[CLOUD-3975] pushing og-public-ingress helm chart to helm-chart-external repo

charts/og-public-ingress/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+appVersion: 1.3.0
+description: Prepare a OpenGov cluster for public facing web services/ingress
+name: og-public-ingress
+version: 3.2.0

charts/og-public-ingress/requirements.lock

@@ -0,0 +1,9 @@
+dependencies:
+- name: nginx-ingress
+  repository: https://charts.helm.sh/stable
+  version: 1.41.3
+- name: ingress-nginx
+  repository: https://kubernetes.github.io/ingress-nginx
+  version: 4.2.0
+digest: sha256:285d292c692364602ce200f0ffc0b7366c10694e3b83c192d7feac239e1ffc41
+generated: "2022-07-22T12:31:03.969491207+05:30"

charts/og-public-ingress/requirements.yaml

@@ -0,0 +1,10 @@
+dependencies:
+  - name: nginx-ingress
+    repository: https://charts.helm.sh/stable
+    version: 1.41.3
+    condition: nginx-ingress.enabled
+
+  - name: ingress-nginx
+    repository: https://kubernetes.github.io/ingress-nginx
+    version: 4.2.0
+    condition: ingress-nginx.enabled

charts/og-public-ingress/templates/_helpers.tpl

@@ -0,0 +1,32 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "og-public-ingress.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "og-public-ingress.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "og-public-ingress.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

charts/og-public-ingress/values.yaml

@@ -0,0 +1,174 @@
+# Default values for og-public-ingress.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# Nginx
+ingress-nginx:
+  defaultBackend:
+    replicaCount: 2
+    resources:
+      requests:
+        cpu: 100m
+        memory: 64Mi
+      limits:
+        cpu: 100m
+        memory: 64Mi
+
+  rbac:
+    create: true
+
+  controller:
+    # We currently run as the root user for Amazon Linux 2, which is the default.
+    # TODO: Find a better non-privileged user that will work
+    # runAsUser: 0
+
+    replicaCount: 2
+
+    autoscaling:
+      enabled: true
+
+      # Should match the replicaCount
+      minReplicas: 2
+      maxReplicas: 8
+
+      targetCPUUtilizationPercentage: 50
+      targetMemoryUtilizationPercentage: 75
+
+    # publishService is required to make external-dns work happily
+    publishService:
+      enabled: true
+
+    service:
+      # Support for AWS ELB TLS Termination
+      targetPorts:
+        http: http
+        https: http
+
+      annotations:
+        # Needs to be configured before launching
+        # service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: 'kubernetes-cluster=${EKS_CLUSTER_NAME_HERE}'
+        service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "1"
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
+        service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: "ELBSecurityPolicy-TLS-1-2-2017-01"
+
+        # Force TLS redirection; this is required when TLS termination occurs at the ELB
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+
+        # See https://github.com/kubernetes/kubernetes/blob/v1.10.3/pkg/cloudprovider/providers/aws/aws.go#L99
+        # for more supported annotations
+
+    config:
+      # Assumes AWS ELB (L7) in front
+      use-proxy-protocol: "false"
+
+      # This will buffer server side responses which should help free up the backends of the requests much sooner
+      proxy-buffering: "on"
+
+      # The global max body upload size
+      proxy-body-size: 128m
+
+      # Sets server_tokens: off in nginx config which stops the nginx version from being sent in the 'server' header
+      server-tokens: "false"
+
+      # This is because IE does not support a 308 code
+      http-redirect-code: "301"
+
+      # Trust any client to extract true client IP address from X-Forwarded-For header. Required when run behind ELB SSL termination
+      use-forwarded-headers: "true"
+
+    resources:
+      requests:
+        cpu: 500m
+        memory: 2Gi
+      limits:
+        cpu: 500m
+        memory: 2Gi
+
+nginx-ingress:
+  defaultBackend:
+    replicaCount: 2
+    resources:
+      requests:
+        cpu: 100m
+        memory: 64Mi
+      limits:
+        cpu: 100m
+        memory: 64Mi
+
+  rbac:
+    create: true
+
+  controller:
+    # We currently run as the root user for Amazon Linux 2, which is the default.
+    # TODO: Find a better non-privileged user that will work
+    # runAsUser: 0
+
+    replicaCount: 2
+
+    autoscaling:
+      enabled: true
+
+      # Should match the replicaCount
+      minReplicas: 2
+      maxReplicas: 8
+
+      targetCPUUtilizationPercentage: 50
+      targetMemoryUtilizationPercentage: 75
+
+    podAnnotations:
+      sumologic.com/sourceCategory: "og-public-ingress"
+      sumologic.com/sourceName: "nginx-ingress-controller"
+
+    # publishService is required to make external-dns work happily
+    publishService:
+      enabled: true
+
+    service:
+      # Support for AWS ELB TLS Termination
+      targetPorts:
+        http: http
+        https: http
+
+      annotations:
+        # Needs to be configured before launching
+        # service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: 'kubernetes-cluster=${EKS_CLUSTER_NAME_HERE}'
+        service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: "1"
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
+        service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: "3600"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
+        service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: "ELBSecurityPolicy-TLS-1-2-2017-01"
+
+        # Force TLS redirection; this is required when TLS termination occurs at the ELB
+        nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+
+        # See https://github.com/kubernetes/kubernetes/blob/v1.10.3/pkg/cloudprovider/providers/aws/aws.go#L99
+        # for more supported annotations
+
+    config:
+      # Assumes AWS ELB (L7) in front
+      use-proxy-protocol: "false"
+
+      # This will buffer server side responses which should help free up the backends of the requests much sooner
+      proxy-buffering: "on"
+
+      # The global max body upload size
+      proxy-body-size: 128m
+
+      # Sets server_tokens: off in nginx config which stops the nginx version from being sent in the 'server' header
+      server-tokens: "false"
+
+      # This is because IE does not support a 308 code
+      http-redirect-code: "301"
+
+      # Trust any client to extract true client IP address from X-Forwarded-For header. Required when run behind ELB SSL termination
+      use-forwarded-headers: "true"
+
+    resources:
+      requests:
+        cpu: 500m
+        memory: 2Gi
+      limits:
+        cpu: 500m
+        memory: 2Gi