Skip to content

Commit 51fe798

Browse files
ns-squareopsns-squareops
authored
Upgrade k8s-dashboard and ingress-nginx to latest version (#108) (#110)
Upgrade k8s-dashboard and ingress-nginx to latest version k8s-dashboard from 6.0.8 to 7.11.1 ingress-nginx from 4.11.0 to 4.12.1
1 parent d21e4f8 commit 51fe798

File tree

5 files changed

+142
-171
lines changed

5 files changed

+142
-171
lines changed

‎examples/complete/config/kubernetes-dashboard.yaml‎

Lines changed: 42 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
1-
## Number of replicas
2-
replicaCount: 1
3-
4-
affinity:
1+
app:
2+
affinity:
53
nodeAffinity:
64
requiredDuringSchedulingIgnoredDuringExecution:
75
nodeSelectorTerms:
@@ -11,10 +9,43 @@ affinity:
119
values:
1210
- "true"
1311

14-
resources:
15-
requests:
16-
cpu: 100m
17-
memory: 200Mi
18-
limits:
19-
cpu: 2
20-
memory: 400Mi
12+
auth:
13+
service:
14+
resources:
15+
requests:
16+
cpu: 100m
17+
memory: 200Mi
18+
limits:
19+
cpu: 250m
20+
memory: 400Mi
21+
22+
api:
23+
service:
24+
resources:
25+
requests:
26+
cpu: 100m
27+
memory: 200Mi
28+
limits:
29+
cpu: 250m
30+
memory: 400Mi
31+
32+
web:
33+
service:
34+
resources:
35+
requests:
36+
cpu: 100m
37+
memory: 200Mi
38+
limits:
39+
cpu: 250m
40+
memory: 400Mi
41+
42+
43+
metricsScraper:
44+
service:
45+
resources:
46+
requests:
47+
cpu: 100m
48+
memory: 200Mi
49+
limits:
50+
cpu: 250m
51+
memory: 400Mi

‎examples/complete/main.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ locals {
2222
}
2323
module "eks-addons" {
2424
source = "squareops/eks-addons/aws"
25-
version = "4.3.0"
25+
version = "4.3.1"
2626
name = local.name
2727
tags = local.additional_tags
2828
vpc_id = local.vpc_id
@@ -137,7 +137,7 @@ module "eks-addons" {
137137

138138
## INGRESS-NGINX
139139
ingress_nginx_enabled = false # to enable ingress nginx
140-
ingress_nginx_version = "4.11.0"
140+
ingress_nginx_version = "4.12.1"
141141
ingress_nginx_config = {
142142
values = [file("${path.module}/config/ingress-nginx.yaml")]
143143
enable_service_monitor = false # enable monitoring in nginx ingress
@@ -166,7 +166,7 @@ module "eks-addons" {
166166

167167
## KUBERNETES-DASHBOARD
168168
kubernetes_dashboard_enabled = false
169-
kubernetes_dashboard_version = "6.0.8"
169+
kubernetes_dashboard_version = "7.11.1"
170170
kubernetes_dashboard_config = {
171171
values_yaml = file("${path.module}/config/kubernetes-dashboard.yaml")
172172
k8s_dashboard_ingress_load_balancer = "nlb" # Pass either "nlb/alb" to choose load balancer controller as ingress-nginx controller or ALB controller

‎modules/ingress-nginx/config/ingress_nginx.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,8 @@ controller:
5959
values:
6060
- "true"
6161
allowSnippetAnnotations: true
62+
config:
63+
annotations-risk-level: "Critical"
6264
## Enabling metrics for prometheus monitoring
6365

6466
metrics:

‎modules/kubernetes-dashboard/config/values.yaml‎

Lines changed: 92 additions & 154 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,14 @@
1-
## Number of replicas
2-
replicaCount: 1
3-
4-
annotations: {}
5-
## Here labels can be added to the kubernetes dashboard deployment
6-
7-
securityContext:
8-
runAsNonRoot: true
9-
seccompProfile:
10-
type: RuntimeDefault
11-
12-
## SecurityContext defaults for the kubernetes dashboard container and metrics scraper container
13-
## To disable set the following configuration to null:
14-
# containerSecurityContext: null
15-
containerSecurityContext:
16-
allowPrivilegeEscalation: false
17-
readOnlyRootFilesystem: true
18-
runAsUser: 1001
19-
runAsGroup: 2001
20-
capabilities:
21-
drop: ["ALL"]
22-
23-
## @param podLabels Extra labels for OAuth2 Proxy pods
24-
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
25-
##
26-
podLabels: {}
27-
## @param podAnnotations Annotations for OAuth2 Proxy pods
28-
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
29-
##
30-
podAnnotations:
31-
co.elastic.logs/enabled: "true"
32-
33-
## Node labels for pod assignment
34-
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
35-
##
36-
nodeSelector:
37-
kubernetes.io/os: linux
38-
39-
## List of node taints to tolerate (requires Kubernetes >= 1.6)
40-
tolerations: []
41-
42-
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
43-
affinity:
1+
# General configuration shared across resources
2+
app:
3+
# Mode determines if chart should deploy a full Dashboard with all containers or just the API.
4+
# - dashboard - deploys all the containers
5+
# - api - deploys just the API
6+
mode: 'dashboard'
7+
scheduling:
8+
nodeSelector:
9+
kubernetes.io/os: linux
10+
tolerations: []
11+
affinity:
4412
nodeAffinity:
4513
requiredDuringSchedulingIgnoredDuringExecution:
4614
nodeSelectorTerms:
@@ -50,119 +18,89 @@ affinity:
5018
values:
5119
- "true"
5220

53-
## Name of Priority Class of pods
54-
# priorityClassName: ""
55-
56-
## Pod resource requests & limits
57-
resources:
58-
requests:
59-
cpu: 100m
60-
memory: 200Mi
61-
limits:
62-
cpu: 2
63-
memory: 200Mi
64-
65-
## Serve application over HTTP without TLS
66-
##
67-
## Note: If set to true, you may want to add --enable-insecure-login to extraArgs
68-
protocolHttp: false
69-
70-
service:
71-
type: ClusterIP
72-
# Dashboard service port
73-
externalPort: 443
74-
annotations: {}
75-
76-
## Here labels can be added to the Kubernetes Dashboard service
77-
labels: {}
78-
79-
## Enable or disable the kubernetes.io/cluster-service label. Should be disabled for GKE clusters >=1.15.
80-
## Otherwise, the addon manager will presume ownership of the service and try to delete it.
81-
clusterServiceLabel:
82-
enabled: true
83-
key: "kubernetes.io/cluster-service"
84-
85-
ingress:
86-
enabled: false
87-
annotations: {}
88-
ingressClassName: ${ingress_class_name}
89-
hostname: ${hostname}
90-
91-
paths:
92-
- /
93-
# - /*
94-
95-
## Custom Kubernetes Dashboard Ingress paths. Will override default paths.
96-
##
97-
customPaths: []
98-
99-
settings:
100-
{}
21+
auth:
22+
role: auth
23+
scaling:
24+
replicas: 1
25+
revisionHistoryLimit: 10
26+
service:
27+
type: ClusterIP
28+
resources:
29+
requests:
30+
cpu: 100m
31+
memory: 200Mi
32+
limits:
33+
cpu: 250m
34+
memory: 400Mi
35+
nodeSelector:
36+
kubernetes.io/os: linux
37+
38+
# API deployment configuration
39+
api:
40+
role: api
41+
scaling:
42+
replicas: 1
43+
revisionHistoryLimit: 10
44+
service:
45+
type: ClusterIP
46+
resources:
47+
requests:
48+
cpu: 100m
49+
memory: 200Mi
50+
limits:
51+
cpu: 250m
52+
memory: 400Mi
53+
nodeSelector:
54+
kubernetes.io/os: linux
55+
56+
# WEB UI deployment configuration
57+
web:
58+
role: web
59+
scaling:
60+
replicas: 1
61+
revisionHistoryLimit: 10
62+
service:
63+
type: ClusterIP
64+
resources:
65+
requests:
66+
cpu: 100m
67+
memory: 200Mi
68+
limits:
69+
cpu: 250m
70+
memory: 400Mi
71+
nodeSelector:
72+
kubernetes.io/os: linux
10173

102-
## Pinned CRDs that will be displayed in dashboard's menu
10374
metricsScraper:
104-
## Wether to enable dashboard-metrics-scraper
105-
enabled: false
106-
image:
107-
repository: kubernetesui/metrics-scraper
108-
tag: v1.0.9
109-
resources: {}
110-
111-
metrics-server:
112-
enabled: false
113-
## Example for additional args
114-
# args:
115-
# - --kubelet-preferred-address-types=InternalIP
116-
# - --kubelet-insecure-tls
117-
118-
rbac:
119-
# Specifies whether namespaced RBAC resources (Role, Rolebinding) should be created
120-
create: true
121-
122-
# Specifies whether cluster-wide RBAC resources (ClusterRole, ClusterRolebinding) to access metrics should be created
123-
# Independent from rbac.create parameter.
124-
clusterRoleMetrics: true
125-
clusterReadOnlyRole: false
126-
127-
128-
serviceAccount:
129-
# Specifies whether a service account should be created
130-
create: true
131-
# The name of the service account to use.
132-
# If not set and create is true, a name is generated using the fullname template
133-
name:
75+
enabled: true
76+
role: metrics-scraper
77+
scaling:
78+
replicas: 1
79+
revisionHistoryLimit: 10
80+
service:
81+
type: ClusterIP
82+
resources:
83+
requests:
84+
cpu: 100m
85+
memory: 200Mi
86+
limits:
87+
cpu: 250m
88+
memory: 400Mi
89+
nodeSelector:
90+
kubernetes.io/os: linux
13491

135-
livenessProbe:
136-
# Number of seconds to wait before sending first probe
137-
initialDelaySeconds: 30
138-
# Number of seconds to wait for probe response
139-
timeoutSeconds: 30
14092

141-
## podDisruptionBudget
142-
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
143-
podDisruptionBudget:
144-
enabled: false
145-
## Minimum available instances; ignored if there is no PodDisruptionBudget
146-
minAvailable:
147-
## Maximum unavailable instances; ignored if there is no PodDisruptionBudget
148-
maxUnavailable:
149-
150-
151-
networkPolicy:
152-
# Whether to create a network policy that allows/restricts access to the service
153-
enabled: false
154-
155-
# Whether to set network policy to deny all ingress traffic for the kubernetes-dashboard
156-
ingressDenyAll: false
157-
158-
podSecurityPolicy:
159-
# Specifies whether a pod security policy should be created
93+
metrics-server:
16094
enabled: false
161-
162-
serviceMonitor:
163-
# Whether or not to create a Prometheus Operator service monitor.
164-
enabled: ${enable_service_monitor}
165-
## Here labels can be added to the serviceMonitor
166-
labels: {}
167-
## Here annotations can be added to the serviceMonitor
168-
annotations: {}
95+
args:
96+
- --kubelet-preferred-address-types=InternalIP
97+
- --kubelet-insecure-tls
98+
99+
## Required Kong sub-chart with DBless configuration to act as a gateway
100+
## for our all containers.
101+
kong:
102+
enabled: true
103+
## Configuration reference: https://docs.konghq.com/gateway/3.6.x/reference/configuration
104+
serviceMonitor:
105+
# Whether to create a Prometheus Operator service monitor.
106+
enabled: ${enable_service_monitor}

‎modules/kubernetes-dashboard/main.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,8 @@ resource "kubernetes_ingress_v1" "k8s-ingress" {
5151
"nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
5252
"nginx.ingress.kubernetes.io/rewrite-target" = "/$2"
5353
"nginx.ingress.kubernetes.io/configuration-snippet" = <<-EOF
54-
if ($uri = "/dashboard") {
55-
rewrite ^(/dashboard)$ $1/ redirect;
54+
if ($request_uri = /) {
55+
return 301 /dashboard/;
5656
}
5757
EOF
5858
}
@@ -68,7 +68,7 @@ resource "kubernetes_ingress_v1" "k8s-ingress" {
6868

6969
backend {
7070
service {
71-
name = "kubernetes-dashboard"
71+
name = "kubernetes-dashboard-kong-proxy"
7272
port {
7373
number = 443
7474
}

0 commit comments

Comments
 (0)