Deploys Ingress Nginx into a Kubernetes cluster via Helm.
Once you have a Corewide Solutions Portal account, this one-time action will use your browser session to retrieve credentials:
shellterraform login solutions.corewide.com
Initialize mandatory providers:
Copy and paste into your Terraform configuration and insert the variables:
hclmodule "tf_k8s_ingress_nginx" {
source = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
version = "~> 5.3.1"
# specify module inputs here or try one of the examples below
...
}
Initialize the setup:
shellterraform init
Corewide DevOps team strictly follows Semantic Versioning
Specification
to
provide our clients with products that have predictable upgrades between versions. We
recommend
pinning
patch versions of our modules using pessimistic
constraint operator (~>) to prevent breaking changes during upgrades.
To get new features during the upgrades (without breaking compatibility), use
~> 5.3 and run
terraform init -upgrade
For the safest setup, use strict pinning with version = "5.3.1"
| tf-k8s-cert-manager | €190 |
| tf-k8s-crd | €50 |
Deploys Ingress Nginx into a Kubernetes cluster via Helm.
All notable changes to this project are documented here.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
ingress_nginx.enable_json_log_format variable to enable JSON-formatted logsingress_nginx.values_override to allow passing custom values as Terraform map. Will supersede custom_values in the next major releaseingress_nginx.ingress_class_name variableingress_nginx.version variable (compatible chart version is 4.12.0 and newer)4.6.1 to 4.12.1) to align with latest fixes of Ingress Nginx vulnerabilitiesingress_class outputService in the data source making the module return an incorrect external IP address in the outputk8s_flavor variableingressClass name (ingress_class)ingress_nginx_ip output to ingress_ipingress_nginx_hostname output to ingress_hostnameingress_nginx_ip in favour of ingress_ip and will be deleted in v6.0ingress_nginx_hostname in favour of ingress_hostname and will be deleted in v6.0helm_timeout parameter for ingress_nginx variable to configure deployment timeout of its Helm releaseBREAKING CHANGE: now Cert Manager setup is managed by the child module and Ingress Nginx deployment is mandatory
acme_email variable for Cert Manager configurationvar.ingress_nginx.enabled parametertf-k8s-crd module dependency to ~> 2.0Ingress Nginx Helm chart (from 4.0.18 to 4.6.1) versionBREAKING CHANGE: now all custom_values are declared as lists of objects which aren't compatible with previous version
k8s_flavor variableBREAKING CHANGE: now all kubernetes provider resources use versioned resources which aren't compatible with previous version
tf-k8s-crd module dependencyClusterIssuer custom resources use CRD TF moduleingress_nginx variablegavinbunney/kubectl provider dependencyBREAKING CHANGE: now module inputs and resources management have fundamentally new concept which isn't compatible with previous version
moved blocks to ensure reverse compatibility1.3ingress_* and certmanager_* separate variables into two ingress and Cert Manager object variables that contain all related elementskubernetes_manifest calls for each cluser issuer into onekubernetes provider resourcesatomic nowtemplatefile function is used instead of template data sourcestemplate providerv2.x to v3.xNow all kubernetes provider resources use versioned resources. According to kubernetes provider's suggestions the simplest, non-destructive way to do this is to remove the old resource from state and import the resource as a version one. If Kubernetes namespaces were managed by the module, they must be re-imported, like so:
bashterraform state rm module.ingress.kubernetes_namespace.ingress_namespace[0] module.ingress.kubernetes_namespace.certmanager_namespace[0]
terraform import module.ingress.kubernetes_namespace_v1.ingress_namespace[0] ingress-nginx
terraform import module.ingress.kubernetes_namespace_v1.certmanager_namespace[0] cert-manager
terraform state mv 'module.ingress.kubectl_manifest.cluster_issuer["letsencrypt"]' 'module.ingress.module.cluster_issuer["letsencrypt"].kubectl_manifest.crd'
terraform state mv 'module.ingress.kubectl_manifest.cluster_issuer["letsencrypt-staging"]' 'module.ingress.module.cluster_issuer["letsencrypt-staging"].kubectl_manifest.crd'
terraform state mv 'module.ingress.kubectl_manifest.cluster_issuer["selfsigned"]' 'module.ingress.module.cluster_issuer["selfsigned"].kubectl_manifest.crd'
v3.x to v4.xNow all custom_values are declared as lists of objects. In case if there were already declared custom_values in the module inputs, then they must be updated:
hcl # Old definition | # New definition
custom_values = { | custom_values = [
"controller.containerPort" = 8080 | {
} | name = "controller.containerPort"
| value = 8080
| },
| ]
If there weren't any custom_values declared (neither for Ingress Nginx nor Cert Manager), no actions are needed.
v4.x to v5.xNow Cert Manager setup is managed by the child module. Cert Manager resource addresses will be moved automatically with moved blocks. Ingress Nginx deployment is mandatory now. Manual removal of the input variable var.ingress_nginx.enabled is mandatory. Variable var.cert_manager.acme_email must be changed to the var.acme_email.
Deploy Ingress Nginx with custom configuration and cert-manager:
hclmodule "ingress" {
source = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
version = "~> 5.3"
acme_email = "[email protected]"
cert_manager = {
version = "1.10.0"
}
ingress_nginx = {
name = "ingress"
namespace = "ingress"
replicas = 3
helm_timeout = 600
custom_values = [
{
name = "controller.metrics.serviceMonitor.additionalLabels\\.app\\.kubernetes\\.io/name"
value = "ingress"
},
]
}
}
Deploy Ingress Nginx with cert-manager and required parameters only:
hclmodule "ingress" {
source = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
version = "~> 5.3"
acme_email = "[email protected]"
}
| Variable | Description | Type | Default | Required | Sensitive |
|---|---|---|---|---|---|
acme_email |
E-mail that Let's Encrypt cluster issuer will use to request certificates | string |
yes | no | |
k8s_flavor |
Name of managed Kubernetes to enable cloud-specific adjustments. Applicable values are: aks or eks |
string |
yes | no | |
cert_manager |
Cert-manager parameters. The parameters are passed to tf-k8s-cert-manager module | any |
{} |
no | no |
ingress_nginx |
Ingress Nginx parameters | object |
{} |
no | no |
ingress_nginx.create_namespace |
Indicates creation of dedicated namespace for Ingress Nginx deployment | bool |
true |
no | no |
ingress_nginx.custom_values |
A list of custom values for Ingress Nginx Helm Chart | list(object) |
no | no | |
ingress_nginx.custom_values[*].name |
Full name of the custom value to be set | string |
yes | no | |
ingress_nginx.custom_values[*].type |
Type of the value to be set (valid options are auto and string) |
string |
auto |
no | no |
ingress_nginx.custom_values[*].value |
Value of the custom value to be set | any |
yes | no | |
ingress_nginx.enable_metrics |
Enable Prometheus metrics of Ingress Nginx | bool |
true |
no | no |
ingress_nginx.enable_real_ip_detection |
Enable/disable Ingress Nginx Real IP detection | bool |
true |
no | no |
ingress_nginx.helm_timeout |
Time in seconds for Helm resource to install in Kubernetes | number |
600 |
no | no |
ingress_nginx.name |
Name to override Ingress Nginx release name | string |
ingress-nginx |
no | no |
ingress_nginx.namespace |
Namespace to install Ingress Nginx into | string |
ingress-nginx |
no | no |
ingress_nginx.replicas |
Number of Ingress Nginx controller replicas | number |
2 |
no | no |
ingress_nginx.version |
Version of Ingress Nginx Helm chart | string |
4.6.1 |
no | no |
| Output | Description | Type | Sensitive |
|---|---|---|---|
ingress_class |
Name of Ingress Class of Ingress Nginx | attribute |
no |
ingress_hostname |
Hostname of Ingress Nginx Load Balancer | computed |
no |
ingress_ip |
External IP of Ingress Nginx Load Balancer | computed |
no |
ingress_nginx_hostname |
Hostname of Ingress Nginx Load Balancer | computed |
no |
ingress_nginx_ip |
External IP of Ingress Nginx Load Balancer | computed |
no |
| Dependency | Version | Kind |
|---|---|---|
terraform |
>= 1.3 |
CLI |
hashicorp/helm |
~> 2.5 |
provider |
hashicorp/kubernetes |
~> 2.9 |
provider |
tf-k8s-cert-manager |
~> 1.0 |
module |