values-ingress-nginx.yaml

# Values for the official ingress-nginx Helm chart.
# Repo: https://kubernetes.github.io/ingress-nginx

controller:
  # LoadBalancer so `minikube tunnel` exposes it on a host-routable IP
  # (127.0.0.1 on macOS/docker, the minikube IP on Linux/vfkit).
  service:
    type: LoadBalancer

  # IngressClass — single default class for the cluster.
  ingressClassResource:
    name: nginx
    enabled: true
    default: true

  # Local dev profile — modest footprint, single replica.
  replicaCount: 1
  resources:
    requests:
      cpu: 100m
      memory: 128Mi
    limits:
      cpu: 500m
      memory: 512Mi

  admissionWebhooks:
    enabled: true
    # Provision the admission-webhook serving cert via cert-manager instead of
    # the chart's default `-create`/`-patch` helm-hook jobs. Those jobs are
    # post-install hooks: the ValidatingWebhookConfiguration exists for a
    # window with an empty `caBundle`, and any `kubectl apply` of an Ingress
    # in that window fails with `x509: certificate signed by unknown
    # authority`. Letting cert-manager + cainjector handle it eliminates the
    # race — the caBundle is injected via the
    # `cert-manager.io/inject-ca-from` annotation the chart already sets when
    # `certManager.enabled=true`.
    patch:
      enabled: false
    createSecretJob:
      enabled: false
    patchWebhookJob:
      enabled: false
    certManager:
      enabled: true
      rootCert:
        # Reuse the local root CA — keeps the trust chain a single CA.
        # Falls back to cert-manager generating a per-install CA if you
        # comment this block out.
        useCertManager: true
      admissionCert:
        duration: 8760h   # 1 year, cert-manager handles renewal
      issuerRef:
        name: fleet-ca
        kind: ClusterIssuer
        group: cert-manager.io