Skip to content

Commit 31eaea7

Browse files
ab-andrescab-andresc
authored
Merge branch 'main' into patch-1
2 parents 5dd677b + fbcb48d commit 31eaea7

File tree

24 files changed

+1541
-295
lines changed

24 files changed

+1541
-295
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ jobs:
171171
- name: Build binary
172172
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
173173
with:
174-
version: v2.9.0 # renovate: datasource=github-tags depName=goreleaser/goreleaser
174+
version: v2.10.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
175175
args: ${{ github.ref_type == 'tag' && 'release' || 'build --snapshot' }} --clean
176176
env:
177177
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/conformance.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ jobs:
7979
- name: Build binary
8080
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
8181
with:
82-
version: v2.9.0 # renovate: datasource=github-tags depName=goreleaser/goreleaser
82+
version: v2.10.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
8383
args: build --single-target --snapshot --clean
8484
env:
8585
TELEMETRY_ENDPOINT: "" # disables sending telemetry

‎.github/workflows/functional.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
- name: Build binary
7474
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
7575
with:
76-
version: v2.9.0 # renovate: datasource=github-tags depName=goreleaser/goreleaser
76+
version: v2.10.2 # renovate: datasource=github-tags depName=goreleaser/goreleaser
7777
args: build --single-target --snapshot --clean
7878
env:
7979
TELEMETRY_ENDPOINT: otel-collector-opentelemetry-collector.collector.svc.cluster.local:4317

‎build/Dockerfile.nginx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,15 +6,15 @@ ADD --link --chown=101:1001 https://cs.nginx.com/static/keys/nginx_signing.rsa.p
66

77
FROM nginx:1.28.0-alpine-otel
88

9-
# renovate: datasource=github-tags depName=nginx/agent extractVersion=^v?(?<version>.*)$
10-
ARG NGINX_AGENT_VERSION=3.0.0
9+
# renovate: datasource=github-tags depName=nginx/agent
10+
ARG NGINX_AGENT_VERSION=v3.0.1
1111
ARG NJS_DIR
1212
ARG NGINX_CONF_DIR
1313
ARG BUILD_AGENT
1414

1515
RUN --mount=type=bind,from=nginx-files,src=nginx_signing.rsa.pub,target=/etc/apk/keys/nginx_signing.rsa.pub \
1616
printf "%s\n" "https://packages.nginx.org/nginx-agent/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
17-
&& apk add --no-cache nginx-agent=${NGINX_AGENT_VERSION}
17+
&& apk add --no-cache nginx-agent=${NGINX_AGENT_VERSION#v}
1818

1919
RUN apk add --no-cache libcap bash \
2020
&& mkdir -p /usr/lib/nginx/modules \

‎build/Dockerfile.nginxplus‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ ADD --link --chown=101:1001 https://cs.nginx.com/static/keys/nginx_signing.rsa.p
77
FROM alpine:3.21
88

99
ARG NGINX_PLUS_VERSION=R34
10-
# renovate: datasource=github-tags depName=nginx/agent extractVersion=^v?(?<version>.*)$
11-
ARG NGINX_AGENT_VERSION=3.0.0
10+
# renovate: datasource=github-tags depName=nginx/agent
11+
ARG NGINX_AGENT_VERSION=v3.0.1
1212
ARG NJS_DIR
1313
ARG NGINX_CONF_DIR
1414
ARG BUILD_AGENT
@@ -20,7 +20,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/apk/cert.pem,mode=0644 \
2020
&& adduser -S -D -H -u 101 -h /var/cache/nginx -s /sbin/nologin -G nginx -g nginx nginx \
2121
&& printf "%s\n" "https://pkgs.nginx.com/plus/${NGINX_PLUS_VERSION}/alpine/v$(grep -E -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
2222
&& printf "%s\n" "https://pkgs.nginx.com/nginx-agent/alpine/v$(egrep -o '^[0-9]+\.[0-9]+' /etc/alpine-release)/main" >> /etc/apk/repositories \
23-
&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-agent=${NGINX_AGENT_VERSION}
23+
&& apk add --no-cache nginx-plus nginx-plus-module-njs nginx-plus-module-otel nginx-agent=${NGINX_AGENT_VERSION#v}
2424

2525
RUN apk add --no-cache libcap bash \
2626
&& mkdir -p /usr/lib/nginx/modules \

‎charts/nginx-gateway-fabric/README.md‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -252,11 +252,16 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
252252

253253
| Key | Description | Type | Default |
254254
|-----|-------------|------|---------|
255-
| `certGenerator` | The certGenerator section contains the configuration for the cert-generator Job. | object | `{"agentTLSSecretName":"agent-tls","annotations":{},"overwrite":false,"serverTLSSecretName":"server-tls"}` |
255+
| `certGenerator` | The certGenerator section contains the configuration for the cert-generator Job. | object | `{"affinity":{},"agentTLSSecretName":"agent-tls","annotations":{},"nodeSelector":{},"overwrite":false,"serverTLSSecretName":"server-tls","tolerations":[],"topologySpreadConstraints":[],"ttlSecondsAfterFinished":30}` |
256+
| `certGenerator.affinity` | The affinity of the cert-generator pod. | object | `{}` |
256257
| `certGenerator.agentTLSSecretName` | The name of the base Secret containing TLS CA, certificate, and key for the NGINX Agent to securely communicate with the NGINX Gateway Fabric control plane. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"agent-tls"` |
257258
| `certGenerator.annotations` | The annotations of the cert-generator Job. | object | `{}` |
259+
| `certGenerator.nodeSelector` | The nodeSelector of the cert-generator pod. | object | `{}` |
258260
| `certGenerator.overwrite` | Overwrite existing TLS Secrets on startup. | bool | `false` |
259261
| `certGenerator.serverTLSSecretName` | The name of the Secret containing TLS CA, certificate, and key for the NGINX Gateway Fabric control plane to securely communicate with the NGINX Agent. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"server-tls"` |
262+
| `certGenerator.tolerations` | Tolerations for the cert-generator pod. | list | `[]` |
263+
| `certGenerator.topologySpreadConstraints` | The topology spread constraints for the cert-generator pod. | list | `[]` |
264+
| `certGenerator.ttlSecondsAfterFinished` | How long to wait after the cert generator job has finished before it is removed by the job controller. | int | `30` |
260265
| `clusterDomain` | The DNS cluster domain of your Kubernetes cluster. | string | `"cluster.local"` |
261266
| `gateways` | A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference. | list | `[]` |
262267
| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{},"debug":false,"extraContainers":[],"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"edge"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |
@@ -284,7 +289,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
284289
| `nginx.usage.resolver` | The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager. | string | `""` |
285290
| `nginx.usage.secretName` | The name of the Secret containing the JWT for NGINX Plus usage reporting. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"nplus-license"` |
286291
| `nginx.usage.skipVerify` | Disable client verification of the NGINX Plus usage reporting server certificate. | bool | `false` |
287-
| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
292+
| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{},"labels":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
288293
| `nginxGateway.affinity` | The affinity of the NGINX Gateway Fabric control plane pod. | object | `{}` |
289294
| `nginxGateway.config.logging.level` | Log level. | string | `"info"` |
290295
| `nginxGateway.configAnnotations` | Set of custom annotations for NginxGateway objects. | object | `{}` |
@@ -312,8 +317,9 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
312317
| `nginxGateway.readinessProbe.port` | Port in which the readiness endpoint is exposed. | int | `8081` |
313318
| `nginxGateway.replicas` | The number of replicas of the NGINX Gateway Fabric Deployment. | int | `1` |
314319
| `nginxGateway.resources` | The resource requests and/or limits of the nginx-gateway container. | object | `{}` |
315-
| `nginxGateway.service` | The service configuration for the NGINX Gateway Fabric control plane. | object | `{"annotations":{}}` |
320+
| `nginxGateway.service` | The service configuration for the NGINX Gateway Fabric control plane. | object | `{"annotations":{},"labels":{}}` |
316321
| `nginxGateway.service.annotations` | The annotations of the NGINX Gateway Fabric control plane service. | object | `{}` |
322+
| `nginxGateway.service.labels` | The labels of the NGINX Gateway Fabric control plane service. | object | `{}` |
317323
| `nginxGateway.serviceAccount` | The serviceaccount configuration for the NGINX Gateway Fabric control plane. | object | `{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""}` |
318324
| `nginxGateway.serviceAccount.annotations` | Set of custom annotations for the NGINX Gateway Fabric control plane service account. | object | `{}` |
319325
| `nginxGateway.serviceAccount.imagePullSecret` | The name of the secret containing docker registry credentials for the control plane. Secret must exist in the same namespace as the helm release. | string | `""` |

‎charts/nginx-gateway-fabric/templates/certs-job.yaml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,4 +153,20 @@ spec:
153153
securityContext:
154154
fsGroup: 1001
155155
runAsNonRoot: true
156-
ttlSecondsAfterFinished: 0
156+
{{- if .Values.certGenerator.topologySpreadConstraints }}
157+
topologySpreadConstraints:
158+
{{- toYaml .Values.certGenerator.topologySpreadConstraints | nindent 6 }}
159+
{{- end }}
160+
{{- if .Values.certGenerator.affinity }}
161+
affinity:
162+
{{- toYaml .Values.certGenerator.affinity | nindent 8 }}
163+
{{- end }}
164+
{{- if .Values.certGenerator.tolerations }}
165+
tolerations:
166+
{{- toYaml .Values.certGenerator.tolerations | nindent 6 }}
167+
{{- end }}
168+
{{- if .Values.certGenerator.nodeSelector }}
169+
nodeSelector:
170+
{{- toYaml .Values.certGenerator.nodeSelector | nindent 8 }}
171+
{{- end }}
172+
ttlSecondsAfterFinished: {{ .Values.certGenerator.ttlSecondsAfterFinished }}

‎charts/nginx-gateway-fabric/templates/service.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ metadata:
55
namespace: {{ .Release.Namespace }}
66
labels:
77
{{- include "nginx-gateway.labels" . | nindent 4 }}
8+
{{- if .Values.nginxGateway.service.labels }}
9+
{{ toYaml .Values.nginxGateway.service.labels | indent 4 }}
10+
{{- end }}
811
{{- if .Values.nginxGateway.service.annotations }}
912
annotations:
1013
{{ toYaml .Values.nginxGateway.service.annotations | indent 4 }}

‎charts/nginx-gateway-fabric/values.schema.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@
44
"certGenerator": {
55
"description": "The certGenerator section contains the configuration for the cert-generator Job.",
66
"properties": {
7+
"affinity": {
8+
"description": "The affinity of the cert-generator pod.",
9+
"required": [],
10+
"title": "affinity",
11+
"type": "object"
12+
},
713
"agentTLSSecretName": {
814
"default": "agent-tls",
915
"description": "The name of the base Secret containing TLS CA, certificate, and key for the NGINX Agent to securely\ncommunicate with the NGINX Gateway Fabric control plane. Must exist in the same namespace that the\nNGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway).",
@@ -17,6 +23,12 @@
1723
"title": "annotations",
1824
"type": "object"
1925
},
26+
"nodeSelector": {
27+
"description": "The nodeSelector of the cert-generator pod.",
28+
"required": [],
29+
"title": "nodeSelector",
30+
"type": "object"
31+
},
2032
"overwrite": {
2133
"default": false,
2234
"description": "Overwrite existing TLS Secrets on startup.",
@@ -30,6 +42,31 @@
3042
"required": [],
3143
"title": "serverTLSSecretName",
3244
"type": "string"
45+
},
46+
"tolerations": {
47+
"description": "Tolerations for the cert-generator pod.",
48+
"items": {
49+
"required": []
50+
},
51+
"required": [],
52+
"title": "tolerations",
53+
"type": "array"
54+
},
55+
"topologySpreadConstraints": {
56+
"description": "The topology spread constraints for the cert-generator pod.",
57+
"items": {
58+
"required": []
59+
},
60+
"required": [],
61+
"title": "topologySpreadConstraints",
62+
"type": "array"
63+
},
64+
"ttlSecondsAfterFinished": {
65+
"default": 30,
66+
"description": "How long to wait after the cert generator job has finished before it is removed by the job controller.",
67+
"required": [],
68+
"title": "ttlSecondsAfterFinished",
69+
"type": "integer"
3370
}
3471
},
3572
"required": [],
@@ -776,6 +813,12 @@
776813
"required": [],
777814
"title": "annotations",
778815
"type": "object"
816+
},
817+
"labels": {
818+
"description": "The labels of the NGINX Gateway Fabric control plane service.",
819+
"required": [],
820+
"title": "labels",
821+
"type": "object"
779822
}
780823
},
781824
"required": [],

‎charts/nginx-gateway-fabric/values.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,9 @@ nginxGateway:
5959
# -- The annotations of the NGINX Gateway Fabric control plane service.
6060
annotations: {}
6161

62+
# -- The labels of the NGINX Gateway Fabric control plane service.
63+
labels: {}
64+
6265
# -- The serviceaccount configuration for the NGINX Gateway Fabric control plane.
6366
serviceAccount:
6467
# -- Set of custom annotations for the NGINX Gateway Fabric control plane service account.
@@ -484,6 +487,21 @@ certGenerator:
484487
# -- Overwrite existing TLS Secrets on startup.
485488
overwrite: false
486489

490+
# -- How long to wait after the cert generator job has finished before it is removed by the job controller.
491+
ttlSecondsAfterFinished: 30
492+
493+
# -- Tolerations for the cert-generator pod.
494+
tolerations: []
495+
496+
# -- The nodeSelector of the cert-generator pod.
497+
nodeSelector: {}
498+
499+
# -- The affinity of the cert-generator pod.
500+
affinity: {}
501+
502+
# -- The topology spread constraints for the cert-generator pod.
503+
topologySpreadConstraints: []
504+
487505
# -- A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference.
488506
gateways: []
489507

0 commit comments

Comments
 (0)