Skip to content
This repository was archived by the owner on Mar 14, 2024. It is now read-only.

Commit 135a1de

Browse files
author
Pamme
authored
Merge pull request #37 from nginxinc/release-1.4
Helm release - 1.4
2 parents 8e27220 + 27a07fa commit 135a1de

22 files changed

+538
-237
lines changed

‎examples/grafana/nginx-mesh-top.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -346,7 +346,7 @@
346346
"alertThreshold": true
347347
},
348348
"percentage": false,
349-
"pluginVersion": "8.1.3",
349+
"pluginVersion": "8.3.4",
350350
"pointradius": 5,
351351
"points": false,
352352
"renderer": "flot",
@@ -441,7 +441,7 @@
441441
"alertThreshold": true
442442
},
443443
"percentage": false,
444-
"pluginVersion": "8.1.3",
444+
"pluginVersion": "8.3.4",
445445
"pointradius": 5,
446446
"points": false,
447447
"renderer": "flot",
@@ -538,7 +538,7 @@
538538
"alertThreshold": true
539539
},
540540
"percentage": false,
541-
"pluginVersion": "8.1.3",
541+
"pluginVersion": "8.3.4",
542542
"pointradius": 2,
543543
"points": false,
544544
"renderer": "flot",
@@ -632,7 +632,7 @@
632632
"alertThreshold": true
633633
},
634634
"percentage": false,
635-
"pluginVersion": "8.1.3",
635+
"pluginVersion": "8.3.4",
636636
"pointradius": 2,
637637
"points": false,
638638
"renderer": "flot",

‎examples/grafana/nginx-service-mesh-summary.json

+7-7
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@
9292
"content": "<div class=\"dashboard-header text-center\">\n<span>Global View</span>\n</div>",
9393
"mode": "html"
9494
},
95-
"pluginVersion": "8.1.3",
95+
"pluginVersion": "8.3.4",
9696
"timeFrom": null,
9797
"timeShift": null,
9898
"transparent": true,
@@ -163,7 +163,7 @@
163163
"text": {},
164164
"textMode": "auto"
165165
},
166-
"pluginVersion": "8.1.3",
166+
"pluginVersion": "8.3.4",
167167
"targets": [
168168
{
169169
"expr": "sum(irate(nginxplus_upstream_server_responses{code=~\"1xx|2xx\"}[30s])) / sum(irate(nginxplus_upstream_server_responses[30s]))",
@@ -229,7 +229,7 @@
229229
"text": {},
230230
"textMode": "auto"
231231
},
232-
"pluginVersion": "8.1.3",
232+
"pluginVersion": "8.3.4",
233233
"targets": [
234234
{
235235
"expr": "count(nginxplus_http_requests_total)",
@@ -300,7 +300,7 @@
300300
"text": {},
301301
"textMode": "auto"
302302
},
303-
"pluginVersion": "8.1.3",
303+
"pluginVersion": "8.3.4",
304304
"targets": [
305305
{
306306
"expr": "sum(irate(nginxplus_http_requests_total[30s]))",
@@ -345,7 +345,7 @@
345345
"content": "<div class=\"dashboard-header text-center\">\n<span>Workload View</span>\n</div>",
346346
"mode": "html"
347347
},
348-
"pluginVersion": "8.1.3",
348+
"pluginVersion": "8.3.4",
349349
"timeFrom": null,
350350
"timeShift": null,
351351
"transparent": true,
@@ -389,7 +389,7 @@
389389
"alertThreshold": true
390390
},
391391
"percentage": false,
392-
"pluginVersion": "8.1.3",
392+
"pluginVersion": "8.3.4",
393393
"pointradius": 2,
394394
"points": true,
395395
"renderer": "flot",
@@ -485,7 +485,7 @@
485485
"alertThreshold": true
486486
},
487487
"percentage": false,
488-
"pluginVersion": "8.1.3",
488+
"pluginVersion": "8.3.4",
489489
"pointradius": 2,
490490
"points": true,
491491
"renderer": "flot",

‎helm-chart/Chart.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v2
22
name: nginx-service-mesh
33
description: NGINX Service Mesh
4-
version: 0.3.1
5-
appVersion: 1.3.1
4+
version: 0.4.0
5+
appVersion: 1.4.0
66
kubeVersion: ">= 1.18-0"
77
icon: https://raw.githubusercontent.com/nginxinc/nginx-service-mesh/master/helm-chart/chart-icon.png

‎helm-chart/configs/grafana-top-dashboard.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -310,7 +310,7 @@
310310
"alertThreshold": true
311311
},
312312
"percentage": false,
313-
"pluginVersion": "8.1.7",
313+
"pluginVersion": "8.3.4",
314314
"pointradius": 5,
315315
"points": false,
316316
"renderer": "flot",
@@ -405,7 +405,7 @@
405405
"alertThreshold": true
406406
},
407407
"percentage": false,
408-
"pluginVersion": "8.1.7",
408+
"pluginVersion": "8.3.4",
409409
"pointradius": 5,
410410
"points": false,
411411
"renderer": "flot",
@@ -502,7 +502,7 @@
502502
"alertThreshold": true
503503
},
504504
"percentage": false,
505-
"pluginVersion": "8.1.7",
505+
"pluginVersion": "8.3.4",
506506
"pointradius": 2,
507507
"points": false,
508508
"renderer": "flot",
@@ -596,7 +596,7 @@
596596
"alertThreshold": true
597597
},
598598
"percentage": false,
599-
"pluginVersion": "8.1.7",
599+
"pluginVersion": "8.3.4",
600600
"pointradius": 2,
601601
"points": false,
602602
"renderer": "flot",

‎helm-chart/configs/k8s-workload-registrar.conf

+2
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,6 @@ pod_controller = true
66
add_svc_dns_name = true
77
mode = "crd"
88
webhook_enabled = true
9+
webhook_cert_dir = "/tmp/k8s-webhook-server/serving-certs"
910
identity_template_label = "spiffe.io/spiffeid"
11+
dns_name_templates = ["{{`{{ .Pod.Name}}`}}", "{{`{{ .Pod.ServiceAccount }}`}}.{{`{{ .Pod.Namespace }}`}}.svc"]

‎helm-chart/configs/mesh-config.conf

+17-5
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
{
22
"accessControlMode": {{ quote .Values.accessControlMode }},
33
"api": {
4-
"address": {{ printf "nginx-mesh-api.%s" .Release.Namespace }},
4+
"address": {{ printf "nginx-mesh-api.%s" .Release.Namespace | quote }},
55
"containerPort": 8443,
66
"port": 443
77
},
88
"autoInjectorPort": 9443,
99
"environment": {{ quote .Values.environment }},
10+
"isUDPEnabled": {{ .Values.enableUDP }},
1011
"injection": {
1112
"disabledNamespaces": [{{ range $idx, $elem := .Values.autoInjection.disabledNamespaces }}{{if $idx}},{{end}}{{quote .}}{{end}}],
1213
"enabledNamespaces": [{{ range $idx, $elem := .Values.autoInjection.enabledNamespaces }}{{if $idx}},{{end}}{{quote .}}{{end}}],
@@ -35,6 +36,8 @@
3536
"incomingTcp": 8904,
3637
"incomingTcpDeny": 8905,
3738
"incomingTcpPermissive": 8907,
39+
"outgoingUdp": 8908,
40+
"incomingUdp": 8909,
3841
"metrics": 8887,
3942
"outgoing": 8889,
4043
"outgoingDefaultEgress": 8894,
@@ -50,18 +53,27 @@
5053
},
5154
"registryKeyName": {{ if (include "docker-config-json" .) }}{{ include "registry-key-name" . | quote }}{{ else }}""{{ end }},
5255
"sidecarImage": {
53-
"image": {{ printf "%s/nginx-mesh-sidecar:%s" .Values.registry.server .Values.registry.imageTag }},
56+
"image": {{ printf "%s/nginx-mesh-sidecar:%s" .Values.registry.server .Values.registry.imageTag | quote }},
5457
"name": "nginx-mesh-sidecar"
5558
},
5659
"sidecarInitImage": {
57-
"image": {{ printf "%s/nginx-mesh-init:%s" .Values.registry.server .Values.registry.imageTag }},
60+
"image": {{ printf "%s/nginx-mesh-init:%s" .Values.registry.server .Values.registry.imageTag | quote }},
5861
"name": "nginx-mesh-init"
5962
},
60-
"tracing": {
63+
"tracing": {{if .Values.tracing }}{
6164
"backend": {{ quote .Values.tracing.backend }},
6265
"backendAddress": {{ include "tracing.address" . | quote }},
6366
"isEnabled": {{ not .Values.tracing.disable }},
6467
"sampleRate": {{ .Values.tracing.sampleRate }}
65-
},
68+
},{{ else }}{},{{ end }}
69+
"telemetry": {{ if .Values.telemetry }}{
70+
"exporters": {
71+
"otlp": {
72+
"host": {{ quote .Values.telemetry.exporters.otlp.host }},
73+
"port": {{ .Values.telemetry.exporters.otlp.port }}
74+
}
75+
},
76+
"samplerRatio": {{ .Values.telemetry.samplerRatio }}
77+
},{{ else }}{},{{ end }}
6678
"trustDomain": {{ quote .Values.mtls.trustDomain }}
6779
}

‎helm-chart/configs/spire-server.conf

+3
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,16 @@ plugins {
5757
{{ tpl (.Files.Get "configs/upstreamAuthority/disk-ua.conf") . }}
5858
{{ else if .Values.mtls.upstreamAuthority.vault }}
5959
{{ tpl (.Files.Get "configs/upstreamAuthority/vault-ua.conf") . }}
60+
{{ else if .Values.mtls.upstreamAuthority.certManager }}
61+
{{ tpl (.Files.Get "configs/upstreamAuthority/cert-manager-ua.conf") . }}
6062
{{ end }}
6163

6264
}
6365

6466
health_checks {
6567
listener_enabled = true
6668
bind_address = "0.0.0.0"
69+
bind_port = "8082"
6770
live_path = "/live"
6871
ready_path = "/ready"
6972
}

‎helm-chart/configs/upstreamAuthority/cert-manager-ua.conf

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
UpstreamAuthority "cert-manager" {
2+
plugin_data {
3+
namespace = {{ quote .Values.mtls.upstreamAuthority.certManager.namespace }}
4+
issuer_name = {{ quote .Values.mtls.upstreamAuthority.certManager.issuerName }}
5+
{{- if .Values.mtls.upstreamAuthority.certManager.issuerKind }}
6+
issuer_kind = {{ quote .Values.mtls.upstreamAuthority.certManager.issuerKind }}{{ end }}
7+
{{- if .Values.mtls.upstreamAuthority.certManager.issuerGroup }}
8+
issuer_group = {{ quote .Values.mtls.upstreamAuthority.certManager.issuerGroup }}{{ end }}
9+
{{- if .Values.mtls.upstreamAuthority.certManager.kubeConfig }}
10+
kube_config_file = "/run/spire/secrets/cert-manager-kubeconfig"{{ end }}
11+
}
12+
}

‎helm-chart/templates/_helpers.tpl

+8-2
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ credentials {{- end }}
8989
upstreamCA.key
9090
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}
9191
upstreamClient.key{{ end }}
92+
{{- else if .Values.mtls.upstreamAuthority.certManager }}{{ if .Values.mtls.upstreamAuthority.certManager.kubeConfig -}}
93+
cert-manager-kubeconfig{{ end }}
9294
{{- end }}
9395
{{- end }}
9496

@@ -102,6 +104,8 @@ Define the name of the mount path where the Upstream Authority secret data is st
102104
/run/spire/secrets
103105
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}
104106
/run/spire/secrets{{ end }}
107+
{{- else if .Values.mtls.upstreamAuthority.certManager }}{{ if .Values.mtls.upstreamAuthority.certManager.kubeConfig -}}
108+
/run/spire/secrets{{ end }}
105109
{{- end }}
106110
{{- end }}
107111

@@ -128,15 +132,17 @@ upstreamBundle.crt: {{ quote .Values.mtls.upstreamAuthority.awsPCA.supplementalB
128132
{{- end }}
129133

130134
{{/*
131-
Define the Upstream Authority key to be stored in the Secret.
135+
Define the Upstream Authority value to be stored in the Secret.
132136
*/}}
133-
{{- define "ua-upstream-key" -}}
137+
{{- define "ua-secret-value" -}}
134138
{{- if .Values.mtls.upstreamAuthority.awsPCA -}}
135139
{{ tpl (.Files.Get "configs/upstreamAuthority/aws-credentials.conf") . | b64enc }}
136140
{{- else if .Values.mtls.upstreamAuthority.disk -}}
137141
{{ .Values.mtls.upstreamAuthority.disk.key | b64enc }}
138142
{{- else if .Values.mtls.upstreamAuthority.vault }}{{ if .Values.mtls.upstreamAuthority.vault.certAuth -}}
139143
{{ .Values.mtls.upstreamAuthority.vault.certAuth.clientKey | b64enc }}{{ end }}
144+
{{- else if .Values.mtls.upstreamAuthority.certManager }}{{ if .Values.mtls.upstreamAuthority.certManager.kubeConfig -}}
145+
{{ .Values.mtls.upstreamAuthority.certManager.kubeConfig | b64enc }}{{ end }}
140146
{{- end }}
141147
{{- end }}
142148

‎helm-chart/templates/grafana.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ spec:
100100
serviceAccountName: grafana
101101
containers:
102102
- name: grafana
103-
image: {{ include "grafana.image-server" . }}/grafana:8.1.7
103+
image: {{ include "grafana.image-server" . }}/grafana:8.3.4
104104
imagePullPolicy: {{ .Values.registry.imagePullPolicy }}
105105
ports:
106106
- containerPort: 3000

‎helm-chart/templates/jaeger.yaml

+7-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
{{- if (and (not .Values.tracing.disable) (eq .Values.tracing.backend "jaeger") (eq .Values.tracing.address "")) }}
1+
{{- if .Values.tracing }} {{ if (and (not .Values.tracing.disable) (eq .Values.tracing.backend "jaeger") (eq .Values.tracing.address "")) }}
22
---
33
apiVersion: v1
44
kind: Service
@@ -20,6 +20,10 @@ spec:
2020
port: 6831
2121
targetPort: 6831
2222
protocol: UDP
23+
- name: collector-http
24+
port: 14268
25+
protocol: TCP
26+
targetPort: 14268
2327
---
2428
apiVersion: apps/v1
2529
kind: Deployment
@@ -47,10 +51,10 @@ spec:
4751
- name: {{ include "registry-key-name" . }}
4852
containers:
4953
- name: jaeger
50-
image: {{ include "jaeger.image-server" . }}/all-in-one:1.26.0
54+
image: {{ include "jaeger.image-server" . }}/all-in-one:1.31.0
5155
imagePullPolicy: {{ .Values.registry.imagePullPolicy }}
5256
ports:
5357
- containerPort: 16686
5458
- containerPort: 6831
5559
protocol: UDP
56-
{{- end }}
60+
{{- end }}{{- end }}

‎helm-chart/templates/nats.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ spec:
103103
- name: spire-agent-socket
104104
mountPath: "/run/spire/sockets"
105105
- name: nats-server
106-
image: {{ include "nats.image-server" . }}nats:2.4.0-alpine3.14
106+
image: {{ include "nats.image-server" . }}nats:2.7.2-alpine3.15
107107
imagePullPolicy: {{ .Values.registry.imagePullPolicy }}
108108
ports:
109109
- containerPort: 4222

‎helm-chart/templates/nginx-mesh-api.yaml

+49
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,36 @@ subjects:
164164
name: nginx-mesh-api
165165
namespace: {{ .Release.Namespace }}
166166
---
167+
apiVersion: rbac.authorization.k8s.io/v1
168+
kind: ClusterRoleBinding
169+
metadata:
170+
name: nginx-mesh-api-svc.internal.builtin.nsm.nginx
171+
labels:
172+
app.kubernetes.io/part-of: nginx-service-mesh
173+
roleRef:
174+
apiGroup: rbac.authorization.k8s.io
175+
kind: ClusterRole
176+
name: system:auth-delegator
177+
subjects:
178+
- kind: ServiceAccount
179+
name: nginx-mesh-api
180+
namespace: {{ .Release.Namespace }}
181+
---
182+
apiVersion: rbac.authorization.k8s.io/v1
183+
kind: RoleBinding
184+
metadata:
185+
name: nginx-mesh-api-svc.internal.builtin.nsm.nginx
186+
labels:
187+
app.kubernetes.io/part-of: nginx-service-mesh
188+
roleRef:
189+
apiGroup: rbac.authorization.k8s.io
190+
kind: Role
191+
name: extension-apiserver-authentication-reader
192+
subjects:
193+
- kind: ServiceAccount
194+
name: nginx-mesh-api
195+
namespace: {{ .Release.Namespace }}
196+
---
167197
apiVersion: v1
168198
kind: ConfigMap
169199
metadata:
@@ -374,6 +404,23 @@ spec:
374404
path: "/run/spire/sockets"
375405
type: DirectoryOrCreate
376406
{{- end }}
407+
---
408+
apiVersion: apiregistration.k8s.io/v1
409+
kind: APIService
410+
metadata:
411+
labels:
412+
app.kubernetes.io/part-of: nginx-service-mesh
413+
spiffe.io/apiservice: "true"
414+
name: v1alpha1.nsm.nginx.com
415+
spec:
416+
group: nsm.nginx.com
417+
groupPriorityMinimum: 100
418+
service:
419+
name: nginx-mesh-api
420+
namespace: {{ .Release.Namespace}}
421+
port: 443
422+
version: v1alpha1
423+
versionPriority: 100
377424
{{- if eq .Values.environment "openshift" }}
378425
---
379426
apiVersion: rbac.authorization.k8s.io/v1
@@ -476,6 +523,8 @@ allowPrivilegedContainer: false
476523
allowedCapabilities:
477524
- NET_ADMIN
478525
- NET_RAW
526+
- SYS_RESOURCE
527+
- SYS_ADMIN
479528
seLinuxContext:
480529
type: RunAsAny
481530
runAsUser:

0 commit comments

Comments
 (0)