Update spegel Docker tag to v0.7.0

charts/atlantis/Chart.yaml

@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.5.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.5.3
+appVersion: v2.5.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/atlantis/values.yaml

@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.5.3
+  tag: v2.5.2
   pullPolicy: IfNotPresent
 init:
   enabled: false

charts/codex/Chart.yaml

@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v2.5.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v2.5.3"
+appVersion: "v2.5.2"

charts/codex/values.yaml

@@ -10,7 +10,7 @@ image:
   # This sets the pull policy for images.
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
-  tag: v2.5.3
+  tag: v2.5.2
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
   - name: gitlab-pull-secret

charts/docs/values.yaml

@@ -47,7 +47,7 @@ service:
   port: 8080
 ingress:
   enabled: true
-  className: haproxy
+  className: nginx
 persistence:
   enabled: false
   size: 1G

charts/makai/values.yaml

@@ -47,7 +47,7 @@ service:
   port: 8080
 ingress:
   enabled: true
-  className: haproxy
+  className: nginx
 persistence:
   enabled: false
   size: 1G

charts/sorcerer/Chart.yaml

@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.5.3
+version: v2.5.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.5.3
+appVersion: v2.5.2
 dependencies:
   - name: diagrid-dashboard
     version: "0.1.0"

charts/sorcerer/values.yaml

@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v2.5.3
+  tag: v2.5.2
   pullPolicy: IfNotPresent
 init:
   enabled: false

helmfile.d/argo.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: argocd
   namespace: argocd
   chart: argo/argo-cd
-  version: 9.5.4
+  version: 9.5.2
   condition: argo.enabled
   values:
   - ../values/argo/values/argocd.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
   namespace: argocd
   chart: argo/argo-workflows
-  version: 1.0.13
+  version: 1.0.10
   condition: argo.workflows.enabled
   missingFileHandler: Info
 - name: manifests

helmfile.d/ingress-haproxy.yaml.gotmpl

@@ -1,44 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-repositories:
-- name: haproxytech
-  oci: true
-  url: 'ghcr.io/haproxytech/helm-charts'
-
-commonLabels:
-  tier: system
-
-releases:
-- name: ingress-haproxy
-  namespace: ingress-haproxy
-  chart: haproxytech/kubernetes-ingress
-  version: 1.42.0
-  condition: haproxy.enabled
-  values:
-  - ../values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl
-  - ../values/ingress-haproxy/values/ingress-haproxy-{{ .Environment.Name }}.yaml.gotmpl
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/ingress-haproxy/kustomize/{{ .Environment.Name }}
-  missingFileHandler: Info
-- name: manifests
-  namespace: ingress-haproxy
-  chart: manifests
-  condition: haproxy.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/ingress-haproxy/env.yaml.gotmpl
-  - ../values/ingress-haproxy/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/ingress-haproxy/manifests
-    - manifests

helmfile.d/kyverno.yaml.gotmpl

@@ -15,7 +15,7 @@ releases:
 - name: kyverno
   namespace: kyverno
   chart: kyverno/kyverno
-  version: 3.7.2
+  version: 3.7.1
   condition: kyverno.enabled
   values:
   - ../values/kyverno/values/kyverno.yaml.gotmpl

helmfile.d/loki.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: loki
   namespace: loki
   chart: loki/loki
-  version: 7.0.0
+  version: 6.55.0
   condition: loki.enabled
   values:
   - ../values/loki/values/loki.yaml.gotmpl

helmfile.d/opentelemetry-collector.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
   namespace: otel
   chart: open-telemetry/opentelemetry-collector
-  version: 0.152.0
+  version: 0.150.1
   condition: otel.enabled
   values:
   - ../values/opentelemetry-collector/values/values.yaml

helmfile.d/spegel.yaml.gotmpl

@@ -13,7 +13,7 @@ releases:
 - name: spegel
   namespace: spegel
   chart: spegel/spegel
-  version: 0.6.0
+  version: 0.7.0
   condition: spegel.enabled
   values:
   - ../values/spegel/values/spegel.yaml.gotmpl

helmfile.d/umami.yaml.gotmpl

@@ -14,7 +14,7 @@ releases:
 - name: umami
   namespace: analytics
   chart: umami/umami
-  version: 7.8.2
+  version: 7.7.20
   condition: umami.enabled
   values:
   - ../values/umami/values/values.yaml

helmfile.d/x509-exporter.yaml.gotmpl

@@ -12,7 +12,7 @@ releases:
 - name: x509-exporter
   namespace: x509-exporter
   chart: x509-exporter/x509-certificate-exporter
-  version: 3.21.0
+  version: 3.20.1
   condition: x509_exporter.enabled
   values:
   - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl

values/atlantis/kustomize/staging/actor-config.yaml

@@ -3,7 +3,7 @@ kind: ConfigMap
 metadata:
   name: staging-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.12"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
   XTRACT_QUEUE: "dev-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.12"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
   PLUME_QUEUE: "dev-queue"

values/atlantis/values/values-staging.yaml.gotmpl

@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
   repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: ea26ac41-debug
+  tag: 5d810716-debug
 podAnnotations:
   dapr.io/app-id: "staging-atlantis"
 env:

values/attic/manifests/ingress.yaml

@@ -3,14 +3,17 @@ kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/timeout-server: 600s
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
   labels:
     app.kubernetes.io/component: attic
   name: attic
   namespace: attic
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
   rules:
   - host: attic.srv.oceanbox.io
     http:

values/docs/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "f040ed60-debug"
+  tag: "ea8cf7dc-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"
@@ -8,11 +8,13 @@ env:
     value: "1"
 ingress:
   enabled: true
-  className: "haproxy"
+  className: "nginx"
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
     oceanbox.io/expose: internal
   hosts:
     - host: docs.oceanbox.io

values/gatus/manifests/ingress.yaml

@@ -3,15 +3,17 @@ kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: ca-issuer
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/cors-allow-headers: Content-Type, x-gatus-cache
+    nginx.ingress.kubernetes.io/cors-allow-headers: Content-Type, x-gatus-cache
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
   labels:
     app.kubernetes.io/name: gatus
   name: gatus
   namespace: uptime
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
   rules:
     - host: uptime.adm.hel1.obx
       http:
@@ -22,7 +24,7 @@ spec:
                 port:
                   number: 80
             path: /
-            pathType: Prefix
+            pathType: ImplementationSpecific
   tls:
     - hosts:
         - uptime.adm.hel1.obx

values/gitea/values/values.yaml

@@ -135,12 +135,15 @@ gitea:
 
 ingress:
   enabled: true
-  className: haproxy
+  className: nginx
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    haproxy.org/timeout-server: 600s
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/allow-list: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
   hosts:
     - host: git.oceanbox.io
       paths:

values/ingress-haproxy/env-hel1.yaml.gotmpl

@@ -1,15 +0,0 @@
-haproxy:
-  enabled: true
-  autosync: true
-  pdb:
-    minAvailable: 1
-  resources:
-    controller:
-      cpu: "100m"
-      memory: "100Mi"
-  annotations:
-    load-balancer.hetzner.cloud/http-redirect-http: "true"
-    load-balancer.hetzner.cloud/location: hel1
-    load-balancer.hetzner.cloud/name: load-balancer-1
-    load-balancer.hetzner.cloud/type: lb11
-    load-balancer.hetzner.cloud/use-private-ip: "true"

values/ingress-haproxy/env.yaml.gotmpl

@@ -1,10 +0,0 @@
-haproxy:
-  enabled: false
-  autosync: true
-  pdb:
-    minAvailable: 1
-  resources:
-    controller:
-      cpu: "100m"
-      memory: "100Mi"
-  annotations: []

values/ingress-haproxy/manifests/ingress-haproxy.yaml

@@ -1,40 +0,0 @@
-{{- if .Values.clusterConfig.argo.enabled }}
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: ingress-haproxy
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  destination:
-    namespace: ingress-haproxy
-    server: 'https://kubernetes.default.svc'
-  sources:
-  - repoURL: {{ .Values.clusterConfig.manifests }}
-    targetRevision: HEAD
-    path: helmfile.d
-    plugin:
-      name: helmfile-cmp
-      env:
-        - name: CLUSTER_NAME
-          value: {{ .Values.clusterConfig.cluster }}
-        - name: HELMFILE_ENVIRONMENT
-          value: default
-        - name: HELMFILE_FILE_PATH
-          value: ingress-haproxy.yaml.gotmpl
-  project: sys
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: sys
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      - ServerSideApply=true
-    {{- if .Values.haproxy.autosync }}
-    automated:
-      prune: true
-      # selfHeal: false
-    {{- end }}
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-host-traffic.yaml

@@ -1,16 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-host-traffic
-  namespace: ingress-haproxy
-spec:
-  egress:
-    - toEntities:
-        - kube-apiserver
-        - host
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-hubble-traffic.yaml

@@ -1,16 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-hubble-traffic
-  namespace: ingress-haproxy
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: hubble.*.*.*
-        - matchPattern: hubble.*.*.*.*
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-prometheus-metrics.yaml

@@ -1,19 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-prometheus-metrics
-  namespace: ingress-haproxy
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ingress-haproxy
-  ingress:
-    - fromEndpoints:
-        - matchLabels:
-            io.kubernetes.pod.namespace: prometheus
-    - toPorts:
-        - ports:
-            - port: "1024"
-              protocol: TCP
-{{- end }}

values/ingress-haproxy/manifests/policies/CiliumNetworkPolicy-allow-world-to-ingress-haproxy.yaml

@@ -1,21 +0,0 @@
-{{- if .Values.clusterConfig.cilium.enabled }}
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-world-to-ingress-haproxy
-  namespace: ingress-haproxy
-spec:
-  endpointSelector:
-    matchLabels:
-      app.kubernetes.io/name: kubernetes-ingress
-      app.kubernetes.io/instance: ingress-haproxy
-  ingress:
-    - fromEntities:
-        - world
-    - toPorts:
-        - ports:
-            - port: "80"
-              protocol: TCP
-            - port: "443"
-              protocol: TCP
-{{- end }}

values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl

@@ -1,98 +0,0 @@
-## HAProxy Kubernetes Ingress Controller configuration
-## Ref: https://www.haproxy.com/documentation/kubernetes-ingress/
-##
-controller:
-  resources:
-    requests:
-      cpu: {{ .Values.haproxy.resources.controller.cpu }}
-      memory: {{ .Values.haproxy.resources.controller.memory }}
-
-  ingressClass: haproxy
-
-  ingressClassResource:
-    name: haproxy
-    default: true
-
-  config:
-    body-size: "0"
-    tune.bufsize: "131072"
-
-  tolerations:
-   - key: unschedulable
-     operator: Exists
-     effect: NoSchedule
-   - key: node-role.kubernetes.io/control-plane
-     operator: Exists
-     effect: NoSchedule
-
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: kubernetes.io/hostname
-            operator: In
-            values: {{ .Values.clusterConfig.ingress_nodes }}
-
-    podAntiAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-      - labelSelector:
-          matchExpressions:
-          - key: app.kubernetes.io/instance
-            operator: In
-            values:
-            - ingress-haproxy
-          - key: app.kubernetes.io/name
-            operator: In
-            values:
-            - kubernetes-ingress
-        topologyKey: "kubernetes.io/hostname"
-
-  replicaCount: {{ .Values.clusterConfig.ingress_replica_count }}
-
-  PodDisruptionBudget:
-    enable: true
-    minAvailable: {{ .Values.haproxy.pdb.minAvailable }}
-
-  service:
-  {{- if .Values.clusterConfig.ingress_loadbalancer }}
-    type: LoadBalancer
-    {{- if .Values.clusterConfig.ingress_nodeport }}
-    nodePorts:
-      http: 30080
-      https: 30443
-    {{- end }}
-  {{- else if .Values.clusterConfig.ingress_nodeport }}
-    type: NodePort
-    externalTrafficPolicy: Local
-    nodePorts:
-      http: 30080
-      https: 30443
-  {{- else }}
-    type: ClusterIP
-  {{- end }}
-    annotations:
-      {{- with .Values.haproxy.annotations }}
-      {{ toYaml . | nindent 8 }}
-      {{- end }}
-
-  hostNetwork: {{ .Values.clusterConfig.ingress_hostnetwork }}
-
-  hostPorts:
-    enable: {{ .Values.clusterConfig.ingress_hostport }}
-    http: 80
-    https: 443
-
-  stats:
-    enabled: true
-
-  prometheus:
-    enabled: true
-    port: 1024
-    service:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "1024"
-
-  serviceMonitor:
-    enabled: true

values/ingress-nginx/env-hel1.yaml.gotmpl

@@ -1,5 +1,5 @@
 nginx:
-  enabled: false
+  enabled: true
   autosync: true
   pdb:
     minAvailable: 1

values/makai/values/values.yaml

@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "1c9c91a9-debug"
+  tag: "ad49e745-debug"
 env:
   - name: APP_VERSION
     value: "0.0.0"
@@ -8,11 +8,13 @@ env:
     value: "1"
 ingress:
   enabled: true
-  className: "haproxy"
+  className: "nginx"
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
+    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    haproxy.org/cors-enable: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
     oceanbox.io/expose: internal
   hosts:
     - host: makai.oceanbox.io

values/system/hel1/hubble-ui-ingress.yaml

@@ -2,11 +2,13 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   annotations:
+    nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri
+    nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth
     oceanbox.io/expose: internal
   name: hubble-ui
   namespace: kube-system
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
   rules:
     - host: hubble.hel1.oceanbox.io
       http:
@@ -24,11 +26,13 @@ kind: Ingress
 metadata:
   annotations:
     cert-manager.io/cluster-issuer: letsencrypt-production
+    nginx.ingress.kubernetes.io/proxy-buffer-size: 8k
+    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: 16k
     oceanbox.io/expose: internal
   name: hubble-ui-oauth2-proxy
   namespace: kube-system
 spec:
-  ingressClassName: haproxy
+  ingressClassName: nginx
   rules:
     - host: hubble.hel1.oceanbox.io
       http:

values/system/hel1/kyverno/whitelist-internal-ingresses.yaml

@@ -14,8 +14,9 @@ metadata:
       whitelist to the already existing ones
 spec:
   mutateExistingOnPolicyUpdate: false
+  #precondition: has whitelist annotation or
   rules:
-  - name: ensure-haproxy-allowlist-exists
+  - name: ensure-nginx-whitelist-exists
     skipBackgroundRequests: true
     match:
       resources:
@@ -27,8 +28,8 @@ spec:
       patchStrategicMerge:
         metadata:
           annotations:
-            +(haproxy.org/allow-list): ""
+            +(nginx.ingress.kubernetes.io/whitelist-source-range): ""
-  - name: append-existing-haproxy-allowlist
+  - name: append-existing-whitelist
     skipBackgroundRequests: true
     match:
       resources:
@@ -38,7 +39,7 @@ spec:
           oceanbox.io/expose: internal
     preconditions:
       any:
-      - key: "{{`{{request.object.metadata.annotations.\"haproxy.org/allow-list\"}}`}}"
+      - key: "{{`{{request.object.metadata.annotations.\"nginx.ingress.kubernetes.io/whitelist-source-range\"}}`}}"
         operator: NotEquals
         value: ""
     mutate:
@@ -46,9 +47,9 @@ spec:
         metadata:
           annotations:
             {{- with .Values.clusterConfig.ingress_whitelist }}
-            haproxy.org/allow-list: "{{`{{ @ }}`}},{{ join "," . }}"
+            nginx.ingress.kubernetes.io/whitelist-source-range: "{{`{{ @ }}`}},{{ join "," . }}"
             {{- end }}
-  - name: add-haproxy-allowlist
+  - name: add-nginx-whitelist
     skipBackgroundRequests: true
     match:
       resources:
@@ -58,7 +59,7 @@ spec:
           oceanbox.io/expose: internal
     preconditions:
       any:
-      - key: "{{`{{request.object.metadata.annotations.\"haproxy.org/allow-list\"}}`}}"
+      - key: "{{`{{request.object.metadata.annotations.\"nginx.ingress.kubernetes.io/whitelist-source-range\"}}`}}"
         operator: Equals
         value: ""
     mutate:
@@ -66,6 +67,7 @@ spec:
         metadata:
           annotations:
             {{- with .Values.clusterConfig.ingress_whitelist }}
-            haproxy.org/allow-list: "{{ join "," . }}"
+            nginx.ingress.kubernetes.io/whitelist-source-range: "{{ join "," . }}"
             {{- end }}
 {{- end }}
+