mirror of
https://github.com/helmfile/helmfile.git
synced 2026-09-30 06:02:58 +02:00
Aditya Menon
d40bfced56
* test: add integration test for issue #2291 with all fixes Add comprehensive integration test for issue #2291 that validates CRD preservation when using strategicMergePatches with chartify. Problem: When using strategicMergePatches, chartify was relocating CRDs from templates/crds/ to root crds/ directory, changing how Helm manages them. This caused helm diff to incorrectly show CRDs as being removed, even though they were still present. Solution: Chartify now preserves the original CRD location in templates/crds/. This integration test validates the fix by: 1. Templating a chart with CRDs in templates/crds/ 2. Applying the chart with strategicMergePatches 3. Verifying CRD is installed 4. Running helm diff to ensure CRD is NOT marked for removal 5. Verifying the strategic merge patch was applied Additional fixes included in this commit: - Fixed grep command error when matching YAML deletion patterns - Updated expected test output for Helm 4 diff behavior - Fixed EXIT trap interference between test cases - Added --plain-http flag for Helm 4 OCI registry compatibility - Ensured CRD templates are valid (cluster-scoped, no namespace) - Fixed strategic merge patch namespace matching Test coverage: - CRD preservation in templates/crds/ subdirectory - Strategic merge patch application - Helm diff behavior with CRDs - Integration with chartify kustomize processing Fixes #2291 Signed-off-by: Aditya Menon <amenon@canarytechnologies.com> * switch chartify package to upstream one Signed-off-by: Aditya Menon <amenon@canarytechnologies.com> * implement copilot suggestion Signed-off-by: Aditya Menon <amenon@canarytechnologies.com> --------- Signed-off-by: Aditya Menon <amenon@canarytechnologies.com>
564 lines
19 KiB
Plaintext
564 lines
19 KiB
Plaintext
Comparing release=ingress-nginx, chart=ingress-nginx/ingress-nginx, namespace=helmfile-tests
|
|
helmfile-tests, ingress-nginx, ClusterRole (rbac.authorization.k8s.io) has changed, but diff is empty after suppression.
|
|
helmfile-tests, ingress-nginx, ClusterRoleBinding (rbac.authorization.k8s.io) has changed:
|
|
# Source: ingress-nginx/templates/clusterrolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
name: ingress-nginx
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: ingress-nginx
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: ingress-nginx
|
|
- namespace: "helmfile-tests"
|
|
+ namespace: helmfile-tests
|
|
helmfile-tests, ingress-nginx, Role (rbac.authorization.k8s.io) has changed:
|
|
# Source: ingress-nginx/templates/controller-role.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: controller
|
|
name: ingress-nginx
|
|
namespace: helmfile-tests
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- namespaces
|
|
verbs:
|
|
- get
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- configmaps
|
|
- pods
|
|
- secrets
|
|
- endpoints
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- services
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingresses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
+ # Omit Ingress status permissions if `--update-status` is disabled.
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingresses/status
|
|
verbs:
|
|
- update
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
resources:
|
|
- ingressclasses
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
resourceNames:
|
|
- ingress-nginx-leader
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- coordination.k8s.io
|
|
resources:
|
|
- leases
|
|
verbs:
|
|
- create
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- events
|
|
verbs:
|
|
- create
|
|
- patch
|
|
- apiGroups:
|
|
- discovery.k8s.io
|
|
resources:
|
|
- endpointslices
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- get
|
|
helmfile-tests, ingress-nginx, RoleBinding (rbac.authorization.k8s.io) has changed:
|
|
# Source: ingress-nginx/templates/controller-rolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: controller
|
|
name: ingress-nginx
|
|
namespace: helmfile-tests
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: ingress-nginx
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: ingress-nginx
|
|
- namespace: "helmfile-tests"
|
|
+ namespace: helmfile-tests
|
|
helmfile-tests, ingress-nginx, ServiceAccount (v1) has changed, but diff is empty after suppression.
|
|
helmfile-tests, ingress-nginx-admission, ClusterRole (rbac.authorization.k8s.io) has changed, but diff is empty after suppression.
|
|
helmfile-tests, ingress-nginx-admission, ClusterRoleBinding (rbac.authorization.k8s.io) has changed:
|
|
# Source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: ingress-nginx-admission
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: ingress-nginx-admission
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: ingress-nginx-admission
|
|
- namespace: "helmfile-tests"
|
|
+ namespace: helmfile-tests
|
|
helmfile-tests, ingress-nginx-admission, Role (rbac.authorization.k8s.io) has changed:
|
|
# Source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: Role
|
|
metadata:
|
|
- name: ingress-nginx-admission
|
|
+ name: ingress-nginx-admission
|
|
namespace: helmfile-tests
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- secrets
|
|
verbs:
|
|
- get
|
|
- create
|
|
helmfile-tests, ingress-nginx-admission, RoleBinding (rbac.authorization.k8s.io) has changed:
|
|
# Source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: ingress-nginx-admission
|
|
namespace: helmfile-tests
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: Role
|
|
name: ingress-nginx-admission
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: ingress-nginx-admission
|
|
- namespace: "helmfile-tests"
|
|
+ namespace: helmfile-tests
|
|
helmfile-tests, ingress-nginx-admission, ServiceAccount (v1) has changed, but diff is empty after suppression.
|
|
helmfile-tests, ingress-nginx-admission, ValidatingWebhookConfiguration (admissionregistration.k8s.io) has changed:
|
|
# Source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml
|
|
# before changing this value, check the required kubernetes version
|
|
# https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: ValidatingWebhookConfiguration
|
|
metadata:
|
|
annotations:
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
name: ingress-nginx-admission
|
|
webhooks:
|
|
- name: validate.nginx.ingress.kubernetes.io
|
|
matchPolicy: Equivalent
|
|
rules:
|
|
- apiGroups:
|
|
- networking.k8s.io
|
|
apiVersions:
|
|
- v1
|
|
operations:
|
|
- CREATE
|
|
- UPDATE
|
|
resources:
|
|
- ingresses
|
|
failurePolicy: Fail
|
|
sideEffects: None
|
|
admissionReviewVersions:
|
|
- v1
|
|
clientConfig:
|
|
service:
|
|
- namespace: "helmfile-tests"
|
|
name: ingress-nginx-controller-admission
|
|
+ namespace: helmfile-tests
|
|
path: /networking/v1/ingresses
|
|
helmfile-tests, ingress-nginx-admission-create, Job (batch) has changed:
|
|
# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: ingress-nginx-admission-create
|
|
namespace: helmfile-tests
|
|
annotations:
|
|
"helm.sh/hook": pre-install,pre-upgrade
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: ingress-nginx-admission-create
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
spec:
|
|
containers:
|
|
- name: create
|
|
- image: "registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80"
|
|
+ image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- create
|
|
- --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
|
|
- --namespace=$(POD_NAMESPACE)
|
|
- --secret-name=ingress-nginx-admission
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
+ capabilities:
|
|
+ drop:
|
|
+ - ALL
|
|
+ readOnlyRootFilesystem: true
|
|
+ runAsNonRoot: true
|
|
+ runAsUser: 65532
|
|
+ seccompProfile:
|
|
+ type: RuntimeDefault
|
|
restartPolicy: OnFailure
|
|
serviceAccountName: ingress-nginx-admission
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
- securityContext:
|
|
- fsGroup: 2000
|
|
- runAsNonRoot: true
|
|
- runAsUser: 2000
|
|
helmfile-tests, ingress-nginx-admission-patch, Job (batch) has changed:
|
|
# Source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: ingress-nginx-admission-patch
|
|
namespace: helmfile-tests
|
|
annotations:
|
|
"helm.sh/hook": post-install,post-upgrade
|
|
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
spec:
|
|
template:
|
|
metadata:
|
|
name: ingress-nginx-admission-patch
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: admission-webhook
|
|
spec:
|
|
containers:
|
|
- name: patch
|
|
- image: "registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80"
|
|
+ image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v20231011-8b53cabe0@sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80
|
|
imagePullPolicy: IfNotPresent
|
|
args:
|
|
- patch
|
|
- --webhook-name=ingress-nginx-admission
|
|
- --namespace=$(POD_NAMESPACE)
|
|
- --patch-mutating=false
|
|
- --secret-name=ingress-nginx-admission
|
|
- --patch-failure-policy=Fail
|
|
env:
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
+ capabilities:
|
|
+ drop:
|
|
+ - ALL
|
|
+ readOnlyRootFilesystem: true
|
|
+ runAsNonRoot: true
|
|
+ runAsUser: 65532
|
|
+ seccompProfile:
|
|
+ type: RuntimeDefault
|
|
restartPolicy: OnFailure
|
|
serviceAccountName: ingress-nginx-admission
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
- securityContext:
|
|
- fsGroup: 2000
|
|
- runAsNonRoot: true
|
|
- runAsUser: 2000
|
|
helmfile-tests, ingress-nginx-controller, ConfigMap (v1) has changed, but diff is empty after suppression.
|
|
helmfile-tests, ingress-nginx-controller, Deployment (apps) has changed:
|
|
# Source: ingress-nginx/templates/controller-deployment.yaml
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: controller
|
|
name: ingress-nginx-controller
|
|
namespace: helmfile-tests
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/component: controller
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
minReadySeconds: 0
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: controller
|
|
spec:
|
|
dnsPolicy: ClusterFirst
|
|
containers:
|
|
- name: controller
|
|
- image: "registry.k8s.io/ingress-nginx/controller:v1.9.4@sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3"
|
|
+ image: registry.k8s.io/ingress-nginx/controller:v1.9.5@sha256:b3aba22b1da80e7acfc52b115cae1d4c687172cbf2b742d5b502419c25ff340e
|
|
imagePullPolicy: IfNotPresent
|
|
lifecycle:
|
|
preStop:
|
|
exec:
|
|
command:
|
|
- /wait-shutdown
|
|
- args:
|
|
+ args:
|
|
- /nginx-ingress-controller
|
|
- --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
|
|
- --election-id=ingress-nginx-leader
|
|
- --controller-class=k8s.io/ingress-nginx
|
|
- --ingress-class=nginx
|
|
- --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
|
|
- --validating-webhook=:8443
|
|
- --validating-webhook-certificate=/usr/local/certificates/cert
|
|
- --validating-webhook-key=/usr/local/certificates/key
|
|
securityContext:
|
|
+ runAsNonRoot: true
|
|
+ runAsUser: 101
|
|
+ allowPrivilegeEscalation: false
|
|
+ seccompProfile:
|
|
+ type: RuntimeDefault
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
add:
|
|
- NET_BIND_SERVICE
|
|
- runAsUser: 101
|
|
- allowPrivilegeEscalation: true
|
|
+ readOnlyRootFilesystem: false
|
|
env:
|
|
- name: POD_NAME
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.name
|
|
- name: POD_NAMESPACE
|
|
valueFrom:
|
|
fieldRef:
|
|
fieldPath: metadata.namespace
|
|
- name: LD_PRELOAD
|
|
value: /usr/local/lib/libmimalloc.so
|
|
livenessProbe:
|
|
failureThreshold: 5
|
|
httpGet:
|
|
path: /healthz
|
|
port: 10254
|
|
scheme: HTTP
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /healthz
|
|
port: 10254
|
|
scheme: HTTP
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
ports:
|
|
- name: http
|
|
containerPort: 80
|
|
protocol: TCP
|
|
- name: https
|
|
containerPort: 443
|
|
protocol: TCP
|
|
- name: webhook
|
|
containerPort: 8443
|
|
protocol: TCP
|
|
volumeMounts:
|
|
- name: webhook-cert
|
|
mountPath: /usr/local/certificates/
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 90Mi
|
|
nodeSelector:
|
|
kubernetes.io/os: linux
|
|
serviceAccountName: ingress-nginx
|
|
terminationGracePeriodSeconds: 300
|
|
volumes:
|
|
- name: webhook-cert
|
|
secret:
|
|
secretName: ingress-nginx-admission
|
|
helmfile-tests, ingress-nginx-controller, Service (v1) has changed:
|
|
# Source: ingress-nginx/templates/controller-service.yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
annotations:
|
|
labels:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/part-of: ingress-nginx
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/component: controller
|
|
name: ingress-nginx-controller
|
|
namespace: helmfile-tests
|
|
spec:
|
|
type: LoadBalancer
|
|
- ipFamilyPolicy: SingleStack
|
|
- ipFamilies:
|
|
- - IPv4
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
protocol: TCP
|
|
targetPort: http
|
|
appProtocol: http
|
|
- name: https
|
|
port: 443
|
|
protocol: TCP
|
|
targetPort: https
|
|
appProtocol: https
|
|
selector:
|
|
app.kubernetes.io/name: ingress-nginx
|
|
app.kubernetes.io/instance: ingress-nginx
|
|
app.kubernetes.io/component: controller
|
|
helmfile-tests, ingress-nginx-controller-admission, Service (v1) has changed, but diff is empty after suppression.
|
|
helmfile-tests, nginx, IngressClass (networking.k8s.io) has changed, but diff is empty after suppression.
|
|
helmfile-tests, ingress-nginx-admission, NetworkPolicy (networking.k8s.io) has been removed:
|
|
- # Source: ingress-nginx/templates/admission-webhooks/job-patch/networkpolicy.yaml
|
|
- apiVersion: networking.k8s.io/v1
|
|
- kind: NetworkPolicy
|
|
- metadata:
|
|
- name: ingress-nginx-admission
|
|
- namespace: helmfile-tests
|
|
- annotations:
|
|
- "helm.sh/hook": pre-install,pre-upgrade,post-install,post-upgrade
|
|
- "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
|
|
- labels:
|
|
- app.kubernetes.io/name: ingress-nginx
|
|
- app.kubernetes.io/instance: ingress-nginx
|
|
- app.kubernetes.io/part-of: ingress-nginx
|
|
- app.kubernetes.io/managed-by: Helm
|
|
- app.kubernetes.io/component: admission-webhook
|
|
- spec:
|
|
- podSelector:
|
|
- matchLabels:
|
|
- app.kubernetes.io/name: ingress-nginx
|
|
- app.kubernetes.io/instance: ingress-nginx
|
|
- app.kubernetes.io/component: admission-webhook
|
|
- policyTypes:
|
|
- - Ingress
|
|
- - Egress
|
|
- egress:
|
|
- - {}
|
|
+
|
|
|