Skip to content

Add extra containers entry to inject side cars into deployment #3486

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 12 commits into
base: main
Choose a base branch
from
Open

Add extra containers entry to inject side cars into deployment #3486

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
9abbd6e
adds override for sidecar containers
ab-andresc Jun 10, 2025
af8ca53
adds blanket variable to add containers into daemonset or deployment
ab-andresc Jun 10, 2025
830720f
adds blanket variable to add containers into daemonset or deployment
ab-andresc Jun 10, 2025
22c1c38
moves extracontainers to correct location
ab-andresc Jun 10, 2025
f10c285
adds schema and readme updates
ab-andresc Jun 10, 2025
2edc176
better image
ab-andresc Jun 10, 2025
9cd71f9
added securitycontext overrides
ab-andresc Jun 11, 2025
b4a587f
added securitycontext overrides
ab-andresc Jun 11, 2025
a9e3437
added securitycontext overrides
ab-andresc Jun 11, 2025
5dd677b
added securitycontext overrides
ab-andresc Jun 11, 2025
31eaea7
Merge branch 'main' into patch-1
ab-andresc Jun 11, 2025
9dfbd00
overrides security context
ab-andresc Jun 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions apis/v1alpha2/nginxproxy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -397,6 +397,12 @@ type DeploymentSpec struct {
//
// +optional
Container ContainerSpec `json:"container"`

// ExtraContainers defines additional containers to be added to the NGINX Pod.
// Uses upstream corev1.Container to allow arbitrary sidecars.
Comment on lines +401 to +402
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it would be great if you could specify one example of the sidecars users can use.

//
// +optional
ExtraContainers []corev1.Container `json:"extraContainers,omitempty"`
}

// DaemonSet is the configuration for the NGINX DaemonSet.
Expand All @@ -410,6 +416,11 @@ type DaemonSetSpec struct {
//
// +optional
Container ContainerSpec `json:"container"`
// ExtraContainers defines additional containers to be added to the NGINX Pod.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
// ExtraContainers defines additional containers to be added to the NGINX Pod.
// ExtraContainers defines additional containers to be added to the NGINX Pod.

// Uses upstream corev1.Container to allow arbitrary sidecars.
//
// +optional
ExtraContainers []corev1.Container `json:"extraContainers,omitempty"`
}

// PodSpec defines Pod-specific fields.
Expand Down Expand Up @@ -453,6 +464,8 @@ type PodSpec struct {
//
// +optional
TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`

SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
}

// ContainerSpec defines container fields for the NGINX container.
Expand Down
19 changes: 19 additions & 0 deletions apis/v1alpha2/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 2 additions & 1 deletion charts/nginx-gateway-fabric/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,10 +264,11 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
| `certGenerator.ttlSecondsAfterFinished` | How long to wait after the cert generator job has finished before it is removed by the job controller. | int | `30` |
| `clusterDomain` | The DNS cluster domain of your Kubernetes cluster. | string | `"cluster.local"` |
| `gateways` | A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference. | list | `[]` |
| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{},"debug":false,"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"edge"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |
| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{},"debug":false,"extraContainers":[],"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"edge"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |
| `nginx.config` | The configuration for the data plane that is contained in the NginxProxy resource. This is applied globally to all Gateways managed by this instance of NGINX Gateway Fabric. | object | `{}` |
| `nginx.container` | The container configuration for the NGINX container. This is applied globally to all Gateways managed by this instance of NGINX Gateway Fabric. | object | `{}` |
| `nginx.debug` | Enable debugging for NGINX. Uses the nginx-debug binary. The NGINX error log level should be set to debug in the NginxProxy resource. | bool | `false` |
| `nginx.extraContainers` | extraVolumeMounts are the additional volume mounts for the NGINX container. extraVolumeMounts: [] Extra containers to be added to the NGINX Gateway Fabric control plane pod. Use this to add additional containers to the control plane pod, such as sidecars. Note that these containers will not have access to the NGINX Gateway Fabric control plane's service account. | list | `[]` |
| `nginx.image.repository` | The NGINX image to use. | string | `"ghcr.io/nginx/nginx-gateway-fabric/nginx"` |
| `nginx.imagePullSecret` | The name of the secret containing docker registry credentials. Secret must exist in the same namespace as the helm release. The control plane will copy this secret into any namespace where NGINX is deployed. | string | `""` |
| `nginx.imagePullSecrets` | A list of secret names containing docker registry credentials. Secrets must exist in the same namespace as the helm release. The control plane will copy these secrets into any namespace where NGINX is deployed. | list | `[]` |
Expand Down
6 changes: 6 additions & 0 deletions charts/nginx-gateway-fabric/templates/nginxproxy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ spec:
{{- if .Values.nginx.debug }}
debug: {{ .Values.nginx.debug }}
{{- end }}
{{- if .Values.nginxGateway.extraContainers }}
{{- toYaml .Values.nginxGateway.extraContainers | nindent 6 }}
{{- end }}
{{- end }}
{{- if eq .Values.nginx.kind "daemonSet" }}
daemonSet:
Expand All @@ -42,6 +45,9 @@ spec:
{{- if .Values.nginx.debug }}
debug: {{ .Values.nginx.debug }}
{{- end }}
{{- if .Values.nginx.extraContainers }}
{{- toYaml .Values.nginx.extraContainers | nindent 6 }}
{{- end }}
{{- end }}
{{- if .Values.nginx.service }}
service:
Expand Down
9 changes: 9 additions & 0 deletions charts/nginx-gateway-fabric/values.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -324,6 +324,15 @@
"title": "debug",
"type": "boolean"
},
"extraContainers": {
"description": "Extra containers to be added to the NGINX Gateway Fabric control plane pod.\nUse this to add additional containers to the control plane pod, such as sidecars.\nNote that these containers will not have access to the NGINX Gateway Fabric control plane's service account.",
"items": {
"required": []
},
"required": [],
"title": "extraContainers",
"type": "array"
},
"image": {
"properties": {
"pullPolicy": {
Expand Down
5 changes: 5 additions & 0 deletions charts/nginx-gateway-fabric/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,11 @@ nginx:
# -- extraVolumeMounts are the additional volume mounts for the NGINX container.
# extraVolumeMounts: []

# Extra containers to be added to the NGINX Gateway Fabric control plane pod.
# Use this to add additional containers to the control plane pod, such as sidecars.
# Note that these containers will not have access to the NGINX Gateway Fabric control plane's service account.
extraContainers: []

# -- The service configuration for the NGINX data plane. This is applied globally to all Gateways managed by this
# instance of NGINX Gateway Fabric.
service:
Expand Down
Loading