YTA4WnRMSGlsZXloTlFjeTlJeGp5WTBYdy9CRmZvM3duMDRsSXRoaGRxbkZ3CjU2SFRtUVYyL25xMkVMTHUzaHozY3N1K3NzOVhRMy9wa211cExBOUxuaVVRZFVNcER4VlE1VFFKRW5CanJ5aXcKOEVhZXBKeDVDQmFQeVd2UmZKT29KRUluemZjWmJxODhFZkJJWDh3bVFCa0xlcnFTVmRYWjBXR3FINVVQVlVZMQpQamVwaklwMmdDb2w0TFIzNWh0ZUpPTjJmVUxBenJkRjAwQ09PdlhrUzgwRGw5eHdoUkVwVWVySGNuNXZod3BJCmszZGNxTUtwcVk2NnpRd3UrTHBSRDN2VVo0dHgvVWJ5VHUrZDJHYVdWaG1RLy85RmtzUzVBS1d2ZXkrK3pPUTEKQ2UwMTc4Q1NIUWF0Q2lhblNpU095cGpGbU1GdDdTK2tuaW5vV3dJREFRQUJBb0lCQVFDQ002UkFNd2dKRGJOTwp5OTBZY2NFdEk4a2RBZmFXY3ZBSUI3MkZSaDhYbVJ5QllxWnJMUjJSd2t6RUpXRjlXYmtUM3lqZVRuMjFzamRlCmZoVi81RWZDb3NnZC8rWlhTN0FxaTlSSlEzS1dMcEYzbTF0dW8zam5sS2J1RnV4Wm54TE9EN1dhNjN6dGpNZ2kKTUFCMzdVQTYzOE1OVE5MY3JmMTBOa1paSTVRQkpYWWNPRk1ueDJ4MXVLRkU5RHQzWUEzbE9nOWNGdmFJTFpEQQo3WTVHVDlmUXdJQS92OGRWRU1DTkNiSzI1b1dnRG90WUdZaUhiYm1hUk9DTkRpNzVQZFpkM2daQ3IxUHFPWEZHCkJaVEh1L3Q4OXMwV1QyUkpNV2ljVW5XV0oyVHhmRWU1YUQ4R0JjRzEyN0pkamxLSitWZCtHWmxvODVYYVBvdnUKTVFxek1nbUJBb0dCQU9IS1pGbzVnSVkzL0J3aElCZ2RGUytnOG1GK21JTWpxSGVMN1NFSTNYL0UzWjhJd0syUgpmTTVFRUpTZnlETFpDVkNlSS8veWhBOUF6dG9Dam12TzdjMUxJT3kwR3k5dFlJVHlYY0xQNWNBWitBTkJCRExFCitYZkx5SE9KVXBDM2o4RFRZWDF0RENiUGJ5UFZTZENUNHNKT2JrNDVZVXQ3a3pEYTVHSFpsL3hqQW9HQkFNN1UKayt6TE5zbFQ2azJaakJaZW81YUdoMUNCSVV4bzNFNVpGYUZWR2lyMSs4NVlkVDdXVEpublJ6K0l6QXBMMmRqZApPZjVlQS9wa3JVNExMeGMzVVNEYjJwczJuT1hQd1p1OWdqRTM3aml0SUFRd3BHL3FiamQ3Y1ZaR2hlUkQyK3l4ClptTWU3c1BCZEVmcldmK1REYU9lT3B4L2RRcnFyTEc2UXo1ZHlQbXBBb0dBVmsyZ0VnU01wY0RjY253TzRtaXIKWW1zb2VpK0RhQXpISmZxc0JzWjJzNUd5REVteUxDWENDSzFua1FlSjVEV2xJOVZ1ZVRSZldkMHhzNDdxbFRhaApHcWt1eW9zRklSbXpuTjF2RFRtZDNkR1BSTjhqRmF6SWxndWtjTlQ2WkNwbG5oU3QzTjFEbWNvTDl5eGRiSVk2ClZIN2FGcmhFQWpBWDBNSzZMTlNaRFhVQ2dZQlRYc3JWeTBBbFBTY1g2b25XUm9Xb1drZlhBb1lhbDdZZCtyakcKVkZoODhyUnlnNk9YRmFqQTdNSUNjVERXQWFjcFRGdGhGaUtDWHV5Z3BjOXdpMEt2ZlErTU95SlpYRHBOZmNFcAo5OEtWbyt0ZzVQNlRnaXExUUpQNTArbUtqblBxMzhOR3R5UkZVZ2grS1BjWkZ2eUxkRzlwdjlLOCtNVnR5b2ZxCmJzRmhLUUtCZ0NvcEg5Wm95MjJBNStLcnJYZmQ0VXRBcndjN0dVanFUT1hhTzgyd3FpU0hZMndPTGdkWWw0L3kKSDJEYy9EMWxmWS9GL09sckNMZDNpL0lLc0wxNG13R2dxODZRdDhxeTIwcWw4RFNyWG91TmhsQTJmL1ZUTk1SMAp2OXAwU1JrQjI2UVYyUitndnNVYk9xb1lhMlVQVkNuQW9QeTYwTXlBaVJUR3cyeTExbm9lCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==" }}
+  tls.crt: {{ .Values.controller.defaultTLS.cert }}
+  tls.key: {{ .Values.controller.defaultTLS.key }}
+{{- end }}

helm-chart/templates/controller-service.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.controller.service.create }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx-ingress
+  labels:
+    app: {{ .Values.controller.name | trunc 63 }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+{{- if .Values.controller.service.annotations }}
+  annotations:
+{{ toYaml .Values.controller.service.annotations | indent 4 }}
+{{- end }}
+spec:
+{{- if or (eq .Values.controller.service.type "LoadBalancer") (eq .Values.controller.service.type "NodePort") }}
+  {{- if .Values.controller.service.externalTrafficPolicy }}
+  externalTrafficPolicy: {{ .Values.controller.service.externalTrafficPolicy }}
+  {{- end }}
+{{- end }}
+  type: {{ .Values.controller.service.type }}
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+    name: http
+  - port: 443
+    targetPort: 443
+    protocol: TCP
+    name: https
+  selector:
+    app: {{ .Values.controller.name | trunc 63 }}
+{{- end }}

helm-chart/templates/controller-serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if .Values.rbac.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.controller.serviceAccountName }}
+  labels:
+    app: {{ .Values.controller.name | trunc 63 }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+{{- end }}