--- images: tags: nginx: docker.io/nginx:1.18.0 conf: glance: DEFAULT: bind_host: 127.0.0.1 keystone_authtoken: cafile: /etc/glance/certs/ca.crt glance_store: https_ca_certificates_file: /etc/glance/certs/ca.crt swift_store_cacert: /etc/glance/certs/ca.crt oslo_messaging_rabbit: ssl: true ssl_ca_file: /etc/rabbitmq/certs/ca.crt ssl_cert_file: /etc/rabbitmq/certs/tls.crt ssl_key_file: /etc/rabbitmq/certs/tls.key nginx: | worker_processes 1; daemon off; user nginx; events { worker_connections 1024; } http { include /etc/nginx/mime.types; default_type application/octet-stream; sendfile on; keepalive_timeout 65s; tcp_nodelay on; log_format main '[nginx] method=$request_method path=$request_uri ' 'status=$status upstream_status=$upstream_status duration=$request_time size=$body_bytes_sent ' '"$remote_user" "$http_referer" "$http_user_agent"'; access_log /dev/stdout main; upstream websocket { server 127.0.0.1:$PORT; } server { server_name {{ printf "%s.%s.svc.%s" "${SHORTNAME}" .Release.Namespace .Values.endpoints.cluster_domain_suffix }}; listen $POD_IP:$PORT ssl; client_max_body_size 0; ssl_certificate /etc/nginx/certs/tls.crt; ssl_certificate_key /etc/nginx/certs/tls.key; ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384; location / { proxy_pass_request_headers on; proxy_http_version 1.1; proxy_pass http://websocket; proxy_read_timeout 90; } } } network: api: ingress: annotations: nginx.ingress.kubernetes.io/backend-protocol: "https" endpoints: identity: name: keystone auth: admin: cacert: /etc/ssl/certs/openstack-helm.crt glance: cacert: /etc/ssl/certs/openstack-helm.crt test: cacert: /etc/ssl/certs/openstack-helm.crt scheme: default: https port: api: default: 443 image: host_fqdn_override: default: tls: secretName: glance-tls-api issuerRef: name: ca-issuer kind: ClusterIssuer scheme: default: https public: https port: api: public: 443 dashboard: scheme: default: https public: https port: web: default: 80 public: 443 oslo_messaging: port: https: default: 15680 pod: security_context: glance: pod: runAsUser: 0 resources: nginx: requests: memory: "128Mi" cpu: "100m" limits: memory: "1024Mi" cpu: "2000m" manifests: certificates: true ...