External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-02-17 19:20:10 -03:30
Code Issues Packages Projects Releases Wiki Activity

[ingress-nginx] Fix nginx controller leader election RBAC permissions (#10569)

Browse Source
This commit is contained in:
Mohamed Omar Zaian
2023-10-30 04:24:52 +01:00
committed by GitHub
parent bd382a9c39
commit 8775dcf92f
2 changed files with 7 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/ds-ingress-nginx-controller.yml.j2
View File

@@ -48,6 +48,7 @@ spec:
args: args:
- /nginx-ingress-controller - /nginx-ingress-controller
- --configmap=$(POD_NAMESPACE)/ingress-nginx - --configmap=$(POD_NAMESPACE)/ingress-nginx
- --election-id=ingress-controller-leader-{{ ingress_nginx_class }}
- --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services
- --udp-services-configmap=$(POD_NAMESPACE)/udp-services - --udp-services-configmap=$(POD_NAMESPACE)/udp-services
- --annotations-prefix=nginx.ingress.kubernetes.io - --annotations-prefix=nginx.ingress.kubernetes.io

18
roles/kubernetes-apps/ingress_controller/ingress_nginx/templates/role-ingress-nginx.yml.j2
View File

@@ -28,23 +28,17 @@ rules:
verbs: ["get", "list", "watch"] verbs: ["get", "list", "watch"]
- apiGroups: ["coordination.k8s.io"] - apiGroups: ["coordination.k8s.io"]
resources: ["leases"] resources: ["leases"]
# Defaults to "<election-id>-<ingress-class>" # Defaults to "<election-id>", defined in
# Here: "<ingress-controller-leader>-<nginx>" # ds-ingress-nginx-controller.yml.js
# This has to be adapted if you change either parameter # by a command-line argument.
# when launching the nginx-ingress-controller. #
# This is the correct behaviour for ingress-controller
# version 1.8.1
resourceNames: ["ingress-controller-leader-{{ ingress_nginx_class }}"] resourceNames: ["ingress-controller-leader-{{ ingress_nginx_class }}"]
verbs: ["get", "update"] verbs: ["get", "update"]
- apiGroups: [""] - apiGroups: [""]
resources: ["events"] resources: ["events"]
verbs: ["create", "patch"] verbs: ["create", "patch"]
- apiGroups: ["coordination.k8s.io"]
resources: ["leases"]
# Defaults to "<election-id>-<ingress-class>"
# Here: "<ingress-controller-leader>-<nginx>"
# This has to be adapted if you change either parameter
# when launching the nginx-ingress-controller.
resourceNames: ["ingress-controller-leader-{{ ingress_nginx_class }}"]
verbs: ["get", "update"]
- apiGroups: ["coordination.k8s.io"] - apiGroups: ["coordination.k8s.io"]
resources: ["leases"] resources: ["leases"]
verbs: ["create"] verbs: ["create"]