Allow Deploying Multiple Ingress Controllers per Cluster

deployments/helm-chart/Chart.yaml

@@ -1,5 +1,5 @@
 name: nginx-ingress
-version: 0.3.6
+version: 0.4.0
 appVersion: edge
 description: NGINX Ingress Controller
 icon: https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/master/deployments/helm-chart/chart-icon.png

deployments/helm-chart/README.md

@@ -57,15 +57,15 @@ The following tables lists the configurable parameters of the NGINX Ingress cont
 
 Parameter | Description | Default
 --- | --- | ---
-`controller.name` | The name of the Ingress controller daemonset or deployment. | nginx-ingress
+`controller.name` | The name of the Ingress controller daemonset or deployment. | Autogenerated
 `controller.kind` | The kind of the Ingress controller installation - deployment or daemonset. | deployment
 `controller.nginxplus` | Deploys the Ingress controller for NGINX Plus. | false
 `controller.hostNetwork` | Enables the Ingress controller pods to use the host's network namespace. | false
 `controller.nginxDebug` | Enables debugging for NGINX. Uses the `nginx-debug` binary. Requires `error-log-level: debug` in the ConfigMap via `controller.config.entries`. | false
 `controller.image.repository` | The image repository of the Ingress controller. | nginx/nginx-ingress
 `controller.image.tag` | The tag of the Ingress controller image. | edge
 `controller.image.pullPolicy` | The pull policy for the Ingress controller image. | IfNotPresent
-`controller.config.name` | The name of the ConfigMap used by the Ingress controller. | nginx-config
+`controller.config.name` | The name of the ConfigMap used by the Ingress controller. | Autogenerated
 `controller.config.entries` | The entries of the ConfigMap for customizing NGINX configuration. | {}
 `controller.defaultTLS.cert` | The base64-encoded TLS certificate for the default HTTPS server. If not specified, a pre-generated self-signed certificate is used. **Note:** It is recommended that you specify your own certificate. | A pre-generated self-signed certificate.
 `controller.defaultTLS.key` | The base64-encoded TLS key for the default HTTPS server. **Note:** If not specified, a pre-generated key is used. It is recommended that you specify your own key. | A pre-generated key.
@@ -98,12 +98,12 @@ Parameter | Description | Default
 `controller.service.httpsPort.enable` | Enables the HTTPS port for the Ingress controller service. | true
 `controller.service.httpsPort.port` | The HTTPS port of the Ingress controller service. | 443
 `controller.service.httpsPort.nodePort` | The custom NodePort for the HTTPS port. Requires `controller.service.type` set to `NodePort`.  | ""
-`controller.serviceAccount.name` | The name of the service account of the Ingress controller pods. Used for RBAC. | nginx-ingress
+`controller.serviceAccount.name` | The name of the service account of the Ingress controller pods. Used for RBAC. | Autogenerated
 `controller.serviceAccount.imagePullSecrets` | The names of the secrets containing docker registry credentials. | []
 `controller.reportIngressStatus.enable` | Update the address field in the status of Ingresses resources with an external address of the Ingress controller. You must also specify the source of the external address either through an external service via `controller.reportIngressStatus.externalService` or the `external-status-address` entry in the ConfigMap via `controller.config.entries`. **Note:** `controller.config.entries.external-status-address` takes precedence if both are set. | true
-`controller.reportIngressStatus.externalService` | Specifies the name of the service with the type LoadBalancer through which the Ingress controller is exposed externally. The external address of the service is used when reporting the status of Ingress resources. `controller.reportIngressStatus.enable` must be set to `true`. | nginx-ingress
+`controller.reportIngressStatus.externalService` | Specifies the name of the service with the type LoadBalancer through which the Ingress controller is exposed externally. The external address of the service is used when reporting the status of Ingress resources. `controller.reportIngressStatus.enable` must be set to `true`. The default is autogenerated and enabled when `controller.service.create` is set to `true` and `controller.service.type` is set to `LoadBalancer`. | Autogenerated
 `controller.reportIngressStatus.enableLeaderElection` | Enable Leader election to avoid multiple replicas of the controller reporting the status of Ingress resources. `controller.reportIngressStatus.enable` must be set to `true`. | true
-`controller.reportIngressStatus.leaderElectionLockName` | Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election. controller.reportIngressStatus.enableLeaderElection must be set to true. | nginx-ingress-leader-election
+`controller.reportIngressStatus.leaderElectionLockName` | Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election. controller.reportIngressStatus.enableLeaderElection must be set to true. | Autogenerated
 `rbac.create` | Configures RBAC. | true
 `prometheus.create` | Expose NGINX or NGINX Plus metrics in the Prometheus format. | false
 `prometheus.port` | Configures the port to scrape the metrics. | 9113

deployments/helm-chart/templates/_helpers.tpl

@@ -4,7 +4,7 @@
 Expand the name of the chart.
 */}}
 {{- define "nginx-ingress.name" -}}
-{{- .Chart.Name | trunc 63 | trimSuffix "-" -}}
+{{- printf "%s-%s" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-" -}}
 {{- end -}}
 
 {{/*
@@ -16,3 +16,42 @@ helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version }}
 app.kubernetes.io/managed-by: {{ .Release.Service }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end -}}
+
+{{/*
+Expand the name of the configmap.
+*/}}
+{{- define "nginx-ingress.configName" -}}
+{{- default (include "nginx-ingress.name" .) .Values.controller.config.name -}}
+{{- end -}}
+
+{{/*
+Expand leader election lock name.
+*/}}
+{{- define "nginx-ingress.leaderElectionName" -}}
+{{- if .Values.controller.reportIngressStatus.leaderElectionLockName -}}
+{{ .Values.controller.reportIngressStatus.leaderElectionLockName }}
+{{- else -}}
+{{- printf "%s-%s" (include "nginx-ingress.name" .) "leader-election" -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Expand service account name.
+*/}}
+{{- define "nginx-ingress.serviceAccountName" -}}
+{{- default (include "nginx-ingress.name" .) .Values.controller.serviceAccount.name -}}
+{{- end -}}
+
+{{/*
+Expand default TLS name.
+*/}}
+{{- define "nginx-ingress.defaultTLSName" -}}
+{{- printf "%s-%s" (include "nginx-ingress.name" .) "default-server-secret" -}}
+{{- end -}}
+
+{{/*
+Expand wildcard TLS name.
+*/}}
+{{- define "nginx-ingress.wildcardTLSName" -}}
+{{- printf "%s-%s" (include "nginx-ingress.name" .) "wildcard-tls-secret" -}}
+{{- end -}}

deployments/helm-chart/templates/controller-configmap.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ .Values.controller.config.name }}
+  name: {{ include "nginx-ingress.configName" . }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 data:

deployments/helm-chart/templates/controller-daemonset.yaml

@@ -2,7 +2,7 @@
 apiVersion: extensions/v1beta1
 kind: DaemonSet
 metadata:
-  name: {{ include "nginx-ingress.name" . }}
+  name: {{ default (include "nginx-ingress.name" .) .Values.controller.name }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 spec:
@@ -19,7 +19,7 @@ spec:
         prometheus.io/port: "{{ .Values.prometheus.port }}"
 {{- end }}
     spec:
-      serviceAccountName: {{ .Values.controller.serviceAccount.name }}
+      serviceAccountName: {{ include "nginx-ingress.serviceAccountName" . }}
       terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
 {{- if .Values.controller.nodeSelector }}
       nodeSelector:
@@ -60,11 +60,11 @@ spec:
               fieldPath: metadata.name
         args:
           - -nginx-plus={{ .Values.controller.nginxplus }}
-          - -nginx-configmaps=$(POD_NAMESPACE)/nginx-config
+          - -nginx-configmaps=$(POD_NAMESPACE)/{{ include "nginx-ingress.configName" . }}
 {{- if .Values.controller.defaultTLS.secret }}
           - -default-server-tls-secret={{ .Values.controller.defaultTLS.secret }}
 {{ else }}
-          - -default-server-tls-secret=$(POD_NAMESPACE)/default-server-secret
+          - -default-server-tls-secret=$(POD_NAMESPACE)/{{ include "nginx-ingress.defaultTLSName" . }}
 {{- end }}
           - -ingress-class={{ .Values.controller.ingressClass }}
           - -use-ingress-class-only={{ .Values.controller.useIngressClassOnly }}
@@ -80,14 +80,19 @@ spec:
 {{- end }}
 {{- if .Values.controller.reportIngressStatus.enable }}
           - -report-ingress-status
+{{- if .Values.controller.reportIngressStatus.externalService }}
           - -external-service={{ .Values.controller.reportIngressStatus.externalService }}
+{{- else if and (.Values.controller.service.create) (eq .Values.controller.service.type "LoadBalancer") }}
+          - -external-service={{ include "nginx-ingress.name" . }}
+{{- end }}
           - -enable-leader-election={{ .Values.controller.reportIngressStatus.enableLeaderElection }}
+          - -leader-election-lock-name={{ include "nginx-ingress.leaderElectionName" . }}
 {{- end }}
 {{- if .Values.controller.wildcardTLS.secret }}
           - -wildcard-tls-secret={{ .Values.controller.wildcardTLS.secret }}
 {{- else if and .Values.controller.wildcardTLS.cert .Values.controller.wildcardTLS.key }}
-          - -wildcard-tls-secret=$(POD_NAMESPACE)/wildcard-tls-secret
+          - -wildcard-tls-secret=$(POD_NAMESPACE)/{{ include "nginx-ingress.wildcardTLSName" . }}
 {{- end }}
           - -enable-prometheus-metrics={{ .Values.prometheus.create }}
           - -prometheus-metrics-listen-port={{ .Values.prometheus.port }}
-{{- end }}
+{{- end }}

deployments/helm-chart/templates/controller-deployment.yaml

@@ -2,7 +2,7 @@
 apiVersion: extensions/v1beta1
 kind: Deployment
 metadata:
-  name: {{ include "nginx-ingress.name" . }}
+  name: {{ default (include "nginx-ingress.name" .) .Values.controller.name }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 spec:
@@ -32,7 +32,7 @@ spec:
       affinity:
 {{ toYaml .Values.controller.affinity | indent 8 }}
 {{- end }}
-      serviceAccountName: {{ .Values.controller.serviceAccount.name }}
+      serviceAccountName: {{ include "nginx-ingress.serviceAccountName" . }}
       hostNetwork: {{ .Values.controller.hostNetwork }}
       containers:
       - image: "{{ .Values.controller.image.repository }}:{{ .Values.controller.image.tag }}"
@@ -58,11 +58,11 @@ spec:
               fieldPath: metadata.name
         args:
           - -nginx-plus={{ .Values.controller.nginxplus }}
-          - -nginx-configmaps=$(POD_NAMESPACE)/{{ .Values.controller.config.name }}
+          - -nginx-configmaps=$(POD_NAMESPACE)/{{ include "nginx-ingress.configName" . }}
 {{- if .Values.controller.defaultTLS.secret }}
           - -default-server-tls-secret={{ .Values.controller.defaultTLS.secret }}
 {{ else }}
-          - -default-server-tls-secret=$(POD_NAMESPACE)/default-server-secret
+          - -default-server-tls-secret=$(POD_NAMESPACE)/{{ include "nginx-ingress.defaultTLSName" . }}
 {{- end }}
           - -ingress-class={{ .Values.controller.ingressClass }}
           - -use-ingress-class-only={{ .Values.controller.useIngressClassOnly }}
@@ -78,14 +78,18 @@ spec:
 {{- end }}
 {{- if .Values.controller.reportIngressStatus.enable }}
           - -report-ingress-status
+{{- if .Values.controller.reportIngressStatus.externalService }}
           - -external-service={{ .Values.controller.reportIngressStatus.externalService }}
+{{- else if and (.Values.controller.service.create) (eq .Values.controller.service.type "LoadBalancer") }}
+          - -external-service={{ include "nginx-ingress.name" . }}
+{{- end }}
           - -enable-leader-election={{ .Values.controller.reportIngressStatus.enableLeaderElection }}
-          - -leader-election-lock-name={{ .Values.controller.reportIngressStatus.leaderElectionLockName }}
+          - -leader-election-lock-name={{ include "nginx-ingress.leaderElectionName" . }}
 {{- end }}
 {{- if .Values.controller.wildcardTLS.secret }}
           - -wildcard-tls-secret={{ .Values.controller.wildcardTLS.secret }}
 {{- else if and .Values.controller.wildcardTLS.cert .Values.controller.wildcardTLS.key }}
-          - -wildcard-tls-secret=$(POD_NAMESPACE)/wildcard-tls-secret
+          - -wildcard-tls-secret=$(POD_NAMESPACE)/{{ include "nginx-ingress.wildcardTLSName" . }}
 {{- end }}
           - -enable-prometheus-metrics={{ .Values.prometheus.create }}
           - -prometheus-metrics-listen-port={{ .Values.prometheus.port }}

deployments/helm-chart/templates/controller-secret.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: default-server-secret
+  name: {{ include "nginx-ingress.defaultTLSName" . }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 type: Opaque

deployments/helm-chart/templates/controller-service.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: nginx-ingress
+  name: {{ include "nginx-ingress.name" . }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 {{- if .Values.controller.service.annotations }}
@@ -45,7 +45,7 @@ spec:
   {{- end }}
 {{- end }}
   selector:
-    app: {{ .Values.controller.name | trunc 63 }}
+    app: {{ include "nginx-ingress.name" . }}
   {{- if .Values.controller.service.externalIPs }}
   externalIPs:
 {{ toYaml .Values.controller.service.externalIPs | indent 4 }}

deployments/helm-chart/templates/controller-serviceaccount.yaml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Values.controller.serviceAccount.name }}
+  name: {{ include "nginx-ingress.serviceAccountName" . }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 {{- if .Values.controller.serviceAccount.imagePullSecrets }}

deployments/helm-chart/templates/controller-wildcard-secret.yaml

@@ -2,11 +2,11 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: wildcard-tls-secret
+  name: {{ include "nginx-ingress.wildcardTLSName" . }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 type: Opaque
 data:
   tls.crt: {{ .Values.controller.wildcardTLS.cert }}
   tls.key: {{ .Values.controller.wildcardTLS.key }}
-{{- end }}
+{{- end }}

deployments/helm-chart/templates/rbac.yaml

@@ -2,7 +2,7 @@
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
-  name: nginx-ingress
+  name: {{ include "nginx-ingress.name" . }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 rules:
@@ -68,15 +68,15 @@ rules:
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
-  name: nginx-ingress
+  name: {{ include "nginx-ingress.name" . }}
   labels:
     {{- include "nginx-ingress.labels" . | nindent 4 }}
 subjects:
 - kind: ServiceAccount
-  name: {{ .Values.controller.serviceAccount.name }}
+  name: {{ include "nginx-ingress.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: nginx-ingress
+  name: {{ include "nginx-ingress.name" . }}
   apiGroup: rbac.authorization.k8s.io
 {{- end }}

deployments/helm-chart/values.yaml

@@ -1,6 +1,7 @@
 controller:
   ## The name of the Ingress controller daemonset or deployment.
-  name: nginx-ingress
+  ## Autogenerated if not set or set to "".
+  # name: nginx-ingress
 
   ## The kind of the Ingress controller installation - deployment or daemonset.
   kind: deployment
@@ -26,7 +27,8 @@ controller:
 
   config:
     ## The name of the ConfigMap used by the Ingress controller.
-    name: nginx-config
+    ## Autogenerated if not set or set to "".
+    # name: nginx-config
 
     ## The entries of the ConfigMap for customizing NGINX configuration.
     entries: {}
@@ -40,7 +42,12 @@ controller:
     ## The base64-encoded TLS key for the default HTTPS server. Note: If not specified, a pre-generated key is used.
     ## Note: It is recommended that you specify your own key.
     key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBdi91RWM4b1JkMHUvZXVJTHNFK1RYZUprckxMMnNJNGFWaEMvYjVyYy9XMlRiNHEvClJOcktGMEdYaVN1eE9ycXgrajlnamx4NXFjdnhkenRKbXNFUkJ1Z1B0ME9hVGtIekhvb3FVWmcwZGxmZ1dkT0EKUTZMNTdlT1l0Q29VOUZ4amRXdzZUVVRJVUQ4R0JsRlNjSVo0b1hFTkhzbysyR3VTTWk2Zk1wTVM3YUhudzFtMApxWkdvRWEzWFNyZEJ6eGc2clhkcUNlUDlCMXl3VmRyYURiUzc1aGQzdUdETDU4cGszOVFqVUFQaHpxdmRoK1JWClZGNGJCaW9CbTVpeTlZTW1hWVhsMm0wTGZzeTZuUTRRdFFzdEdNVWozcGJtdlFmazJBNnljeGRFeFpkZFZsdmwKMm82MjBsMllxcHFDZEtCRThCay90elFIVTlKcU56cHpoOUJUTXdJREFRQUJBb0lCQVFDZklHbXowOHhRVmorNwpLZnZJUXQwQ0YzR2MxNld6eDhVNml4MHg4Mm15d1kxUUNlL3BzWE9LZlRxT1h1SENyUlp5TnUvZ2IvUUQ4bUFOCmxOMjRZTWl0TWRJODg5TEZoTkp3QU5OODJDeTczckM5bzVvUDlkazAvYzRIbjAzSkVYNzZ5QjgzQm9rR1FvYksKMjhMNk0rdHUzUmFqNjd6Vmc2d2szaEhrU0pXSzBwV1YrSjdrUkRWYmhDYUZhNk5nMUZNRWxhTlozVDhhUUtyQgpDUDNDeEFTdjYxWTk5TEI4KzNXWVFIK3NYaTVGM01pYVNBZ1BkQUk3WEh1dXFET1lvMU5PL0JoSGt1aVg2QnRtCnorNTZud2pZMy8yUytSRmNBc3JMTnIwMDJZZi9oY0IraVlDNzVWYmcydVd6WTY3TWdOTGQ5VW9RU3BDRkYrVm4KM0cyUnhybnhBb0dCQU40U3M0ZVlPU2huMVpQQjdhTUZsY0k2RHR2S2ErTGZTTXFyY2pOZjJlSEpZNnhubmxKdgpGenpGL2RiVWVTbWxSekR0WkdlcXZXaHFISy9iTjIyeWJhOU1WMDlRQ0JFTk5jNmtWajJTVHpUWkJVbEx4QzYrCk93Z0wyZHhKendWelU0VC84ajdHalRUN05BZVpFS2FvRHFyRG5BYWkyaW5oZU1JVWZHRXFGKzJyQW9HQkFOMVAKK0tZL0lsS3RWRzRKSklQNzBjUis3RmpyeXJpY05iWCtQVzUvOXFHaWxnY2grZ3l4b25BWlBpd2NpeDN3QVpGdwpaZC96ZFB2aTBkWEppc1BSZjRMazg5b2pCUmpiRmRmc2l5UmJYbyt3TFU4NUhRU2NGMnN5aUFPaTVBRHdVU0FkCm45YWFweUNweEFkREtERHdObit3ZFhtaTZ0OHRpSFRkK3RoVDhkaVpBb0dCQUt6Wis1bG9OOTBtYlF4VVh5YUwKMjFSUm9tMGJjcndsTmVCaWNFSmlzaEhYa2xpSVVxZ3hSZklNM2hhUVRUcklKZENFaHFsV01aV0xPb2I2NTNyZgo3aFlMSXM1ZUtka3o0aFRVdnpldm9TMHVXcm9CV2xOVHlGanIrSWhKZnZUc0hpOGdsU3FkbXgySkJhZUFVWUNXCndNdlQ4NmNLclNyNkQrZG8wS05FZzFsL0FvR0FlMkFVdHVFbFNqLzBmRzgrV3hHc1RFV1JqclRNUzRSUjhRWXQKeXdjdFA4aDZxTGxKUTRCWGxQU05rMXZLTmtOUkxIb2pZT2pCQTViYjhibXNVU1BlV09NNENoaFJ4QnlHbmR2eAphYkJDRkFwY0IvbEg4d1R0alVZYlN5T294ZGt5OEp0ek90ajJhS0FiZHd6NlArWDZDODhjZmxYVFo5MWpYL3RMCjF3TmRKS2tDZ1lCbyt0UzB5TzJ2SWFmK2UwSkN5TGhzVDQ5cTN3Zis2QWVqWGx2WDJ1VnRYejN5QTZnbXo5aCsKcDNlK2JMRUxwb3B0WFhNdUFRR0xhUkcrYlNNcjR5dERYbE5ZSndUeThXczNKY3dlSTdqZVp2b0ZpbmNvVlVIMwphdmxoTUVCRGYxSjltSDB5cDBwWUNaS2ROdHNvZEZtQktzVEtQMjJhTmtsVVhCS3gyZzR6cFE9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo=
+
+    ## The secret with a TLS certificate and key for the default HTTPS server.
+    ## The value must follow the following format: `<namespace>/<name>`.
+    ## Used as an alternative to specifying a certificate and key using `controller.defaultTLS.cert` and `controller.defaultTLS.key` parameters.
     secret: #<namespace>/<secret_name>
+
   wildcardTLS:
     ## The base64-encoded TLS certificate for every Ingress host that has TLS enabled but no secret specified.
     ## If the parameter is not set, for such Ingress hosts NGINX will break any attempt to establish a TLS connection.
@@ -139,7 +146,8 @@ controller:
 
   serviceAccount:
     ## The name of the service account of the Ingress controller pods. Used for RBAC.
-    name: nginx-ingress
+    ## Autogenerated if not set or set to "".
+    # name: nginx-ingress
 
     ## The names of the secrets containing docker registry credentials.
     imagePullSecrets: []
@@ -153,13 +161,15 @@ controller:
 
     ## Specifies the name of the service with the type LoadBalancer through which the Ingress controller is exposed externally.
     ## The external address of the service is used when reporting the status of Ingress resources. controller.reportIngressStatus.enable must be set to true.
-    externalService: nginx-ingress
+    ## The default is autogenerated and matches the created service (see controller.service.create).
+    # externalService: nginx-ingress
 
     ## Enable Leader election to avoid multiple replicas of the controller reporting the status of Ingress resources. controller.reportIngressStatus.enable must be set to true.
     enableLeaderElection: true
 
     ## Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election. controller.reportIngressStatus.enableLeaderElection must be set to true.
-    leaderElectionLockName: "nginx-ingress-leader-election"
+    ## Autogenerated if not set or set to "".
+    # leaderElectionLockName: "nginx-ingress-leader-election"
 
 rbac:
   ## Configures RBAC.