tencentcloud 1.82.36 published on Thursday, Nov 13, 2025 by tencentcloudstack
tencentcloud 1.82.36 published on Thursday, Nov 13, 2025 by tencentcloudstack
Provides a resource to create a TKE kubernetes cluster release
NOTE: Cluster cluster release version currently does not support downgrading.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as tencentcloud from "@pulumi/tencentcloud";
const example = new tencentcloud.KubernetesClusterRelease("example", {
clusterId: "cls-fdy7hm1q",
name: "tf-example",
namespace: "default",
chart: "nginx-ingress",
chartFrom: "tke-market",
chartVersion: "4.9.0",
chartNamespace: "opensource-stable",
clusterType: "tke",
values: {
rawOriginal: `## nginx configuration\\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md\\
##\\
\\
## Overrides for generated resource names\\
# See templates/_helpers.tpl\\
# nameOverride:\\
# fullnameOverride:\\
\\
# -- Override the deployment namespace; defaults to .Release.Namespace\\
namespaceOverride: \\\\\\"\\\\\\"\\
## Labels to apply to all resources\\
##\\
commonLabels: {}\\
# scmhash: abc123\\
# myLabel: aakkmd\\
\\
controller:\\
name: controller\\
enableAnnotationValidations: false\\
image:\\
## Keep false as default for now!\\
chroot: false\\
registry: ccr.ccs.tencentyun.com\\
image: tke-market/ingress-nginx-controller\\
## for backwards compatibility consider setting the full image url via the repository value below\\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\
## repository:\\
tag: \\\\\\"v1.9.5\\\\\\"\\
digest: \\\\\\"\\\\\\"\\
digestChroot: \\\\\\"\\\\\\"\\
pullPolicy: IfNotPresent\\
runAsNonRoot: true\\
# www-data -> uid 101\\
runAsUser: 101\\
allowPrivilegeEscalation: false\\
seccompProfile:\\
type: RuntimeDefault\\
readOnlyRootFilesystem: false\\
# -- Use an existing PSP instead of creating one\\
existingPsp: \\\\\\"\\\\\\"\\
# -- Configures the controller container name\\
containerName: controller\\
# -- Configures the ports that the nginx-controller listens on\\
containerPort:\\
http: 80\\
https: 443\\
# -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/\\
config: {}\\
# -- Annotations to be added to the controller config configuration configmap.\\
configAnnotations: {}\\
# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers\\
proxySetHeaders: {}\\
# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers\\
addHeaders: {}\\
# -- Optionally customize the pod dnsConfig.\\
dnsConfig: {}\\
# -- Optionally customize the pod hostAliases.\\
hostAliases: []\\
# - ip: 127.0.0.1\\
# hostnames:\\
# - foo.local\\
# - bar.local\\
# - ip: 10.1.2.3\\
# hostnames:\\
# - foo.remote\\
# - bar.remote\\
# -- Optionally customize the pod hostname.\\
hostname: {}\\
# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.\\
# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller\\
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.\\
dnsPolicy: ClusterFirst\\
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network\\
# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply\\
reportNodeInternalIp: false\\
# -- Process Ingress objects without ingressClass annotation/ingressClassName field\\
# Overrides value for --watch-ingress-without-class flag of the controller binary\\
# Defaults to false\\
watchIngressWithoutClass: false\\
# -- Process IngressClass per name (additionally as per spec.controller).\\
ingressClassByName: false\\
# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode=\\\\\\"auto\\\\\\"\\
# Defaults to false\\
enableTopologyAwareRouting: false\\
# -- This configuration defines if Ingress Controller should allow users to set\\
# their own *-snippet annotations, otherwise this is forbidden / dropped\\
# when users add those annotations.\\
# Global snippets in ConfigMap are still respected\\
allowSnippetAnnotations: false\\
# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),\\
# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920\\
# is merged\\
hostNetwork: false\\
## Use host ports 80 and 443\\
## Disabled by default\\
hostPort:\\
# -- Enable 'hostPort' or not\\
enabled: false\\
ports:\\
# -- 'hostPort' http port\\
http: 80\\
# -- 'hostPort' https port\\
https: 443\\
# NetworkPolicy for controller component.\\
networkPolicy:\\
# -- Enable 'networkPolicy' or not\\
enabled: false\\
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'\\
electionID: \\\\\\"\\\\\\"\\
## This section refers to the creation of the IngressClass resource\\
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19\\
ingressClassResource:\\
# -- Name of the ingressClass\\
name: nginx\\
# -- Is this ingressClass enabled or not\\
enabled: true\\
# -- Is this the default ingressClass for the cluster\\
default: false\\
# -- Controller-value of the controller that is processing this ingressClass\\
controllerValue: \\\\\\"k8s.io/ingress-nginx\\\\\\"\\
# -- Parameters is a link to a custom resource containing additional\\
# configuration for the controller. This is optional if the controller\\
# does not require extra parameters.\\
parameters: {}\\
# -- For backwards compatibility with ingress.class annotation, use ingressClass.\\
# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation\\
ingressClass: nginx\\
# -- Labels to add to the pod container metadata\\
podLabels: {}\\
# key: value\\
\\
# -- Security context for controller pods\\
podSecurityContext: {}\\
# -- sysctls for controller pods\\
## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/\\
sysctls: {}\\
# sysctls:\\
# \\\\\\"net.core.somaxconn\\\\\\": \\\\\\"8192\\\\\\"\\
# -- Security context for controller containers\\
containerSecurityContext: {}\\
# -- Allows customization of the source of the IP address or FQDN to report\\
# in the ingress status field. By default, it reads the information provided\\
# by the service. If disable, the status field reports the IP address of the\\
# node or nodes where an ingress controller pod is running.\\
publishService:\\
# -- Enable 'publishService' or not\\
enabled: true\\
# -- Allows overriding of the publish service to bind to\\
# Must be <namespace>/<service_name>\\
pathOverride: \\\\\\"\\\\\\"\\
# Limit the scope of the controller to a specific namespace\\
scope:\\
# -- Enable 'scope' or not\\
enabled: false\\
# -- Namespace to limit the controller to; defaults to (POD_NAMESPACE)\\
namespace: \\\\\\"\\\\\\"\\
# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels\\
# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.\\
namespaceSelector: \\\\\\"\\\\\\"\\
# -- Allows customization of the configmap / nginx-configmap namespace; defaults to (POD_NAMESPACE)\\
configMapNamespace: \\\\\\"\\\\\\"\\
tcp:\\
# -- Allows customization of the tcp-services-configmap; defaults to (POD_NAMESPACE)\\
configMapNamespace: \\\\\\"\\\\\\"\\
# -- Annotations to be added to the tcp config configmap\\
annotations: {}\\
udp:\\
# -- Allows customization of the udp-services-configmap; defaults to (POD_NAMESPACE)\\
configMapNamespace: \\\\\\"\\\\\\"\\
# -- Annotations to be added to the udp config configmap\\
annotations: {}\\
# -- Maxmind license key to download GeoLite2 Databases.\\
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases\\
maxmindLicenseKey: \\\\\\"\\\\\\"\\
# -- Additional command line arguments to pass to Ingress-Nginx Controller\\
# E.g. to specify the default SSL certificate you can use\\
extraArgs: {}\\
## extraArgs:\\
## default-ssl-certificate: \\\\\\"<namespace>/<secret_name>\\\\\\"\\
## time-buckets: \\\\\\"0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10\\\\\\"\\
## length-buckets: \\\\\\"10,20,30,40,50,60,70,80,90,100\\\\\\"\\
## size-buckets: \\\\\\"10,100,1000,10000,100000,1e+06,1e+07\\\\\\"\\
\\
# -- Additional environment variables to set\\
# extraEnvs:\\
# - name: FOO\\
# valueFrom:\\
# secretKeyRef:\\
# key: FOO\\
# name: secret-resource\\
extraEnvs: \\
- name: TZ\\
value: Asia/Shanghai\\
\\
# -- Use a \`DaemonSet\` or \`Deployment\`\\
kind: Deployment\\
# -- Annotations to be added to the controller Deployment or DaemonSet\\
##\\
annotations: {}\\
# keel.sh/pollSchedule: \\\\\\"@every 60m\\\\\\"\\
\\
# -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels\\
##\\
labels: {}\\
# keel.sh/policy: patch\\
# keel.sh/trigger: poll\\
\\
# -- The update strategy to apply to the Deployment or DaemonSet\\
##\\
updateStrategy: {}\\
# rollingUpdate:\\
# maxUnavailable: 1\\
# type: RollingUpdate\\
\\
# -- \`minReadySeconds\` to avoid killing pods before we are ready\\
##\\
minReadySeconds: 0\\
# -- Node tolerations for server scheduling to nodes with taints\\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\\
##\\
tolerations: []\\
# - key: \\\\\\"key\\\\\\"\\
# operator: \\\\\\"Equal|Exists\\\\\\"\\
# value: \\\\\\"value\\\\\\"\\
# effect: \\\\\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\\\\"\\
\\
# -- Affinity and anti-affinity rules for server scheduling to nodes\\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity\\
##\\
affinity: {}\\
# # An example of preferred pod anti-affinity, weight is in the range 1-100\\
# podAntiAffinity:\\
# preferredDuringSchedulingIgnoredDuringExecution:\\
# - weight: 100\\
# podAffinityTerm:\\
# labelSelector:\\
# matchExpressions:\\
# - key: app.kubernetes.io/name\\
# operator: In\\
# values:\\
# - ingress-nginx\\
# - key: app.kubernetes.io/instance\\
# operator: In\\
# values:\\
# - ingress-nginx\\
# - key: app.kubernetes.io/component\\
# operator: In\\
# values:\\
# - controller\\
# topologyKey: kubernetes.io/hostname\\
\\
# # An example of required pod anti-affinity\\
# podAntiAffinity:\\
# requiredDuringSchedulingIgnoredDuringExecution:\\
# - labelSelector:\\
# matchExpressions:\\
# - key: app.kubernetes.io/name\\
# operator: In\\
# values:\\
# - ingress-nginx\\
# - key: app.kubernetes.io/instance\\
# operator: In\\
# values:\\
# - ingress-nginx\\
# - key: app.kubernetes.io/component\\
# operator: In\\
# values:\\
# - controller\\
# topologyKey: \\\\\\"kubernetes.io/hostname\\\\\\"\\
\\
# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.\\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/\\
##\\
topologySpreadConstraints: []\\
# - labelSelector:\\
# matchLabels:\\
# app.kubernetes.io/name: '{{ include \\\\\\"ingress-nginx.name\\\\\\" . }}'\\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\\
# app.kubernetes.io/component: controller\\
# topologyKey: topology.kubernetes.io/zone\\
# maxSkew: 1\\
# whenUnsatisfiable: ScheduleAnyway\\
# - labelSelector:\\
# matchLabels:\\
# app.kubernetes.io/name: '{{ include \\\\\\"ingress-nginx.name\\\\\\" . }}'\\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\\
# app.kubernetes.io/component: controller\\
# topologyKey: kubernetes.io/hostname\\
# maxSkew: 1\\
# whenUnsatisfiable: ScheduleAnyway\\
\\
# -- \`terminationGracePeriodSeconds\` to avoid killing pods before we are ready\\
## wait up to five minutes for the drain of connections\\
##\\
terminationGracePeriodSeconds: 300\\
# -- Node labels for controller pod assignment\\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\\
##\\
nodeSelector:\\
kubernetes.io/os: linux\\
## Liveness and readiness probe values\\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes\\
##\\
## startupProbe:\\
## httpGet:\\
## # should match container.healthCheckPath\\
## path: \\\\\\"/healthz\\\\\\"\\
## port: 10254\\
## scheme: HTTP\\
## initialDelaySeconds: 5\\
## periodSeconds: 5\\
## timeoutSeconds: 2\\
## successThreshold: 1\\
## failureThreshold: 5\\
livenessProbe:\\
httpGet:\\
# should match container.healthCheckPath\\
path: \\\\\\"/healthz\\\\\\"\\
port: 10254\\
scheme: HTTP\\
initialDelaySeconds: 10\\
periodSeconds: 10\\
timeoutSeconds: 1\\
successThreshold: 1\\
failureThreshold: 5\\
readinessProbe:\\
httpGet:\\
# should match container.healthCheckPath\\
path: \\\\\\"/healthz\\\\\\"\\
port: 10254\\
scheme: HTTP\\
initialDelaySeconds: 10\\
periodSeconds: 10\\
timeoutSeconds: 1\\
successThreshold: 1\\
failureThreshold: 3\\
# -- Path of the health check endpoint. All requests received on the port defined by\\
# the healthz-port parameter are forwarded internally to this path.\\
healthCheckPath: \\\\\\"/healthz\\\\\\"\\
# -- Address to bind the health check endpoint.\\
# It is better to set this option to the internal node address\\
# if the Ingress-Nginx Controller is running in the \`hostNetwork: true\` mode.\\
healthCheckHost: \\\\\\"\\\\\\"\\
# -- Annotations to be added to controller pods\\
##\\
podAnnotations: {}\\
replicaCount: 1\\
# -- Minimum available pods set in PodDisruptionBudget.\\
# Define either 'minAvailable' or 'maxUnavailable', never both.\\
minAvailable: 1\\
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.\\
# maxUnavailable: 1\\
\\
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes\\
## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903\\
## Ideally, there should be no limits.\\
## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/\\
resources:\\
## limits:\\
## cpu: 100m\\
## memory: 90Mi\\
requests:\\
cpu: 100m\\
memory: 90Mi\\
# Mutually exclusive with keda autoscaling\\
autoscaling:\\
enabled: false\\
annotations: {}\\
minReplicas: 1\\
maxReplicas: 11\\
targetCPUUtilizationPercentage: 50\\
targetMemoryUtilizationPercentage: 50\\
behavior: {}\\
# scaleDown:\\
# stabilizationWindowSeconds: 300\\
# policies:\\
# - type: Pods\\
# value: 1\\
# periodSeconds: 180\\
# scaleUp:\\
# stabilizationWindowSeconds: 300\\
# policies:\\
# - type: Pods\\
# value: 2\\
# periodSeconds: 60\\
autoscalingTemplate: []\\
# Custom or additional autoscaling metrics\\
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics\\
# - type: Pods\\
# pods:\\
# metric:\\
# name: k8s_pod_rate_cpu_core_used_limit\\
# target:\\
# averageValue: \\\\\\"80\\\\\\"\\
# type: AverageValue\\
\\
# Mutually exclusive with hpa autoscaling\\
keda:\\
apiVersion: \\\\\\"keda.sh/v1alpha1\\\\\\"\\
## apiVersion changes with keda 1.x vs 2.x\\
## 2.x = keda.sh/v1alpha1\\
## 1.x = keda.k8s.io/v1alpha1\\
enabled: false\\
minReplicas: 1\\
maxReplicas: 11\\
pollingInterval: 30\\
cooldownPeriod: 300\\
# fallback:\\
# failureThreshold: 3\\
# replicas: 11\\
restoreToOriginalReplicaCount: false\\
scaledObject:\\
annotations: {}\\
# Custom annotations for ScaledObject resource\\
# annotations:\\
# key: value\\
triggers: []\\
# - type: prometheus\\
# metadata:\\
# serverAddress: http://<prometheus-host>:9090\\
# metricName: http_requests_total\\
# threshold: '100'\\
# query: sum(rate(http_requests_total{deployment=\\\\\\"my-deployment\\\\\\"}[2m]))\\
\\
behavior: {}\\
# scaleDown:\\
# stabilizationWindowSeconds: 300\\
# policies:\\
# - type: Pods\\
# value: 1\\
# periodSeconds: 180\\
# scaleUp:\\
# stabilizationWindowSeconds: 300\\
# policies:\\
# - type: Pods\\
# value: 2\\
# periodSeconds: 60\\
# -- Enable mimalloc as a drop-in replacement for malloc.\\
## ref: https://github.com/microsoft/mimalloc\\
##\\
enableMimalloc: true\\
## Override NGINX template\\
customTemplate:\\
configMapName: \\\\\\"\\\\\\"\\
configMapKey: \\\\\\"\\\\\\"\\
service:\\
# -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.\\
enabled: true\\
external:\\
# -- Enable the external controller service or not. Useful for internal-only deployments.\\
enabled: true\\
# -- Annotations to be added to the external controller service. See \`controller.service.internal.annotations\` for annotations to be added to the internal controller service.\\
annotations: {}\\
# -- Labels to be added to both controller services.\\
labels: {}\\
# -- Type of the external controller service.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\\
type: LoadBalancer\\
# -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.\\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\\
clusterIP: \\\\\\"\\\\\\"\\
# -- List of node IP addresses at which the external controller service is available.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\
externalIPs: []\\
# -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\\
loadBalancerIP: \\\\\\"\\\\\\"\\
# -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.\\
loadBalancerSourceRanges: []\\
# -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\\
loadBalancerClass: \\\\\\"\\\\\\"\\
# -- Enable node port allocation for the external controller service or not. Applies to type \`LoadBalancer\` only.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\\
# allocateLoadBalancerNodePorts: true\\
\\
# -- External traffic policy of the external controller service. Set to \\\\\\"Local\\\\\\" to preserve source IP on providers supporting it.\\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\
externalTrafficPolicy: \\\\\\"\\\\\\"\\
# -- Session affinity of the external controller service. Must be either \\\\\\"None\\\\\\" or \\\\\\"ClientIP\\\\\\" if set. Defaults to \\\\\\"None\\\\\\".\\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\\
sessionAffinity: \\\\\\"\\\\\\"\\
# -- Specifies the health check node port (numeric port number) for the external controller service.\\
# If not specified, the service controller allocates a port from your cluster's node port range.\\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\
# healthCheckNodePort: 0\\
\\
# -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\\
# Fields \`ipFamilies\` and \`clusterIP\` depend on the value of this field.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\
ipFamilyPolicy: SingleStack\\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the \`ipFamilyPolicy\` field.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\
ipFamilies:\\
- IPv4\\
# -- Enable the HTTP listener on both controller services or not.\\
enableHttp: true\\
# -- Enable the HTTPS listener on both controller services or not.\\
enableHttps: true\\
ports:\\
# -- Port the external HTTP listener is published with.\\
http: 80\\
# -- Port the external HTTPS listener is published with.\\
https: 443\\
targetPorts:\\
# -- Port of the ingress controller the external HTTP listener is mapped to.\\
http: http\\
# -- Port of the ingress controller the external HTTPS listener is mapped to.\\
https: https\\
# -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\\
appProtocol: true\\
nodePorts:\\
# -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.\\
http: \\\\\\"\\\\\\"\\
# -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\\
https: \\\\\\"\\\\\\"\\
# -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.\\
# Example:\\
# tcp:\\
# 8080: 30080\\
tcp: {}\\
# -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.\\
# Example:\\
# udp:\\
# 53: 30053\\
udp: {}\\
internal:\\
# -- Enable the internal controller service or not. Remember to configure \`controller.service.internal.annotations\` when enabling this.\\
enabled: false\\
# -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer\\
annotations: {}\\
# -- Type of the internal controller service.\\
# Defaults to the value of \`controller.service.type\`.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\\
type: \\\\\\"\\\\\\"\\
# -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.\\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\\
clusterIP: \\\\\\"\\\\\\"\\
# -- List of node IP addresses at which the internal controller service is available.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\
externalIPs: []\\
# -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\\
loadBalancerIP: \\\\\\"\\\\\\"\\
# -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.\\
loadBalancerSourceRanges: []\\
# -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\\
loadBalancerClass: \\\\\\"\\\\\\"\\
# -- Enable node port allocation for the internal controller service or not. Applies to type \`LoadBalancer\` only.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\\
# allocateLoadBalancerNodePorts: true\\
\\
# -- External traffic policy of the internal controller service. Set to \\\\\\"Local\\\\\\" to preserve source IP on providers supporting it.\\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\
externalTrafficPolicy: \\\\\\"\\\\\\"\\
# -- Session affinity of the internal controller service. Must be either \\\\\\"None\\\\\\" or \\\\\\"ClientIP\\\\\\" if set. Defaults to \\\\\\"None\\\\\\".\\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\\
sessionAffinity: \\\\\\"\\\\\\"\\
# -- Specifies the health check node port (numeric port number) for the internal controller service.\\
# If not specified, the service controller allocates a port from your cluster's node port range.\\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\
# healthCheckNodePort: 0\\
\\
# -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\\
# Fields \`ipFamilies\` and \`clusterIP\` depend on the value of this field.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\
ipFamilyPolicy: SingleStack\\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the \`ipFamilyPolicy\` field.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\
ipFamilies:\\
- IPv4\\
ports: {}\\
# -- Port the internal HTTP listener is published with.\\
# Defaults to the value of \`controller.service.ports.http\`.\\
# http: 80\\
# -- Port the internal HTTPS listener is published with.\\
# Defaults to the value of \`controller.service.ports.https\`.\\
# https: 443\\
\\
targetPorts: {}\\
# -- Port of the ingress controller the internal HTTP listener is mapped to.\\
# Defaults to the value of \`controller.service.targetPorts.http\`.\\
# http: http\\
# -- Port of the ingress controller the internal HTTPS listener is mapped to.\\
# Defaults to the value of \`controller.service.targetPorts.https\`.\\
# https: https\\
\\
# -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\\
appProtocol: true\\
nodePorts:\\
# -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.\\
http: \\\\\\"\\\\\\"\\
# -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\\
https: \\\\\\"\\\\\\"\\
# -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.\\
# Example:\\
# tcp:\\
# 8080: 30080\\
tcp: {}\\
# -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.\\
# Example:\\
# udp:\\
# 53: 30053\\
udp: {}\\
# shareProcessNamespace enables process namespace sharing within the pod.\\
# This can be used for example to signal log rotation using \`kill -USR1\` from a sidecar.\\
shareProcessNamespace: false\\
# -- Additional containers to be added to the controller pod.\\
# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.\\
extraContainers: []\\
# - name: my-sidecar\\
# image: nginx:latest\\
\\
# -- Additional volumeMounts to the controller main container.\\
extraVolumeMounts: []\\
# - name: copy-portal-skins\\
# mountPath: /var/lib/lemonldap-ng/portal/skins\\
\\
# -- Additional volumes to the controller pod.\\
extraVolumes: []\\
# - name: copy-portal-skins\\
# emptyDir: {}\\
\\
# -- Containers, which are run before the app containers are started.\\
extraInitContainers: \\
- command:\\
- sh\\
- -c\\
- |-\\
sysctl -w net.core.somaxconn=65535\\
sysctl -w net.ipv4.ip_local_reserved_ports=9100\\
sysctl -w net.ipv4.ip_local_port_range=\\\\\\"1024 61999\\\\\\"\\
sysctl -w net.ipv4.tcp_tw_reuse=1\\
sysctl -w fs.file-max=1048576\\
image: ccr.ccs.tencentyun.com/tkeimages/busybox:latest\\
imagePullPolicy: Always\\
name: setsysctl\\
securityContext:\\
privileged: true\\
\\
# -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module\\
extraModules: []\\
# - name: mytestmodule\\
# image:\\
# registry: registry.k8s.io\\
# image: ingress-nginx/mytestmodule\\
# ## for backwards compatibility consider setting the full image url via the repository value below\\
# ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\
# ## repository:\\
# tag: \\\\\\"v1.0.0\\\\\\"\\
# digest: \\\\\\"\\\\\\"\\
# distroless: false\\
# containerSecurityContext:\\
# runAsNonRoot: true\\
# runAsUser: <user-id>\\
# allowPrivilegeEscalation: false\\
# seccompProfile:\\
# type: RuntimeDefault\\
# capabilities:\\
# drop:\\
# - ALL\\
# readOnlyRootFilesystem: true\\
# resources: {}\\
#\\
# The image must contain a \`/usr/local/bin/init_module.sh\` executable, which\\
# will be executed as initContainers, to move its config files within the\\
# mounted volume.\\
\\
opentelemetry:\\
enabled: false\\
name: opentelemetry\\
image:\\
registry: ccr.ccs.tencentyun.com\\
image: tke-market/ingress-nginx-opentelemetry\\
## for backwards compatibility consider setting the full image url via the repository value below\\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\
## repository:\\
tag: \\\\\\"v20230721-3e2062ee5\\\\\\"\\
digest: \\\\\\"\\\\\\"\\
distroless: true\\
containerSecurityContext:\\
runAsNonRoot: true\\
# -- The image's default user, inherited from its base image \`cgr.dev/chainguard/static\`.\\
runAsUser: 65532\\
allowPrivilegeEscalation: false\\
seccompProfile:\\
type: RuntimeDefault\\
capabilities:\\
drop:\\
- ALL\\
readOnlyRootFilesystem: true\\
resources: {}\\
admissionWebhooks:\\
name: admission\\
annotations: {}\\
# ignore-check.kube-linter.io/no-read-only-rootfs: \\\\\\"This deployment needs write access to root filesystem\\\\\\".\\
\\
## Additional annotations to the admission webhooks.\\
## These annotations will be added to the ValidatingWebhookConfiguration and\\
## the Jobs Spec of the admission webhooks.\\
enabled: true\\
# -- Additional environment variables to set\\
extraEnvs: []\\
# extraEnvs:\\
# - name: FOO\\
# valueFrom:\\
# secretKeyRef:\\
# key: FOO\\
# name: secret-resource\\
# -- Admission Webhook failure policy to use\\
failurePolicy: Fail\\
# timeoutSeconds: 10\\
port: 8443\\
certificate: \\\\\\"/usr/local/certificates/cert\\\\\\"\\
key: \\\\\\"/usr/local/certificates/key\\\\\\"\\
namespaceSelector: {}\\
objectSelector: {}\\
# -- Labels to be added to admission webhooks\\
labels: {}\\
# -- Use an existing PSP instead of creating one\\
existingPsp: \\\\\\"\\\\\\"\\
service:\\
annotations: {}\\
# clusterIP: \\\\\\"\\\\\\"\\
externalIPs: []\\
# loadBalancerIP: \\\\\\"\\\\\\"\\
loadBalancerSourceRanges: []\\
servicePort: 443\\
type: ClusterIP\\
createSecretJob:\\
name: create\\
# -- Security context for secret creation containers\\
securityContext:\\
runAsNonRoot: true\\
runAsUser: 65532\\
allowPrivilegeEscalation: false\\
seccompProfile:\\
type: RuntimeDefault\\
capabilities:\\
drop:\\
- ALL\\
readOnlyRootFilesystem: true\\
resources: {}\\
# limits:\\
# cpu: 10m\\
# memory: 20Mi\\
# requests:\\
# cpu: 10m\\
# memory: 20Mi\\
patchWebhookJob:\\
name: patch\\
# -- Security context for webhook patch containers\\
securityContext:\\
runAsNonRoot: true\\
runAsUser: 65532\\
allowPrivilegeEscalation: false\\
seccompProfile:\\
type: RuntimeDefault\\
capabilities:\\
drop:\\
- ALL\\
readOnlyRootFilesystem: true\\
resources: {}\\
patch:\\
enabled: true\\
image:\\
registry: ccr.ccs.tencentyun.com\\
image: tke-market/ingress-nginx-webhook-certgen\\
## for backwards compatibility consider setting the full image url via the repository value below\\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\
## repository:\\
tag: v20231011-8b53cabe0\\
digest: \\\\\\"\\\\\\"\\
pullPolicy: IfNotPresent\\
# -- Provide a priority class name to the webhook patching job\\
##\\
priorityClassName: \\\\\\"\\\\\\"\\
podAnnotations: {}\\
# NetworkPolicy for webhook patch\\
networkPolicy:\\
# -- Enable 'networkPolicy' or not\\
enabled: false\\
nodeSelector:\\
kubernetes.io/os: linux\\
tolerations: []\\
# -- Labels to be added to patch job resources\\
labels: {}\\
# -- Security context for secret creation & webhook patch pods\\
securityContext: {}\\
# Use certmanager to generate webhook certs\\
certManager:\\
enabled: false\\
# self-signed root certificate\\
rootCert:\\
# default to be 5y\\
duration: \\\\\\"\\\\\\"\\
admissionCert:\\
# default to be 1y\\
duration: \\\\\\"\\\\\\"\\
# issuerRef:\\
# name: \\\\\\"issuer\\\\\\"\\
# kind: \\\\\\"ClusterIssuer\\\\\\"\\
metrics:\\
port: 10254\\
portName: metrics\\
# if this port is changed, change healthz-port: in extraArgs: accordingly\\
enabled: false\\
service:\\
annotations: {}\\
# prometheus.io/scrape: \\\\\\"true\\\\\\"\\
# prometheus.io/port: \\\\\\"10254\\\\\\"\\
# -- Labels to be added to the metrics service resource\\
labels: {}\\
# clusterIP: \\\\\\"\\\\\\"\\
\\
# -- List of IP addresses at which the stats-exporter service is available\\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\
##\\
externalIPs: []\\
# loadBalancerIP: \\\\\\"\\\\\\"\\
loadBalancerSourceRanges: []\\
servicePort: 10254\\
type: ClusterIP\\
# externalTrafficPolicy: \\\\\\"\\\\\\"\\
# nodePort: \\\\\\"\\\\\\"\\
serviceMonitor:\\
enabled: false\\
additionalLabels: {}\\
annotations: {}\\
## The label to use to retrieve the job name from.\\
## jobLabel: \\\\\\"app.kubernetes.io/name\\\\\\"\\
namespace: \\\\\\"\\\\\\"\\
namespaceSelector: {}\\
## Default: scrape .Release.Namespace or namespaceOverride only\\
## To scrape all, use the following:\\
## namespaceSelector:\\
## any: true\\
scrapeInterval: 30s\\
# honorLabels: true\\
targetLabels: []\\
relabelings: []\\
metricRelabelings: []\\
prometheusRule:\\
enabled: false\\
additionalLabels: {}\\
# namespace: \\\\\\"\\\\\\"\\
rules: []\\
# # These are just examples rules, please adapt them to your needs\\
# - alert: NGINXConfigFailed\\
# expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0\\
# for: 1s\\
# labels:\\
# severity: critical\\
# annotations:\\
# description: bad ingress config - nginx config test failed\\
# summary: uninstall the latest ingress changes to allow config reloads to resume\\
# # By default a fake self-signed certificate is generated as default and\\
# # it is fine if it expires. If \`--default-ssl-certificate\` flag is used\\
# # and a valid certificate passed please do not filter for \`host\` label!\\
# # (i.e. delete \`{host!=\\\\\\"_\\\\\\"}\` so also the default SSL certificate is\\
# # checked for expiration)\\
# - alert: NGINXCertificateExpiry\\
# expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!=\\\\\\"_\\\\\\"}) by (host) - time()) < 604800\\
# for: 1s\\
# labels:\\
# severity: critical\\
# annotations:\\
# description: ssl certificate(s) will expire in less then a week\\
# summary: renew expiring certificates to avoid downtime\\
# - alert: NGINXTooMany500s\\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\\\\"5.+\\\\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\\
# for: 1m\\
# labels:\\
# severity: warning\\
# annotations:\\
# description: Too many 5XXs\\
# summary: More than 5% of all requests returned 5XX, this requires your attention\\
# - alert: NGINXTooMany400s\\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\\\\"4.+\\\\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\\
# for: 1m\\
# labels:\\
# severity: warning\\
# annotations:\\
# description: Too many 4XXs\\
# summary: More than 5% of all requests returned 4XX, this requires your attention\\
# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:\\
# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds\\
# to 300, allowing the draining of connections up to five minutes.\\
# If the active connections end before that, the pod will terminate gracefully at that time.\\
# To effectively take advantage of this feature, the Configmap feature\\
# worker-shutdown-timeout new value is 240s instead of 10s.\\
##\\
lifecycle:\\
preStop:\\
exec:\\
command:\\
- /wait-shutdown\\
priorityClassName: \\\\\\"\\\\\\"\\
# -- Rollback limit\\
##\\
revisionHistoryLimit: 10\\
## Default 404 backend\\
##\\
defaultBackend:\\
##\\
enabled: false\\
name: defaultbackend\\
image:\\
registry: ccr.ccs.tencentyun.com\\
image: \\\\ttke-market/ingress-nginx-defaultbackend-amd64\\
## for backwards compatibility consider setting the full image url via the repository value below\\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\
## repository:\\
tag: \\\\\\"1.5\\\\\\"\\
pullPolicy: IfNotPresent\\
runAsNonRoot: true\\
# nobody user -> uid 65534\\
runAsUser: 65534\\
allowPrivilegeEscalation: false\\
seccompProfile:\\
type: RuntimeDefault\\
readOnlyRootFilesystem: true\\
# -- Use an existing PSP instead of creating one\\
existingPsp: \\\\\\"\\\\\\"\\
extraArgs: {}\\
serviceAccount:\\
create: true\\
name: \\\\\\"\\\\\\"\\
automountServiceAccountToken: true\\
# -- Additional environment variables to set for defaultBackend pods\\
extraEnvs: []\\
port: 8080\\
## Readiness and liveness probes for default backend\\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/\\
##\\
livenessProbe:\\
failureThreshold: 3\\
initialDelaySeconds: 30\\
periodSeconds: 10\\
successThreshold: 1\\
timeoutSeconds: 5\\
readinessProbe:\\
failureThreshold: 6\\
initialDelaySeconds: 0\\
periodSeconds: 5\\
successThreshold: 1\\
timeoutSeconds: 5\\
# -- The update strategy to apply to the Deployment or DaemonSet\\
##\\
updateStrategy: {}\\
# rollingUpdate:\\
# maxUnavailable: 1\\
# type: RollingUpdate\\
\\
# -- \`minReadySeconds\` to avoid killing pods before we are ready\\
##\\
minReadySeconds: 0\\
# -- Node tolerations for server scheduling to nodes with taints\\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\\
##\\
tolerations: []\\
# - key: \\\\\\"key\\\\\\"\\
# operator: \\\\\\"Equal|Exists\\\\\\"\\
# value: \\\\\\"value\\\\\\"\\
# effect: \\\\\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\\\\"\\
\\
affinity: {}\\
# -- Security context for default backend pods\\
podSecurityContext: {}\\
# -- Security context for default backend containers\\
containerSecurityContext: {}\\
# -- Labels to add to the pod container metadata\\
podLabels: {}\\
# key: value\\
\\
# -- Node labels for default backend pod assignment\\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\\
##\\
nodeSelector:\\
kubernetes.io/os: linux\\
# -- Annotations to be added to default backend pods\\
##\\
podAnnotations: {}\\
replicaCount: 1\\
minAvailable: 1\\
resources: {}\\
# limits:\\
# cpu: 10m\\
# memory: 20Mi\\
# requests:\\
# cpu: 10m\\
# memory: 20Mi\\
\\
extraVolumeMounts: []\\
## Additional volumeMounts to the default backend container.\\
# - name: copy-portal-skins\\
# mountPath: /var/lib/lemonldap-ng/portal/skins\\
\\
extraVolumes: []\\
## Additional volumes to the default backend pod.\\
# - name: copy-portal-skins\\
# emptyDir: {}\\
\\
extraConfigMaps: []\\
## Additional configmaps to the default backend pod.\\
# - name: my-extra-configmap-1\\
# labels:\\
# type: config-1\\
# data:\\
# extra_file_1.html: |\\
# <!-- Extra HTML content for ConfigMap 1 -->\\
# - name: my-extra-configmap-2\\
# labels:\\
# type: config-2\\
# data:\\
# extra_file_2.html: |\\
# <!-- Extra HTML content for ConfigMap 2 -->\\
\\
autoscaling:\\
annotations: {}\\
enabled: false\\
minReplicas: 1\\
maxReplicas: 2\\
targetCPUUtilizationPercentage: 50\\
targetMemoryUtilizationPercentage: 50\\
# NetworkPolicy for default backend component.\\
networkPolicy:\\
# -- Enable 'networkPolicy' or not\\
enabled: false\\
service:\\
annotations: {}\\
# clusterIP: \\\\\\"\\\\\\"\\
\\
# -- List of IP addresses at which the default backend service is available\\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\
##\\
externalIPs: []\\
# loadBalancerIP: \\\\\\"\\\\\\"\\
loadBalancerSourceRanges: []\\
servicePort: 80\\
type: ClusterIP\\
priorityClassName: \\\\\\"\\\\\\"\\
# -- Labels to be added to the default backend resources\\
labels: {}\\
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266\\
rbac:\\
create: true\\
scope: false\\
## If true, create & use Pod Security Policy resources\\
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/\\
podSecurityPolicy:\\
enabled: false\\
serviceAccount:\\
create: true\\
name: \\\\\\"\\\\\\"\\
automountServiceAccountToken: true\\
# -- Annotations for the controller service account\\
annotations: {}\\
# -- Optional array of imagePullSecrets containing private registry credentials\\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/\\
imagePullSecrets: []\\
# - name: secretName\\
\\
# -- TCP service key-value pairs\\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\\
##\\
tcp: {}\\
# 8080: \\\\\\"default/example-tcp-svc:9000\\\\\\"\\
\\
# -- UDP service key-value pairs\\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\\
##\\
udp: {}\\
# 53: \\\\\\"kube-system/kube-dns:53\\\\\\"\\
\\
# -- Prefix for TCP and UDP ports names in ingress controller service\\
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration\\
portNamePrefix: \\\\\\"\\\\\\"\\
# -- (string) A base64-encoded Diffie-Hellman parameter.\\
# This can be generated with: \`openssl dhparam 4096 2> /dev/null | base64\`\\
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param\\
dhParam: \\\\\\"\\\\\\"\\
`,
valuesType: "yaml",
},
});
import pulumi
import pulumi_tencentcloud as tencentcloud
example = tencentcloud.KubernetesClusterRelease("example",
cluster_id="cls-fdy7hm1q",
name="tf-example",
namespace="default",
chart="nginx-ingress",
chart_from="tke-market",
chart_version="4.9.0",
chart_namespace="opensource-stable",
cluster_type="tke",
values={
"raw_original": """## nginx configuration\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md\
##\
\
## Overrides for generated resource names\
# See templates/_helpers.tpl\
# nameOverride:\
# fullnameOverride:\
\
# -- Override the deployment namespace; defaults to .Release.Namespace\
namespaceOverride: \\\"\\\"\
## Labels to apply to all resources\
##\
commonLabels: {}\
# scmhash: abc123\
# myLabel: aakkmd\
\
controller:\
name: controller\
enableAnnotationValidations: false\
image:\
## Keep false as default for now!\
chroot: false\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-controller\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"v1.9.5\\\"\
digest: \\\"\\\"\
digestChroot: \\\"\\\"\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# www-data -> uid 101\
runAsUser: 101\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: false\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
# -- Configures the controller container name\
containerName: controller\
# -- Configures the ports that the nginx-controller listens on\
containerPort:\
http: 80\
https: 443\
# -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/\
config: {}\
# -- Annotations to be added to the controller config configuration configmap.\
configAnnotations: {}\
# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers\
proxySetHeaders: {}\
# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers\
addHeaders: {}\
# -- Optionally customize the pod dnsConfig.\
dnsConfig: {}\
# -- Optionally customize the pod hostAliases.\
hostAliases: []\
# - ip: 127.0.0.1\
# hostnames:\
# - foo.local\
# - bar.local\
# - ip: 10.1.2.3\
# hostnames:\
# - foo.remote\
# - bar.remote\
# -- Optionally customize the pod hostname.\
hostname: {}\
# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.\
# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller\
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.\
dnsPolicy: ClusterFirst\
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network\
# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply\
reportNodeInternalIp: false\
# -- Process Ingress objects without ingressClass annotation/ingressClassName field\
# Overrides value for --watch-ingress-without-class flag of the controller binary\
# Defaults to false\
watchIngressWithoutClass: false\
# -- Process IngressClass per name (additionally as per spec.controller).\
ingressClassByName: false\
# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode=\\\"auto\\\"\
# Defaults to false\
enableTopologyAwareRouting: false\
# -- This configuration defines if Ingress Controller should allow users to set\
# their own *-snippet annotations, otherwise this is forbidden / dropped\
# when users add those annotations.\
# Global snippets in ConfigMap are still respected\
allowSnippetAnnotations: false\
# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),\
# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920\
# is merged\
hostNetwork: false\
## Use host ports 80 and 443\
## Disabled by default\
hostPort:\
# -- Enable 'hostPort' or not\
enabled: false\
ports:\
# -- 'hostPort' http port\
http: 80\
# -- 'hostPort' https port\
https: 443\
# NetworkPolicy for controller component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'\
electionID: \\\"\\\"\
## This section refers to the creation of the IngressClass resource\
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19\
ingressClassResource:\
# -- Name of the ingressClass\
name: nginx\
# -- Is this ingressClass enabled or not\
enabled: true\
# -- Is this the default ingressClass for the cluster\
default: false\
# -- Controller-value of the controller that is processing this ingressClass\
controllerValue: \\\"k8s.io/ingress-nginx\\\"\
# -- Parameters is a link to a custom resource containing additional\
# configuration for the controller. This is optional if the controller\
# does not require extra parameters.\
parameters: {}\
# -- For backwards compatibility with ingress.class annotation, use ingressClass.\
# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation\
ingressClass: nginx\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Security context for controller pods\
podSecurityContext: {}\
# -- sysctls for controller pods\
## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/\
sysctls: {}\
# sysctls:\
# \\\"net.core.somaxconn\\\": \\\"8192\\\"\
# -- Security context for controller containers\
containerSecurityContext: {}\
# -- Allows customization of the source of the IP address or FQDN to report\
# in the ingress status field. By default, it reads the information provided\
# by the service. If disable, the status field reports the IP address of the\
# node or nodes where an ingress controller pod is running.\
publishService:\
# -- Enable 'publishService' or not\
enabled: true\
# -- Allows overriding of the publish service to bind to\
# Must be <namespace>/<service_name>\
pathOverride: \\\"\\\"\
# Limit the scope of the controller to a specific namespace\
scope:\
# -- Enable 'scope' or not\
enabled: false\
# -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)\
namespace: \\\"\\\"\
# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels\
# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.\
namespaceSelector: \\\"\\\"\
# -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
tcp:\
# -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
# -- Annotations to be added to the tcp config configmap\
annotations: {}\
udp:\
# -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
# -- Annotations to be added to the udp config configmap\
annotations: {}\
# -- Maxmind license key to download GeoLite2 Databases.\
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases\
maxmindLicenseKey: \\\"\\\"\
# -- Additional command line arguments to pass to Ingress-Nginx Controller\
# E.g. to specify the default SSL certificate you can use\
extraArgs: {}\
## extraArgs:\
## default-ssl-certificate: \\\"<namespace>/<secret_name>\\\"\
## time-buckets: \\\"0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10\\\"\
## length-buckets: \\\"10,20,30,40,50,60,70,80,90,100\\\"\
## size-buckets: \\\"10,100,1000,10000,100000,1e+06,1e+07\\\"\
\
# -- Additional environment variables to set\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
extraEnvs: \
- name: TZ\
value: Asia/Shanghai\
\
# -- Use a `DaemonSet` or `Deployment`\
kind: Deployment\
# -- Annotations to be added to the controller Deployment or DaemonSet\
##\
annotations: {}\
# keel.sh/pollSchedule: \\\"@every 60m\\\"\
\
# -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels\
##\
labels: {}\
# keel.sh/policy: patch\
# keel.sh/trigger: poll\
\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\"key\\\"\
# operator: \\\"Equal|Exists\\\"\
# value: \\\"value\\\"\
# effect: \\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\"\
\
# -- Affinity and anti-affinity rules for server scheduling to nodes\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity\
##\
affinity: {}\
# # An example of preferred pod anti-affinity, weight is in the range 1-100\
# podAntiAffinity:\
# preferredDuringSchedulingIgnoredDuringExecution:\
# - weight: 100\
# podAffinityTerm:\
# labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: kubernetes.io/hostname\
\
# # An example of required pod anti-affinity\
# podAntiAffinity:\
# requiredDuringSchedulingIgnoredDuringExecution:\
# - labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: \\\"kubernetes.io/hostname\\\"\
\
# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/\
##\
topologySpreadConstraints: []\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\"ingress-nginx.name\\\" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: topology.kubernetes.io/zone\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\"ingress-nginx.name\\\" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: kubernetes.io/hostname\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
\
# -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready\
## wait up to five minutes for the drain of connections\
##\
terminationGracePeriodSeconds: 300\
# -- Node labels for controller pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
## Liveness and readiness probe values\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes\
##\
## startupProbe:\
## httpGet:\
## # should match container.healthCheckPath\
## path: \\\"/healthz\\\"\
## port: 10254\
## scheme: HTTP\
## initialDelaySeconds: 5\
## periodSeconds: 5\
## timeoutSeconds: 2\
## successThreshold: 1\
## failureThreshold: 5\
livenessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\"/healthz\\\"\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 5\
readinessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\"/healthz\\\"\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 3\
# -- Path of the health check endpoint. All requests received on the port defined by\
# the healthz-port parameter are forwarded internally to this path.\
healthCheckPath: \\\"/healthz\\\"\
# -- Address to bind the health check endpoint.\
# It is better to set this option to the internal node address\
# if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.\
healthCheckHost: \\\"\\\"\
# -- Annotations to be added to controller pods\
##\
podAnnotations: {}\
replicaCount: 1\
# -- Minimum available pods set in PodDisruptionBudget.\
# Define either 'minAvailable' or 'maxUnavailable', never both.\
minAvailable: 1\
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.\
# maxUnavailable: 1\
\
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes\
## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903\
## Ideally, there should be no limits.\
## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/\
resources:\
## limits:\
## cpu: 100m\
## memory: 90Mi\
requests:\
cpu: 100m\
memory: 90Mi\
# Mutually exclusive with keda autoscaling\
autoscaling:\
enabled: false\
annotations: {}\
minReplicas: 1\
maxReplicas: 11\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
autoscalingTemplate: []\
# Custom or additional autoscaling metrics\
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics\
# - type: Pods\
# pods:\
# metric:\
# name: k8s_pod_rate_cpu_core_used_limit\
# target:\
# averageValue: \\\"80\\\"\
# type: AverageValue\
\
# Mutually exclusive with hpa autoscaling\
keda:\
apiVersion: \\\"keda.sh/v1alpha1\\\"\
## apiVersion changes with keda 1.x vs 2.x\
## 2.x = keda.sh/v1alpha1\
## 1.x = keda.k8s.io/v1alpha1\
enabled: false\
minReplicas: 1\
maxReplicas: 11\
pollingInterval: 30\
cooldownPeriod: 300\
# fallback:\
# failureThreshold: 3\
# replicas: 11\
restoreToOriginalReplicaCount: false\
scaledObject:\
annotations: {}\
# Custom annotations for ScaledObject resource\
# annotations:\
# key: value\
triggers: []\
# - type: prometheus\
# metadata:\
# serverAddress: http://<prometheus-host>:9090\
# metricName: http_requests_total\
# threshold: '100'\
# query: sum(rate(http_requests_total{deployment=\\\"my-deployment\\\"}[2m]))\
\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
# -- Enable mimalloc as a drop-in replacement for malloc.\
## ref: https://github.com/microsoft/mimalloc\
##\
enableMimalloc: true\
## Override NGINX template\
customTemplate:\
configMapName: \\\"\\\"\
configMapKey: \\\"\\\"\
service:\
# -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.\
enabled: true\
external:\
# -- Enable the external controller service or not. Useful for internal-only deployments.\
enabled: true\
# -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.\
annotations: {}\
# -- Labels to be added to both controller services.\
labels: {}\
# -- Type of the external controller service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: LoadBalancer\
# -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\"\\\"\
# -- List of node IP addresses at which the external controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\"\\\"\
# -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\"\\\"\
# -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the external controller service. Set to \\\"Local\\\" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\"\\\"\
# -- Session affinity of the external controller service. Must be either \\\"None\\\" or \\\"ClientIP\\\" if set. Defaults to \\\"None\\\".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\"\\\"\
# -- Specifies the health check node port (numeric port number) for the external controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
# -- Enable the HTTP listener on both controller services or not.\
enableHttp: true\
# -- Enable the HTTPS listener on both controller services or not.\
enableHttps: true\
ports:\
# -- Port the external HTTP listener is published with.\
http: 80\
# -- Port the external HTTPS listener is published with.\
https: 443\
targetPorts:\
# -- Port of the ingress controller the external HTTP listener is mapped to.\
http: http\
# -- Port of the ingress controller the external HTTPS listener is mapped to.\
https: https\
# -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\"\\\"\
# -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\"\\\"\
# -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
internal:\
# -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.\
enabled: false\
# -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer\
annotations: {}\
# -- Type of the internal controller service.\
# Defaults to the value of `controller.service.type`.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: \\\"\\\"\
# -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\"\\\"\
# -- List of node IP addresses at which the internal controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\"\\\"\
# -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\"\\\"\
# -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the internal controller service. Set to \\\"Local\\\" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\"\\\"\
# -- Session affinity of the internal controller service. Must be either \\\"None\\\" or \\\"ClientIP\\\" if set. Defaults to \\\"None\\\".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\"\\\"\
# -- Specifies the health check node port (numeric port number) for the internal controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
ports: {}\
# -- Port the internal HTTP listener is published with.\
# Defaults to the value of `controller.service.ports.http`.\
# http: 80\
# -- Port the internal HTTPS listener is published with.\
# Defaults to the value of `controller.service.ports.https`.\
# https: 443\
\
targetPorts: {}\
# -- Port of the ingress controller the internal HTTP listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.http`.\
# http: http\
# -- Port of the ingress controller the internal HTTPS listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.https`.\
# https: https\
\
# -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\"\\\"\
# -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\"\\\"\
# -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
# shareProcessNamespace enables process namespace sharing within the pod.\
# This can be used for example to signal log rotation using `kill -USR1` from a sidecar.\
shareProcessNamespace: false\
# -- Additional containers to be added to the controller pod.\
# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.\
extraContainers: []\
# - name: my-sidecar\
# image: nginx:latest\
\
# -- Additional volumeMounts to the controller main container.\
extraVolumeMounts: []\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
# -- Additional volumes to the controller pod.\
extraVolumes: []\
# - name: copy-portal-skins\
# emptyDir: {}\
\
# -- Containers, which are run before the app containers are started.\
extraInitContainers: \
- command:\
- sh\
- -c\
- |-\
sysctl -w net.core.somaxconn=65535\
sysctl -w net.ipv4.ip_local_reserved_ports=9100\
sysctl -w net.ipv4.ip_local_port_range=\\\"1024 61999\\\"\
sysctl -w net.ipv4.tcp_tw_reuse=1\
sysctl -w fs.file-max=1048576\
image: ccr.ccs.tencentyun.com/tkeimages/busybox:latest\
imagePullPolicy: Always\
name: setsysctl\
securityContext:\
privileged: true\
\
# -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module\
extraModules: []\
# - name: mytestmodule\
# image:\
# registry: registry.k8s.io\
# image: ingress-nginx/mytestmodule\
# ## for backwards compatibility consider setting the full image url via the repository value below\
# ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
# ## repository:\
# tag: \\\"v1.0.0\\\"\
# digest: \\\"\\\"\
# distroless: false\
# containerSecurityContext:\
# runAsNonRoot: true\
# runAsUser: <user-id>\
# allowPrivilegeEscalation: false\
# seccompProfile:\
# type: RuntimeDefault\
# capabilities:\
# drop:\
# - ALL\
# readOnlyRootFilesystem: true\
# resources: {}\
#\
# The image must contain a `/usr/local/bin/init_module.sh` executable, which\
# will be executed as initContainers, to move its config files within the\
# mounted volume.\
\
opentelemetry:\
enabled: false\
name: opentelemetry\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-opentelemetry\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"v20230721-3e2062ee5\\\"\
digest: \\\"\\\"\
distroless: true\
containerSecurityContext:\
runAsNonRoot: true\
# -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
admissionWebhooks:\
name: admission\
annotations: {}\
# ignore-check.kube-linter.io/no-read-only-rootfs: \\\"This deployment needs write access to root filesystem\\\".\
\
## Additional annotations to the admission webhooks.\
## These annotations will be added to the ValidatingWebhookConfiguration and\
## the Jobs Spec of the admission webhooks.\
enabled: true\
# -- Additional environment variables to set\
extraEnvs: []\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
# -- Admission Webhook failure policy to use\
failurePolicy: Fail\
# timeoutSeconds: 10\
port: 8443\
certificate: \\\"/usr/local/certificates/cert\\\"\
key: \\\"/usr/local/certificates/key\\\"\
namespaceSelector: {}\
objectSelector: {}\
# -- Labels to be added to admission webhooks\
labels: {}\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
service:\
annotations: {}\
# clusterIP: \\\"\\\"\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 443\
type: ClusterIP\
createSecretJob:\
name: create\
# -- Security context for secret creation containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
patchWebhookJob:\
name: patch\
# -- Security context for webhook patch containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
patch:\
enabled: true\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-webhook-certgen\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: v20231011-8b53cabe0\
digest: \\\"\\\"\
pullPolicy: IfNotPresent\
# -- Provide a priority class name to the webhook patching job\
##\
priorityClassName: \\\"\\\"\
podAnnotations: {}\
# NetworkPolicy for webhook patch\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
nodeSelector:\
kubernetes.io/os: linux\
tolerations: []\
# -- Labels to be added to patch job resources\
labels: {}\
# -- Security context for secret creation & webhook patch pods\
securityContext: {}\
# Use certmanager to generate webhook certs\
certManager:\
enabled: false\
# self-signed root certificate\
rootCert:\
# default to be 5y\
duration: \\\"\\\"\
admissionCert:\
# default to be 1y\
duration: \\\"\\\"\
# issuerRef:\
# name: \\\"issuer\\\"\
# kind: \\\"ClusterIssuer\\\"\
metrics:\
port: 10254\
portName: metrics\
# if this port is changed, change healthz-port: in extraArgs: accordingly\
enabled: false\
service:\
annotations: {}\
# prometheus.io/scrape: \\\"true\\\"\
# prometheus.io/port: \\\"10254\\\"\
# -- Labels to be added to the metrics service resource\
labels: {}\
# clusterIP: \\\"\\\"\
\
# -- List of IP addresses at which the stats-exporter service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 10254\
type: ClusterIP\
# externalTrafficPolicy: \\\"\\\"\
# nodePort: \\\"\\\"\
serviceMonitor:\
enabled: false\
additionalLabels: {}\
annotations: {}\
## The label to use to retrieve the job name from.\
## jobLabel: \\\"app.kubernetes.io/name\\\"\
namespace: \\\"\\\"\
namespaceSelector: {}\
## Default: scrape .Release.Namespace or namespaceOverride only\
## To scrape all, use the following:\
## namespaceSelector:\
## any: true\
scrapeInterval: 30s\
# honorLabels: true\
targetLabels: []\
relabelings: []\
metricRelabelings: []\
prometheusRule:\
enabled: false\
additionalLabels: {}\
# namespace: \\\"\\\"\
rules: []\
# # These are just examples rules, please adapt them to your needs\
# - alert: NGINXConfigFailed\
# expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: bad ingress config - nginx config test failed\
# summary: uninstall the latest ingress changes to allow config reloads to resume\
# # By default a fake self-signed certificate is generated as default and\
# # it is fine if it expires. If `--default-ssl-certificate` flag is used\
# # and a valid certificate passed please do not filter for `host` label!\
# # (i.e. delete `{host!=\\\"_\\\"}` so also the default SSL certificate is\
# # checked for expiration)\
# - alert: NGINXCertificateExpiry\
# expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!=\\\"_\\\"}) by (host) - time()) < 604800\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: ssl certificate(s) will expire in less then a week\
# summary: renew expiring certificates to avoid downtime\
# - alert: NGINXTooMany500s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\"5.+\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 5XXs\
# summary: More than 5% of all requests returned 5XX, this requires your attention\
# - alert: NGINXTooMany400s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\"4.+\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 4XXs\
# summary: More than 5% of all requests returned 4XX, this requires your attention\
# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:\
# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds\
# to 300, allowing the draining of connections up to five minutes.\
# If the active connections end before that, the pod will terminate gracefully at that time.\
# To effectively take advantage of this feature, the Configmap feature\
# worker-shutdown-timeout new value is 240s instead of 10s.\
##\
lifecycle:\
preStop:\
exec:\
command:\
- /wait-shutdown\
priorityClassName: \\\"\\\"\
# -- Rollback limit\
##\
revisionHistoryLimit: 10\
## Default 404 backend\
##\
defaultBackend:\
##\
enabled: false\
name: defaultbackend\
image:\
registry: ccr.ccs.tencentyun.com\
image: \\ttke-market/ingress-nginx-defaultbackend-amd64\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"1.5\\\"\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# nobody user -> uid 65534\
runAsUser: 65534\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: true\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
extraArgs: {}\
serviceAccount:\
create: true\
name: \\\"\\\"\
automountServiceAccountToken: true\
# -- Additional environment variables to set for defaultBackend pods\
extraEnvs: []\
port: 8080\
## Readiness and liveness probes for default backend\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/\
##\
livenessProbe:\
failureThreshold: 3\
initialDelaySeconds: 30\
periodSeconds: 10\
successThreshold: 1\
timeoutSeconds: 5\
readinessProbe:\
failureThreshold: 6\
initialDelaySeconds: 0\
periodSeconds: 5\
successThreshold: 1\
timeoutSeconds: 5\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\"key\\\"\
# operator: \\\"Equal|Exists\\\"\
# value: \\\"value\\\"\
# effect: \\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\"\
\
affinity: {}\
# -- Security context for default backend pods\
podSecurityContext: {}\
# -- Security context for default backend containers\
containerSecurityContext: {}\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Node labels for default backend pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
# -- Annotations to be added to default backend pods\
##\
podAnnotations: {}\
replicaCount: 1\
minAvailable: 1\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
\
extraVolumeMounts: []\
## Additional volumeMounts to the default backend container.\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
extraVolumes: []\
## Additional volumes to the default backend pod.\
# - name: copy-portal-skins\
# emptyDir: {}\
\
extraConfigMaps: []\
## Additional configmaps to the default backend pod.\
# - name: my-extra-configmap-1\
# labels:\
# type: config-1\
# data:\
# extra_file_1.html: |\
# <!-- Extra HTML content for ConfigMap 1 -->\
# - name: my-extra-configmap-2\
# labels:\
# type: config-2\
# data:\
# extra_file_2.html: |\
# <!-- Extra HTML content for ConfigMap 2 -->\
\
autoscaling:\
annotations: {}\
enabled: false\
minReplicas: 1\
maxReplicas: 2\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
# NetworkPolicy for default backend component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
service:\
annotations: {}\
# clusterIP: \\\"\\\"\
\
# -- List of IP addresses at which the default backend service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 80\
type: ClusterIP\
priorityClassName: \\\"\\\"\
# -- Labels to be added to the default backend resources\
labels: {}\
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266\
rbac:\
create: true\
scope: false\
## If true, create & use Pod Security Policy resources\
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/\
podSecurityPolicy:\
enabled: false\
serviceAccount:\
create: true\
name: \\\"\\\"\
automountServiceAccountToken: true\
# -- Annotations for the controller service account\
annotations: {}\
# -- Optional array of imagePullSecrets containing private registry credentials\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/\
imagePullSecrets: []\
# - name: secretName\
\
# -- TCP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
tcp: {}\
# 8080: \\\"default/example-tcp-svc:9000\\\"\
\
# -- UDP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
udp: {}\
# 53: \\\"kube-system/kube-dns:53\\\"\
\
# -- Prefix for TCP and UDP ports names in ingress controller service\
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration\
portNamePrefix: \\\"\\\"\
# -- (string) A base64-encoded Diffie-Hellman parameter.\
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`\
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param\
dhParam: \\\"\\\"\
""",
"values_type": "yaml",
})
package main
import (
"github.com/pulumi/pulumi-terraform-provider/sdks/go/tencentcloud/tencentcloud"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := tencentcloud.NewKubernetesClusterRelease(ctx, "example", &tencentcloud.KubernetesClusterReleaseArgs{
ClusterId: pulumi.String("cls-fdy7hm1q"),
Name: pulumi.String("tf-example"),
Namespace: pulumi.String("default"),
Chart: pulumi.String("nginx-ingress"),
ChartFrom: pulumi.String("tke-market"),
ChartVersion: pulumi.String("4.9.0"),
ChartNamespace: pulumi.String("opensource-stable"),
ClusterType: pulumi.String("tke"),
Values: &tencentcloud.KubernetesClusterReleaseValuesArgs{
RawOriginal: pulumi.String("## nginx configuration\\\n## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md\\\n##\\\n\\\n## Overrides for generated resource names\\\n# See templates/_helpers.tpl\\\n# nameOverride:\\\n# fullnameOverride:\\\n\\\n# -- Override the deployment namespace; defaults to .Release.Namespace\\\nnamespaceOverride: \\\\\\\"\\\\\\\"\\\n## Labels to apply to all resources\\\n##\\\ncommonLabels: {}\\\n# scmhash: abc123\\\n# myLabel: aakkmd\\\n\\\ncontroller:\\\n name: controller\\\n enableAnnotationValidations: false\\\n image:\\\n ## Keep false as default for now!\\\n chroot: false\\\n registry: ccr.ccs.tencentyun.com\\\n image: tke-market/ingress-nginx-controller\\\n ## for backwards compatibility consider setting the full image url via the repository value below\\\n ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\\n ## repository:\\\n tag: \\\\\\\"v1.9.5\\\\\\\"\\\n digest: \\\\\\\"\\\\\\\"\\\n digestChroot: \\\\\\\"\\\\\\\"\\\n pullPolicy: IfNotPresent\\\n runAsNonRoot: true\\\n # www-data -> uid 101\\\n runAsUser: 101\\\n allowPrivilegeEscalation: false\\\n seccompProfile:\\\n type: RuntimeDefault\\\n readOnlyRootFilesystem: false\\\n # -- Use an existing PSP instead of creating one\\\n existingPsp: \\\\\\\"\\\\\\\"\\\n # -- Configures the controller container name\\\n containerName: controller\\\n # -- Configures the ports that the nginx-controller listens on\\\n containerPort:\\\n http: 80\\\n https: 443\\\n # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/\\\n config: {}\\\n # -- Annotations to be added to the controller config configuration configmap.\\\n configAnnotations: {}\\\n # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers\\\n proxySetHeaders: {}\\\n # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers\\\n addHeaders: {}\\\n # -- Optionally customize the pod dnsConfig.\\\n dnsConfig: {}\\\n # -- Optionally customize the pod hostAliases.\\\n hostAliases: []\\\n # - ip: 127.0.0.1\\\n # hostnames:\\\n # - foo.local\\\n # - bar.local\\\n # - ip: 10.1.2.3\\\n # hostnames:\\\n # - foo.remote\\\n # - bar.remote\\\n # -- Optionally customize the pod hostname.\\\n hostname: {}\\\n # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.\\\n # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller\\\n # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.\\\n dnsPolicy: ClusterFirst\\\n # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network\\\n # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply\\\n reportNodeInternalIp: false\\\n # -- Process Ingress objects without ingressClass annotation/ingressClassName field\\\n # Overrides value for --watch-ingress-without-class flag of the controller binary\\\n # Defaults to false\\\n watchIngressWithoutClass: false\\\n # -- Process IngressClass per name (additionally as per spec.controller).\\\n ingressClassByName: false\\\n # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode=\\\\\\\"auto\\\\\\\"\\\n # Defaults to false\\\n enableTopologyAwareRouting: false\\\n # -- This configuration defines if Ingress Controller should allow users to set\\\n # their own *-snippet annotations, otherwise this is forbidden / dropped\\\n # when users add those annotations.\\\n # Global snippets in ConfigMap are still respected\\\n allowSnippetAnnotations: false\\\n # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),\\\n # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920\\\n # is merged\\\n hostNetwork: false\\\n ## Use host ports 80 and 443\\\n ## Disabled by default\\\n hostPort:\\\n # -- Enable 'hostPort' or not\\\n enabled: false\\\n ports:\\\n # -- 'hostPort' http port\\\n http: 80\\\n # -- 'hostPort' https port\\\n https: 443\\\n # NetworkPolicy for controller component.\\\n networkPolicy:\\\n # -- Enable 'networkPolicy' or not\\\n enabled: false\\\n # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'\\\n electionID: \\\\\\\"\\\\\\\"\\\n ## This section refers to the creation of the IngressClass resource\\\n ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19\\\n ingressClassResource:\\\n # -- Name of the ingressClass\\\n name: nginx\\\n # -- Is this ingressClass enabled or not\\\n enabled: true\\\n # -- Is this the default ingressClass for the cluster\\\n default: false\\\n # -- Controller-value of the controller that is processing this ingressClass\\\n controllerValue: \\\\\\\"k8s.io/ingress-nginx\\\\\\\"\\\n # -- Parameters is a link to a custom resource containing additional\\\n # configuration for the controller. This is optional if the controller\\\n # does not require extra parameters.\\\n parameters: {}\\\n # -- For backwards compatibility with ingress.class annotation, use ingressClass.\\\n # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation\\\n ingressClass: nginx\\\n # -- Labels to add to the pod container metadata\\\n podLabels: {}\\\n # key: value\\\n\\\n # -- Security context for controller pods\\\n podSecurityContext: {}\\\n # -- sysctls for controller pods\\\n ## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/\\\n sysctls: {}\\\n # sysctls:\\\n # \\\\\\\"net.core.somaxconn\\\\\\\": \\\\\\\"8192\\\\\\\"\\\n # -- Security context for controller containers\\\n containerSecurityContext: {}\\\n # -- Allows customization of the source of the IP address or FQDN to report\\\n # in the ingress status field. By default, it reads the information provided\\\n # by the service. If disable, the status field reports the IP address of the\\\n # node or nodes where an ingress controller pod is running.\\\n publishService:\\\n # -- Enable 'publishService' or not\\\n enabled: true\\\n # -- Allows overriding of the publish service to bind to\\\n # Must be <namespace>/<service_name>\\\n pathOverride: \\\\\\\"\\\\\\\"\\\n # Limit the scope of the controller to a specific namespace\\\n scope:\\\n # -- Enable 'scope' or not\\\n enabled: false\\\n # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)\\\n namespace: \\\\\\\"\\\\\\\"\\\n # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels\\\n # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.\\\n namespaceSelector: \\\\\\\"\\\\\\\"\\\n # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)\\\n configMapNamespace: \\\\\\\"\\\\\\\"\\\n tcp:\\\n # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)\\\n configMapNamespace: \\\\\\\"\\\\\\\"\\\n # -- Annotations to be added to the tcp config configmap\\\n annotations: {}\\\n udp:\\\n # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)\\\n configMapNamespace: \\\\\\\"\\\\\\\"\\\n # -- Annotations to be added to the udp config configmap\\\n annotations: {}\\\n # -- Maxmind license key to download GeoLite2 Databases.\\\n ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases\\\n maxmindLicenseKey: \\\\\\\"\\\\\\\"\\\n # -- Additional command line arguments to pass to Ingress-Nginx Controller\\\n # E.g. to specify the default SSL certificate you can use\\\n extraArgs: {}\\\n ## extraArgs:\\\n ## default-ssl-certificate: \\\\\\\"<namespace>/<secret_name>\\\\\\\"\\\n ## time-buckets: \\\\\\\"0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10\\\\\\\"\\\n ## length-buckets: \\\\\\\"10,20,30,40,50,60,70,80,90,100\\\\\\\"\\\n ## size-buckets: \\\\\\\"10,100,1000,10000,100000,1e+06,1e+07\\\\\\\"\\\n\\\n # -- Additional environment variables to set\\\n # extraEnvs:\\\n # - name: FOO\\\n # valueFrom:\\\n # secretKeyRef:\\\n # key: FOO\\\n # name: secret-resource\\\n extraEnvs: \\\n - name: TZ\\\n value: Asia/Shanghai\\\n\\\n # -- Use a `DaemonSet` or `Deployment`\\\n kind: Deployment\\\n # -- Annotations to be added to the controller Deployment or DaemonSet\\\n ##\\\n annotations: {}\\\n # keel.sh/pollSchedule: \\\\\\\"@every 60m\\\\\\\"\\\n\\\n # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels\\\n ##\\\n labels: {}\\\n # keel.sh/policy: patch\\\n # keel.sh/trigger: poll\\\n\\\n # -- The update strategy to apply to the Deployment or DaemonSet\\\n ##\\\n updateStrategy: {}\\\n # rollingUpdate:\\\n # maxUnavailable: 1\\\n # type: RollingUpdate\\\n\\\n # -- `minReadySeconds` to avoid killing pods before we are ready\\\n ##\\\n minReadySeconds: 0\\\n # -- Node tolerations for server scheduling to nodes with taints\\\n ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\\\n ##\\\n tolerations: []\\\n # - key: \\\\\\\"key\\\\\\\"\\\n # operator: \\\\\\\"Equal|Exists\\\\\\\"\\\n # value: \\\\\\\"value\\\\\\\"\\\n # effect: \\\\\\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\\\\\"\\\n\\\n # -- Affinity and anti-affinity rules for server scheduling to nodes\\\n ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity\\\n ##\\\n affinity: {}\\\n # # An example of preferred pod anti-affinity, weight is in the range 1-100\\\n # podAntiAffinity:\\\n # preferredDuringSchedulingIgnoredDuringExecution:\\\n # - weight: 100\\\n # podAffinityTerm:\\\n # labelSelector:\\\n # matchExpressions:\\\n # - key: app.kubernetes.io/name\\\n # operator: In\\\n # values:\\\n # - ingress-nginx\\\n # - key: app.kubernetes.io/instance\\\n # operator: In\\\n # values:\\\n # - ingress-nginx\\\n # - key: app.kubernetes.io/component\\\n # operator: In\\\n # values:\\\n # - controller\\\n # topologyKey: kubernetes.io/hostname\\\n\\\n # # An example of required pod anti-affinity\\\n # podAntiAffinity:\\\n # requiredDuringSchedulingIgnoredDuringExecution:\\\n # - labelSelector:\\\n # matchExpressions:\\\n # - key: app.kubernetes.io/name\\\n # operator: In\\\n # values:\\\n # - ingress-nginx\\\n # - key: app.kubernetes.io/instance\\\n # operator: In\\\n # values:\\\n # - ingress-nginx\\\n # - key: app.kubernetes.io/component\\\n # operator: In\\\n # values:\\\n # - controller\\\n # topologyKey: \\\\\\\"kubernetes.io/hostname\\\\\\\"\\\n\\\n # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.\\\n ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/\\\n ##\\\n topologySpreadConstraints: []\\\n # - labelSelector:\\\n # matchLabels:\\\n # app.kubernetes.io/name: '{{ include \\\\\\\"ingress-nginx.name\\\\\\\" . }}'\\\n # app.kubernetes.io/instance: '{{ .Release.Name }}'\\\n # app.kubernetes.io/component: controller\\\n # topologyKey: topology.kubernetes.io/zone\\\n # maxSkew: 1\\\n # whenUnsatisfiable: ScheduleAnyway\\\n # - labelSelector:\\\n # matchLabels:\\\n # app.kubernetes.io/name: '{{ include \\\\\\\"ingress-nginx.name\\\\\\\" . }}'\\\n # app.kubernetes.io/instance: '{{ .Release.Name }}'\\\n # app.kubernetes.io/component: controller\\\n # topologyKey: kubernetes.io/hostname\\\n # maxSkew: 1\\\n # whenUnsatisfiable: ScheduleAnyway\\\n\\\n # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready\\\n ## wait up to five minutes for the drain of connections\\\n ##\\\n terminationGracePeriodSeconds: 300\\\n # -- Node labels for controller pod assignment\\\n ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\\\n ##\\\n nodeSelector:\\\n kubernetes.io/os: linux\\\n ## Liveness and readiness probe values\\\n ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes\\\n ##\\\n ## startupProbe:\\\n ## httpGet:\\\n ## # should match container.healthCheckPath\\\n ## path: \\\\\\\"/healthz\\\\\\\"\\\n ## port: 10254\\\n ## scheme: HTTP\\\n ## initialDelaySeconds: 5\\\n ## periodSeconds: 5\\\n ## timeoutSeconds: 2\\\n ## successThreshold: 1\\\n ## failureThreshold: 5\\\n livenessProbe:\\\n httpGet:\\\n # should match container.healthCheckPath\\\n path: \\\\\\\"/healthz\\\\\\\"\\\n port: 10254\\\n scheme: HTTP\\\n initialDelaySeconds: 10\\\n periodSeconds: 10\\\n timeoutSeconds: 1\\\n successThreshold: 1\\\n failureThreshold: 5\\\n readinessProbe:\\\n httpGet:\\\n # should match container.healthCheckPath\\\n path: \\\\\\\"/healthz\\\\\\\"\\\n port: 10254\\\n scheme: HTTP\\\n initialDelaySeconds: 10\\\n periodSeconds: 10\\\n timeoutSeconds: 1\\\n successThreshold: 1\\\n failureThreshold: 3\\\n # -- Path of the health check endpoint. All requests received on the port defined by\\\n # the healthz-port parameter are forwarded internally to this path.\\\n healthCheckPath: \\\\\\\"/healthz\\\\\\\"\\\n # -- Address to bind the health check endpoint.\\\n # It is better to set this option to the internal node address\\\n # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.\\\n healthCheckHost: \\\\\\\"\\\\\\\"\\\n # -- Annotations to be added to controller pods\\\n ##\\\n podAnnotations: {}\\\n replicaCount: 1\\\n # -- Minimum available pods set in PodDisruptionBudget.\\\n # Define either 'minAvailable' or 'maxUnavailable', never both.\\\n minAvailable: 1\\\n # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.\\\n # maxUnavailable: 1\\\n\\\n ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes\\\n ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903\\\n ## Ideally, there should be no limits.\\\n ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/\\\n resources:\\\n ## limits:\\\n ## cpu: 100m\\\n ## memory: 90Mi\\\n requests:\\\n cpu: 100m\\\n memory: 90Mi\\\n # Mutually exclusive with keda autoscaling\\\n autoscaling:\\\n enabled: false\\\n annotations: {}\\\n minReplicas: 1\\\n maxReplicas: 11\\\n targetCPUUtilizationPercentage: 50\\\n targetMemoryUtilizationPercentage: 50\\\n behavior: {}\\\n # scaleDown:\\\n # stabilizationWindowSeconds: 300\\\n # policies:\\\n # - type: Pods\\\n # value: 1\\\n # periodSeconds: 180\\\n # scaleUp:\\\n # stabilizationWindowSeconds: 300\\\n # policies:\\\n # - type: Pods\\\n # value: 2\\\n # periodSeconds: 60\\\n autoscalingTemplate: []\\\n # Custom or additional autoscaling metrics\\\n # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics\\\n # - type: Pods\\\n # pods:\\\n # metric:\\\n # name: k8s_pod_rate_cpu_core_used_limit\\\n # target:\\\n # averageValue: \\\\\\\"80\\\\\\\"\\\n # type: AverageValue\\\n\\\n # Mutually exclusive with hpa autoscaling\\\n keda:\\\n apiVersion: \\\\\\\"keda.sh/v1alpha1\\\\\\\"\\\n ## apiVersion changes with keda 1.x vs 2.x\\\n ## 2.x = keda.sh/v1alpha1\\\n ## 1.x = keda.k8s.io/v1alpha1\\\n enabled: false\\\n minReplicas: 1\\\n maxReplicas: 11\\\n pollingInterval: 30\\\n cooldownPeriod: 300\\\n # fallback:\\\n # failureThreshold: 3\\\n # replicas: 11\\\n restoreToOriginalReplicaCount: false\\\n scaledObject:\\\n annotations: {}\\\n # Custom annotations for ScaledObject resource\\\n # annotations:\\\n # key: value\\\n triggers: []\\\n # - type: prometheus\\\n # metadata:\\\n # serverAddress: http://<prometheus-host>:9090\\\n # metricName: http_requests_total\\\n # threshold: '100'\\\n # query: sum(rate(http_requests_total{deployment=\\\\\\\"my-deployment\\\\\\\"}[2m]))\\\n\\\n behavior: {}\\\n # scaleDown:\\\n # stabilizationWindowSeconds: 300\\\n # policies:\\\n # - type: Pods\\\n # value: 1\\\n # periodSeconds: 180\\\n # scaleUp:\\\n # stabilizationWindowSeconds: 300\\\n # policies:\\\n # - type: Pods\\\n # value: 2\\\n # periodSeconds: 60\\\n # -- Enable mimalloc as a drop-in replacement for malloc.\\\n ## ref: https://github.com/microsoft/mimalloc\\\n ##\\\n enableMimalloc: true\\\n ## Override NGINX template\\\n customTemplate:\\\n configMapName: \\\\\\\"\\\\\\\"\\\n configMapKey: \\\\\\\"\\\\\\\"\\\n service:\\\n # -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.\\\n enabled: true\\\n external:\\\n # -- Enable the external controller service or not. Useful for internal-only deployments.\\\n enabled: true\\\n # -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.\\\n annotations: {}\\\n # -- Labels to be added to both controller services.\\\n labels: {}\\\n # -- Type of the external controller service.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\\\n type: LoadBalancer\\\n # -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.\\\n # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\\\n clusterIP: \\\\\\\"\\\\\\\"\\\n # -- List of node IP addresses at which the external controller service is available.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\\n externalIPs: []\\\n # -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\\\n loadBalancerIP: \\\\\\\"\\\\\\\"\\\n # -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.\\\n loadBalancerSourceRanges: []\\\n # -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\\\n loadBalancerClass: \\\\\\\"\\\\\\\"\\\n # -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\\\n # allocateLoadBalancerNodePorts: true\\\n\\\n # -- External traffic policy of the external controller service. Set to \\\\\\\"Local\\\\\\\" to preserve source IP on providers supporting it.\\\n # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\\n externalTrafficPolicy: \\\\\\\"\\\\\\\"\\\n # -- Session affinity of the external controller service. Must be either \\\\\\\"None\\\\\\\" or \\\\\\\"ClientIP\\\\\\\" if set. Defaults to \\\\\\\"None\\\\\\\".\\\n # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\\\n sessionAffinity: \\\\\\\"\\\\\\\"\\\n # -- Specifies the health check node port (numeric port number) for the external controller service.\\\n # If not specified, the service controller allocates a port from your cluster's node port range.\\\n # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\\n # healthCheckNodePort: 0\\\n\\\n # -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\\\n # Fields `ipFamilies` and `clusterIP` depend on the value of this field.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\\n ipFamilyPolicy: SingleStack\\\n # -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\\n ipFamilies:\\\n - IPv4\\\n # -- Enable the HTTP listener on both controller services or not.\\\n enableHttp: true\\\n # -- Enable the HTTPS listener on both controller services or not.\\\n enableHttps: true\\\n ports:\\\n # -- Port the external HTTP listener is published with.\\\n http: 80\\\n # -- Port the external HTTPS listener is published with.\\\n https: 443\\\n targetPorts:\\\n # -- Port of the ingress controller the external HTTP listener is mapped to.\\\n http: http\\\n # -- Port of the ingress controller the external HTTPS listener is mapped to.\\\n https: https\\\n # -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\\\n appProtocol: true\\\n nodePorts:\\\n # -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.\\\n http: \\\\\\\"\\\\\\\"\\\n # -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\\\n https: \\\\\\\"\\\\\\\"\\\n # -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.\\\n # Example:\\\n # tcp:\\\n # 8080: 30080\\\n tcp: {}\\\n # -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.\\\n # Example:\\\n # udp:\\\n # 53: 30053\\\n udp: {}\\\n internal:\\\n # -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.\\\n enabled: false\\\n # -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer\\\n annotations: {}\\\n # -- Type of the internal controller service.\\\n # Defaults to the value of `controller.service.type`.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\\\n type: \\\\\\\"\\\\\\\"\\\n # -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.\\\n # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\\\n clusterIP: \\\\\\\"\\\\\\\"\\\n # -- List of node IP addresses at which the internal controller service is available.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\\n externalIPs: []\\\n # -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\\\n loadBalancerIP: \\\\\\\"\\\\\\\"\\\n # -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.\\\n loadBalancerSourceRanges: []\\\n # -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\\\n loadBalancerClass: \\\\\\\"\\\\\\\"\\\n # -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\\\n # allocateLoadBalancerNodePorts: true\\\n\\\n # -- External traffic policy of the internal controller service. Set to \\\\\\\"Local\\\\\\\" to preserve source IP on providers supporting it.\\\n # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\\n externalTrafficPolicy: \\\\\\\"\\\\\\\"\\\n # -- Session affinity of the internal controller service. Must be either \\\\\\\"None\\\\\\\" or \\\\\\\"ClientIP\\\\\\\" if set. Defaults to \\\\\\\"None\\\\\\\".\\\n # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\\\n sessionAffinity: \\\\\\\"\\\\\\\"\\\n # -- Specifies the health check node port (numeric port number) for the internal controller service.\\\n # If not specified, the service controller allocates a port from your cluster's node port range.\\\n # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\\\n # healthCheckNodePort: 0\\\n\\\n # -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\\\n # Fields `ipFamilies` and `clusterIP` depend on the value of this field.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\\n ipFamilyPolicy: SingleStack\\\n # -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\\\n ipFamilies:\\\n - IPv4\\\n ports: {}\\\n # -- Port the internal HTTP listener is published with.\\\n # Defaults to the value of `controller.service.ports.http`.\\\n # http: 80\\\n # -- Port the internal HTTPS listener is published with.\\\n # Defaults to the value of `controller.service.ports.https`.\\\n # https: 443\\\n\\\n targetPorts: {}\\\n # -- Port of the ingress controller the internal HTTP listener is mapped to.\\\n # Defaults to the value of `controller.service.targetPorts.http`.\\\n # http: http\\\n # -- Port of the ingress controller the internal HTTPS listener is mapped to.\\\n # Defaults to the value of `controller.service.targetPorts.https`.\\\n # https: https\\\n\\\n # -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\\\n # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\\\n appProtocol: true\\\n nodePorts:\\\n # -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.\\\n http: \\\\\\\"\\\\\\\"\\\n # -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\\\n https: \\\\\\\"\\\\\\\"\\\n # -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.\\\n # Example:\\\n # tcp:\\\n # 8080: 30080\\\n tcp: {}\\\n # -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.\\\n # Example:\\\n # udp:\\\n # 53: 30053\\\n udp: {}\\\n # shareProcessNamespace enables process namespace sharing within the pod.\\\n # This can be used for example to signal log rotation using `kill -USR1` from a sidecar.\\\n shareProcessNamespace: false\\\n # -- Additional containers to be added to the controller pod.\\\n # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.\\\n extraContainers: []\\\n # - name: my-sidecar\\\n # image: nginx:latest\\\n\\\n # -- Additional volumeMounts to the controller main container.\\\n extraVolumeMounts: []\\\n # - name: copy-portal-skins\\\n # mountPath: /var/lib/lemonldap-ng/portal/skins\\\n\\\n # -- Additional volumes to the controller pod.\\\n extraVolumes: []\\\n # - name: copy-portal-skins\\\n # emptyDir: {}\\\n\\\n # -- Containers, which are run before the app containers are started.\\\n extraInitContainers: \\\n - command:\\\n - sh\\\n - -c\\\n - |-\\\n sysctl -w net.core.somaxconn=65535\\\n sysctl -w net.ipv4.ip_local_reserved_ports=9100\\\n sysctl -w net.ipv4.ip_local_port_range=\\\\\\\"1024 61999\\\\\\\"\\\n sysctl -w net.ipv4.tcp_tw_reuse=1\\\n sysctl -w fs.file-max=1048576\\\n image: ccr.ccs.tencentyun.com/tkeimages/busybox:latest\\\n imagePullPolicy: Always\\\n name: setsysctl\\\n securityContext:\\\n privileged: true\\\n\\\n # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module\\\n extraModules: []\\\n # - name: mytestmodule\\\n # image:\\\n # registry: registry.k8s.io\\\n # image: ingress-nginx/mytestmodule\\\n # ## for backwards compatibility consider setting the full image url via the repository value below\\\n # ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\\n # ## repository:\\\n # tag: \\\\\\\"v1.0.0\\\\\\\"\\\n # digest: \\\\\\\"\\\\\\\"\\\n # distroless: false\\\n # containerSecurityContext:\\\n # runAsNonRoot: true\\\n # runAsUser: <user-id>\\\n # allowPrivilegeEscalation: false\\\n # seccompProfile:\\\n # type: RuntimeDefault\\\n # capabilities:\\\n # drop:\\\n # - ALL\\\n # readOnlyRootFilesystem: true\\\n # resources: {}\\\n #\\\n # The image must contain a `/usr/local/bin/init_module.sh` executable, which\\\n # will be executed as initContainers, to move its config files within the\\\n # mounted volume.\\\n\\\n opentelemetry:\\\n enabled: false\\\n name: opentelemetry\\\n image:\\\n registry: ccr.ccs.tencentyun.com\\\n image: tke-market/ingress-nginx-opentelemetry\\\n ## for backwards compatibility consider setting the full image url via the repository value below\\\n ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\\n ## repository:\\\n tag: \\\\\\\"v20230721-3e2062ee5\\\\\\\"\\\n digest: \\\\\\\"\\\\\\\"\\\n distroless: true\\\n containerSecurityContext:\\\n runAsNonRoot: true\\\n # -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.\\\n runAsUser: 65532\\\n allowPrivilegeEscalation: false\\\n seccompProfile:\\\n type: RuntimeDefault\\\n capabilities:\\\n drop:\\\n - ALL\\\n readOnlyRootFilesystem: true\\\n resources: {}\\\n admissionWebhooks:\\\n name: admission\\\n annotations: {}\\\n # ignore-check.kube-linter.io/no-read-only-rootfs: \\\\\\\"This deployment needs write access to root filesystem\\\\\\\".\\\n\\\n ## Additional annotations to the admission webhooks.\\\n ## These annotations will be added to the ValidatingWebhookConfiguration and\\\n ## the Jobs Spec of the admission webhooks.\\\n enabled: true\\\n # -- Additional environment variables to set\\\n extraEnvs: []\\\n # extraEnvs:\\\n # - name: FOO\\\n # valueFrom:\\\n # secretKeyRef:\\\n # key: FOO\\\n # name: secret-resource\\\n # -- Admission Webhook failure policy to use\\\n failurePolicy: Fail\\\n # timeoutSeconds: 10\\\n port: 8443\\\n certificate: \\\\\\\"/usr/local/certificates/cert\\\\\\\"\\\n key: \\\\\\\"/usr/local/certificates/key\\\\\\\"\\\n namespaceSelector: {}\\\n objectSelector: {}\\\n # -- Labels to be added to admission webhooks\\\n labels: {}\\\n # -- Use an existing PSP instead of creating one\\\n existingPsp: \\\\\\\"\\\\\\\"\\\n service:\\\n annotations: {}\\\n # clusterIP: \\\\\\\"\\\\\\\"\\\n externalIPs: []\\\n # loadBalancerIP: \\\\\\\"\\\\\\\"\\\n loadBalancerSourceRanges: []\\\n servicePort: 443\\\n type: ClusterIP\\\n createSecretJob:\\\n name: create\\\n # -- Security context for secret creation containers\\\n securityContext:\\\n runAsNonRoot: true\\\n runAsUser: 65532\\\n allowPrivilegeEscalation: false\\\n seccompProfile:\\\n type: RuntimeDefault\\\n capabilities:\\\n drop:\\\n - ALL\\\n readOnlyRootFilesystem: true\\\n resources: {}\\\n # limits:\\\n # cpu: 10m\\\n # memory: 20Mi\\\n # requests:\\\n # cpu: 10m\\\n # memory: 20Mi\\\n patchWebhookJob:\\\n name: patch\\\n # -- Security context for webhook patch containers\\\n securityContext:\\\n runAsNonRoot: true\\\n runAsUser: 65532\\\n allowPrivilegeEscalation: false\\\n seccompProfile:\\\n type: RuntimeDefault\\\n capabilities:\\\n drop:\\\n - ALL\\\n readOnlyRootFilesystem: true\\\n resources: {}\\\n patch:\\\n enabled: true\\\n image:\\\n registry: ccr.ccs.tencentyun.com\\\n image: tke-market/ingress-nginx-webhook-certgen\\\n ## for backwards compatibility consider setting the full image url via the repository value below\\\n ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\\n ## repository:\\\n tag: v20231011-8b53cabe0\\\n digest: \\\\\\\"\\\\\\\"\\\n pullPolicy: IfNotPresent\\\n # -- Provide a priority class name to the webhook patching job\\\n ##\\\n priorityClassName: \\\\\\\"\\\\\\\"\\\n podAnnotations: {}\\\n # NetworkPolicy for webhook patch\\\n networkPolicy:\\\n # -- Enable 'networkPolicy' or not\\\n enabled: false\\\n nodeSelector:\\\n kubernetes.io/os: linux\\\n tolerations: []\\\n # -- Labels to be added to patch job resources\\\n labels: {}\\\n # -- Security context for secret creation & webhook patch pods\\\n securityContext: {}\\\n # Use certmanager to generate webhook certs\\\n certManager:\\\n enabled: false\\\n # self-signed root certificate\\\n rootCert:\\\n # default to be 5y\\\n duration: \\\\\\\"\\\\\\\"\\\n admissionCert:\\\n # default to be 1y\\\n duration: \\\\\\\"\\\\\\\"\\\n # issuerRef:\\\n # name: \\\\\\\"issuer\\\\\\\"\\\n # kind: \\\\\\\"ClusterIssuer\\\\\\\"\\\n metrics:\\\n port: 10254\\\n portName: metrics\\\n # if this port is changed, change healthz-port: in extraArgs: accordingly\\\n enabled: false\\\n service:\\\n annotations: {}\\\n # prometheus.io/scrape: \\\\\\\"true\\\\\\\"\\\n # prometheus.io/port: \\\\\\\"10254\\\\\\\"\\\n # -- Labels to be added to the metrics service resource\\\n labels: {}\\\n # clusterIP: \\\\\\\"\\\\\\\"\\\n\\\n # -- List of IP addresses at which the stats-exporter service is available\\\n ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\\n ##\\\n externalIPs: []\\\n # loadBalancerIP: \\\\\\\"\\\\\\\"\\\n loadBalancerSourceRanges: []\\\n servicePort: 10254\\\n type: ClusterIP\\\n # externalTrafficPolicy: \\\\\\\"\\\\\\\"\\\n # nodePort: \\\\\\\"\\\\\\\"\\\n serviceMonitor:\\\n enabled: false\\\n additionalLabels: {}\\\n annotations: {}\\\n ## The label to use to retrieve the job name from.\\\n ## jobLabel: \\\\\\\"app.kubernetes.io/name\\\\\\\"\\\n namespace: \\\\\\\"\\\\\\\"\\\n namespaceSelector: {}\\\n ## Default: scrape .Release.Namespace or namespaceOverride only\\\n ## To scrape all, use the following:\\\n ## namespaceSelector:\\\n ## any: true\\\n scrapeInterval: 30s\\\n # honorLabels: true\\\n targetLabels: []\\\n relabelings: []\\\n metricRelabelings: []\\\n prometheusRule:\\\n enabled: false\\\n additionalLabels: {}\\\n # namespace: \\\\\\\"\\\\\\\"\\\n rules: []\\\n # # These are just examples rules, please adapt them to your needs\\\n # - alert: NGINXConfigFailed\\\n # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0\\\n # for: 1s\\\n # labels:\\\n # severity: critical\\\n # annotations:\\\n # description: bad ingress config - nginx config test failed\\\n # summary: uninstall the latest ingress changes to allow config reloads to resume\\\n # # By default a fake self-signed certificate is generated as default and\\\n # # it is fine if it expires. If `--default-ssl-certificate` flag is used\\\n # # and a valid certificate passed please do not filter for `host` label!\\\n # # (i.e. delete `{host!=\\\\\\\"_\\\\\\\"}` so also the default SSL certificate is\\\n # # checked for expiration)\\\n # - alert: NGINXCertificateExpiry\\\n # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!=\\\\\\\"_\\\\\\\"}) by (host) - time()) < 604800\\\n # for: 1s\\\n # labels:\\\n # severity: critical\\\n # annotations:\\\n # description: ssl certificate(s) will expire in less then a week\\\n # summary: renew expiring certificates to avoid downtime\\\n # - alert: NGINXTooMany500s\\\n # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\\\\\"5.+\\\\\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\\\n # for: 1m\\\n # labels:\\\n # severity: warning\\\n # annotations:\\\n # description: Too many 5XXs\\\n # summary: More than 5% of all requests returned 5XX, this requires your attention\\\n # - alert: NGINXTooMany400s\\\n # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\\\\\"4.+\\\\\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\\\n # for: 1m\\\n # labels:\\\n # severity: warning\\\n # annotations:\\\n # description: Too many 4XXs\\\n # summary: More than 5% of all requests returned 4XX, this requires your attention\\\n # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:\\\n # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds\\\n # to 300, allowing the draining of connections up to five minutes.\\\n # If the active connections end before that, the pod will terminate gracefully at that time.\\\n # To effectively take advantage of this feature, the Configmap feature\\\n # worker-shutdown-timeout new value is 240s instead of 10s.\\\n ##\\\n lifecycle:\\\n preStop:\\\n exec:\\\n command:\\\n - /wait-shutdown\\\n priorityClassName: \\\\\\\"\\\\\\\"\\\n# -- Rollback limit\\\n##\\\nrevisionHistoryLimit: 10\\\n## Default 404 backend\\\n##\\\ndefaultBackend:\\\n ##\\\n enabled: false\\\n name: defaultbackend\\\n image:\\\n registry: ccr.ccs.tencentyun.com\\\n image: \\\\ttke-market/ingress-nginx-defaultbackend-amd64\\\n ## for backwards compatibility consider setting the full image url via the repository value below\\\n ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\\\n ## repository:\\\n tag: \\\\\\\"1.5\\\\\\\"\\\n pullPolicy: IfNotPresent\\\n runAsNonRoot: true\\\n # nobody user -> uid 65534\\\n runAsUser: 65534\\\n allowPrivilegeEscalation: false\\\n seccompProfile:\\\n type: RuntimeDefault\\\n readOnlyRootFilesystem: true\\\n # -- Use an existing PSP instead of creating one\\\n existingPsp: \\\\\\\"\\\\\\\"\\\n extraArgs: {}\\\n serviceAccount:\\\n create: true\\\n name: \\\\\\\"\\\\\\\"\\\n automountServiceAccountToken: true\\\n # -- Additional environment variables to set for defaultBackend pods\\\n extraEnvs: []\\\n port: 8080\\\n ## Readiness and liveness probes for default backend\\\n ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/\\\n ##\\\n livenessProbe:\\\n failureThreshold: 3\\\n initialDelaySeconds: 30\\\n periodSeconds: 10\\\n successThreshold: 1\\\n timeoutSeconds: 5\\\n readinessProbe:\\\n failureThreshold: 6\\\n initialDelaySeconds: 0\\\n periodSeconds: 5\\\n successThreshold: 1\\\n timeoutSeconds: 5\\\n # -- The update strategy to apply to the Deployment or DaemonSet\\\n ##\\\n updateStrategy: {}\\\n # rollingUpdate:\\\n # maxUnavailable: 1\\\n # type: RollingUpdate\\\n\\\n # -- `minReadySeconds` to avoid killing pods before we are ready\\\n ##\\\n minReadySeconds: 0\\\n # -- Node tolerations for server scheduling to nodes with taints\\\n ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\\\n ##\\\n tolerations: []\\\n # - key: \\\\\\\"key\\\\\\\"\\\n # operator: \\\\\\\"Equal|Exists\\\\\\\"\\\n # value: \\\\\\\"value\\\\\\\"\\\n # effect: \\\\\\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\\\\\"\\\n\\\n affinity: {}\\\n # -- Security context for default backend pods\\\n podSecurityContext: {}\\\n # -- Security context for default backend containers\\\n containerSecurityContext: {}\\\n # -- Labels to add to the pod container metadata\\\n podLabels: {}\\\n # key: value\\\n\\\n # -- Node labels for default backend pod assignment\\\n ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\\\n ##\\\n nodeSelector:\\\n kubernetes.io/os: linux\\\n # -- Annotations to be added to default backend pods\\\n ##\\\n podAnnotations: {}\\\n replicaCount: 1\\\n minAvailable: 1\\\n resources: {}\\\n # limits:\\\n # cpu: 10m\\\n # memory: 20Mi\\\n # requests:\\\n # cpu: 10m\\\n # memory: 20Mi\\\n\\\n extraVolumeMounts: []\\\n ## Additional volumeMounts to the default backend container.\\\n # - name: copy-portal-skins\\\n # mountPath: /var/lib/lemonldap-ng/portal/skins\\\n\\\n extraVolumes: []\\\n ## Additional volumes to the default backend pod.\\\n # - name: copy-portal-skins\\\n # emptyDir: {}\\\n\\\n extraConfigMaps: []\\\n ## Additional configmaps to the default backend pod.\\\n # - name: my-extra-configmap-1\\\n # labels:\\\n # type: config-1\\\n # data:\\\n # extra_file_1.html: |\\\n # <!-- Extra HTML content for ConfigMap 1 -->\\\n # - name: my-extra-configmap-2\\\n # labels:\\\n # type: config-2\\\n # data:\\\n # extra_file_2.html: |\\\n # <!-- Extra HTML content for ConfigMap 2 -->\\\n\\\n autoscaling:\\\n annotations: {}\\\n enabled: false\\\n minReplicas: 1\\\n maxReplicas: 2\\\n targetCPUUtilizationPercentage: 50\\\n targetMemoryUtilizationPercentage: 50\\\n # NetworkPolicy for default backend component.\\\n networkPolicy:\\\n # -- Enable 'networkPolicy' or not\\\n enabled: false\\\n service:\\\n annotations: {}\\\n # clusterIP: \\\\\\\"\\\\\\\"\\\n\\\n # -- List of IP addresses at which the default backend service is available\\\n ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\\\n ##\\\n externalIPs: []\\\n # loadBalancerIP: \\\\\\\"\\\\\\\"\\\n loadBalancerSourceRanges: []\\\n servicePort: 80\\\n type: ClusterIP\\\n priorityClassName: \\\\\\\"\\\\\\\"\\\n # -- Labels to be added to the default backend resources\\\n labels: {}\\\n## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266\\\nrbac:\\\n create: true\\\n scope: false\\\n## If true, create & use Pod Security Policy resources\\\n## https://kubernetes.io/docs/concepts/policy/pod-security-policy/\\\npodSecurityPolicy:\\\n enabled: false\\\nserviceAccount:\\\n create: true\\\n name: \\\\\\\"\\\\\\\"\\\n automountServiceAccountToken: true\\\n # -- Annotations for the controller service account\\\n annotations: {}\\\n# -- Optional array of imagePullSecrets containing private registry credentials\\\n## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/\\\nimagePullSecrets: []\\\n# - name: secretName\\\n\\\n# -- TCP service key-value pairs\\\n## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\\\n##\\\ntcp: {}\\\n# 8080: \\\\\\\"default/example-tcp-svc:9000\\\\\\\"\\\n\\\n# -- UDP service key-value pairs\\\n## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\\\n##\\\nudp: {}\\\n# 53: \\\\\\\"kube-system/kube-dns:53\\\\\\\"\\\n\\\n# -- Prefix for TCP and UDP ports names in ingress controller service\\\n## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration\\\nportNamePrefix: \\\\\\\"\\\\\\\"\\\n# -- (string) A base64-encoded Diffie-Hellman parameter.\\\n# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`\\\n## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param\\\ndhParam: \\\\\\\"\\\\\\\"\\\n\n"),
ValuesType: pulumi.String("yaml"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Tencentcloud = Pulumi.Tencentcloud;
return await Deployment.RunAsync(() =>
{
var example = new Tencentcloud.KubernetesClusterRelease("example", new()
{
ClusterId = "cls-fdy7hm1q",
Name = "tf-example",
Namespace = "default",
Chart = "nginx-ingress",
ChartFrom = "tke-market",
ChartVersion = "4.9.0",
ChartNamespace = "opensource-stable",
ClusterType = "tke",
Values = new Tencentcloud.Inputs.KubernetesClusterReleaseValuesArgs
{
RawOriginal = @"## nginx configuration\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md\
##\
\
## Overrides for generated resource names\
# See templates/_helpers.tpl\
# nameOverride:\
# fullnameOverride:\
\
# -- Override the deployment namespace; defaults to .Release.Namespace\
namespaceOverride: \\\""\\\""\
## Labels to apply to all resources\
##\
commonLabels: {}\
# scmhash: abc123\
# myLabel: aakkmd\
\
controller:\
name: controller\
enableAnnotationValidations: false\
image:\
## Keep false as default for now!\
chroot: false\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-controller\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\""v1.9.5\\\""\
digest: \\\""\\\""\
digestChroot: \\\""\\\""\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# www-data -> uid 101\
runAsUser: 101\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: false\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\""\\\""\
# -- Configures the controller container name\
containerName: controller\
# -- Configures the ports that the nginx-controller listens on\
containerPort:\
http: 80\
https: 443\
# -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/\
config: {}\
# -- Annotations to be added to the controller config configuration configmap.\
configAnnotations: {}\
# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers\
proxySetHeaders: {}\
# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers\
addHeaders: {}\
# -- Optionally customize the pod dnsConfig.\
dnsConfig: {}\
# -- Optionally customize the pod hostAliases.\
hostAliases: []\
# - ip: 127.0.0.1\
# hostnames:\
# - foo.local\
# - bar.local\
# - ip: 10.1.2.3\
# hostnames:\
# - foo.remote\
# - bar.remote\
# -- Optionally customize the pod hostname.\
hostname: {}\
# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.\
# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller\
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.\
dnsPolicy: ClusterFirst\
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network\
# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply\
reportNodeInternalIp: false\
# -- Process Ingress objects without ingressClass annotation/ingressClassName field\
# Overrides value for --watch-ingress-without-class flag of the controller binary\
# Defaults to false\
watchIngressWithoutClass: false\
# -- Process IngressClass per name (additionally as per spec.controller).\
ingressClassByName: false\
# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode=\\\""auto\\\""\
# Defaults to false\
enableTopologyAwareRouting: false\
# -- This configuration defines if Ingress Controller should allow users to set\
# their own *-snippet annotations, otherwise this is forbidden / dropped\
# when users add those annotations.\
# Global snippets in ConfigMap are still respected\
allowSnippetAnnotations: false\
# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),\
# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920\
# is merged\
hostNetwork: false\
## Use host ports 80 and 443\
## Disabled by default\
hostPort:\
# -- Enable 'hostPort' or not\
enabled: false\
ports:\
# -- 'hostPort' http port\
http: 80\
# -- 'hostPort' https port\
https: 443\
# NetworkPolicy for controller component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'\
electionID: \\\""\\\""\
## This section refers to the creation of the IngressClass resource\
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19\
ingressClassResource:\
# -- Name of the ingressClass\
name: nginx\
# -- Is this ingressClass enabled or not\
enabled: true\
# -- Is this the default ingressClass for the cluster\
default: false\
# -- Controller-value of the controller that is processing this ingressClass\
controllerValue: \\\""k8s.io/ingress-nginx\\\""\
# -- Parameters is a link to a custom resource containing additional\
# configuration for the controller. This is optional if the controller\
# does not require extra parameters.\
parameters: {}\
# -- For backwards compatibility with ingress.class annotation, use ingressClass.\
# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation\
ingressClass: nginx\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Security context for controller pods\
podSecurityContext: {}\
# -- sysctls for controller pods\
## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/\
sysctls: {}\
# sysctls:\
# \\\""net.core.somaxconn\\\"": \\\""8192\\\""\
# -- Security context for controller containers\
containerSecurityContext: {}\
# -- Allows customization of the source of the IP address or FQDN to report\
# in the ingress status field. By default, it reads the information provided\
# by the service. If disable, the status field reports the IP address of the\
# node or nodes where an ingress controller pod is running.\
publishService:\
# -- Enable 'publishService' or not\
enabled: true\
# -- Allows overriding of the publish service to bind to\
# Must be <namespace>/<service_name>\
pathOverride: \\\""\\\""\
# Limit the scope of the controller to a specific namespace\
scope:\
# -- Enable 'scope' or not\
enabled: false\
# -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)\
namespace: \\\""\\\""\
# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels\
# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.\
namespaceSelector: \\\""\\\""\
# -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\""\\\""\
tcp:\
# -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\""\\\""\
# -- Annotations to be added to the tcp config configmap\
annotations: {}\
udp:\
# -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\""\\\""\
# -- Annotations to be added to the udp config configmap\
annotations: {}\
# -- Maxmind license key to download GeoLite2 Databases.\
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases\
maxmindLicenseKey: \\\""\\\""\
# -- Additional command line arguments to pass to Ingress-Nginx Controller\
# E.g. to specify the default SSL certificate you can use\
extraArgs: {}\
## extraArgs:\
## default-ssl-certificate: \\\""<namespace>/<secret_name>\\\""\
## time-buckets: \\\""0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10\\\""\
## length-buckets: \\\""10,20,30,40,50,60,70,80,90,100\\\""\
## size-buckets: \\\""10,100,1000,10000,100000,1e+06,1e+07\\\""\
\
# -- Additional environment variables to set\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
extraEnvs: \
- name: TZ\
value: Asia/Shanghai\
\
# -- Use a `DaemonSet` or `Deployment`\
kind: Deployment\
# -- Annotations to be added to the controller Deployment or DaemonSet\
##\
annotations: {}\
# keel.sh/pollSchedule: \\\""@every 60m\\\""\
\
# -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels\
##\
labels: {}\
# keel.sh/policy: patch\
# keel.sh/trigger: poll\
\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\""key\\\""\
# operator: \\\""Equal|Exists\\\""\
# value: \\\""value\\\""\
# effect: \\\""NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\""\
\
# -- Affinity and anti-affinity rules for server scheduling to nodes\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity\
##\
affinity: {}\
# # An example of preferred pod anti-affinity, weight is in the range 1-100\
# podAntiAffinity:\
# preferredDuringSchedulingIgnoredDuringExecution:\
# - weight: 100\
# podAffinityTerm:\
# labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: kubernetes.io/hostname\
\
# # An example of required pod anti-affinity\
# podAntiAffinity:\
# requiredDuringSchedulingIgnoredDuringExecution:\
# - labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: \\\""kubernetes.io/hostname\\\""\
\
# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/\
##\
topologySpreadConstraints: []\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\""ingress-nginx.name\\\"" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: topology.kubernetes.io/zone\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\""ingress-nginx.name\\\"" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: kubernetes.io/hostname\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
\
# -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready\
## wait up to five minutes for the drain of connections\
##\
terminationGracePeriodSeconds: 300\
# -- Node labels for controller pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
## Liveness and readiness probe values\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes\
##\
## startupProbe:\
## httpGet:\
## # should match container.healthCheckPath\
## path: \\\""/healthz\\\""\
## port: 10254\
## scheme: HTTP\
## initialDelaySeconds: 5\
## periodSeconds: 5\
## timeoutSeconds: 2\
## successThreshold: 1\
## failureThreshold: 5\
livenessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\""/healthz\\\""\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 5\
readinessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\""/healthz\\\""\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 3\
# -- Path of the health check endpoint. All requests received on the port defined by\
# the healthz-port parameter are forwarded internally to this path.\
healthCheckPath: \\\""/healthz\\\""\
# -- Address to bind the health check endpoint.\
# It is better to set this option to the internal node address\
# if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.\
healthCheckHost: \\\""\\\""\
# -- Annotations to be added to controller pods\
##\
podAnnotations: {}\
replicaCount: 1\
# -- Minimum available pods set in PodDisruptionBudget.\
# Define either 'minAvailable' or 'maxUnavailable', never both.\
minAvailable: 1\
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.\
# maxUnavailable: 1\
\
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes\
## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903\
## Ideally, there should be no limits.\
## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/\
resources:\
## limits:\
## cpu: 100m\
## memory: 90Mi\
requests:\
cpu: 100m\
memory: 90Mi\
# Mutually exclusive with keda autoscaling\
autoscaling:\
enabled: false\
annotations: {}\
minReplicas: 1\
maxReplicas: 11\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
autoscalingTemplate: []\
# Custom or additional autoscaling metrics\
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics\
# - type: Pods\
# pods:\
# metric:\
# name: k8s_pod_rate_cpu_core_used_limit\
# target:\
# averageValue: \\\""80\\\""\
# type: AverageValue\
\
# Mutually exclusive with hpa autoscaling\
keda:\
apiVersion: \\\""keda.sh/v1alpha1\\\""\
## apiVersion changes with keda 1.x vs 2.x\
## 2.x = keda.sh/v1alpha1\
## 1.x = keda.k8s.io/v1alpha1\
enabled: false\
minReplicas: 1\
maxReplicas: 11\
pollingInterval: 30\
cooldownPeriod: 300\
# fallback:\
# failureThreshold: 3\
# replicas: 11\
restoreToOriginalReplicaCount: false\
scaledObject:\
annotations: {}\
# Custom annotations for ScaledObject resource\
# annotations:\
# key: value\
triggers: []\
# - type: prometheus\
# metadata:\
# serverAddress: http://<prometheus-host>:9090\
# metricName: http_requests_total\
# threshold: '100'\
# query: sum(rate(http_requests_total{deployment=\\\""my-deployment\\\""}[2m]))\
\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
# -- Enable mimalloc as a drop-in replacement for malloc.\
## ref: https://github.com/microsoft/mimalloc\
##\
enableMimalloc: true\
## Override NGINX template\
customTemplate:\
configMapName: \\\""\\\""\
configMapKey: \\\""\\\""\
service:\
# -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.\
enabled: true\
external:\
# -- Enable the external controller service or not. Useful for internal-only deployments.\
enabled: true\
# -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.\
annotations: {}\
# -- Labels to be added to both controller services.\
labels: {}\
# -- Type of the external controller service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: LoadBalancer\
# -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\""\\\""\
# -- List of node IP addresses at which the external controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\""\\\""\
# -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\""\\\""\
# -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the external controller service. Set to \\\""Local\\\"" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\""\\\""\
# -- Session affinity of the external controller service. Must be either \\\""None\\\"" or \\\""ClientIP\\\"" if set. Defaults to \\\""None\\\"".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\""\\\""\
# -- Specifies the health check node port (numeric port number) for the external controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
# -- Enable the HTTP listener on both controller services or not.\
enableHttp: true\
# -- Enable the HTTPS listener on both controller services or not.\
enableHttps: true\
ports:\
# -- Port the external HTTP listener is published with.\
http: 80\
# -- Port the external HTTPS listener is published with.\
https: 443\
targetPorts:\
# -- Port of the ingress controller the external HTTP listener is mapped to.\
http: http\
# -- Port of the ingress controller the external HTTPS listener is mapped to.\
https: https\
# -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\""\\\""\
# -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\""\\\""\
# -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
internal:\
# -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.\
enabled: false\
# -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer\
annotations: {}\
# -- Type of the internal controller service.\
# Defaults to the value of `controller.service.type`.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: \\\""\\\""\
# -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\""\\\""\
# -- List of node IP addresses at which the internal controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\""\\\""\
# -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\""\\\""\
# -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the internal controller service. Set to \\\""Local\\\"" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\""\\\""\
# -- Session affinity of the internal controller service. Must be either \\\""None\\\"" or \\\""ClientIP\\\"" if set. Defaults to \\\""None\\\"".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\""\\\""\
# -- Specifies the health check node port (numeric port number) for the internal controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
ports: {}\
# -- Port the internal HTTP listener is published with.\
# Defaults to the value of `controller.service.ports.http`.\
# http: 80\
# -- Port the internal HTTPS listener is published with.\
# Defaults to the value of `controller.service.ports.https`.\
# https: 443\
\
targetPorts: {}\
# -- Port of the ingress controller the internal HTTP listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.http`.\
# http: http\
# -- Port of the ingress controller the internal HTTPS listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.https`.\
# https: https\
\
# -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\""\\\""\
# -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\""\\\""\
# -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
# shareProcessNamespace enables process namespace sharing within the pod.\
# This can be used for example to signal log rotation using `kill -USR1` from a sidecar.\
shareProcessNamespace: false\
# -- Additional containers to be added to the controller pod.\
# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.\
extraContainers: []\
# - name: my-sidecar\
# image: nginx:latest\
\
# -- Additional volumeMounts to the controller main container.\
extraVolumeMounts: []\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
# -- Additional volumes to the controller pod.\
extraVolumes: []\
# - name: copy-portal-skins\
# emptyDir: {}\
\
# -- Containers, which are run before the app containers are started.\
extraInitContainers: \
- command:\
- sh\
- -c\
- |-\
sysctl -w net.core.somaxconn=65535\
sysctl -w net.ipv4.ip_local_reserved_ports=9100\
sysctl -w net.ipv4.ip_local_port_range=\\\""1024 61999\\\""\
sysctl -w net.ipv4.tcp_tw_reuse=1\
sysctl -w fs.file-max=1048576\
image: ccr.ccs.tencentyun.com/tkeimages/busybox:latest\
imagePullPolicy: Always\
name: setsysctl\
securityContext:\
privileged: true\
\
# -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module\
extraModules: []\
# - name: mytestmodule\
# image:\
# registry: registry.k8s.io\
# image: ingress-nginx/mytestmodule\
# ## for backwards compatibility consider setting the full image url via the repository value below\
# ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
# ## repository:\
# tag: \\\""v1.0.0\\\""\
# digest: \\\""\\\""\
# distroless: false\
# containerSecurityContext:\
# runAsNonRoot: true\
# runAsUser: <user-id>\
# allowPrivilegeEscalation: false\
# seccompProfile:\
# type: RuntimeDefault\
# capabilities:\
# drop:\
# - ALL\
# readOnlyRootFilesystem: true\
# resources: {}\
#\
# The image must contain a `/usr/local/bin/init_module.sh` executable, which\
# will be executed as initContainers, to move its config files within the\
# mounted volume.\
\
opentelemetry:\
enabled: false\
name: opentelemetry\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-opentelemetry\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\""v20230721-3e2062ee5\\\""\
digest: \\\""\\\""\
distroless: true\
containerSecurityContext:\
runAsNonRoot: true\
# -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
admissionWebhooks:\
name: admission\
annotations: {}\
# ignore-check.kube-linter.io/no-read-only-rootfs: \\\""This deployment needs write access to root filesystem\\\"".\
\
## Additional annotations to the admission webhooks.\
## These annotations will be added to the ValidatingWebhookConfiguration and\
## the Jobs Spec of the admission webhooks.\
enabled: true\
# -- Additional environment variables to set\
extraEnvs: []\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
# -- Admission Webhook failure policy to use\
failurePolicy: Fail\
# timeoutSeconds: 10\
port: 8443\
certificate: \\\""/usr/local/certificates/cert\\\""\
key: \\\""/usr/local/certificates/key\\\""\
namespaceSelector: {}\
objectSelector: {}\
# -- Labels to be added to admission webhooks\
labels: {}\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\""\\\""\
service:\
annotations: {}\
# clusterIP: \\\""\\\""\
externalIPs: []\
# loadBalancerIP: \\\""\\\""\
loadBalancerSourceRanges: []\
servicePort: 443\
type: ClusterIP\
createSecretJob:\
name: create\
# -- Security context for secret creation containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
patchWebhookJob:\
name: patch\
# -- Security context for webhook patch containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
patch:\
enabled: true\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-webhook-certgen\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: v20231011-8b53cabe0\
digest: \\\""\\\""\
pullPolicy: IfNotPresent\
# -- Provide a priority class name to the webhook patching job\
##\
priorityClassName: \\\""\\\""\
podAnnotations: {}\
# NetworkPolicy for webhook patch\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
nodeSelector:\
kubernetes.io/os: linux\
tolerations: []\
# -- Labels to be added to patch job resources\
labels: {}\
# -- Security context for secret creation & webhook patch pods\
securityContext: {}\
# Use certmanager to generate webhook certs\
certManager:\
enabled: false\
# self-signed root certificate\
rootCert:\
# default to be 5y\
duration: \\\""\\\""\
admissionCert:\
# default to be 1y\
duration: \\\""\\\""\
# issuerRef:\
# name: \\\""issuer\\\""\
# kind: \\\""ClusterIssuer\\\""\
metrics:\
port: 10254\
portName: metrics\
# if this port is changed, change healthz-port: in extraArgs: accordingly\
enabled: false\
service:\
annotations: {}\
# prometheus.io/scrape: \\\""true\\\""\
# prometheus.io/port: \\\""10254\\\""\
# -- Labels to be added to the metrics service resource\
labels: {}\
# clusterIP: \\\""\\\""\
\
# -- List of IP addresses at which the stats-exporter service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\""\\\""\
loadBalancerSourceRanges: []\
servicePort: 10254\
type: ClusterIP\
# externalTrafficPolicy: \\\""\\\""\
# nodePort: \\\""\\\""\
serviceMonitor:\
enabled: false\
additionalLabels: {}\
annotations: {}\
## The label to use to retrieve the job name from.\
## jobLabel: \\\""app.kubernetes.io/name\\\""\
namespace: \\\""\\\""\
namespaceSelector: {}\
## Default: scrape .Release.Namespace or namespaceOverride only\
## To scrape all, use the following:\
## namespaceSelector:\
## any: true\
scrapeInterval: 30s\
# honorLabels: true\
targetLabels: []\
relabelings: []\
metricRelabelings: []\
prometheusRule:\
enabled: false\
additionalLabels: {}\
# namespace: \\\""\\\""\
rules: []\
# # These are just examples rules, please adapt them to your needs\
# - alert: NGINXConfigFailed\
# expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: bad ingress config - nginx config test failed\
# summary: uninstall the latest ingress changes to allow config reloads to resume\
# # By default a fake self-signed certificate is generated as default and\
# # it is fine if it expires. If `--default-ssl-certificate` flag is used\
# # and a valid certificate passed please do not filter for `host` label!\
# # (i.e. delete `{host!=\\\""_\\\""}` so also the default SSL certificate is\
# # checked for expiration)\
# - alert: NGINXCertificateExpiry\
# expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!=\\\""_\\\""}) by (host) - time()) < 604800\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: ssl certificate(s) will expire in less then a week\
# summary: renew expiring certificates to avoid downtime\
# - alert: NGINXTooMany500s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\""5.+\\\""} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 5XXs\
# summary: More than 5% of all requests returned 5XX, this requires your attention\
# - alert: NGINXTooMany400s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\""4.+\\\""} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 4XXs\
# summary: More than 5% of all requests returned 4XX, this requires your attention\
# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:\
# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds\
# to 300, allowing the draining of connections up to five minutes.\
# If the active connections end before that, the pod will terminate gracefully at that time.\
# To effectively take advantage of this feature, the Configmap feature\
# worker-shutdown-timeout new value is 240s instead of 10s.\
##\
lifecycle:\
preStop:\
exec:\
command:\
- /wait-shutdown\
priorityClassName: \\\""\\\""\
# -- Rollback limit\
##\
revisionHistoryLimit: 10\
## Default 404 backend\
##\
defaultBackend:\
##\
enabled: false\
name: defaultbackend\
image:\
registry: ccr.ccs.tencentyun.com\
image: \\ttke-market/ingress-nginx-defaultbackend-amd64\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\""1.5\\\""\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# nobody user -> uid 65534\
runAsUser: 65534\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: true\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\""\\\""\
extraArgs: {}\
serviceAccount:\
create: true\
name: \\\""\\\""\
automountServiceAccountToken: true\
# -- Additional environment variables to set for defaultBackend pods\
extraEnvs: []\
port: 8080\
## Readiness and liveness probes for default backend\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/\
##\
livenessProbe:\
failureThreshold: 3\
initialDelaySeconds: 30\
periodSeconds: 10\
successThreshold: 1\
timeoutSeconds: 5\
readinessProbe:\
failureThreshold: 6\
initialDelaySeconds: 0\
periodSeconds: 5\
successThreshold: 1\
timeoutSeconds: 5\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\""key\\\""\
# operator: \\\""Equal|Exists\\\""\
# value: \\\""value\\\""\
# effect: \\\""NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\""\
\
affinity: {}\
# -- Security context for default backend pods\
podSecurityContext: {}\
# -- Security context for default backend containers\
containerSecurityContext: {}\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Node labels for default backend pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
# -- Annotations to be added to default backend pods\
##\
podAnnotations: {}\
replicaCount: 1\
minAvailable: 1\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
\
extraVolumeMounts: []\
## Additional volumeMounts to the default backend container.\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
extraVolumes: []\
## Additional volumes to the default backend pod.\
# - name: copy-portal-skins\
# emptyDir: {}\
\
extraConfigMaps: []\
## Additional configmaps to the default backend pod.\
# - name: my-extra-configmap-1\
# labels:\
# type: config-1\
# data:\
# extra_file_1.html: |\
# <!-- Extra HTML content for ConfigMap 1 -->\
# - name: my-extra-configmap-2\
# labels:\
# type: config-2\
# data:\
# extra_file_2.html: |\
# <!-- Extra HTML content for ConfigMap 2 -->\
\
autoscaling:\
annotations: {}\
enabled: false\
minReplicas: 1\
maxReplicas: 2\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
# NetworkPolicy for default backend component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
service:\
annotations: {}\
# clusterIP: \\\""\\\""\
\
# -- List of IP addresses at which the default backend service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\""\\\""\
loadBalancerSourceRanges: []\
servicePort: 80\
type: ClusterIP\
priorityClassName: \\\""\\\""\
# -- Labels to be added to the default backend resources\
labels: {}\
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266\
rbac:\
create: true\
scope: false\
## If true, create & use Pod Security Policy resources\
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/\
podSecurityPolicy:\
enabled: false\
serviceAccount:\
create: true\
name: \\\""\\\""\
automountServiceAccountToken: true\
# -- Annotations for the controller service account\
annotations: {}\
# -- Optional array of imagePullSecrets containing private registry credentials\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/\
imagePullSecrets: []\
# - name: secretName\
\
# -- TCP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
tcp: {}\
# 8080: \\\""default/example-tcp-svc:9000\\\""\
\
# -- UDP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
udp: {}\
# 53: \\\""kube-system/kube-dns:53\\\""\
\
# -- Prefix for TCP and UDP ports names in ingress controller service\
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration\
portNamePrefix: \\\""\\\""\
# -- (string) A base64-encoded Diffie-Hellman parameter.\
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`\
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param\
dhParam: \\\""\\\""\
",
ValuesType = "yaml",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.tencentcloud.KubernetesClusterRelease;
import com.pulumi.tencentcloud.KubernetesClusterReleaseArgs;
import com.pulumi.tencentcloud.inputs.KubernetesClusterReleaseValuesArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new KubernetesClusterRelease("example", KubernetesClusterReleaseArgs.builder()
.clusterId("cls-fdy7hm1q")
.name("tf-example")
.namespace("default")
.chart("nginx-ingress")
.chartFrom("tke-market")
.chartVersion("4.9.0")
.chartNamespace("opensource-stable")
.clusterType("tke")
.values(KubernetesClusterReleaseValuesArgs.builder()
.rawOriginal("""
## nginx configuration\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md\
##\
\
## Overrides for generated resource names\
# See templates/_helpers.tpl\
# nameOverride:\
# fullnameOverride:\
\
# -- Override the deployment namespace; defaults to .Release.Namespace\
namespaceOverride: \\\"\\\"\
## Labels to apply to all resources\
##\
commonLabels: {}\
# scmhash: abc123\
# myLabel: aakkmd\
\
controller:\
name: controller\
enableAnnotationValidations: false\
image:\
## Keep false as default for now!\
chroot: false\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-controller\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"v1.9.5\\\"\
digest: \\\"\\\"\
digestChroot: \\\"\\\"\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# www-data -> uid 101\
runAsUser: 101\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: false\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
# -- Configures the controller container name\
containerName: controller\
# -- Configures the ports that the nginx-controller listens on\
containerPort:\
http: 80\
https: 443\
# -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/\
config: {}\
# -- Annotations to be added to the controller config configuration configmap.\
configAnnotations: {}\
# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers\
proxySetHeaders: {}\
# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers\
addHeaders: {}\
# -- Optionally customize the pod dnsConfig.\
dnsConfig: {}\
# -- Optionally customize the pod hostAliases.\
hostAliases: []\
# - ip: 127.0.0.1\
# hostnames:\
# - foo.local\
# - bar.local\
# - ip: 10.1.2.3\
# hostnames:\
# - foo.remote\
# - bar.remote\
# -- Optionally customize the pod hostname.\
hostname: {}\
# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.\
# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller\
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.\
dnsPolicy: ClusterFirst\
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network\
# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply\
reportNodeInternalIp: false\
# -- Process Ingress objects without ingressClass annotation/ingressClassName field\
# Overrides value for --watch-ingress-without-class flag of the controller binary\
# Defaults to false\
watchIngressWithoutClass: false\
# -- Process IngressClass per name (additionally as per spec.controller).\
ingressClassByName: false\
# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode=\\\"auto\\\"\
# Defaults to false\
enableTopologyAwareRouting: false\
# -- This configuration defines if Ingress Controller should allow users to set\
# their own *-snippet annotations, otherwise this is forbidden / dropped\
# when users add those annotations.\
# Global snippets in ConfigMap are still respected\
allowSnippetAnnotations: false\
# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),\
# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920\
# is merged\
hostNetwork: false\
## Use host ports 80 and 443\
## Disabled by default\
hostPort:\
# -- Enable 'hostPort' or not\
enabled: false\
ports:\
# -- 'hostPort' http port\
http: 80\
# -- 'hostPort' https port\
https: 443\
# NetworkPolicy for controller component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'\
electionID: \\\"\\\"\
## This section refers to the creation of the IngressClass resource\
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19\
ingressClassResource:\
# -- Name of the ingressClass\
name: nginx\
# -- Is this ingressClass enabled or not\
enabled: true\
# -- Is this the default ingressClass for the cluster\
default: false\
# -- Controller-value of the controller that is processing this ingressClass\
controllerValue: \\\"k8s.io/ingress-nginx\\\"\
# -- Parameters is a link to a custom resource containing additional\
# configuration for the controller. This is optional if the controller\
# does not require extra parameters.\
parameters: {}\
# -- For backwards compatibility with ingress.class annotation, use ingressClass.\
# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation\
ingressClass: nginx\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Security context for controller pods\
podSecurityContext: {}\
# -- sysctls for controller pods\
## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/\
sysctls: {}\
# sysctls:\
# \\\"net.core.somaxconn\\\": \\\"8192\\\"\
# -- Security context for controller containers\
containerSecurityContext: {}\
# -- Allows customization of the source of the IP address or FQDN to report\
# in the ingress status field. By default, it reads the information provided\
# by the service. If disable, the status field reports the IP address of the\
# node or nodes where an ingress controller pod is running.\
publishService:\
# -- Enable 'publishService' or not\
enabled: true\
# -- Allows overriding of the publish service to bind to\
# Must be <namespace>/<service_name>\
pathOverride: \\\"\\\"\
# Limit the scope of the controller to a specific namespace\
scope:\
# -- Enable 'scope' or not\
enabled: false\
# -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)\
namespace: \\\"\\\"\
# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels\
# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.\
namespaceSelector: \\\"\\\"\
# -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
tcp:\
# -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
# -- Annotations to be added to the tcp config configmap\
annotations: {}\
udp:\
# -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
# -- Annotations to be added to the udp config configmap\
annotations: {}\
# -- Maxmind license key to download GeoLite2 Databases.\
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases\
maxmindLicenseKey: \\\"\\\"\
# -- Additional command line arguments to pass to Ingress-Nginx Controller\
# E.g. to specify the default SSL certificate you can use\
extraArgs: {}\
## extraArgs:\
## default-ssl-certificate: \\\"<namespace>/<secret_name>\\\"\
## time-buckets: \\\"0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10\\\"\
## length-buckets: \\\"10,20,30,40,50,60,70,80,90,100\\\"\
## size-buckets: \\\"10,100,1000,10000,100000,1e+06,1e+07\\\"\
\
# -- Additional environment variables to set\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
extraEnvs: \
- name: TZ\
value: Asia/Shanghai\
\
# -- Use a `DaemonSet` or `Deployment`\
kind: Deployment\
# -- Annotations to be added to the controller Deployment or DaemonSet\
##\
annotations: {}\
# keel.sh/pollSchedule: \\\"@every 60m\\\"\
\
# -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels\
##\
labels: {}\
# keel.sh/policy: patch\
# keel.sh/trigger: poll\
\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\"key\\\"\
# operator: \\\"Equal|Exists\\\"\
# value: \\\"value\\\"\
# effect: \\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\"\
\
# -- Affinity and anti-affinity rules for server scheduling to nodes\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity\
##\
affinity: {}\
# # An example of preferred pod anti-affinity, weight is in the range 1-100\
# podAntiAffinity:\
# preferredDuringSchedulingIgnoredDuringExecution:\
# - weight: 100\
# podAffinityTerm:\
# labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: kubernetes.io/hostname\
\
# # An example of required pod anti-affinity\
# podAntiAffinity:\
# requiredDuringSchedulingIgnoredDuringExecution:\
# - labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: \\\"kubernetes.io/hostname\\\"\
\
# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/\
##\
topologySpreadConstraints: []\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\"ingress-nginx.name\\\" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: topology.kubernetes.io/zone\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\"ingress-nginx.name\\\" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: kubernetes.io/hostname\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
\
# -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready\
## wait up to five minutes for the drain of connections\
##\
terminationGracePeriodSeconds: 300\
# -- Node labels for controller pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
## Liveness and readiness probe values\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes\
##\
## startupProbe:\
## httpGet:\
## # should match container.healthCheckPath\
## path: \\\"/healthz\\\"\
## port: 10254\
## scheme: HTTP\
## initialDelaySeconds: 5\
## periodSeconds: 5\
## timeoutSeconds: 2\
## successThreshold: 1\
## failureThreshold: 5\
livenessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\"/healthz\\\"\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 5\
readinessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\"/healthz\\\"\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 3\
# -- Path of the health check endpoint. All requests received on the port defined by\
# the healthz-port parameter are forwarded internally to this path.\
healthCheckPath: \\\"/healthz\\\"\
# -- Address to bind the health check endpoint.\
# It is better to set this option to the internal node address\
# if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.\
healthCheckHost: \\\"\\\"\
# -- Annotations to be added to controller pods\
##\
podAnnotations: {}\
replicaCount: 1\
# -- Minimum available pods set in PodDisruptionBudget.\
# Define either 'minAvailable' or 'maxUnavailable', never both.\
minAvailable: 1\
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.\
# maxUnavailable: 1\
\
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes\
## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903\
## Ideally, there should be no limits.\
## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/\
resources:\
## limits:\
## cpu: 100m\
## memory: 90Mi\
requests:\
cpu: 100m\
memory: 90Mi\
# Mutually exclusive with keda autoscaling\
autoscaling:\
enabled: false\
annotations: {}\
minReplicas: 1\
maxReplicas: 11\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
autoscalingTemplate: []\
# Custom or additional autoscaling metrics\
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics\
# - type: Pods\
# pods:\
# metric:\
# name: k8s_pod_rate_cpu_core_used_limit\
# target:\
# averageValue: \\\"80\\\"\
# type: AverageValue\
\
# Mutually exclusive with hpa autoscaling\
keda:\
apiVersion: \\\"keda.sh/v1alpha1\\\"\
## apiVersion changes with keda 1.x vs 2.x\
## 2.x = keda.sh/v1alpha1\
## 1.x = keda.k8s.io/v1alpha1\
enabled: false\
minReplicas: 1\
maxReplicas: 11\
pollingInterval: 30\
cooldownPeriod: 300\
# fallback:\
# failureThreshold: 3\
# replicas: 11\
restoreToOriginalReplicaCount: false\
scaledObject:\
annotations: {}\
# Custom annotations for ScaledObject resource\
# annotations:\
# key: value\
triggers: []\
# - type: prometheus\
# metadata:\
# serverAddress: http://<prometheus-host>:9090\
# metricName: http_requests_total\
# threshold: '100'\
# query: sum(rate(http_requests_total{deployment=\\\"my-deployment\\\"}[2m]))\
\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
# -- Enable mimalloc as a drop-in replacement for malloc.\
## ref: https://github.com/microsoft/mimalloc\
##\
enableMimalloc: true\
## Override NGINX template\
customTemplate:\
configMapName: \\\"\\\"\
configMapKey: \\\"\\\"\
service:\
# -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.\
enabled: true\
external:\
# -- Enable the external controller service or not. Useful for internal-only deployments.\
enabled: true\
# -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.\
annotations: {}\
# -- Labels to be added to both controller services.\
labels: {}\
# -- Type of the external controller service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: LoadBalancer\
# -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\"\\\"\
# -- List of node IP addresses at which the external controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\"\\\"\
# -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\"\\\"\
# -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the external controller service. Set to \\\"Local\\\" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\"\\\"\
# -- Session affinity of the external controller service. Must be either \\\"None\\\" or \\\"ClientIP\\\" if set. Defaults to \\\"None\\\".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\"\\\"\
# -- Specifies the health check node port (numeric port number) for the external controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
# -- Enable the HTTP listener on both controller services or not.\
enableHttp: true\
# -- Enable the HTTPS listener on both controller services or not.\
enableHttps: true\
ports:\
# -- Port the external HTTP listener is published with.\
http: 80\
# -- Port the external HTTPS listener is published with.\
https: 443\
targetPorts:\
# -- Port of the ingress controller the external HTTP listener is mapped to.\
http: http\
# -- Port of the ingress controller the external HTTPS listener is mapped to.\
https: https\
# -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\"\\\"\
# -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\"\\\"\
# -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
internal:\
# -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.\
enabled: false\
# -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer\
annotations: {}\
# -- Type of the internal controller service.\
# Defaults to the value of `controller.service.type`.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: \\\"\\\"\
# -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\"\\\"\
# -- List of node IP addresses at which the internal controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\"\\\"\
# -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\"\\\"\
# -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the internal controller service. Set to \\\"Local\\\" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\"\\\"\
# -- Session affinity of the internal controller service. Must be either \\\"None\\\" or \\\"ClientIP\\\" if set. Defaults to \\\"None\\\".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\"\\\"\
# -- Specifies the health check node port (numeric port number) for the internal controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
ports: {}\
# -- Port the internal HTTP listener is published with.\
# Defaults to the value of `controller.service.ports.http`.\
# http: 80\
# -- Port the internal HTTPS listener is published with.\
# Defaults to the value of `controller.service.ports.https`.\
# https: 443\
\
targetPorts: {}\
# -- Port of the ingress controller the internal HTTP listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.http`.\
# http: http\
# -- Port of the ingress controller the internal HTTPS listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.https`.\
# https: https\
\
# -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\"\\\"\
# -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\"\\\"\
# -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
# shareProcessNamespace enables process namespace sharing within the pod.\
# This can be used for example to signal log rotation using `kill -USR1` from a sidecar.\
shareProcessNamespace: false\
# -- Additional containers to be added to the controller pod.\
# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.\
extraContainers: []\
# - name: my-sidecar\
# image: nginx:latest\
\
# -- Additional volumeMounts to the controller main container.\
extraVolumeMounts: []\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
# -- Additional volumes to the controller pod.\
extraVolumes: []\
# - name: copy-portal-skins\
# emptyDir: {}\
\
# -- Containers, which are run before the app containers are started.\
extraInitContainers: \
- command:\
- sh\
- -c\
- |-\
sysctl -w net.core.somaxconn=65535\
sysctl -w net.ipv4.ip_local_reserved_ports=9100\
sysctl -w net.ipv4.ip_local_port_range=\\\"1024 61999\\\"\
sysctl -w net.ipv4.tcp_tw_reuse=1\
sysctl -w fs.file-max=1048576\
image: ccr.ccs.tencentyun.com/tkeimages/busybox:latest\
imagePullPolicy: Always\
name: setsysctl\
securityContext:\
privileged: true\
\
# -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module\
extraModules: []\
# - name: mytestmodule\
# image:\
# registry: registry.k8s.io\
# image: ingress-nginx/mytestmodule\
# ## for backwards compatibility consider setting the full image url via the repository value below\
# ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
# ## repository:\
# tag: \\\"v1.0.0\\\"\
# digest: \\\"\\\"\
# distroless: false\
# containerSecurityContext:\
# runAsNonRoot: true\
# runAsUser: <user-id>\
# allowPrivilegeEscalation: false\
# seccompProfile:\
# type: RuntimeDefault\
# capabilities:\
# drop:\
# - ALL\
# readOnlyRootFilesystem: true\
# resources: {}\
#\
# The image must contain a `/usr/local/bin/init_module.sh` executable, which\
# will be executed as initContainers, to move its config files within the\
# mounted volume.\
\
opentelemetry:\
enabled: false\
name: opentelemetry\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-opentelemetry\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"v20230721-3e2062ee5\\\"\
digest: \\\"\\\"\
distroless: true\
containerSecurityContext:\
runAsNonRoot: true\
# -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
admissionWebhooks:\
name: admission\
annotations: {}\
# ignore-check.kube-linter.io/no-read-only-rootfs: \\\"This deployment needs write access to root filesystem\\\".\
\
## Additional annotations to the admission webhooks.\
## These annotations will be added to the ValidatingWebhookConfiguration and\
## the Jobs Spec of the admission webhooks.\
enabled: true\
# -- Additional environment variables to set\
extraEnvs: []\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
# -- Admission Webhook failure policy to use\
failurePolicy: Fail\
# timeoutSeconds: 10\
port: 8443\
certificate: \\\"/usr/local/certificates/cert\\\"\
key: \\\"/usr/local/certificates/key\\\"\
namespaceSelector: {}\
objectSelector: {}\
# -- Labels to be added to admission webhooks\
labels: {}\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
service:\
annotations: {}\
# clusterIP: \\\"\\\"\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 443\
type: ClusterIP\
createSecretJob:\
name: create\
# -- Security context for secret creation containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
patchWebhookJob:\
name: patch\
# -- Security context for webhook patch containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
patch:\
enabled: true\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-webhook-certgen\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: v20231011-8b53cabe0\
digest: \\\"\\\"\
pullPolicy: IfNotPresent\
# -- Provide a priority class name to the webhook patching job\
##\
priorityClassName: \\\"\\\"\
podAnnotations: {}\
# NetworkPolicy for webhook patch\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
nodeSelector:\
kubernetes.io/os: linux\
tolerations: []\
# -- Labels to be added to patch job resources\
labels: {}\
# -- Security context for secret creation & webhook patch pods\
securityContext: {}\
# Use certmanager to generate webhook certs\
certManager:\
enabled: false\
# self-signed root certificate\
rootCert:\
# default to be 5y\
duration: \\\"\\\"\
admissionCert:\
# default to be 1y\
duration: \\\"\\\"\
# issuerRef:\
# name: \\\"issuer\\\"\
# kind: \\\"ClusterIssuer\\\"\
metrics:\
port: 10254\
portName: metrics\
# if this port is changed, change healthz-port: in extraArgs: accordingly\
enabled: false\
service:\
annotations: {}\
# prometheus.io/scrape: \\\"true\\\"\
# prometheus.io/port: \\\"10254\\\"\
# -- Labels to be added to the metrics service resource\
labels: {}\
# clusterIP: \\\"\\\"\
\
# -- List of IP addresses at which the stats-exporter service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 10254\
type: ClusterIP\
# externalTrafficPolicy: \\\"\\\"\
# nodePort: \\\"\\\"\
serviceMonitor:\
enabled: false\
additionalLabels: {}\
annotations: {}\
## The label to use to retrieve the job name from.\
## jobLabel: \\\"app.kubernetes.io/name\\\"\
namespace: \\\"\\\"\
namespaceSelector: {}\
## Default: scrape .Release.Namespace or namespaceOverride only\
## To scrape all, use the following:\
## namespaceSelector:\
## any: true\
scrapeInterval: 30s\
# honorLabels: true\
targetLabels: []\
relabelings: []\
metricRelabelings: []\
prometheusRule:\
enabled: false\
additionalLabels: {}\
# namespace: \\\"\\\"\
rules: []\
# # These are just examples rules, please adapt them to your needs\
# - alert: NGINXConfigFailed\
# expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: bad ingress config - nginx config test failed\
# summary: uninstall the latest ingress changes to allow config reloads to resume\
# # By default a fake self-signed certificate is generated as default and\
# # it is fine if it expires. If `--default-ssl-certificate` flag is used\
# # and a valid certificate passed please do not filter for `host` label!\
# # (i.e. delete `{host!=\\\"_\\\"}` so also the default SSL certificate is\
# # checked for expiration)\
# - alert: NGINXCertificateExpiry\
# expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!=\\\"_\\\"}) by (host) - time()) < 604800\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: ssl certificate(s) will expire in less then a week\
# summary: renew expiring certificates to avoid downtime\
# - alert: NGINXTooMany500s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\"5.+\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 5XXs\
# summary: More than 5% of all requests returned 5XX, this requires your attention\
# - alert: NGINXTooMany400s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\"4.+\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 4XXs\
# summary: More than 5% of all requests returned 4XX, this requires your attention\
# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:\
# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds\
# to 300, allowing the draining of connections up to five minutes.\
# If the active connections end before that, the pod will terminate gracefully at that time.\
# To effectively take advantage of this feature, the Configmap feature\
# worker-shutdown-timeout new value is 240s instead of 10s.\
##\
lifecycle:\
preStop:\
exec:\
command:\
- /wait-shutdown\
priorityClassName: \\\"\\\"\
# -- Rollback limit\
##\
revisionHistoryLimit: 10\
## Default 404 backend\
##\
defaultBackend:\
##\
enabled: false\
name: defaultbackend\
image:\
registry: ccr.ccs.tencentyun.com\
image: \\ttke-market/ingress-nginx-defaultbackend-amd64\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"1.5\\\"\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# nobody user -> uid 65534\
runAsUser: 65534\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: true\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
extraArgs: {}\
serviceAccount:\
create: true\
name: \\\"\\\"\
automountServiceAccountToken: true\
# -- Additional environment variables to set for defaultBackend pods\
extraEnvs: []\
port: 8080\
## Readiness and liveness probes for default backend\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/\
##\
livenessProbe:\
failureThreshold: 3\
initialDelaySeconds: 30\
periodSeconds: 10\
successThreshold: 1\
timeoutSeconds: 5\
readinessProbe:\
failureThreshold: 6\
initialDelaySeconds: 0\
periodSeconds: 5\
successThreshold: 1\
timeoutSeconds: 5\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\"key\\\"\
# operator: \\\"Equal|Exists\\\"\
# value: \\\"value\\\"\
# effect: \\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\"\
\
affinity: {}\
# -- Security context for default backend pods\
podSecurityContext: {}\
# -- Security context for default backend containers\
containerSecurityContext: {}\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Node labels for default backend pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
# -- Annotations to be added to default backend pods\
##\
podAnnotations: {}\
replicaCount: 1\
minAvailable: 1\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
\
extraVolumeMounts: []\
## Additional volumeMounts to the default backend container.\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
extraVolumes: []\
## Additional volumes to the default backend pod.\
# - name: copy-portal-skins\
# emptyDir: {}\
\
extraConfigMaps: []\
## Additional configmaps to the default backend pod.\
# - name: my-extra-configmap-1\
# labels:\
# type: config-1\
# data:\
# extra_file_1.html: |\
# <!-- Extra HTML content for ConfigMap 1 -->\
# - name: my-extra-configmap-2\
# labels:\
# type: config-2\
# data:\
# extra_file_2.html: |\
# <!-- Extra HTML content for ConfigMap 2 -->\
\
autoscaling:\
annotations: {}\
enabled: false\
minReplicas: 1\
maxReplicas: 2\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
# NetworkPolicy for default backend component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
service:\
annotations: {}\
# clusterIP: \\\"\\\"\
\
# -- List of IP addresses at which the default backend service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 80\
type: ClusterIP\
priorityClassName: \\\"\\\"\
# -- Labels to be added to the default backend resources\
labels: {}\
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266\
rbac:\
create: true\
scope: false\
## If true, create & use Pod Security Policy resources\
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/\
podSecurityPolicy:\
enabled: false\
serviceAccount:\
create: true\
name: \\\"\\\"\
automountServiceAccountToken: true\
# -- Annotations for the controller service account\
annotations: {}\
# -- Optional array of imagePullSecrets containing private registry credentials\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/\
imagePullSecrets: []\
# - name: secretName\
\
# -- TCP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
tcp: {}\
# 8080: \\\"default/example-tcp-svc:9000\\\"\
\
# -- UDP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
udp: {}\
# 53: \\\"kube-system/kube-dns:53\\\"\
\
# -- Prefix for TCP and UDP ports names in ingress controller service\
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration\
portNamePrefix: \\\"\\\"\
# -- (string) A base64-encoded Diffie-Hellman parameter.\
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`\
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param\
dhParam: \\\"\\\"\
""")
.valuesType("yaml")
.build())
.build());
}
}
resources:
example:
type: tencentcloud:KubernetesClusterRelease
properties:
clusterId: cls-fdy7hm1q
name: tf-example
namespace: default
chart: nginx-ingress
chartFrom: tke-market
chartVersion: 4.9.0
chartNamespace: opensource-stable
clusterType: tke
values:
rawOriginal: |+
## nginx configuration\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md\
##\
\
## Overrides for generated resource names\
# See templates/_helpers.tpl\
# nameOverride:\
# fullnameOverride:\
\
# -- Override the deployment namespace; defaults to .Release.Namespace\
namespaceOverride: \\\"\\\"\
## Labels to apply to all resources\
##\
commonLabels: {}\
# scmhash: abc123\
# myLabel: aakkmd\
\
controller:\
name: controller\
enableAnnotationValidations: false\
image:\
## Keep false as default for now!\
chroot: false\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-controller\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"v1.9.5\\\"\
digest: \\\"\\\"\
digestChroot: \\\"\\\"\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# www-data -> uid 101\
runAsUser: 101\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: false\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
# -- Configures the controller container name\
containerName: controller\
# -- Configures the ports that the nginx-controller listens on\
containerPort:\
http: 80\
https: 443\
# -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/\
config: {}\
# -- Annotations to be added to the controller config configuration configmap.\
configAnnotations: {}\
# -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers\
proxySetHeaders: {}\
# -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers\
addHeaders: {}\
# -- Optionally customize the pod dnsConfig.\
dnsConfig: {}\
# -- Optionally customize the pod hostAliases.\
hostAliases: []\
# - ip: 127.0.0.1\
# hostnames:\
# - foo.local\
# - bar.local\
# - ip: 10.1.2.3\
# hostnames:\
# - foo.remote\
# - bar.remote\
# -- Optionally customize the pod hostname.\
hostname: {}\
# -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.\
# By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller\
# to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.\
dnsPolicy: ClusterFirst\
# -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network\
# Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply\
reportNodeInternalIp: false\
# -- Process Ingress objects without ingressClass annotation/ingressClassName field\
# Overrides value for --watch-ingress-without-class flag of the controller binary\
# Defaults to false\
watchIngressWithoutClass: false\
# -- Process IngressClass per name (additionally as per spec.controller).\
ingressClassByName: false\
# -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode=\\\"auto\\\"\
# Defaults to false\
enableTopologyAwareRouting: false\
# -- This configuration defines if Ingress Controller should allow users to set\
# their own *-snippet annotations, otherwise this is forbidden / dropped\
# when users add those annotations.\
# Global snippets in ConfigMap are still respected\
allowSnippetAnnotations: false\
# -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),\
# since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920\
# is merged\
hostNetwork: false\
## Use host ports 80 and 443\
## Disabled by default\
hostPort:\
# -- Enable 'hostPort' or not\
enabled: false\
ports:\
# -- 'hostPort' http port\
http: 80\
# -- 'hostPort' https port\
https: 443\
# NetworkPolicy for controller component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
# -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'\
electionID: \\\"\\\"\
## This section refers to the creation of the IngressClass resource\
## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19\
ingressClassResource:\
# -- Name of the ingressClass\
name: nginx\
# -- Is this ingressClass enabled or not\
enabled: true\
# -- Is this the default ingressClass for the cluster\
default: false\
# -- Controller-value of the controller that is processing this ingressClass\
controllerValue: \\\"k8s.io/ingress-nginx\\\"\
# -- Parameters is a link to a custom resource containing additional\
# configuration for the controller. This is optional if the controller\
# does not require extra parameters.\
parameters: {}\
# -- For backwards compatibility with ingress.class annotation, use ingressClass.\
# Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation\
ingressClass: nginx\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Security context for controller pods\
podSecurityContext: {}\
# -- sysctls for controller pods\
## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/\
sysctls: {}\
# sysctls:\
# \\\"net.core.somaxconn\\\": \\\"8192\\\"\
# -- Security context for controller containers\
containerSecurityContext: {}\
# -- Allows customization of the source of the IP address or FQDN to report\
# in the ingress status field. By default, it reads the information provided\
# by the service. If disable, the status field reports the IP address of the\
# node or nodes where an ingress controller pod is running.\
publishService:\
# -- Enable 'publishService' or not\
enabled: true\
# -- Allows overriding of the publish service to bind to\
# Must be <namespace>/<service_name>\
pathOverride: \\\"\\\"\
# Limit the scope of the controller to a specific namespace\
scope:\
# -- Enable 'scope' or not\
enabled: false\
# -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)\
namespace: \\\"\\\"\
# -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels\
# only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.\
namespaceSelector: \\\"\\\"\
# -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
tcp:\
# -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
# -- Annotations to be added to the tcp config configmap\
annotations: {}\
udp:\
# -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)\
configMapNamespace: \\\"\\\"\
# -- Annotations to be added to the udp config configmap\
annotations: {}\
# -- Maxmind license key to download GeoLite2 Databases.\
## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases\
maxmindLicenseKey: \\\"\\\"\
# -- Additional command line arguments to pass to Ingress-Nginx Controller\
# E.g. to specify the default SSL certificate you can use\
extraArgs: {}\
## extraArgs:\
## default-ssl-certificate: \\\"<namespace>/<secret_name>\\\"\
## time-buckets: \\\"0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10\\\"\
## length-buckets: \\\"10,20,30,40,50,60,70,80,90,100\\\"\
## size-buckets: \\\"10,100,1000,10000,100000,1e+06,1e+07\\\"\
\
# -- Additional environment variables to set\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
extraEnvs: \
- name: TZ\
value: Asia/Shanghai\
\
# -- Use a `DaemonSet` or `Deployment`\
kind: Deployment\
# -- Annotations to be added to the controller Deployment or DaemonSet\
##\
annotations: {}\
# keel.sh/pollSchedule: \\\"@every 60m\\\"\
\
# -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels\
##\
labels: {}\
# keel.sh/policy: patch\
# keel.sh/trigger: poll\
\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\"key\\\"\
# operator: \\\"Equal|Exists\\\"\
# value: \\\"value\\\"\
# effect: \\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\"\
\
# -- Affinity and anti-affinity rules for server scheduling to nodes\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity\
##\
affinity: {}\
# # An example of preferred pod anti-affinity, weight is in the range 1-100\
# podAntiAffinity:\
# preferredDuringSchedulingIgnoredDuringExecution:\
# - weight: 100\
# podAffinityTerm:\
# labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: kubernetes.io/hostname\
\
# # An example of required pod anti-affinity\
# podAntiAffinity:\
# requiredDuringSchedulingIgnoredDuringExecution:\
# - labelSelector:\
# matchExpressions:\
# - key: app.kubernetes.io/name\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/instance\
# operator: In\
# values:\
# - ingress-nginx\
# - key: app.kubernetes.io/component\
# operator: In\
# values:\
# - controller\
# topologyKey: \\\"kubernetes.io/hostname\\\"\
\
# -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/\
##\
topologySpreadConstraints: []\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\"ingress-nginx.name\\\" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: topology.kubernetes.io/zone\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
# - labelSelector:\
# matchLabels:\
# app.kubernetes.io/name: '{{ include \\\"ingress-nginx.name\\\" . }}'\
# app.kubernetes.io/instance: '{{ .Release.Name }}'\
# app.kubernetes.io/component: controller\
# topologyKey: kubernetes.io/hostname\
# maxSkew: 1\
# whenUnsatisfiable: ScheduleAnyway\
\
# -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready\
## wait up to five minutes for the drain of connections\
##\
terminationGracePeriodSeconds: 300\
# -- Node labels for controller pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
## Liveness and readiness probe values\
## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes\
##\
## startupProbe:\
## httpGet:\
## # should match container.healthCheckPath\
## path: \\\"/healthz\\\"\
## port: 10254\
## scheme: HTTP\
## initialDelaySeconds: 5\
## periodSeconds: 5\
## timeoutSeconds: 2\
## successThreshold: 1\
## failureThreshold: 5\
livenessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\"/healthz\\\"\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 5\
readinessProbe:\
httpGet:\
# should match container.healthCheckPath\
path: \\\"/healthz\\\"\
port: 10254\
scheme: HTTP\
initialDelaySeconds: 10\
periodSeconds: 10\
timeoutSeconds: 1\
successThreshold: 1\
failureThreshold: 3\
# -- Path of the health check endpoint. All requests received on the port defined by\
# the healthz-port parameter are forwarded internally to this path.\
healthCheckPath: \\\"/healthz\\\"\
# -- Address to bind the health check endpoint.\
# It is better to set this option to the internal node address\
# if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.\
healthCheckHost: \\\"\\\"\
# -- Annotations to be added to controller pods\
##\
podAnnotations: {}\
replicaCount: 1\
# -- Minimum available pods set in PodDisruptionBudget.\
# Define either 'minAvailable' or 'maxUnavailable', never both.\
minAvailable: 1\
# -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.\
# maxUnavailable: 1\
\
## Define requests resources to avoid probe issues due to CPU utilization in busy nodes\
## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903\
## Ideally, there should be no limits.\
## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/\
resources:\
## limits:\
## cpu: 100m\
## memory: 90Mi\
requests:\
cpu: 100m\
memory: 90Mi\
# Mutually exclusive with keda autoscaling\
autoscaling:\
enabled: false\
annotations: {}\
minReplicas: 1\
maxReplicas: 11\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
autoscalingTemplate: []\
# Custom or additional autoscaling metrics\
# ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics\
# - type: Pods\
# pods:\
# metric:\
# name: k8s_pod_rate_cpu_core_used_limit\
# target:\
# averageValue: \\\"80\\\"\
# type: AverageValue\
\
# Mutually exclusive with hpa autoscaling\
keda:\
apiVersion: \\\"keda.sh/v1alpha1\\\"\
## apiVersion changes with keda 1.x vs 2.x\
## 2.x = keda.sh/v1alpha1\
## 1.x = keda.k8s.io/v1alpha1\
enabled: false\
minReplicas: 1\
maxReplicas: 11\
pollingInterval: 30\
cooldownPeriod: 300\
# fallback:\
# failureThreshold: 3\
# replicas: 11\
restoreToOriginalReplicaCount: false\
scaledObject:\
annotations: {}\
# Custom annotations for ScaledObject resource\
# annotations:\
# key: value\
triggers: []\
# - type: prometheus\
# metadata:\
# serverAddress: http://<prometheus-host>:9090\
# metricName: http_requests_total\
# threshold: '100'\
# query: sum(rate(http_requests_total{deployment=\\\"my-deployment\\\"}[2m]))\
\
behavior: {}\
# scaleDown:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 1\
# periodSeconds: 180\
# scaleUp:\
# stabilizationWindowSeconds: 300\
# policies:\
# - type: Pods\
# value: 2\
# periodSeconds: 60\
# -- Enable mimalloc as a drop-in replacement for malloc.\
## ref: https://github.com/microsoft/mimalloc\
##\
enableMimalloc: true\
## Override NGINX template\
customTemplate:\
configMapName: \\\"\\\"\
configMapKey: \\\"\\\"\
service:\
# -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.\
enabled: true\
external:\
# -- Enable the external controller service or not. Useful for internal-only deployments.\
enabled: true\
# -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.\
annotations: {}\
# -- Labels to be added to both controller services.\
labels: {}\
# -- Type of the external controller service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: LoadBalancer\
# -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\"\\\"\
# -- List of node IP addresses at which the external controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\"\\\"\
# -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\"\\\"\
# -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the external controller service. Set to \\\"Local\\\" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\"\\\"\
# -- Session affinity of the external controller service. Must be either \\\"None\\\" or \\\"ClientIP\\\" if set. Defaults to \\\"None\\\".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\"\\\"\
# -- Specifies the health check node port (numeric port number) for the external controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
# -- Enable the HTTP listener on both controller services or not.\
enableHttp: true\
# -- Enable the HTTPS listener on both controller services or not.\
enableHttps: true\
ports:\
# -- Port the external HTTP listener is published with.\
http: 80\
# -- Port the external HTTPS listener is published with.\
https: 443\
targetPorts:\
# -- Port of the ingress controller the external HTTP listener is mapped to.\
http: http\
# -- Port of the ingress controller the external HTTPS listener is mapped to.\
https: https\
# -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\"\\\"\
# -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\"\\\"\
# -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
internal:\
# -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.\
enabled: false\
# -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer\
annotations: {}\
# -- Type of the internal controller service.\
# Defaults to the value of `controller.service.type`.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types\
type: \\\"\\\"\
# -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.\
# This value is immutable. Set once, it can not be changed without deleting and re-creating the service.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address\
clusterIP: \\\"\\\"\
# -- List of node IP addresses at which the internal controller service is available.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
externalIPs: []\
# -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer\
loadBalancerIP: \\\"\\\"\
# -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.\
loadBalancerSourceRanges: []\
# -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class\
loadBalancerClass: \\\"\\\"\
# -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation\
# allocateLoadBalancerNodePorts: true\
\
# -- External traffic policy of the internal controller service. Set to \\\"Local\\\" to preserve source IP on providers supporting it.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
externalTrafficPolicy: \\\"\\\"\
# -- Session affinity of the internal controller service. Must be either \\\"None\\\" or \\\"ClientIP\\\" if set. Defaults to \\\"None\\\".\
# Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity\
sessionAffinity: \\\"\\\"\
# -- Specifies the health check node port (numeric port number) for the internal controller service.\
# If not specified, the service controller allocates a port from your cluster's node port range.\
# Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip\
# healthCheckNodePort: 0\
\
# -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.\
# Fields `ipFamilies` and `clusterIP` depend on the value of this field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilyPolicy: SingleStack\
# -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services\
ipFamilies:\
- IPv4\
ports: {}\
# -- Port the internal HTTP listener is published with.\
# Defaults to the value of `controller.service.ports.http`.\
# http: 80\
# -- Port the internal HTTPS listener is published with.\
# Defaults to the value of `controller.service.ports.https`.\
# https: 443\
\
targetPorts: {}\
# -- Port of the ingress controller the internal HTTP listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.http`.\
# http: http\
# -- Port of the ingress controller the internal HTTPS listener is mapped to.\
# Defaults to the value of `controller.service.targetPorts.https`.\
# https: https\
\
# -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.\
# Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol\
appProtocol: true\
nodePorts:\
# -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.\
http: \\\"\\\"\
# -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.\
https: \\\"\\\"\
# -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# tcp:\
# 8080: 30080\
tcp: {}\
# -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.\
# Example:\
# udp:\
# 53: 30053\
udp: {}\
# shareProcessNamespace enables process namespace sharing within the pod.\
# This can be used for example to signal log rotation using `kill -USR1` from a sidecar.\
shareProcessNamespace: false\
# -- Additional containers to be added to the controller pod.\
# See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.\
extraContainers: []\
# - name: my-sidecar\
# image: nginx:latest\
\
# -- Additional volumeMounts to the controller main container.\
extraVolumeMounts: []\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
# -- Additional volumes to the controller pod.\
extraVolumes: []\
# - name: copy-portal-skins\
# emptyDir: {}\
\
# -- Containers, which are run before the app containers are started.\
extraInitContainers: \
- command:\
- sh\
- -c\
- |-\
sysctl -w net.core.somaxconn=65535\
sysctl -w net.ipv4.ip_local_reserved_ports=9100\
sysctl -w net.ipv4.ip_local_port_range=\\\"1024 61999\\\"\
sysctl -w net.ipv4.tcp_tw_reuse=1\
sysctl -w fs.file-max=1048576\
image: ccr.ccs.tencentyun.com/tkeimages/busybox:latest\
imagePullPolicy: Always\
name: setsysctl\
securityContext:\
privileged: true\
\
# -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module\
extraModules: []\
# - name: mytestmodule\
# image:\
# registry: registry.k8s.io\
# image: ingress-nginx/mytestmodule\
# ## for backwards compatibility consider setting the full image url via the repository value below\
# ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
# ## repository:\
# tag: \\\"v1.0.0\\\"\
# digest: \\\"\\\"\
# distroless: false\
# containerSecurityContext:\
# runAsNonRoot: true\
# runAsUser: <user-id>\
# allowPrivilegeEscalation: false\
# seccompProfile:\
# type: RuntimeDefault\
# capabilities:\
# drop:\
# - ALL\
# readOnlyRootFilesystem: true\
# resources: {}\
#\
# The image must contain a `/usr/local/bin/init_module.sh` executable, which\
# will be executed as initContainers, to move its config files within the\
# mounted volume.\
\
opentelemetry:\
enabled: false\
name: opentelemetry\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-opentelemetry\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"v20230721-3e2062ee5\\\"\
digest: \\\"\\\"\
distroless: true\
containerSecurityContext:\
runAsNonRoot: true\
# -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
admissionWebhooks:\
name: admission\
annotations: {}\
# ignore-check.kube-linter.io/no-read-only-rootfs: \\\"This deployment needs write access to root filesystem\\\".\
\
## Additional annotations to the admission webhooks.\
## These annotations will be added to the ValidatingWebhookConfiguration and\
## the Jobs Spec of the admission webhooks.\
enabled: true\
# -- Additional environment variables to set\
extraEnvs: []\
# extraEnvs:\
# - name: FOO\
# valueFrom:\
# secretKeyRef:\
# key: FOO\
# name: secret-resource\
# -- Admission Webhook failure policy to use\
failurePolicy: Fail\
# timeoutSeconds: 10\
port: 8443\
certificate: \\\"/usr/local/certificates/cert\\\"\
key: \\\"/usr/local/certificates/key\\\"\
namespaceSelector: {}\
objectSelector: {}\
# -- Labels to be added to admission webhooks\
labels: {}\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
service:\
annotations: {}\
# clusterIP: \\\"\\\"\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 443\
type: ClusterIP\
createSecretJob:\
name: create\
# -- Security context for secret creation containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
patchWebhookJob:\
name: patch\
# -- Security context for webhook patch containers\
securityContext:\
runAsNonRoot: true\
runAsUser: 65532\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
capabilities:\
drop:\
- ALL\
readOnlyRootFilesystem: true\
resources: {}\
patch:\
enabled: true\
image:\
registry: ccr.ccs.tencentyun.com\
image: tke-market/ingress-nginx-webhook-certgen\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: v20231011-8b53cabe0\
digest: \\\"\\\"\
pullPolicy: IfNotPresent\
# -- Provide a priority class name to the webhook patching job\
##\
priorityClassName: \\\"\\\"\
podAnnotations: {}\
# NetworkPolicy for webhook patch\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
nodeSelector:\
kubernetes.io/os: linux\
tolerations: []\
# -- Labels to be added to patch job resources\
labels: {}\
# -- Security context for secret creation & webhook patch pods\
securityContext: {}\
# Use certmanager to generate webhook certs\
certManager:\
enabled: false\
# self-signed root certificate\
rootCert:\
# default to be 5y\
duration: \\\"\\\"\
admissionCert:\
# default to be 1y\
duration: \\\"\\\"\
# issuerRef:\
# name: \\\"issuer\\\"\
# kind: \\\"ClusterIssuer\\\"\
metrics:\
port: 10254\
portName: metrics\
# if this port is changed, change healthz-port: in extraArgs: accordingly\
enabled: false\
service:\
annotations: {}\
# prometheus.io/scrape: \\\"true\\\"\
# prometheus.io/port: \\\"10254\\\"\
# -- Labels to be added to the metrics service resource\
labels: {}\
# clusterIP: \\\"\\\"\
\
# -- List of IP addresses at which the stats-exporter service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 10254\
type: ClusterIP\
# externalTrafficPolicy: \\\"\\\"\
# nodePort: \\\"\\\"\
serviceMonitor:\
enabled: false\
additionalLabels: {}\
annotations: {}\
## The label to use to retrieve the job name from.\
## jobLabel: \\\"app.kubernetes.io/name\\\"\
namespace: \\\"\\\"\
namespaceSelector: {}\
## Default: scrape .Release.Namespace or namespaceOverride only\
## To scrape all, use the following:\
## namespaceSelector:\
## any: true\
scrapeInterval: 30s\
# honorLabels: true\
targetLabels: []\
relabelings: []\
metricRelabelings: []\
prometheusRule:\
enabled: false\
additionalLabels: {}\
# namespace: \\\"\\\"\
rules: []\
# # These are just examples rules, please adapt them to your needs\
# - alert: NGINXConfigFailed\
# expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: bad ingress config - nginx config test failed\
# summary: uninstall the latest ingress changes to allow config reloads to resume\
# # By default a fake self-signed certificate is generated as default and\
# # it is fine if it expires. If `--default-ssl-certificate` flag is used\
# # and a valid certificate passed please do not filter for `host` label!\
# # (i.e. delete `{host!=\\\"_\\\"}` so also the default SSL certificate is\
# # checked for expiration)\
# - alert: NGINXCertificateExpiry\
# expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!=\\\"_\\\"}) by (host) - time()) < 604800\
# for: 1s\
# labels:\
# severity: critical\
# annotations:\
# description: ssl certificate(s) will expire in less then a week\
# summary: renew expiring certificates to avoid downtime\
# - alert: NGINXTooMany500s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\"5.+\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 5XXs\
# summary: More than 5% of all requests returned 5XX, this requires your attention\
# - alert: NGINXTooMany400s\
# expr: 100 * ( sum( nginx_ingress_controller_requests{status=~\\\"4.+\\\"} ) / sum(nginx_ingress_controller_requests) ) > 5\
# for: 1m\
# labels:\
# severity: warning\
# annotations:\
# description: Too many 4XXs\
# summary: More than 5% of all requests returned 4XX, this requires your attention\
# -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:\
# With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds\
# to 300, allowing the draining of connections up to five minutes.\
# If the active connections end before that, the pod will terminate gracefully at that time.\
# To effectively take advantage of this feature, the Configmap feature\
# worker-shutdown-timeout new value is 240s instead of 10s.\
##\
lifecycle:\
preStop:\
exec:\
command:\
- /wait-shutdown\
priorityClassName: \\\"\\\"\
# -- Rollback limit\
##\
revisionHistoryLimit: 10\
## Default 404 backend\
##\
defaultBackend:\
##\
enabled: false\
name: defaultbackend\
image:\
registry: ccr.ccs.tencentyun.com\
image: \\ttke-market/ingress-nginx-defaultbackend-amd64\
## for backwards compatibility consider setting the full image url via the repository value below\
## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail\
## repository:\
tag: \\\"1.5\\\"\
pullPolicy: IfNotPresent\
runAsNonRoot: true\
# nobody user -> uid 65534\
runAsUser: 65534\
allowPrivilegeEscalation: false\
seccompProfile:\
type: RuntimeDefault\
readOnlyRootFilesystem: true\
# -- Use an existing PSP instead of creating one\
existingPsp: \\\"\\\"\
extraArgs: {}\
serviceAccount:\
create: true\
name: \\\"\\\"\
automountServiceAccountToken: true\
# -- Additional environment variables to set for defaultBackend pods\
extraEnvs: []\
port: 8080\
## Readiness and liveness probes for default backend\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/\
##\
livenessProbe:\
failureThreshold: 3\
initialDelaySeconds: 30\
periodSeconds: 10\
successThreshold: 1\
timeoutSeconds: 5\
readinessProbe:\
failureThreshold: 6\
initialDelaySeconds: 0\
periodSeconds: 5\
successThreshold: 1\
timeoutSeconds: 5\
# -- The update strategy to apply to the Deployment or DaemonSet\
##\
updateStrategy: {}\
# rollingUpdate:\
# maxUnavailable: 1\
# type: RollingUpdate\
\
# -- `minReadySeconds` to avoid killing pods before we are ready\
##\
minReadySeconds: 0\
# -- Node tolerations for server scheduling to nodes with taints\
## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/\
##\
tolerations: []\
# - key: \\\"key\\\"\
# operator: \\\"Equal|Exists\\\"\
# value: \\\"value\\\"\
# effect: \\\"NoSchedule|PreferNoSchedule|NoExecute(1.6 only)\\\"\
\
affinity: {}\
# -- Security context for default backend pods\
podSecurityContext: {}\
# -- Security context for default backend containers\
containerSecurityContext: {}\
# -- Labels to add to the pod container metadata\
podLabels: {}\
# key: value\
\
# -- Node labels for default backend pod assignment\
## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/\
##\
nodeSelector:\
kubernetes.io/os: linux\
# -- Annotations to be added to default backend pods\
##\
podAnnotations: {}\
replicaCount: 1\
minAvailable: 1\
resources: {}\
# limits:\
# cpu: 10m\
# memory: 20Mi\
# requests:\
# cpu: 10m\
# memory: 20Mi\
\
extraVolumeMounts: []\
## Additional volumeMounts to the default backend container.\
# - name: copy-portal-skins\
# mountPath: /var/lib/lemonldap-ng/portal/skins\
\
extraVolumes: []\
## Additional volumes to the default backend pod.\
# - name: copy-portal-skins\
# emptyDir: {}\
\
extraConfigMaps: []\
## Additional configmaps to the default backend pod.\
# - name: my-extra-configmap-1\
# labels:\
# type: config-1\
# data:\
# extra_file_1.html: |\
# <!-- Extra HTML content for ConfigMap 1 -->\
# - name: my-extra-configmap-2\
# labels:\
# type: config-2\
# data:\
# extra_file_2.html: |\
# <!-- Extra HTML content for ConfigMap 2 -->\
\
autoscaling:\
annotations: {}\
enabled: false\
minReplicas: 1\
maxReplicas: 2\
targetCPUUtilizationPercentage: 50\
targetMemoryUtilizationPercentage: 50\
# NetworkPolicy for default backend component.\
networkPolicy:\
# -- Enable 'networkPolicy' or not\
enabled: false\
service:\
annotations: {}\
# clusterIP: \\\"\\\"\
\
# -- List of IP addresses at which the default backend service is available\
## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips\
##\
externalIPs: []\
# loadBalancerIP: \\\"\\\"\
loadBalancerSourceRanges: []\
servicePort: 80\
type: ClusterIP\
priorityClassName: \\\"\\\"\
# -- Labels to be added to the default backend resources\
labels: {}\
## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266\
rbac:\
create: true\
scope: false\
## If true, create & use Pod Security Policy resources\
## https://kubernetes.io/docs/concepts/policy/pod-security-policy/\
podSecurityPolicy:\
enabled: false\
serviceAccount:\
create: true\
name: \\\"\\\"\
automountServiceAccountToken: true\
# -- Annotations for the controller service account\
annotations: {}\
# -- Optional array of imagePullSecrets containing private registry credentials\
## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/\
imagePullSecrets: []\
# - name: secretName\
\
# -- TCP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
tcp: {}\
# 8080: \\\"default/example-tcp-svc:9000\\\"\
\
# -- UDP service key-value pairs\
## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md\
##\
udp: {}\
# 53: \\\"kube-system/kube-dns:53\\\"\
\
# -- Prefix for TCP and UDP ports names in ingress controller service\
## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration\
portNamePrefix: \\\"\\\"\
# -- (string) A base64-encoded Diffie-Hellman parameter.\
# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`\
## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param\
dhParam: \\\"\\\"\
valuesType: yaml
Create KubernetesClusterRelease Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new KubernetesClusterRelease(name: string, args: KubernetesClusterReleaseArgs, opts?: CustomResourceOptions);@overload
def KubernetesClusterRelease(resource_name: str,
args: KubernetesClusterReleaseArgs,
opts: Optional[ResourceOptions] = None)
@overload
def KubernetesClusterRelease(resource_name: str,
opts: Optional[ResourceOptions] = None,
chart: Optional[str] = None,
namespace: Optional[str] = None,
cluster_id: Optional[str] = None,
chart_repo_url: Optional[str] = None,
chart_version: Optional[str] = None,
chart_namespace: Optional[str] = None,
cluster_type: Optional[str] = None,
kubernetes_cluster_release_id: Optional[str] = None,
name: Optional[str] = None,
chart_from: Optional[str] = None,
password: Optional[str] = None,
timeouts: Optional[KubernetesClusterReleaseTimeoutsArgs] = None,
username: Optional[str] = None,
values: Optional[KubernetesClusterReleaseValuesArgs] = None)func NewKubernetesClusterRelease(ctx *Context, name string, args KubernetesClusterReleaseArgs, opts ...ResourceOption) (*KubernetesClusterRelease, error)public KubernetesClusterRelease(string name, KubernetesClusterReleaseArgs args, CustomResourceOptions? opts = null)
public KubernetesClusterRelease(String name, KubernetesClusterReleaseArgs args)
public KubernetesClusterRelease(String name, KubernetesClusterReleaseArgs args, CustomResourceOptions options)
type: tencentcloud:KubernetesClusterRelease
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args KubernetesClusterReleaseArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args KubernetesClusterReleaseArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args KubernetesClusterReleaseArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args KubernetesClusterReleaseArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args KubernetesClusterReleaseArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
KubernetesClusterRelease Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The KubernetesClusterRelease resource accepts the following input properties:
- Chart string
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- Cluster
Id string - Cluster ID.
- Namespace string
- Application namespace, obtained from the cluster details namespace.
- Chart
From string - Chart source, range: tke-market or other, default value: tke-market.
- Chart
Namespace string - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- Chart
Repo stringUrl - Chart repository URL address.
- Chart
Version string - Chart version.
- Cluster
Type string - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- Kubernetes
Cluster stringRelease Id - ID of the resource.
- Name string
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- Password string
- Chart access password.
- Timeouts
Kubernetes
Cluster Release Timeouts - Username string
- Chart access username.
- Values
Kubernetes
Cluster Release Values - Custom parameters.
- Chart string
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- Cluster
Id string - Cluster ID.
- Namespace string
- Application namespace, obtained from the cluster details namespace.
- Chart
From string - Chart source, range: tke-market or other, default value: tke-market.
- Chart
Namespace string - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- Chart
Repo stringUrl - Chart repository URL address.
- Chart
Version string - Chart version.
- Cluster
Type string - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- Kubernetes
Cluster stringRelease Id - ID of the resource.
- Name string
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- Password string
- Chart access password.
- Timeouts
Kubernetes
Cluster Release Timeouts Args - Username string
- Chart access username.
- Values
Kubernetes
Cluster Release Values Args - Custom parameters.
- chart String
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- cluster
Id String - Cluster ID.
- namespace String
- Application namespace, obtained from the cluster details namespace.
- chart
From String - Chart source, range: tke-market or other, default value: tke-market.
- chart
Namespace String - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart
Repo StringUrl - Chart repository URL address.
- chart
Version String - Chart version.
- cluster
Type String - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes
Cluster StringRelease Id - ID of the resource.
- name String
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- password String
- Chart access password.
- timeouts
Kubernetes
Cluster Release Timeouts - username String
- Chart access username.
- values
Kubernetes
Cluster Release Values - Custom parameters.
- chart string
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- cluster
Id string - Cluster ID.
- namespace string
- Application namespace, obtained from the cluster details namespace.
- chart
From string - Chart source, range: tke-market or other, default value: tke-market.
- chart
Namespace string - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart
Repo stringUrl - Chart repository URL address.
- chart
Version string - Chart version.
- cluster
Type string - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes
Cluster stringRelease Id - ID of the resource.
- name string
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- password string
- Chart access password.
- timeouts
Kubernetes
Cluster Release Timeouts - username string
- Chart access username.
- values
Kubernetes
Cluster Release Values - Custom parameters.
- chart str
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- cluster_
id str - Cluster ID.
- namespace str
- Application namespace, obtained from the cluster details namespace.
- chart_
from str - Chart source, range: tke-market or other, default value: tke-market.
- chart_
namespace str - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart_
repo_ strurl - Chart repository URL address.
- chart_
version str - Chart version.
- cluster_
type str - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes_
cluster_ strrelease_ id - ID of the resource.
- name str
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- password str
- Chart access password.
- timeouts
Kubernetes
Cluster Release Timeouts Args - username str
- Chart access username.
- values
Kubernetes
Cluster Release Values Args - Custom parameters.
- chart String
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- cluster
Id String - Cluster ID.
- namespace String
- Application namespace, obtained from the cluster details namespace.
- chart
From String - Chart source, range: tke-market or other, default value: tke-market.
- chart
Namespace String - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart
Repo StringUrl - Chart repository URL address.
- chart
Version String - Chart version.
- cluster
Type String - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes
Cluster StringRelease Id - ID of the resource.
- name String
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- password String
- Chart access password.
- timeouts Property Map
- username String
- Chart access username.
- values Property Map
- Custom parameters.
Outputs
All input properties are implicitly available as output properties. Additionally, the KubernetesClusterRelease resource produces the following output properties:
- Cluster
Release stringId - Cluster release ID.
- Id string
- The provider-assigned unique ID for this managed resource.
- Release
Status string - Cluster release status.
- Cluster
Release stringId - Cluster release ID.
- Id string
- The provider-assigned unique ID for this managed resource.
- Release
Status string - Cluster release status.
- cluster
Release StringId - Cluster release ID.
- id String
- The provider-assigned unique ID for this managed resource.
- release
Status String - Cluster release status.
- cluster
Release stringId - Cluster release ID.
- id string
- The provider-assigned unique ID for this managed resource.
- release
Status string - Cluster release status.
- cluster_
release_ strid - Cluster release ID.
- id str
- The provider-assigned unique ID for this managed resource.
- release_
status str - Cluster release status.
- cluster
Release StringId - Cluster release ID.
- id String
- The provider-assigned unique ID for this managed resource.
- release
Status String - Cluster release status.
Look up Existing KubernetesClusterRelease Resource
Get an existing KubernetesClusterRelease resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: KubernetesClusterReleaseState, opts?: CustomResourceOptions): KubernetesClusterRelease@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
chart: Optional[str] = None,
chart_from: Optional[str] = None,
chart_namespace: Optional[str] = None,
chart_repo_url: Optional[str] = None,
chart_version: Optional[str] = None,
cluster_id: Optional[str] = None,
cluster_release_id: Optional[str] = None,
cluster_type: Optional[str] = None,
kubernetes_cluster_release_id: Optional[str] = None,
name: Optional[str] = None,
namespace: Optional[str] = None,
password: Optional[str] = None,
release_status: Optional[str] = None,
timeouts: Optional[KubernetesClusterReleaseTimeoutsArgs] = None,
username: Optional[str] = None,
values: Optional[KubernetesClusterReleaseValuesArgs] = None) -> KubernetesClusterReleasefunc GetKubernetesClusterRelease(ctx *Context, name string, id IDInput, state *KubernetesClusterReleaseState, opts ...ResourceOption) (*KubernetesClusterRelease, error)public static KubernetesClusterRelease Get(string name, Input<string> id, KubernetesClusterReleaseState? state, CustomResourceOptions? opts = null)public static KubernetesClusterRelease get(String name, Output<String> id, KubernetesClusterReleaseState state, CustomResourceOptions options)resources: _: type: tencentcloud:KubernetesClusterRelease get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Chart string
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- Chart
From string - Chart source, range: tke-market or other, default value: tke-market.
- Chart
Namespace string - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- Chart
Repo stringUrl - Chart repository URL address.
- Chart
Version string - Chart version.
- Cluster
Id string - Cluster ID.
- Cluster
Release stringId - Cluster release ID.
- Cluster
Type string - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- Kubernetes
Cluster stringRelease Id - ID of the resource.
- Name string
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- Namespace string
- Application namespace, obtained from the cluster details namespace.
- Password string
- Chart access password.
- Release
Status string - Cluster release status.
- Timeouts
Kubernetes
Cluster Release Timeouts - Username string
- Chart access username.
- Values
Kubernetes
Cluster Release Values - Custom parameters.
- Chart string
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- Chart
From string - Chart source, range: tke-market or other, default value: tke-market.
- Chart
Namespace string - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- Chart
Repo stringUrl - Chart repository URL address.
- Chart
Version string - Chart version.
- Cluster
Id string - Cluster ID.
- Cluster
Release stringId - Cluster release ID.
- Cluster
Type string - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- Kubernetes
Cluster stringRelease Id - ID of the resource.
- Name string
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- Namespace string
- Application namespace, obtained from the cluster details namespace.
- Password string
- Chart access password.
- Release
Status string - Cluster release status.
- Timeouts
Kubernetes
Cluster Release Timeouts Args - Username string
- Chart access username.
- Values
Kubernetes
Cluster Release Values Args - Custom parameters.
- chart String
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- chart
From String - Chart source, range: tke-market or other, default value: tke-market.
- chart
Namespace String - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart
Repo StringUrl - Chart repository URL address.
- chart
Version String - Chart version.
- cluster
Id String - Cluster ID.
- cluster
Release StringId - Cluster release ID.
- cluster
Type String - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes
Cluster StringRelease Id - ID of the resource.
- name String
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- namespace String
- Application namespace, obtained from the cluster details namespace.
- password String
- Chart access password.
- release
Status String - Cluster release status.
- timeouts
Kubernetes
Cluster Release Timeouts - username String
- Chart access username.
- values
Kubernetes
Cluster Release Values - Custom parameters.
- chart string
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- chart
From string - Chart source, range: tke-market or other, default value: tke-market.
- chart
Namespace string - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart
Repo stringUrl - Chart repository URL address.
- chart
Version string - Chart version.
- cluster
Id string - Cluster ID.
- cluster
Release stringId - Cluster release ID.
- cluster
Type string - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes
Cluster stringRelease Id - ID of the resource.
- name string
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- namespace string
- Application namespace, obtained from the cluster details namespace.
- password string
- Chart access password.
- release
Status string - Cluster release status.
- timeouts
Kubernetes
Cluster Release Timeouts - username string
- Chart access username.
- values
Kubernetes
Cluster Release Values - Custom parameters.
- chart str
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- chart_
from str - Chart source, range: tke-market or other, default value: tke-market.
- chart_
namespace str - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart_
repo_ strurl - Chart repository URL address.
- chart_
version str - Chart version.
- cluster_
id str - Cluster ID.
- cluster_
release_ strid - Cluster release ID.
- cluster_
type str - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes_
cluster_ strrelease_ id - ID of the resource.
- name str
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- namespace str
- Application namespace, obtained from the cluster details namespace.
- password str
- Chart access password.
- release_
status str - Cluster release status.
- timeouts
Kubernetes
Cluster Release Timeouts Args - username str
- Chart access username.
- values
Kubernetes
Cluster Release Values Args - Custom parameters.
- chart String
- Chart name (obtained from the application market) or the download URL of the chart package when installing from a third-party repo, redirect-type chart URLs are not supported, must end with *.tgz.
- chart
From String - Chart source, range: tke-market or other, default value: tke-market.
- chart
Namespace String - Chart namespace, when ChartFrom is tke-market, ChartNamespace is not empty, value is the Namespace returned by the DescribeProducts interface.
- chart
Repo StringUrl - Chart repository URL address.
- chart
Version String - Chart version.
- cluster
Id String - Cluster ID.
- cluster
Release StringId - Cluster release ID.
- cluster
Type String - Cluster type, supports tke, eks, tkeedge, external (registered cluster).
- kubernetes
Cluster StringRelease Id - ID of the resource.
- name String
- Application name, maximum 63 characters, can only contain lowercase letters, numbers, and the separator "-", and must start with a lowercase letter and end with a number or lowercase letter.
- namespace String
- Application namespace, obtained from the cluster details namespace.
- password String
- Chart access password.
- release
Status String - Cluster release status.
- timeouts Property Map
- username String
- Chart access username.
- values Property Map
- Custom parameters.
Supporting Types
KubernetesClusterReleaseTimeouts, KubernetesClusterReleaseTimeoutsArgs
KubernetesClusterReleaseValues, KubernetesClusterReleaseValuesArgs
- Raw
Original string - Custom parameter original value.
- Values
Type string - Custom parameter value type.
- Raw
Original string - Custom parameter original value.
- Values
Type string - Custom parameter value type.
- raw
Original String - Custom parameter original value.
- values
Type String - Custom parameter value type.
- raw
Original string - Custom parameter original value.
- values
Type string - Custom parameter value type.
- raw_
original str - Custom parameter original value.
- values_
type str - Custom parameter value type.
- raw
Original String - Custom parameter original value.
- values
Type String - Custom parameter value type.
Package Details
- Repository
- tencentcloud tencentcloudstack/terraform-provider-tencentcloud
- License
- Notes
- This Pulumi package is based on the
tencentcloudTerraform Provider.
tencentcloud 1.82.36 published on Thursday, Nov 13, 2025 by tencentcloudstack
