[charts/ingress-nginx] add Service Internal Traffic Policy enables in…

charts/ingress-nginx/README.md

@@ -434,6 +434,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.service.internal.enabled | bool | `false` | Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this. |
 | controller.service.internal.externalIPs | list | `[]` | List of node IP addresses at which the internal controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips |
 | controller.service.internal.externalTrafficPolicy | string | `""` | External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip |
+| controller.service.internal.internalTrafficPolicy | string | `""` | Service Internal Traffic Policy enables internal traffic restrictions to only route internal traffic to endpoints within the node the traffic originated from. Set this to 'Local' to instruct kube-proxy to use only node-local endpoints for handling cluster internal traffic. Ref: https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy |
 | controller.service.internal.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
 | controller.service.internal.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
 | controller.service.internal.loadBalancerClass | string | `""` | Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class |
@@ -447,6 +448,7 @@ As of version `1.26.0` of this chart, by simply not providing any clusterIP valu
 | controller.service.internal.sessionAffinity | string | `""` | Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity |
 | controller.service.internal.targetPorts | object | `{}` |  |
 | controller.service.internal.type | string | `""` | Type of the internal controller service. Defaults to the value of `controller.service.type`. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types |
+| controller.service.internalTrafficPolicy | string | `""` | Service Internal Traffic Policy enables internal traffic restrictions to only route internal traffic to endpoints within the node the traffic originated from. Set this to 'Local' to instruct kube-proxy to use only node-local endpoints for handling cluster internal traffic. Ref: https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy |
 | controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
 | controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
 | controller.service.labels | object | `{}` | Labels to be added to both controller services. |

charts/ingress-nginx/templates/controller-service-internal.yaml

@@ -37,6 +37,9 @@ spec:
 {{- if .Values.controller.service.internal.externalTrafficPolicy }}
   externalTrafficPolicy: {{ .Values.controller.service.internal.externalTrafficPolicy }}
 {{- end }}
+{{- if .Values.controller.service.internal.internalTrafficPolicy }}
+  internalTrafficPolicy: {{ .Values.controller.service.internal.internalTrafficPolicy }}
+{{- end }}
 {{- if .Values.controller.service.internal.sessionAffinity }}
   sessionAffinity: {{ .Values.controller.service.internal.sessionAffinity }}
 {{- end }}

charts/ingress-nginx/templates/controller-service.yaml

@@ -37,6 +37,9 @@ spec:
 {{- if .Values.controller.service.externalTrafficPolicy }}
   externalTrafficPolicy: {{ .Values.controller.service.externalTrafficPolicy }}
 {{- end }}
+{{- if .Values.controller.service.internalTrafficPolicy }}
+  internalTrafficPolicy: {{ .Values.controller.service.internalTrafficPolicy }}
+{{- end }}
 {{- if .Values.controller.service.sessionAffinity }}
   sessionAffinity: {{ .Values.controller.service.sessionAffinity }}
 {{- end }}

charts/ingress-nginx/values.yaml

@@ -477,6 +477,10 @@ controller:
     # -- External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it.
     # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
     externalTrafficPolicy: ""
+    # -- Service Internal Traffic Policy enables internal traffic restrictions to only route internal traffic to endpoints within the node the traffic originated from.
+    # Set this to 'Local' to instruct kube-proxy to use only node-local endpoints for handling cluster internal traffic.
+    # Ref: https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy
+    internalTrafficPolicy: ""
     # -- Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
     # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
     sessionAffinity: ""
@@ -557,6 +561,10 @@ controller:
       # -- External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it.
       # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
       externalTrafficPolicy: ""
+      # -- Service Internal Traffic Policy enables internal traffic restrictions to only route internal traffic to endpoints within the node the traffic originated from.
+      # Set this to 'Local' to instruct kube-proxy to use only node-local endpoints for handling cluster internal traffic.
+      # Ref: https://kubernetes.io/docs/concepts/services-networking/service-traffic-policy
+      internalTrafficPolicy: ""
       # -- Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
       # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
       sessionAffinity: ""