External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-01-11 18:09:59 -03:30
Code Issues Packages Projects Releases Wiki Activity

[ingress-nginx] Fix nginx controller leader election RBAC permissions (#10569)

Browse Source
This commit is contained in:
Mohamed Omar Zaian 2023-10-30 04:24:52 +01:00 committed by GitHub
parent bd382a9c39
commit 8775dcf92f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 7 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2
View File

@ -48,6 +48,7 @@ spec:
args:
- /nginx-ingress-controller
- --configmap=$(POD_NAMESPACE)/ingress-nginx
- --election-id=ingress-controller-leader-{{ ingress_nginx_class }}
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services
- --annotations-prefix=nginx.ingress.kubernetes.io

18
roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/role-ingress-nginx.yml.j2
View File

@ -28,23 +28,17 @@ rules:
verbs: ["get", "list", "watch"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
# Defaults to "<election-id>-<ingress-class>"
# Here: "<ingress-controller-leader>-<nginx>"
# This has to be adapted if you change either parameter
# when launching the nginx-ingress-controller.
# Defaults to "<election-id>", defined in
# ds-ingress-nginx-controller.yml.js
# by a command-line argument.
#
# This is the correct behaviour for ingress-controller
# version 1.8.1
resourceNames: ["ingress-controller-leader-{{ ingress_nginx_class }}"]
verbs: ["get", "update"]
- apiGroups: [""]
resources: ["events"]
verbs: ["create", "patch"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
# Defaults to "<election-id>-<ingress-class>"
# Here: "<ingress-controller-leader>-<nginx>"
# This has to be adapted if you change either parameter
# when launching the nginx-ingress-controller.
resourceNames: ["ingress-controller-leader-{{ ingress_nginx_class }}"]
verbs: ["get", "update"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
verbs: ["create"]