Merge pull request #1378 from marcosbc/nginx-ingress-controller-0.25

[bitnami/nginx-ingress-controller] Update to 0.25 and sync chart with upstream

bitnami/nginx-ingress-controller/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: nginx-ingress-controller
-version: 4.0.2
+version: 5.0.0
 appVersion: 0.25.1
 description: Chart for the nginx Ingress controller
 keywords:

bitnami/nginx-ingress-controller/README.md

@@ -59,8 +59,12 @@ Parameter | Description | Default
 `image.pullPolicy` | Controller container image pull policy | `IfNotPresent`
 `nameOverride` | String to partially override nginx-ingress-controller.fullname template with a string (will prepend the release name) | `nil`
 `fullnameOverride` | String to fully override nginx-ingress-controller.fullname template with a string | `nil`
-`config` | Nginx ConfigMap entries | `use-geoip: "false", use-geoip2: "true"`
+`containerPort.http` | The port that the controller container listens on for HTTP connections. | `80`
+`containerPort.https` | The port that the controller container listens on for HTTPS connections. | `443`
+`config` | Nginx ConfigMap entries | `{}`
 `hostNetwork` | If the nginx deployment / daemonset should run on the host's network namespace. Do not set this when `service.externalIPs` is set and `kube-proxy` is used as there will be a port-conflict for port `80` | false
+`dnsPolicy` | If using `hostNetwork=true`, change to `ClusterFirstWithHostNet`. See [pod's dns policy](https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy) for details | false
+`reportNodeInternalIp` | If using `hostNetwork=true`, setting `reportNodeInternalIp=true`, will pass the flag `report-node-internal-ip-address` to nginx-ingress. This sets the status of all Ingress objects to the internal IP address of all nodes running the NGINX Ingress controller. | `ClusterFirst`
 `defaultBackendService` | Default 404 backend service; required only if `defaultBackend.enabled = false` | `""`
 `electionID` | Election ID to use for the status update | `ingress-controller-leader`
 `extraEnvs` | Any additional environment variables to set in the pods | `{}`
@@ -78,10 +82,12 @@ Parameter | Description | Default
 `daemonset.hostPorts.https` | If `daemonset.useHostPort` is `true` and this is non-empty, it sets the hostPort | `"443"`
 `tolerations` | Node taints to tolerate (requires Kubernetes >=1.6) | `[]`
 `affinity` | Node/pod affinities (requires Kubernetes >=1.6) | `{}`
+`terminationGracePeriodSeconds` | How many seconds to wait before terminating a pod | `60`
 `minReadySeconds` | How many seconds a pod needs to be ready before killing the next, during update | `0`
 `nodeSelector` | Node labels for pod assignment | `{}`
 `podAnnotations` | Annotations to be added to pods | `{}`
 `podLabels` | Labels to add to the pod container metadata | `{}`
+`podSecurityContext` | Security context policies to add to the controller pod | `{}`
 `replicaCount` | Desired number of controller pods | `1`
 `minAvailable` | Minimum number of available controller pods for PodDisruptionBudget | `1`
 `resources` | Controller pod resource requests & limits | `{}`
@@ -92,6 +98,7 @@ Parameter | Description | Default
 `publishService.enabled` | If true, the controller will set the endpoint records on the ingress objects to reflect those on the service | `false`
 `publishService.pathOverride` | Override of the default publish-service name | `""`
 `service.clusterIP` | Internal controller cluster service IP | `""`
+`service.omitClusterIP` | To omit the `ClusterIP` from the controller service | `false`
 `service.externalIPs` | Controller service external IP addresses. Do not set this when `hostNetwork` is set to `true` and `kube-proxy` is used as there will be a port-conflict for port `80` | `[]`
 `service.externalTrafficPolicy` | If `service.type` is `NodePort` or `LoadBalancer`, set this to `Local` to enable [source IP preservation](https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typenodeport) | `"Cluster"`
 `service.healthCheckNodePort` | If `service.type` is `NodePort` or `LoadBalancer` and `service.externalTrafficPolicy` is set to `Local`, set this to [the managed health-check port the kube-proxy will expose](https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typenodeport). If blank, a random port in the `NodePort` range will be assigned | `""`
@@ -101,10 +108,14 @@ Parameter | Description | Default
 `service.enableHttps` | If port 443 should be opened for service | `true`
 `service.targetPorts.http` | Sets the targetPort that maps to the Ingress' port 80 | `80`
 `service.targetPorts.https` | Sets the targetPort that maps to the Ingress' port 443 | `443`
+`service.ports.http` | Sets service http port | `80`
+`service.ports.https` | Sets service https port | `443`
 `service.type` | Type of controller service to create | `LoadBalancer`
 `service.nodePorts.http` | If `service.type` is `NodePort` and this is non-empty, it sets the nodePort that maps to the Ingress' port 80 | `""`
 `service.nodePorts.https` | If `service.type` is `NodePort` and this is non-empty, it sets the nodePort that maps to the Ingress' port 443 | `""`
-`livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 10
+`service.nodePorts.tcp` | Sets the nodePort for an entry referenced by its key from `tcp` | `{}`
+`service.nodePorts.udp` | Sets the nodePort for an entry referenced by its key from `udp` | `{}`
+`livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated | 10`
 `livenessProbe.periodSeconds` | How often to perform the probe | 10
 `livenessProbe.timeoutSeconds` | When the probe times out | 5
 `livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1
@@ -116,25 +127,31 @@ Parameter | Description | Default
 `readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed. | 1
 `readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | 3
 `readinessProbe.port` | The port number that the readiness probe will listen on. | 10254
-`stats.enabled` | If `true`, enable "vts-status" page | `false`
-`stats.service.annotations` | Annotations for controller stats service | `{}`
-`stats.service.clusterIP` | Internal controller stats cluster service IP | `""`
-`stats.service.externalIPs` | Controller service stats external IP addresses | `[]`
-`stats.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""`
-`stats.service.loadBalancerSourceRanges` | List of IP CIDRs allowed access to load balancer (if supported) | `[]`
-`stats.service.type` | Type of controller stats service to create | `ClusterIP`
 `metrics.enabled` | If `true`, enable Prometheus metrics (`stats.enabled` must be `true` as well) | `false`
 `metrics.service.annotations` | Annotations for Prometheus metrics service | `{}`
 `metrics.service.clusterIP` | Cluster IP address to assign to service | `""`
+`metrics.service.omitClusterIP` | To omit the `ClusterIP` from the metrics service | `false`
 `metrics.service.externalIPs` | Prometheus metrics service external IP addresses | `[]`
 `metrics.service.loadBalancerIP` | IP address to assign to load balancer (if supported) | `""`
 `metrics.service.loadBalancerSourceRanges` | List of IP CIDRs allowed access to load balancer (if supported) | `[]`
 `metrics.service.port` | Prometheus metrics service port | `9913`
 `metrics.service.type` | Type of Prometheus metrics service to create | `ClusterIP`
+`metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false`
+`metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}`
+`metrics.serviceMonitor.namespace` | namespace where servicemonitor resource should be created | `the same namespace as nginx ingress`
+`metrics.serviceMonitor.honorLabels` | honorLabels chooses the metric's labels on collisions with target labels. | `false`
+`metrics.prometheusRule.enabled` | Set this to `true` to create prometheusRules for Prometheus operator | `false`
+`metrics.prometheusRule.additionalLabels` | Additional labels that can be used so prometheusRules will be discovered by Prometheus | `{}`
+`metrics.prometheusRule.namespace` | Namespace where prometheusRules resource should be created | `the same namespace as nginx ingress`
+`metrics.prometheusRule.rules` | Rules to be prometheus in YAML format, check values for an example. | `[]`
 `customTemplate.configMapName` | ConfigMap containing a custom nginx template | `""`
 `customTemplate.configMapKey` | ConfigMap key containing the nginx template | `""`
-`headers` | ConfigMap key:value pairs containing the [custom headers](https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers) for Nginx | `{}`
+`addHeaders` | ConfigMap key:value pairs containing [custom headers](https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers) added before sending response to the client | `{}`
+`proxySetHeaders` | ConfigMap key:value pairs containing [custom headers](https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers) added before sending request to the backends for Nginx | `{}`
 `updateStrategy` | Allows setting of RollingUpdate strategy | `{}`
+`configMapNamespace` | The nginx-configmap namespace name | `""`
+`tcp.configMapNamespace` | The tcp-services-configmap namespace name | `""`
+`udp.configMapNamespace` | The udp-services-configmap namespace name | `""`
 `defaultBackend.enabled` | If false, defaultBackendService must be provided | `true`
 `defaultBackend.name` | Name of the default backend component | `default-backend`
 `defaultBackend.image.repository` | Default backend container image repository | `k8s.gcr.io/defaultbackend`

bitnami/nginx-ingress-controller/templates/NOTES.txt

@@ -65,8 +65,14 @@ If TLS is enabled for the Ingress, a Secret containing the certificate and key m
     tls.key: <base64 encoded key>
   type: kubernetes.io/tls
 
-{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
+{{- if .Values.headers }}
+#################################################################################
+######   WARNING: `controller.headers` has been deprecated!                 #####
+######            It has been renamed to `controller.proxySetHeaders`.      #####
+#################################################################################
+{{- end }}
 
+{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }}
 WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment.
 +info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/
 

bitnami/nginx-ingress-controller/templates/addheaders-configmap.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.headers }}
+{{- if .Values.addHeaders }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -8,7 +8,7 @@ metadata:
     component: "{{ .Values.name }}"
     heritage: {{ .Release.Service }}
     release: {{ .Release.Name }}
-  name: {{ template "nginx-ingress.fullname" . }}-custom-headers
+  name: {{ template "nginx-ingress.fullname" . }}-custom-add-headers
 data:
-{{ toYaml .Values.headers | indent 2 }}
+{{ toYaml .Values.addHeaders | indent 2 }}
 {{- end }}

bitnami/nginx-ingress-controller/templates/clusterrole.yaml

@@ -47,6 +47,7 @@ rules:
       - watch
   - apiGroups:
       - extensions
+      - "networking.k8s.io" # k8s 1.14+
     resources:
       - ingresses
     verbs:
@@ -62,6 +63,7 @@ rules:
       - patch
   - apiGroups:
       - extensions
+      - "networking.k8s.io" # k8s 1.14+
     resources:
       - ingresses/status
     verbs:

bitnami/nginx-ingress-controller/templates/controller-configmap.yaml

@@ -1,3 +1,4 @@
+{{- if or .Values.config (or (or .Values.proxySetHeaders .Values.headers) .Values.addHeaders) }}
 apiVersion: v1
 kind: ConfigMap
 metadata:
@@ -9,10 +10,13 @@ metadata:
     release: {{ .Release.Name }}
   name: {{ template "nginx-ingress.fullname" . }}
 data:
-  enable-vts-status: "{{ .Values.stats.enabled }}"
-{{- if .Values.headers }}
-  proxy-set-headers: {{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-custom-headers
+{{- if .Values.addHeaders }}
+  add-headers: {{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-custom-add-headers
+{{- end }}
+{{- if or .Values.proxySetHeaders .Values.headers }}
+  proxy-set-headers: {{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-custom-proxy-headers
 {{- end }}
 {{- if .Values.config }}
 {{ toYaml .Values.config | indent 2 }}
 {{- end }}
+{{- end }}

bitnami/nginx-ingress-controller/templates/controller-daemonset.yaml

@@ -1,4 +1,5 @@
 {{- if eq .Values.kind "DaemonSet" }}
+{{- $useHostPort := .Values.daemonset.useHostPort -}}
 apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
@@ -21,11 +22,10 @@ spec:
   minReadySeconds: {{ .Values.minReadySeconds }}
   template:
     metadata:
+      {{- if .Values.podAnnotations }}
       annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/controller-configmap.yaml") . | sha256sum }}
-    {{- if .Values.podAnnotations }}
 {{ toYaml .Values.podAnnotations | indent 8}}
-    {{- end }}
+      {{- end }}
       labels:
         app: {{ template "nginx-ingress.name" . }}
         chart: {{ template "nginx-ingress-controller.chart" . }}
@@ -40,9 +40,10 @@ spec:
 {{- if .Values.priorityClassName }}
       priorityClassName: "{{ .Values.priorityClassName }}"
 {{- end }}
+      {{- if .Values.podSecurityContext }}
       securityContext:
-        fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
+{{ toYaml .Values.podSecurityContext | indent 8 }}
+      {{- end }}
       containers:
         - name: {{ template "nginx-ingress.name" . }}-{{ .Values.name }}
           image: "{{ template "nginx-ingress-controller.image" . }}"
@@ -69,6 +70,9 @@ spec:
           {{- if .Values.scope.enabled }}
             - --watch-namespace={{ default .Release.Namespace .Values.scope.namespace }}
           {{- end }}
+          {{- if and (.Values.reportNodeInternalIp) (.Values.hostNetwork)}}
+            - --report-node-internal-ip-address={{ .Values.reportNodeInternalIp }}
+          {{- end }}
           {{- range $key, $value := .Values.extraArgs }}
             {{- if $value }}
             - --{{ $key }}={{ $value }}
@@ -80,6 +84,8 @@ spec:
             capabilities:
               drop: ["ALL"]
               add: ["NET_BIND_SERVICE"]
+            runAsUser: {{ .Values.securityContext.runAsUser }}
+            allowPrivilegeEscalation: {{ .Values.image.allowPrivilegeEscalation }}
           env:
             - name: POD_NAME
               valueFrom:
@@ -104,36 +110,37 @@ spec:
             failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
           ports:
             - name: http
-              containerPort: 80
+              containerPort: {{ .Values.containerPort.http }}
               protocol: TCP
               {{- if .Values.daemonset.useHostPort }}
               hostPort: {{ .Values.daemonset.hostPorts.http }}
               {{- end }}
             - name: https
-              containerPort: 443
+              containerPort: {{ .Values.containerPort.https }}
               protocol: TCP
               {{- if .Values.daemonset.useHostPort }}
               hostPort: {{ .Values.daemonset.hostPorts.https }}
               {{- end }}
-          {{- if .Values.stats.enabled }}
-            - name: stats
-              containerPort: 18080
-              protocol: TCP
-            {{- if .Values.metrics.enabled }}
+          {{- if .Values.metrics.enabled }}
             - name: metrics
               containerPort: 10254
               protocol: TCP
-            {{- end }}
           {{- end }}
           {{- range $key, $value := .Values.tcp }}
             - name: "{{ $key }}-tcp"
               containerPort: {{ $key }}
               protocol: TCP
+              {{- if $useHostPort }}
+              hostPort: {{ $key }}
+              {{- end }}
           {{- end }}
           {{- range $key, $value := .Values.udp }}
             - name: "{{ $key }}-udp"
               containerPort: {{ $key }}
               protocol: UDP
+              {{- if $useHostPort }}
+              hostPort: {{ $key }}
+              {{- end }}
           {{- end }}
           readinessProbe:
             httpGet:
@@ -154,7 +161,7 @@ spec:
               readOnly: true
 {{- end }}
 {{- if .Values.extraVolumeMounts }}
-{{ toYaml .Values.extraVolumeMounts | indent 10}}
+{{ toYaml .Values.extraVolumeMounts | indent 12}}
 {{- end }}
           resources:
 {{ toYaml .Values.resources | indent 12 }}
@@ -192,6 +199,6 @@ spec:
               path: nginx.tmpl
 {{- end }}
 {{- if .Values.extraVolumes }}
-{{ toYaml .Values.extraVolumes | indent 6}}
+{{ toYaml .Values.extraVolumes | indent 8}}
 {{- end }}
 {{- end }}

bitnami/nginx-ingress-controller/templates/controller-deployment.yaml

@@ -40,9 +40,10 @@ spec:
 {{- if .Values.priorityClassName }}
       priorityClassName: "{{ .Values.priorityClassName }}"
 {{- end }}
+      {{- if .Values.podSecurityContext }}
       securityContext:
-        fsGroup: {{ .Values.securityContext.fsGroup }}
-        runAsUser: {{ .Values.securityContext.runAsUser }}
+{{ toYaml .Values.podSecurityContext | indent 8 }}
+      {{- end }}
       containers:
         - name: {{ template "nginx-ingress.name" . }}-{{ .Values.name }}
           image: "{{ template "nginx-ingress-controller.image" . }}"
@@ -59,16 +60,19 @@ spec:
           {{- end }}
             - --election-id={{ .Values.electionID }}
             - --ingress-class={{ .Values.ingressClass }}
-            - --configmap={{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}
+            - --configmap={{ default .Release.Namespace .Values.configMapNamespace }}/{{ template "nginx-ingress.fullname" . }}
           {{- if .Values.tcp }}
-            - --tcp-services-configmap={{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-tcp
+            - --tcp-services-configmap={{ default .Release.Namespace .Values.tcp.configMapNamespace }}/{{ template "nginx-ingress.fullname" . }}-tcp
           {{- end }}
           {{- if .Values.udp }}
-            - --udp-services-configmap={{ .Release.Namespace }}/{{ template "nginx-ingress.fullname" . }}-udp
+            - --udp-services-configmap={{ default .Release.Namespace .Values.udp.configMapNamespace }}/{{ template "nginx-ingress.fullname" . }}-udp
           {{- end }}
           {{- if .Values.scope.enabled }}
             - --watch-namespace={{ default .Release.Namespace .Values.scope.namespace }}
           {{- end }}
+          {{- if and (.Values.reportNodeInternalIp) (.Values.hostNetwork) }}
+            - --report-node-internal-ip-address={{ .Values.reportNodeInternalIp }}
+          {{- end }}
           {{- range $key, $value := .Values.extraArgs }}
             {{- if $value }}
             - --{{ $key }}={{ $value }}
@@ -76,12 +80,12 @@ spec:
             - --{{ $key }}
             {{- end }}
           {{- end }}
-{{- if .Values.hostNetwork }}
           securityContext:
             capabilities:
               drop: ["ALL"]
               add: ["NET_BIND_SERVICE"]
-{{- end }}
+            runAsUser: {{ .Values.securityContext.runAsUser }}
+            allowPrivilegeEscalation: {{ .Values.image.allowPrivilegeEscalation }}
           env:
             - name: POD_NAME
               valueFrom:
@@ -106,20 +110,15 @@ spec:
             failureThreshold: {{ .Values.livenessProbe.failureThreshold }}
           ports:
             - name: http
-              containerPort: 80
+              containerPort: {{ .Values.containerPort.http }}
               protocol: TCP
             - name: https
-              containerPort: 443
+              containerPort: {{ .Values.containerPort.https }}
               protocol: TCP
-          {{- if .Values.stats.enabled }}
-            - name: stats
-              containerPort: 18080
-              protocol: TCP
-            {{- if .Values.metrics.enabled }}
+          {{- if .Values.metrics.enabled }}
             - name: metrics
               containerPort: 10254
               protocol: TCP
-            {{- end }}
           {{- end }}
           {{- range $key, $value := .Values.tcp }}
             - name: "{{ $key }}-tcp"
@@ -175,7 +174,7 @@ spec:
 {{ toYaml .Values.affinity | indent 8 }}
     {{- end }}
       serviceAccountName: {{ template "nginx-ingress.serviceAccountName" . }}
-      terminationGracePeriodSeconds: 60
+      terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }}
 {{- if (or .Values.customTemplate.configMapName .Values.extraVolumes) }}
       volumes:
 {{- end }}

bitnami/nginx-ingress-controller/templates/controller-hpa.yaml

@@ -18,13 +18,17 @@ spec:
   minReplicas: {{ .Values.autoscaling.minReplicas }}
   maxReplicas: {{ .Values.autoscaling.maxReplicas }}
   metrics:
+{{- with .Values.autoscaling.targetCPUUtilizationPercentage }}
     - type: Resource
       resource:
         name: cpu
-        targetAverageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+        targetAverageUtilization: {{ . }}
+{{- end }}
+{{- with .Values.autoscaling.targetMemoryUtilizationPercentage }}
     - type: Resource
       resource:
         name: memory
-        targetAverageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
+        targetAverageUtilization: {{ . }}
+{{- end }}
 {{- end }}
 {{- end }}

bitnami/nginx-ingress-controller/templates/controller-metrics-service.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.stats.enabled .Values.metrics.enabled }}
+{{- if .Values.metrics.enabled }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -7,6 +7,9 @@ metadata:
 {{ toYaml .Values.metrics.service.annotations | indent 4 }}
 {{- end }}
   labels:
+{{- if .Values.metrics.service.labels }}
+{{ toYaml .Values.metrics.service.labels | indent 4 }}
+{{- end }}
     app: {{ template "nginx-ingress.name" . }}
     chart: {{ .Chart.Name }}-{{ .Chart.Version }}
     component: "{{ .Values.name }}"
@@ -14,7 +17,9 @@ metadata:
     release: {{ .Release.Name }}
   name: {{ template "nginx-ingress.fullname" . }}-metrics
 spec:
+{{- if not .Values.metrics.service.omitClusterIP }}
   clusterIP: "{{ .Values.metrics.service.clusterIP }}"
+{{- end }}
 {{- if .Values.metrics.service.externalIPs }}
   externalIPs:
 {{ toYaml .Values.metrics.service.externalIPs | indent 4 }}

bitnami/nginx-ingress-controller/templates/controller-poddisruptionbudget.yaml

@@ -1,3 +1,4 @@
+{{- if gt .Values.replicaCount 1.0 }}
 apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
@@ -15,3 +16,4 @@ spec:
       release: {{ .Release.Name }}
       component: "{{ .Values.name }}"
   minAvailable: {{ .Values.minAvailable }}
+{{- end }}

bitnami/nginx-ingress-controller/templates/controller-prometheusrules.yaml

@@ -0,0 +1,24 @@
+{{- if and .Values.metrics.enabled .Values.metrics.prometheusRule.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: {{ template "nginx-ingress.fullname" . }}
+  {{- if .Values.metrics.prometheusRule.namespace }}
+  namespace: {{ .Values.metrics.prometheusRule.namespace }}
+  {{- end }}
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    component: "{{ .Values.name }}"
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    {{- if .Values.metrics.prometheusRule.additionalLabels }}
+{{ toYaml .Values.metrics.prometheusRule.additionalLabels | indent 4 }}
+    {{- end }}
+spec:
+  {{- with .Values.metrics.prometheusRule.rules }}
+  groups:
+  - name: {{ template "nginx-ingress.name" $ }}
+    rules: {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

bitnami/nginx-ingress-controller/templates/controller-service.yaml

@@ -16,7 +16,9 @@ metadata:
     release: {{ .Release.Name }}
   name: {{ template "nginx-ingress.fullname" . }}
 spec:
+{{- if not .Values.service.omitClusterIP }}
   clusterIP: "{{ .Values.service.clusterIP }}"
+{{- end }}
 {{- if .Values.service.externalIPs }}
   externalIPs:
 {{ toYaml .Values.service.externalIPs | indent 4 }}
@@ -35,21 +37,22 @@ spec:
   healthCheckNodePort: {{ .Values.service.healthCheckNodePort }}
 {{- end }}
   ports:
+    {{- $setNodePorts := (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) }}
     {{- if .Values.service.enableHttp }}
     - name: http
-      port: 80
+      port: {{ .Values.service.ports.http }}
       protocol: TCP
       targetPort: {{ .Values.service.targetPorts.http }}
-      {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePorts.http))) }}
+      {{- if (and $setNodePorts (not (empty .Values.service.nodePorts.http))) }}
       nodePort: {{ .Values.service.nodePorts.http }}
       {{- end }}
     {{- end }}
     {{- if .Values.service.enableHttps }}
     - name: https
-      port: 443
+      port: {{ .Values.service.ports.https }}
       protocol: TCP
       targetPort: {{ .Values.service.targetPorts.https }}
-      {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.service.nodePorts.https))) }}
+      {{- if (and $setNodePorts (not (empty .Values.service.nodePorts.https))) }}
       nodePort: {{ .Values.service.nodePorts.https }}
       {{- end }}
     {{- end }}
@@ -58,12 +61,22 @@ spec:
       port: {{ $key }}
       protocol: TCP
       targetPort: "{{ $key }}-tcp"
+      {{- if $.Values.service.nodePorts.tcp }}
+      {{- if index $.Values.service.nodePorts.tcp $key }}
+      nodePort: {{ index $.Values.service.nodePorts.tcp $key }}
+      {{- end }}
+      {{- end }}
   {{- end }}
   {{- range $key, $value := .Values.udp }}
     - name: "{{ $key }}-udp"
       port: {{ $key }}
       protocol: UDP
       targetPort: "{{ $key }}-udp"
+      {{- if $.Values.service.nodePorts.udp }}
+      {{- if index $.Values.service.nodePorts.udp $key }}
+      nodePort: {{ index $.Values.service.nodePorts.udp $key }}
+      {{- end }}
+      {{- end }}
   {{- end }}
   selector:
     app: {{ template "nginx-ingress.name" . }}

bitnami/nginx-ingress-controller/templates/controller-servicemonitor.yaml

@@ -0,0 +1,33 @@
+{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ template "nginx-ingress.fullname" . }}
+  {{- if .Values.metrics.serviceMonitor.namespace }}
+  namespace: {{ .Values.metrics.serviceMonitor.namespace }}
+  {{- end }}
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    component: "{{ .Values.name }}"
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+    {{- if .Values.metrics.serviceMonitor.additionalLabels }}
+{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }}
+    {{- end }}
+spec:
+  endpoints:
+    - port: metrics
+      interval: 30s
+      {{- if .Values.metrics.serviceMonitor.honorLabels }}
+      honorLabels: true
+      {{- end }}
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  selector:
+    matchLabels:
+      app: {{ template "nginx-ingress.name" . }}
+      component: "{{ .Values.name }}"
+      release: {{ .Release.Name }}
+{{- end }}

bitnami/nginx-ingress-controller/templates/controller-stats-service.yaml

@@ -1,38 +0,0 @@
-{{- if .Values.stats.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-{{- if .Values.stats.service.annotations }}
-  annotations:
-{{ toYaml .Values.stats.service.annotations | indent 4 }}
-{{- end }}
-  labels:
-    app: {{ template "nginx-ingress.name" . }}
-    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
-    component: "{{ .Values.name }}"
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
-  name: {{ template "nginx-ingress.fullname" . }}-stats
-spec:
-  clusterIP: "{{ .Values.stats.service.clusterIP }}"
-{{- if .Values.stats.service.externalIPs }}
-  externalIPs:
-{{ toYaml .Values.stats.service.externalIPs | indent 4 }}
-{{- end }}
-{{- if .Values.stats.service.loadBalancerIP }}
-  loadBalancerIP: "{{ .Values.stats.service.loadBalancerIP }}"
-{{- end }}
-{{- if .Values.stats.service.loadBalancerSourceRanges }}
-  loadBalancerSourceRanges:
-{{ toYaml .Values.stats.service.loadBalancerSourceRanges | indent 4 }}
-{{- end }}
-  ports:
-    - name: stats
-      port: {{ .Values.stats.service.port }}
-      targetPort: stats
-  selector:
-    app: {{ template "nginx-ingress.name" . }}
-    component: "{{ .Values.name }}"
-    release: {{ .Release.Name }}
-  type: "{{ .Values.stats.service.type }}"
-{{- end }}

bitnami/nginx-ingress-controller/templates/default-backend-deployment.yaml

@@ -34,6 +34,10 @@ spec:
 {{- if .Values.defaultBackend.priorityClassName }}
       priorityClassName: "{{ .Values.defaultBackend.priorityClassName }}"
 {{- end }}
+      {{- if .Values.defaultBackend.podSecurityContext }}
+      securityContext:
+{{ toYaml .Values.defaultBackend.podSecurityContext | indent 8 }}
+      {{- end }}
       containers:
         - name: {{ template "nginx-ingress.name" . }}-{{ .Values.defaultBackend.name }}
           image: "{{ template "nginx-ingress-controller.defaultBackend.image" . }}"
@@ -46,13 +50,28 @@ spec:
             - --{{ $key }}
             {{- end }}
           {{- end }}
+          securityContext:
+            runAsUser: {{ .Values.securityContext.runAsUser }}
           livenessProbe:
             httpGet:
               path: /
               port: {{ .Values.defaultBackend.port }}
               scheme: HTTP
-            initialDelaySeconds: 30
-            timeoutSeconds: 5
+            initialDelaySeconds: {{ .Values.defaultBackend.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.defaultBackend.livenessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.defaultBackend.livenessProbe.timeoutSeconds }}
+            successThreshold: {{ .Values.defaultBackend.livenessProbe.successThreshold }}
+            failureThreshold: {{ .Values.defaultBackend.livenessProbe.failureThreshold }}
+          readinessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.defaultBackend.port }}
+              scheme: HTTP
+            initialDelaySeconds: {{ .Values.defaultBackend.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.defaultBackend.readinessProbe.periodSeconds }}
+            timeoutSeconds: {{ .Values.defaultBackend.readinessProbe.timeoutSeconds }}
+            successThreshold: {{ .Values.defaultBackend.readinessProbe.successThreshold }}
+            failureThreshold: {{ .Values.defaultBackend.readinessProbe.failureThreshold }}
           ports:
             - name: http
               containerPort: {{ .Values.defaultBackend.port }}

bitnami/nginx-ingress-controller/templates/default-backend-poddisruptionbudget.yaml

@@ -1,3 +1,4 @@
+{{- if gt .Values.defaultBackend.replicaCount 1.0 }}
 apiVersion: policy/v1beta1
 kind: PodDisruptionBudget
 metadata:
@@ -15,3 +16,4 @@ spec:
       release: {{ .Release.Name }}
       component: "{{ .Values.defaultBackend.name }}"
   minAvailable: {{ .Values.defaultBackend.minAvailable }}
+{{- end }}

bitnami/nginx-ingress-controller/templates/default-backend-service.yaml

@@ -14,7 +14,9 @@ metadata:
     release: {{ .Release.Name }}
   name: {{ template "nginx-ingress.defaultBackend.fullname" . }}
 spec:
+{{- if not .Values.defaultBackend.service.omitClusterIP }}
   clusterIP: "{{ .Values.defaultBackend.service.clusterIP }}"
+{{- end }}
 {{- if .Values.defaultBackend.service.externalIPs }}
   externalIPs:
 {{ toYaml .Values.defaultBackend.service.externalIPs | indent 4 }}

bitnami/nginx-ingress-controller/templates/podsecuritypolicy.yaml

@@ -20,7 +20,7 @@ spec:
     #- 'projected'
     - 'secret'
     #- 'downwardAPI'
-  hostNetwork: false
+  hostNetwork: {{ .Values.hostNetwork }}
   hostIPC: false
   hostPID: false
   runAsUser:

bitnami/nginx-ingress-controller/templates/proxyheaders-configmap.yaml

@@ -0,0 +1,18 @@
+{{- if or .Values.proxySetHeaders .Values.headers }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app: {{ template "nginx-ingress.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version }}
+    component: "{{ .Values.name }}"
+    heritage: {{ .Release.Service }}
+    release: {{ .Release.Name }}
+  name: {{ template "nginx-ingress.fullname" . }}-custom-proxy-headers
+data:
+{{- if .Values.proxySetHeaders }}
+{{ toYaml .Values.proxySetHeaders | indent 2 }}
+{{ else if and .Values.headers (not .Values.proxySetHeaders) }}
+{{ toYaml .Values.headers | indent 2 }}
+{{- end }}
+{{- end }}

bitnami/nginx-ingress-controller/templates/role.yaml

@@ -37,6 +37,7 @@ rules:
       - watch
   - apiGroups:
       - extensions
+      - "networking.k8s.io" # k8s 1.14+
     resources:
       - ingresses
     verbs:
@@ -45,6 +46,7 @@ rules:
       - watch
   - apiGroups:
       - extensions
+      - "networking.k8s.io" # k8s 1.14+
     resources:
       - ingresses/status
     verbs:

bitnami/nginx-ingress-controller/templates/tcp-configmap.yaml

@@ -10,5 +10,5 @@ metadata:
     release: {{ .Release.Name }}
   name: {{ template "nginx-ingress.fullname" . }}-tcp
 data:
-{{ toYaml .Values.tcp | indent 2 }}
+{{ tpl (toYaml .Values.tcp) . | indent 2 }}
 {{- end }}

bitnami/nginx-ingress-controller/templates/udp-configmap.yaml

@@ -10,5 +10,5 @@ metadata:
     release: {{ .Release.Name }}
   name: {{ template "nginx-ingress.fullname" . }}-udp
 data:
-{{ toYaml .Values.udp | indent 2 }}
+{{ tpl (toYaml .Values.udp) . | indent 2 }}
 {{- end }}

bitnami/nginx-ingress-controller/values-production.yaml

@@ -13,7 +13,7 @@ name: controller
 image:
   registry: docker.io
   repository: bitnami/nginx-ingress-controller
-  tag: 0.25.1-debian-9-r0
+  tag: 0.25.1-debian-9-r5
   ## Specify a imagePullPolicy
   ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
   ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
@@ -34,12 +34,18 @@ image:
 ##
 # fullnameOverride:
 
-config:
-  use-geoip: "false"
-  use-geoip2: "true"
+# Configures the ports the nginx-controller listens on
+containerPort:
+  http: 80
+  https: 443
+# Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
+config: {}
 
-# Will add custom header to Nginx https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers
-headers: {}
+# Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers
+proxySetHeaders: {}
+
+# Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
+addHeaders: {}
 
 # Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
 # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
@@ -51,6 +57,10 @@ hostNetwork: false
 # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
 dnsPolicy: ClusterFirst
 
+# Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
+# Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
+reportNodeInternalIp: false
+
 ## Use host ports 80 and 443
 daemonset:
   useHostPort: false
@@ -76,6 +86,12 @@ ingressClass: nginx
 podLabels: {}
 #  key: value
 
+## Security Context policies for controller pods
+## See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
+## notes on enabling and using sysctls
+##
+podSecurityContext: {}
+
 ## Allows customization of the external service
 ## the ingress will be bound to via DNS
 publishService:
@@ -91,6 +107,20 @@ scope:
   enabled: false
   namespace: ""   # defaults to .Release.Namespace
 
+## Allows customization of the configmap / nginx-configmap namespace
+##
+configMapNamespace: ""   # defaults to .Release.Namespace
+
+## Allows customization of the tcp-services-configmap namespace
+##
+tcp:
+  configMapNamespace: ""   # defaults to .Release.Namespace
+
+## Allows customization of the udp-services-configmap namespace
+##
+udp:
+  configMapNamespace: ""   # defaults to .Release.Namespace
+
 ## Additional command line arguments to pass to nginx-ingress-controller
 ## E.g. to specify the default SSL certificate you can use
 ## extraArgs:
@@ -130,7 +160,37 @@ tolerations: []
 #    value: "value"
 #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
 
+## Affinity and anti-affinity
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+##
 affinity: {}
+  # # An example of preferred pod anti-affinity, weight is in the range 1-100
+  # podAntiAffinity:
+  #   preferredDuringSchedulingIgnoredDuringExecution:
+  #   - weight: 100
+  #     podAffinityTerm:
+  #       labelSelector:
+  #         matchExpressions:
+  #         - key: app
+  #           operator: In
+  #           values:
+  #           - nginx-ingress
+  #       topologyKey: kubernetes.io/hostname
+
+  # # An example of required pod anti-affinity
+  # podAntiAffinity:
+  #   requiredDuringSchedulingIgnoredDuringExecution:
+  #   - labelSelector:
+  #       matchExpressions:
+  #       - key: app
+  #         operator: In
+  #         values:
+  #         - nginx-ingress
+  #     topologyKey: "kubernetes.io/hostname"
+
+## terminationGracePeriodSeconds
+##
+terminationGracePeriodSeconds: 60
 
 ## Node labels for controller pod assignment
 ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
@@ -186,6 +246,7 @@ customTemplate:
 service:
   annotations: {}
   labels: {}
+  omitClusterIP: false
   clusterIP: ""
 
   ## List of IP addresses at which the controller services are available
@@ -206,6 +267,10 @@ service:
 
   healthCheckNodePort: 0
 
+  ports:
+    http: 80
+    https: 443
+
   targetPorts:
     http: http
     https: https
@@ -216,9 +281,13 @@ service:
   # nodePorts:
   #   http: 32080
   #   https: 32443
+  #   tcp:
+  #     8080: 32808
   nodePorts:
     http: ""
     https: ""
+    tcp: {}
+    udp: {}
 
 extraContainers: []
 ## Additional containers to be added to the controller pod.
@@ -260,25 +329,6 @@ extraInitContainers: []
 #   image: bitnami/minideb
 #   command: ['sh', '-c', 'install_packages dnsutils && until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
 
-stats:
-  enabled: true
-
-  service:
-    annotations: {}
-    clusterIP: ""
-
-    ## List of IP addresses at which the stats service is available
-    ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
-    ##
-    externalIPs: []
-
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    port: 18080
-    type: ClusterIP
-
-## If stats.enabled = true and metrics.enabled = true, Prometheus metrics will be exported
-##
 metrics:
   enabled: true
 
@@ -287,6 +337,7 @@ metrics:
       prometheus.io/scrape: "true"
       prometheus.io/port: "10254"
 
+    omitClusterIP: false
     clusterIP: ""
 
     ## List of IP addresses at which the stats-exporter service is available
@@ -299,6 +350,36 @@ metrics:
     port: 9913
     type: ClusterIP
 
+  serviceMonitor:
+    enabled: false
+    additionalLabels: {}
+    namespace: ""
+    # honorLabels: true
+
+  prometheusRule:
+    enabled: false
+    additionalLabels: {}
+    namespace: ""
+    rules: []
+      # # These are just examples rules, please adapt them to your needs
+      # - alert: TooMany500s
+      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
+      #   for: 1m
+      #   labels:
+      #     severity: critical
+      #   annotations:
+      #     description: Too many 5XXs
+      #     summary: More than 5% of the all requests did return 5XX, this require your attention
+      # - alert: TooMany400s
+      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
+      #   for: 1m
+      #   labels:
+      #     severity: critical
+      #   annotations:
+      #     description: Too many 4XXs
+      #     summary: More than 5% of the all requests did return 4XX, this require your attention
+
+
 lifecycle: {}
 
 priorityClassName: ""
@@ -332,6 +413,22 @@ defaultBackend:
 
   port: 8080
 
+  ## Readiness and liveness probes for default backend
+  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
+  ##
+  livenessProbe:
+    failureThreshold: 3
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    successThreshold: 1
+    timeoutSeconds: 5
+  readinessProbe:
+    failureThreshold: 6
+    initialDelaySeconds: 0
+    periodSeconds: 5
+    successThreshold: 1
+    timeoutSeconds: 5
+
   ## Node tolerations for server scheduling to nodes with taints
   ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
   ##
@@ -343,6 +440,12 @@ defaultBackend:
 
   affinity: {}
 
+  ## Security Context policies for controller pods
+  ## See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
+  ## notes on enabling and using sysctls
+  ##
+  podSecurityContext: {}
+
   # labels to add to the pod container metadata
   podLabels: {}
   #  key: value
@@ -370,6 +473,7 @@ defaultBackend:
 
   service:
     annotations: {}
+    omitClusterIP: false
     clusterIP: ""
 
     ## List of IP addresses at which the default backend service is available
@@ -394,6 +498,7 @@ rbac:
 securityContext:
   fsGroup: 1001
   runAsUser: 1001
+  allowPrivilegeEscalation: true
 
 # If true, create & use Pod Security Policy resources
 # https://kubernetes.io/docs/concepts/policy/pod-security-policy/

bitnami/nginx-ingress-controller/values.yaml

@@ -13,7 +13,7 @@ name: controller
 image:
   registry: docker.io
   repository: bitnami/nginx-ingress-controller
-  tag: 0.25.1-debian-9-r0
+  tag: 0.25.1-debian-9-r5
   ## Specify a imagePullPolicy
   ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
   ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
@@ -34,11 +34,18 @@ image:
 ##
 # fullnameOverride:
 
-config:
-  use-geoip: "false"
-  use-geoip2: "true"
-# Will add custom header to Nginx https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers
-headers: {}
+# Configures the ports the nginx-controller listens on
+containerPort:
+  http: 80
+  https: 443
+# Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
+config: {}
+
+# Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/customization/custom-headers
+proxySetHeaders: {}
+
+# Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
+addHeaders: {}
 
 # Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
 # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
@@ -50,6 +57,10 @@ hostNetwork: false
 # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
 dnsPolicy: ClusterFirst
 
+# Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
+# Ingress status was blank because there is no Service exposing the NGINX Ingress controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
+reportNodeInternalIp: false
+
 ## Use host ports 80 and 443
 daemonset:
   useHostPort: false
@@ -75,6 +86,12 @@ ingressClass: nginx
 podLabels: {}
 #  key: value
 
+## Security Context policies for controller pods
+## See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
+## notes on enabling and using sysctls
+##
+podSecurityContext: {}
+
 ## Allows customization of the external service
 ## the ingress will be bound to via DNS
 publishService:
@@ -90,6 +107,20 @@ scope:
   enabled: false
   namespace: ""   # defaults to .Release.Namespace
 
+## Allows customization of the configmap / nginx-configmap namespace
+##
+configMapNamespace: ""   # defaults to .Release.Namespace
+
+## Allows customization of the tcp-services-configmap namespace
+##
+tcp:
+  configMapNamespace: ""   # defaults to .Release.Namespace
+
+## Allows customization of the udp-services-configmap namespace
+##
+udp:
+  configMapNamespace: ""   # defaults to .Release.Namespace
+
 ## Additional command line arguments to pass to nginx-ingress-controller
 ## E.g. to specify the default SSL certificate you can use
 ## extraArgs:
@@ -129,7 +160,37 @@ tolerations: []
 #    value: "value"
 #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
 
+## Affinity and anti-affinity
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+##
 affinity: {}
+  # # An example of preferred pod anti-affinity, weight is in the range 1-100
+  # podAntiAffinity:
+  #   preferredDuringSchedulingIgnoredDuringExecution:
+  #   - weight: 100
+  #     podAffinityTerm:
+  #       labelSelector:
+  #         matchExpressions:
+  #         - key: app
+  #           operator: In
+  #           values:
+  #           - nginx-ingress
+  #       topologyKey: kubernetes.io/hostname
+
+  # # An example of required pod anti-affinity
+  # podAntiAffinity:
+  #   requiredDuringSchedulingIgnoredDuringExecution:
+  #   - labelSelector:
+  #       matchExpressions:
+  #       - key: app
+  #         operator: In
+  #         values:
+  #         - nginx-ingress
+  #     topologyKey: "kubernetes.io/hostname"
+
+## terminationGracePeriodSeconds
+##
+terminationGracePeriodSeconds: 60
 
 ## Node labels for controller pod assignment
 ## Ref: https://kubernetes.io/docs/user-guide/node-selection/
@@ -185,6 +246,7 @@ customTemplate:
 service:
   annotations: {}
   labels: {}
+  omitClusterIP: false
   clusterIP: ""
 
   ## List of IP addresses at which the controller services are available
@@ -205,6 +267,10 @@ service:
 
   healthCheckNodePort: 0
 
+  ports:
+    http: 80
+    https: 443
+
   targetPorts:
     http: http
     https: https
@@ -215,9 +281,13 @@ service:
   # nodePorts:
   #   http: 32080
   #   https: 32443
+  #   tcp:
+  #     8080: 32808
   nodePorts:
     http: ""
     https: ""
+    tcp: {}
+    udp: {}
 
 extraContainers: []
 ## Additional containers to be added to the controller pod.
@@ -259,25 +329,6 @@ extraInitContainers: []
 #   image: bitnami/minideb
 #   command: ['sh', '-c', 'install_packages dnsutils && until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
 
-stats:
-  enabled: false
-
-  service:
-    annotations: {}
-    clusterIP: ""
-
-    ## List of IP addresses at which the stats service is available
-    ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips
-    ##
-    externalIPs: []
-
-    loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    port: 18080
-    type: ClusterIP
-
-## If stats.enabled = true and metrics.enabled = true, Prometheus metrics will be exported
-##
 metrics:
   enabled: false
 
@@ -286,6 +337,7 @@ metrics:
       prometheus.io/scrape: "true"
       prometheus.io/port: "10254"
 
+    omitClusterIP: false
     clusterIP: ""
 
     ## List of IP addresses at which the stats-exporter service is available
@@ -298,6 +350,36 @@ metrics:
     port: 9913
     type: ClusterIP
 
+  serviceMonitor:
+    enabled: false
+    additionalLabels: {}
+    namespace: ""
+    # honorLabels: true
+
+  prometheusRule:
+    enabled: false
+    additionalLabels: {}
+    namespace: ""
+    rules: []
+      # # These are just examples rules, please adapt them to your needs
+      # - alert: TooMany500s
+      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
+      #   for: 1m
+      #   labels:
+      #     severity: critical
+      #   annotations:
+      #     description: Too many 5XXs
+      #     summary: More than 5% of the all requests did return 5XX, this require your attention
+      # - alert: TooMany400s
+      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
+      #   for: 1m
+      #   labels:
+      #     severity: critical
+      #   annotations:
+      #     description: Too many 4XXs
+      #     summary: More than 5% of the all requests did return 4XX, this require your attention
+
+
 lifecycle: {}
 
 priorityClassName: ""
@@ -331,6 +413,22 @@ defaultBackend:
 
   port: 8080
 
+  ## Readiness and liveness probes for default backend
+  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
+  ##
+  livenessProbe:
+    failureThreshold: 3
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    successThreshold: 1
+    timeoutSeconds: 5
+  readinessProbe:
+    failureThreshold: 6
+    initialDelaySeconds: 0
+    periodSeconds: 5
+    successThreshold: 1
+    timeoutSeconds: 5
+
   ## Node tolerations for server scheduling to nodes with taints
   ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
   ##
@@ -342,6 +440,12 @@ defaultBackend:
 
   affinity: {}
 
+  ## Security Context policies for controller pods
+  ## See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for
+  ## notes on enabling and using sysctls
+  ##
+  podSecurityContext: {}
+
   # labels to add to the pod container metadata
   podLabels: {}
   #  key: value
@@ -369,6 +473,7 @@ defaultBackend:
 
   service:
     annotations: {}
+    omitClusterIP: false
     clusterIP: ""
 
     ## List of IP addresses at which the default backend service is available
@@ -393,6 +498,7 @@ rbac:
 securityContext:
   fsGroup: 1001
   runAsUser: 1001
+  allowPrivilegeEscalation: true
 
 # If true, create & use Pod Security Policy resources
 # https://kubernetes.io/docs/concepts/policy/pod-security-policy/