apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: ingress-nginx
  namespace: nginx-system
spec:
  releaseName: nginx-ingress
  chart:
    spec:
      chart: ingress-nginx
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
        namespace: nginx-system
      version: 4.0.18
  interval: 5m
  valuesFrom:
    - kind: ConfigMap
      name: ingress-nginx-base-values
      valuesKey: values.yaml
    - kind: Secret
      name: ingress-nginx-override-values
      valuesKey: values-overrides.yaml
      optional: true
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-nginx-base-values
  namespace: nginx-system
data:
  values.yaml: |
    controller:
      ingressClassResource:
        name: nginx
        enabled: true
        default: true
        controllerValue: "k8s.io/ingress-nginx"
      # Configuring various details for ingress-nginx that make sense by default
      config:
        enable-modsecurity: "true"
        enable-owasp-modsecurity-crs: "true"
        enable-ocsp: "true"
        hsts: "true"
        hsts-max-age: "63072000"
        hsts-include-subdomains: false
        enable-brotli: "true"
        use-http2: "true"
      dnsConfig:
        options:
          - name: ndots
            value: "1"
      replicaCount: 2
      minAvailable: 1
      resources:
        limits:
          memory: 1Gi
        requests:
          cpu: 100m
          memory: 400Mi
      service:
        enabled: true
        enableHttp: true
        enableHttps: true
        # Has to be set to keep external IPs
        externalTrafficPolicy: "Local"
        ports:
          http: 80
          https: 443
        targetPorts:
          http: http
          https: https
        type: LoadBalancer
      admissionWebhooks:
        enabled: true
        failurePolicy: Fail
        service:
          servicePort: 443
          type: ClusterIP

      metrics:
        enabled: true
        port: 10254
        serviceMonitor:
          enabled: true
        prometheusRule:
          enabled: true
          rules:
            # # Initial ingress alerting rules
            - alert: NGINXConfigFailed
              expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0
              for: 30m
              labels:
                severity: critical
              annotations:
                description: bad ingress config - nginx config test failed
                summary: uninstall the latest ingress changes to allow config reloads to resume
            - alert: NGINXCertificateExpiry
              expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800
              for: 30m
              labels:
                severity: critical
              annotations:
                description: ssl certificate(s) will expire in less then a week
                summary: renew expiring certificates to avoid downtime
            - alert: NGINXTooMany500s
              expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
              for: 30m
              labels:
                severity: warning
              annotations:
                description: Too many 5XXs
                summary: More than 5% of all requests returned 5XX, this requires your attention
            - alert: NGINXTooMany400s
              expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
              for: 30m
              labels:
                severity: warning
              annotations:
                description: Too many 4XXs
                summary: More than 5% of all requests returned 4XX, this requires your attention
    rbac:
      create: true
      scope: false
    podSecurityPolicy:
      enabled: true
    serviceAccount:
      create: true
