Use upstream ingress-nginx

Change-Id: I3d013b6d0cf1bf5a1ab81870f7b11c6afbaa52d2
2024-01-31 02:11:23 +00:00 · 2024-01-31 02:11:23 +00:00 · 490d1a581e
parent 103aab2ec2
commit 490d1a581e
7 changed files with 668 additions and 246 deletions
--- a/global/software/charts/kubernetes/ingress/ingress.yaml
+++ b/global/software/charts/kubernetes/ingress/ingress.yaml
@ -22,9 +22,60 @@ metadata:
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
-        path: .images.kubernetes.ingress
+        path: .images.kubernetes.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
      dest:
-        path: .values.images.tags
+        path: .values.controller.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.kubernetes.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.kubernetes.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.defaultBackend.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.kubernetes.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.defaultBackend.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.kubernetes.ingress.patch
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.kubernetes.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.digest
+    # Ingress VIP
+    # - src:
+    #     schema: pegleg/CommonAddresses/v1
+    #     name: common-addresses
+    #     path: .calico.bgp.ipv4.ingress_vip
+    #     pattern: ^(.*)/
+    #     match_group: 1
+    #   dest:
+    #     path: .values.controller.service.externalIPs[0]
 data:
  chart_name: ingress-kube-system
  release: ingress-kube-system
@ -43,35 +94,65 @@ data:
          labels:
            release_group: airship-ingress-kube-system
  values:
-    labels:
-      server:
-        node_selector_key: kube-ingress
-        node_selector_value: enabled
-      error_server:
-        node_selector_key: kube-ingress
-        node_selector_value: enabled
-    deployment:
-      mode: cluster
-      type: Deployment
-      cluster:
-        class: kube-ingress
-        controllerClass: k8s.io/kube-ingress
-    conf:
-      ingress:
-        proxy-body-size: 20m
-    network:
-      host_namespace: true
-      ingress:
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-        ingressClass:
-          spec:
-            controller: k8s.io/kube-ingress
-        ingress:
-          spec:
-            ingressClassName: kube-ingress
-    pod:
-      replicas:
-        ingress: 1
-        error_page: 1
-...
+    commonLabels:
+      release_group: airship-ingress-kube-system
+    controller:
+      allowSnippetAnnotations: true
+      enableAnnotationValidations: true
+      admissionWebhooks:
+        enabled: false
+        patch:
+          image:
+            digest: REPLACED
+            repository: REPLACED
+      config:
+        enable-underscores-in-headers: "true"
+        proxy-connect-timeout: "75"
+        proxy-next-upstream: error timeout http_503 http_504
+        proxy-read-timeout: "60"
+        proxy-send-timeout: "60"
+        ssl-ciphers: ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
+        ssl-reject-handshake: "true"
+        upstream-keepalive-timeout: "300"
+      electionID: airship-ingress-kube-system-nginx-cluster
+      extraArgs:
+        default-ssl-certificate: ucp/keystone-tls-public
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      ingressClass: kube-ingress
+      ingressClassByName: true
+      ingressClassResource:
+        controllerValue: k8s.io/kube-ingress
+        enabled: true
+        name: kube-ingress
+      kind: DaemonSet
+      metrics:
+        enabled: true
+        service:
+          annotations:
+            prometheus.io/port: "10254"
+            prometheus.io/scrape: "true"
+      nodeSelector:
+        kube-ingress: enabled
+      podLabels:
+        application: ingress
+        component: server
+        release_group: airship-ingress-kube-system
+      service:
+        externalIPs:
+          - REPLACED
+        type: ClusterIP
+    defaultBackend:
+      enabled: true
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      nodeSelector:
+        kube-ingress: enabled
+      podLabels:
+        application: ingress
+        component: error-pages
+        release_group: airship-ingress-kube-system
+    fullnameOverride: ingress
+...
--- a/global/software/charts/osh-infra/osh-infra-ingress-controller/ingress.yaml
+++ b/global/software/charts/osh-infra/osh-infra-ingress-controller/ingress.yaml
@ -21,56 +21,124 @@ metadata:
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
-        path: .images.osh.ingress
+        path: .images.osh.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
      dest:
-        path: .values.images.tags
+        path: .values.controller.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.defaultBackend.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.defaultBackend.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.patch
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.digest
 data:
  chart_name: osh-infra-ingress-controller
  release: osh-infra-ingress-controller
  namespace: osh-infra
  wait:
-    timeout: 900
+    timeout: 300
    labels:
      release_group: airship-osh-infra-ingress-controller
+    resources:
+      - type: deployment
+        min_ready: 33%
+    native:
+      enabled: false
  install:
    no_hooks: false
  upgrade:
    no_hooks: false
-    pre:
-      delete:
-        - type: job
-          labels:
-            release_group: airship-osh-infra-ingress-controller
-
  values:
-    deployment:
-      cluster:
-        class: osh-infra-ingress
-        controllerClass: k8s.io/osh-infra-ingress
-    conf:
-      ingress:
-        proxy-body-size: 20m
-    labels:
-      server:
-        node_selector_key: openstack-control-plane
-        node_selector_value: enabled
-      error_server:
-        node_selector_key: openstack-control-plane
-        node_selector_value: enabled
-    pod:
-      replicas:
-        ingress: 2
-        error_page: 2
-    network:
-      ingress:
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: 20m
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-        ingressClass:
-          spec:
-            controller: k8s.io/osh-infra-ingress
-        ingress:
-          spec:
-            ingressClassName: osh-infra-ingress
-  dependencies:
-    - osh-helm-toolkit
+    commonLabels:
+      release_group: airship-osh-infra-ingress-controller
+    controller:
+      allowSnippetAnnotations: true
+      enableAnnotationValidations: true
+      admissionWebhooks:
+        enabled: false
+        patch:
+          image:
+            digest: REPLACED
+            repository: REPLACED
+      config:
+        enable-underscores-in-headers: "true"
+        ssl-reject-handshake: "true"
+      electionID: airship-osh-infra-ingress-controller
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      ingressClass: osh-infra-ingress
+      ingressClassByName: true
+      ingressClassResource:
+        controllerValue: k8s.io/osh-infra-ingress
+        enabled: true
+        name: osh-infra-ingress
+      kind: Deployment
+      metrics:
+        enabled: true
+        service:
+          annotations:
+            prometheus.io/port: '10254'
+            prometheus.io/scrape: 'true'
+      nodeSelector:
+        openstack-control-plane: enabled
+      podLabels:
+        app: ingress-api
+        application: ingress
+        component: server
+        release_group: airship-osh-infra-ingress-controller
+      replicaCount: 1
+      scope:
+        enabled: true
+      service:
+        type: ClusterIP
+    defaultBackend:
+      enabled: true
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      nodeSelector:
+        openstack-control-plane: enabled
+      podLabels:
+        application: ingress
+        component: error-pages
+        release_group: airship-osh-infra-ingress-controller
+    fullnameOverride: osh-infra-ingress
+    rbac:
+      scope: false
+...
--- a/global/software/charts/osh/openstack-ingress-controller/ingress.yaml
+++ b/global/software/charts/osh/openstack-ingress-controller/ingress.yaml
@ -22,55 +22,127 @@ metadata:
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
-        path: .images.osh.ingress
+        path: .images.osh.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
      dest:
-        path: .values.images.tags
+        path: .values.controller.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.defaultBackend.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.defaultBackend.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.patch
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.osh.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.digest
 data:
  chart_name: openstack-ingress-controller
  release: openstack-ingress-controller
  namespace: openstack
  wait:
-    timeout: 900
+    timeout: 300
    labels:
      release_group: airship-openstack-ingress-controller
+    resources:
+      - type: deployment
+        min_ready: 33%
+    native:
+      enabled: false
  install:
    no_hooks: false
  upgrade:
    no_hooks: false
-    pre:
-      delete:
-        - type: job
-          labels:
-            release_group: airship-openstack-ingress-controller
  values:
-    deployment:
-      cluster:
-        class: openstack-ingress
-        controllerClass: k8s.io/openstack-ingress
-    conf:
-      ingress:
-        proxy-body-size: 20m
-    labels:
-      server:
-        node_selector_key: openstack-control-plane
-        node_selector_value: enabled
-      error_server:
-        node_selector_key: openstack-control-plane
-        node_selector_value: enabled
-    pod:
-      replicas:
-        ingress: 2
-        error_page: 2
-    network:
-      ingress:
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: 20m
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-        ingressClass:
-          spec:
-            controller: k8s.io/openstack-ingress
-        ingress:
-          spec:
-            ingressClassName: openstack-ingress
-...
-
+    commonLabels:
+      release_group: airship-openstack-ingress-controller
+    controller:
+      allowSnippetAnnotations: true
+      enableAnnotationValidations: true
+      admissionWebhooks:
+        enabled: false
+        patch:
+          image:
+            digest: REPLACED
+            repository: REPLACED
+      config:
+        enable-underscores-in-headers: "true"
+        proxy-next-upstream: error timeout http_504
+        upstream-keepalive-timeout: "300"
+        ssl-ciphers: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256"
+        ssl-reject-handshake: "true"
+      electionID: airship-openstack-ingress-controller
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      ingressClass: openstack-ingress
+      ingressClassByName: true
+      ingressClassResource:
+        controllerValue: k8s.io/openstack-ingress
+        enabled: true
+        name: openstack-ingress
+      kind: Deployment
+      metrics:
+        enabled: true
+        service:
+          annotations:
+            prometheus.io/port: '10254'
+            prometheus.io/scrape: 'true'
+      nodeSelector:
+        openstack-control-plane: enabled
+      podLabels:
+        app: ingress-api
+        application: ingress
+        component: server
+        release_group: airship-openstack-ingress-controller
+      replicaCount: 1
+      scope:
+        enabled: true
+      service:
+        type: ClusterIP
+    defaultBackend:
+      enabled: true
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      nodeSelector:
+        openstack-control-plane: enabled
+      podLabels:
+        application: ingress
+        component: error-pages
+        release_group: airship-openstack-ingress-controller
+    fullnameOverride: openstack-ingress
+    rbac:
+      scope: false
+...
--- a/global/software/charts/osh/openstack-tenant-ceph/ceph-ingress.yaml
+++ b/global/software/charts/osh/openstack-tenant-ceph/ceph-ingress.yaml
@ -21,9 +21,51 @@ metadata:
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
-        path: .images.ucp.ingress
+        path: .images.ucp.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
      dest:
-        path: .values.images.tags
+        path: .values.controller.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.defaultBackend.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.defaultBackend.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.patch
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.digest
 data:
  chart_name: tenant-ceph-ingress
  release: tenant-ceph-ingress
@ -32,43 +74,72 @@ data:
    timeout: 300
    labels:
      release_group: airship-tenant-ceph-ingress
+    resources:
+      - type: deployment
+        min_ready: 33%
+    native:
+      enabled: false
  install:
    no_hooks: false
  upgrade:
    no_hooks: false
-    pre:
-      delete:
-        - type: job
-          labels:
-            release_group: airship-tenant-ceph-ingress
  values:
-    deployment:
-      cluster:
-        class: tenant-ceph-ingress
-        controllerClass: k8s.io/tenant-ceph-ingress
-    conf:
-      ingress:
+    commonLabels:
+      release_group: airship-tenant-ceph-ingress
+    controller:
+      allowSnippetAnnotations: true
+      enableAnnotationValidations: true
+      admissionWebhooks:
+        enabled: false
+        patch:
+          image:
+            digest: REPLACED
+            repository: REPLACED
+      config:
+        enable-underscores-in-headers: "true"
        proxy-body-size: 20m
-    labels:
-      server:
-        node_selector_key: tenant-ceph-control-plane
-        node_selector_value: enabled
-      error_server:
-        node_selector_key: tenant-ceph-control-plane
-        node_selector_value: enabled
-    pod:
-      replicas:
-        ingress: 2
-        error_page: 2
-    network:
-      ingress:
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: 20m
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-        ingressClass:
-          spec:
-            controller: k8s.io/tenant-ceph-ingress
-        ingress:
-          spec:
-            ingressClassName: tenant-ceph-ingress
+        ssl-reject-handshake: "true"
+      electionID: airship-tenant-ceph-ingress
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      ingressClass: tenant-ceph-ingress
+      ingressClassByName: true
+      ingressClassResource:
+        controllerValue: k8s.io/tenant-ceph-ingress
+        enabled: false
+        name: tenant-ceph-ingress
+      kind: Deployment
+      metrics:
+        enabled: true
+        service:
+          annotations:
+            prometheus.io/port: '10254'
+            prometheus.io/scrape: 'true'
+      nodeSelector:
+        tenant-ceph-control-plane: enabled
+      podLabels:
+        app: ingress-api
+        application: ingress
+        component: server
+        release_group: airship-tenant-ceph-ingress
+      replicaCount: 1
+      scope:
+        enabled: true
+      service:
+        type: ClusterIP
+    defaultBackend:
+      enabled: true
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      nodeSelector:
+        tenant-ceph-control-plane: enabled
+      podLabels:
+        application: ingress
+        component: error-pages
+        release_group: airship-tenant-ceph-ingress
+    fullnameOverride: ingress
+    rbac:
+      scope: true
 ...
--- a/global/software/charts/ucp/ceph/ceph-ingress.yaml
+++ b/global/software/charts/ucp/ceph/ceph-ingress.yaml
@ -3,11 +3,11 @@ schema: armada/Chart/v1
 metadata:
  schema: metadata/Document/v1
  name: ucp-ceph-ingress
+  labels:
+    name: ucp-ceph-ingress-global
  layeringDefinition:
    abstract: false
    layer: global
-  labels:
-    name: ucp-ceph-ingress-global
  storagePolicy: cleartext
  substitutions:
    # Chart source
@ -21,9 +21,51 @@ metadata:
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
-        path: .images.ucp.ingress
+        path: .images.ucp.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
      dest:
-        path: .values.images.tags
+        path: .values.controller.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.defaultBackend.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.defaultBackend.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.patch
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.digest
 data:
  chart_name: ucp-ceph-ingress
  release: ucp-ceph-ingress
@ -32,40 +74,71 @@ data:
    timeout: 300
    labels:
      release_group: airship-ucp-ceph-ingress
+    resources:
+      - type: deployment
+        min_ready: 33%
+    native:
+      enabled: false
  install:
    no_hooks: false
  upgrade:
    no_hooks: false
-    pre:
-      delete:
-        - type: job
-          labels:
-            release_group: airship-ucp-ceph-ingress
  values:
-    conf:
-      ingress:
-        proxy-body-size: 20m
+    commonLabels:
+      release_group: airship-ucp-ceph-ingress
    controller:
+      allowSnippetAnnotations: true
+      enableAnnotationValidations: true
+      admissionWebhooks:
+        enabled: false
+        patch:
+          image:
+            digest: REPLACED
+            repository: REPLACED
+      config:
+        enable-underscores-in-headers: "true"
+        proxy-body-size: 20m
+        ssl-reject-handshake: "true"
+      electionID: airship-ucp-ceph-ingress
+      image:
+        digest: REPLACED
+        repository: REPLACED
      ingressClass: ceph-ingress
      ingressClassByName: true
      ingressClassResource:
        controllerValue: k8s.io/ceph-ingress
        enabled: false
-        name: ceph-ingress
-    labels:
-      server:
-        node_selector_key: ucp-control-plane
-        node_selector_value: enabled
-      error_server:
-        node_selector_key: ucp-control-plane
-        node_selector_value: enabled
-    pod:
-      replicas:
-        ingress: 2
-        error_page: 2
-    network:
-      ingress:
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: 20m
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-...
+      kind: Deployment
+      metrics:
+        enabled: true
+        service:
+          annotations:
+            prometheus.io/port: '10254'
+            prometheus.io/scrape: 'true'
+      nodeSelector:
+        ucp-control-plane: enabled
+      podLabels:
+        app: ingress-api
+        application: ingress
+        component: server
+        release_group: airship-ucp-ceph-ingress
+      replicaCount: 1
+      scope:
+        enabled: true
+      service:
+        type: ClusterIP
+    defaultBackend:
+      enabled: true
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      nodeSelector:
+        ucp-control-plane: enabled
+      podLabels:
+        application: ingress
+        component: error-pages
+        release_group: airship-ucp-ceph-ingress
+    fullnameOverride: ingress
+    rbac:
+      scope: true
+...
--- a/global/software/charts/ucp/core/ingress.yaml
+++ b/global/software/charts/ucp/core/ingress.yaml
@ -21,9 +21,51 @@ metadata:
    - src:
        schema: pegleg/SoftwareVersions/v1
        name: software-versions
-        path: .images.ucp.ingress
+        path: .images.ucp.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
      dest:
-        path: .values.images.tags
+        path: .values.controller.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.controller
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.defaultBackend.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.defaultBackend.image.digest
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.patch
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 1
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.repository
+    - src:
+        schema: pegleg/SoftwareVersions/v1
+        name: software-versions
+        path: .images.ucp.ingress.defaultBackend
+        pattern: ^(.*)@(sha256:.*)$
+        match_group: 2
+      dest:
+        path: .values.controller.admissionWebhooks.patch.image.digest
 data:
  chart_name: ingress
  release: ingress
@ -32,43 +74,72 @@ data:
    timeout: 300
    labels:
      release_group: airship-ingress
+    resources:
+      - type: deployment
+        min_ready: 33%
+    native:
+      enabled: false
  install:
    no_hooks: false
  upgrade:
    no_hooks: false
-    pre:
-      delete:
-        - type: job
-          labels:
-            release_group: airship-ingress
  values:
-    deployment:
-      cluster:
-        class: ucp-ingress
-        controllerClass: k8s.io/ucp-ingress
-    conf:
-      ingress:
+    commonLabels:
+      release_group: airship-ingress
+    controller:
+      allowSnippetAnnotations: true
+      enableAnnotationValidations: true
+      admissionWebhooks:
+        enabled: false
+        patch:
+          image:
+            digest: REPLACED
+            repository: REPLACED
+      config:
+        enable-underscores-in-headers: "true"
        proxy-body-size: 20m
-    labels:
-      server:
-        node_selector_key: ucp-control-plane
-        node_selector_value: enabled
-      error_server:
-        node_selector_key: ucp-control-plane
-        node_selector_value: enabled
-    pod:
-      replicas:
-        ingress: 2
-        error_page: 2
-    network:
-      ingress:
-        annotations:
-          nginx.ingress.kubernetes.io/proxy-body-size: 20m
-          nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-        ingressClass:
-          spec:
-            controller: k8s.io/ucp-ingress
-        ingress:
-          spec:
-            ingressClassName: ucp-ingress
-...
+        ssl-reject-handshake: "true"
+      electionID: airship-ingress
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      ingressClass: ucp-ingress
+      ingressClassByName: true
+      ingressClassResource:
+        controllerValue: k8s.io/ucp-ingress
+        enabled: true
+        name: ucp-ingress
+      kind: Deployment
+      metrics:
+        enabled: true
+        service:
+          annotations:
+            prometheus.io/port: '10254'
+            prometheus.io/scrape: 'true'
+      nodeSelector:
+        ucp-control-plane: enabled
+      podLabels:
+        app: ingress-api
+        application: ingress
+        component: server
+        release_group: airship-ingress
+      replicaCount: 1
+      scope:
+        enabled: true
+      service:
+        type: ClusterIP
+    defaultBackend:
+      enabled: true
+      image:
+        digest: REPLACED
+        repository: REPLACED
+      nodeSelector:
+        ucp-control-plane: enabled
+      podLabels:
+        application: ingress
+        component: error-pages
+        release_group: airship-ingress
+    fullnameOverride: ucp-ingress
+    rbac:
+      scope: false
+...
--- a/global/software/config/versions.yaml
+++ b/global/software/config/versions.yaml
@ -17,7 +17,7 @@ data:
          type: tar
      controller-manager:
        location: http://control-plane.minikube.internal:8282/controller_manager.tgz
-        subpath: controller_manager
+        subpath: controller_managerin
        type: tar
      coredns:
        location: http://control-plane.minikube.internal:8282/etcd.tgz
@ -32,8 +32,8 @@ data:
        subpath: haproxy
        type: tar
      ingress:
-        location: http://control-plane.minikube.internal:8282/ingress.tgz
-        subpath: ingress
+        location: https://github.com/kubernetes/ingress-nginx/releases/download/helm-chart-4.8.3/ingress-nginx-4.8.3.tgz
+        subpath: ingress-nginx
        type: tar
      proxy:
        location: http://control-plane.minikube.internal:8282/proxy.tgz
@ -94,8 +94,8 @@ data:
        subpath: helm-toolkit
        type: git
      ingress:
-        location: http://control-plane.minikube.internal:8282/ingress.tgz
-        subpath: ingress
+        location: https://github.com/kubernetes/ingress-nginx/releases/download/helm-chart-4.8.3/ingress-nginx-4.8.3.tgz
+        subpath: ingress-nginx
        type: tar
      keystone:
        location: http://control-plane.minikube.internal:8282/keystone.tgz
@ -287,8 +287,8 @@ data:
        subpath: drydock
        type: tar
      ingress:
-        location: http://control-plane.minikube.internal:8282/ingress.tgz
-        subpath: ingress
+        location: https://github.com/kubernetes/ingress-nginx/releases/download/helm-chart-4.8.3/ingress-nginx-4.8.3.tgz
+        subpath: ingress-nginx
        type: tar
      keystone:
        location: http://control-plane.minikube.internal:8282/keystone.tgz
@ -519,13 +519,9 @@ data:
        test: docker.io/library/python:3.6
      hyperkube: gcr.io/google-containers/hyperkube-amd64:v1.17.3
      ingress:
-        dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
-        entrypoint: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
-        error_pages: gcr.io/google_containers/defaultbackend:1.0
-        ingress: registry.k8s.io/ingress-nginx/controller:v1.8.2
-        ingress_module_init: docker.io/openstackhelm/neutron:xena-ubuntu_focal
-        ingress_routed_vip: docker.io/openstackhelm/neutron:xena-ubuntu_focal
-        keepalived: docker.io/osixia/keepalived:1.4.5
+        controller: registry.k8s.io/ingress-nginx/controller:v1.9.4
+        defaultBackend: k8s.gcr.io/defaultbackend-amd64:1.5
+        patch: k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343
      pause: gcr.io/google-containers/pause-amd64:3.1
      proxy:
        proxy: gcr.io/google-containers/hyperkube-amd64:v1.17.3
@ -608,14 +604,9 @@ data:
        horizon_db_sync: docker.io/openstackhelm/horizon:ocata-ubuntu_xenial-20200513
        test: docker.io/openstackhelm/osh-selenium:latest-ubuntu_bionic
      ingress:
-        entrypoint: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
-        ingress: registry.k8s.io/ingress-nginx/controller:v1.8.2
-        ingress_module_init: docker.io/openstackhelm/neutron:xena-ubuntu_focal
-        ingress_routed_vip: docker.io/openstackhelm/neutron:xena-ubuntu_focal
-        error_pages: registry.k8s.io/defaultbackend:1.4
-        keepalived: docker.io/osixia/keepalived:1.4.5
-        dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
-        image_repo_sync: docker.io/library/docker:17.07.0
+        controller: registry.k8s.io/ingress-nginx/controller:v1.9.4
+        defaultBackend: k8s.gcr.io/defaultbackend-amd64:1.5
+        patch: k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343
      keystone:
        bootstrap: docker.io/openstackhelm/heat:wallaby-ubuntu_focal
        test: docker.io/xrally/xrally-openstack:2.0.0
@ -838,14 +829,9 @@ data:
        drydock_db_cleanup: quay.io/airshipit/drydock:master
        drydock_db_sync: quay.io/airshipit/drydock:master
      ingress:
-        entrypoint: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
-        ingress: registry.k8s.io/ingress-nginx/controller:v1.8.2
-        ingress_module_init: docker.io/openstackhelm/neutron:xena-ubuntu_focal
-        ingress_routed_vip: docker.io/openstackhelm/neutron:xena-ubuntu_focal
-        error_pages: registry.k8s.io/defaultbackend:1.4
-        keepalived: docker.io/osixia/keepalived:1.4.5
-        dep_check: quay.io/airshipit/kubernetes-entrypoint:v1.0.0
-        image_repo_sync: docker.io/library/docker:17.07.0
+        controller: registry.k8s.io/ingress-nginx/controller:v1.9.4
+        defaultBackend: k8s.gcr.io/defaultbackend-amd64:1.5
+        patch: k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v20220916-gd32f8c343
      keystone:
        bootstrap: docker.io/openstackhelm/heat:wallaby-ubuntu_focal
        test: docker.io/xrally/xrally-openstack:2.0.0
@ -872,13 +858,13 @@ data:
        export_api_key: quay.io/airshipit/maas-region-controller:latest
        maas_cache: quay.io/airshipit/sstream-cache:latest
        dep_check: quay.io/stackanetes/kubernetes-entrypoint:v0.3.1
-        ingress: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.26.1
+        ingress: registry.k8s.io/ingress-nginx/controller:v1.9.4
        ingress_vip: docker.io/busybox:latest
        error_pages: gcr.io/google_containers/ingress-gce-404-server-with-metrics-amd64:v1.6.0
        maas_syslog: quay.io/airshipit/maas-region-controller:latest
      mariadb:
        mariadb: docker.io/openstackhelm/mariadb:latest-ubuntu_focal
-        ingress: registry.k8s.io/ingress-nginx/controller:v1.5.1
+        ingress: registry.k8s.io/ingress-nginx/controller:v1.9.4
        error_pages: registry.k8s.io/defaultbackend:1.4
        prometheus_create_mysql_user: docker.io/library/mariadb:10.6.14-focal
        prometheus_mysql_exporter: docker.io/prom/mysqld-exporter:v0.12.1