feat(ingress): add TLS configuration for staging hosts

Add TLS configuration for staging-shiny and staging-shiny-api 
hosts in the ingress resources. Create a new namespace for 
ingress-nginx to better organize resources. Update kustomization 
files to include new certificates and secrets. Streamline setup 
process with improved wait commands for pod readiness.

k8s/app/certificates.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+data:
+  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ2ekNDQXRPZ0F3SUJBZ0lVSjVMNmRDaWNZMlByN2dZb3NmMjNtVElZV1dBd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZTXhDekFKQmdOVkJBWVRBbE5GTVI0d0hBWURWUVFJREJWV3c0UENwSE4wY21FZ1I4T0R3clowWVd4aApibVF4RWpBUUJnTlZCQWNNQ1ZOMllXNWxjM1Z1WkRFd01DNEdBMVVFQ2d3blZXNWliM1Z1WkNCVGIyWjBkMkZ5ClpTQkVaWFpsYkc5d2JXVnVkQ0JUZG1WdWMydGhJRUZDTVE0d0RBWURWUVFEREFWc2IyTmhiREFnRncweU5URXkKTVRBd05qTTFOREJhR0E4ek1ESTFNRFF4TWpBMk16VTBNRm93Z1lNeEN6QUpCZ05WQkFZVEFsTkZNUjR3SEFZRApWUVFJREJWV3c0UENwSE4wY21FZ1I4T0R3clowWVd4aGJtUXhFakFRQmdOVkJBY01DVk4yWVc1bGMzVnVaREV3Ck1DNEdBMVVFQ2d3blZXNWliM1Z1WkNCVGIyWjBkMkZ5WlNCRVpYWmxiRzl3YldWdWRDQlRkbVZ1YzJ0aElFRkMKTVE0d0RBWURWUVFEREFWc2IyTmhiRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQgpBTFczUmxDOGpLVlZMem9xZ2NqYk90b0duSlE2UDZ2QTRHZ1kyR1QyR1NySVRpMWtjWnRYbitJaW5xM3RYNmtuCkoyU3JDVTdaT3hJVWJSMVo3ZTV2RVlBMFQ2dXpGNk1aOTNZeWp1ejhqQUN6V0o5MjdXWTRxUDRrNWpUS2t5VEsKUWloTDByTEJoM3EvalFkWXZuc2dMa2hNd0hkTVJ6aWxNNG1iay9JNmhzZUJWenBpaCtOQ1dIYVRLdFQvOWMraApYam1kNWRuK3VVK3dncUtzUDd5WWRubm1tM2ZLOVBUQkliRGdObEdSTkdBRkJqMzJOd3BmejNCckRXSTBaSFcrCkl5cHVHQTQwNm9GMzFSZVRJdzlaUTJvUnQ5Z2pEYWFvdUtOMHFPeTlnZ2dyTGliTDVNTlFRa0sraWJUQXgzUncKOFhhNVlTK05GQmIvZVJKTHZkcFVQcEVDQXdFQUFhTlRNRkV3SFFZRFZSME9CQllFRkFyRmY3alEvRWN3UHNEcQpQdUJxYVZnTDVicUVNQjhHQTFVZEl3UVlNQmFBRkFyRmY3alEvRWN3UHNEcVB1QnFhVmdMNWJxRU1BOEdBMVVkCkV3RUIvd1FGTUFNQkFmOHdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQ044Ukx3azR2ajhzOEtHTTFhRHlkbFgKVWJIamRaVmE3Q2dxNm9DbS9MZTVEdUVxUkFjTnY2L0U2TFQ3ZzZuTXdtSlBSUk9oMjE3TVgyNitMY3JpZkxpRAoxZHBZSGw3OUErN1J2SFcyb2t2T3VjWGcrcU4wM3FTaGh2NzBqZ0p1MHE0QmZOSmpSbzI3dTBRb1VNbUpaNVpHCnZ5ZUxUaTcyZDNpdXdLdFBrNi9RN25VR01pR0ROOWNLWStHdk1CNjVVNHNXWDgwN1piZ3h0Zk9mQi9McmJ5ZG8KVUVRU3BNR2U2RGlEajVnWmN2SGNORUVQNlpHOHJpYUY0MDZBdDN5ODZMQTE5WGJZajRBSkkxeFpWUE8rZWIvQwptVzVDYU1yRGd5TGhHeDFYUm9WWTlLZldqekp6alIvQTFNUGV2cFZiQTFPb20wRGtWM09DZWFCY25jcjVmYUE9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2Z0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktnd2dnU2tBZ0VBQW9JQkFRQzF0MFpRdkl5bFZTODYKS29ISTJ6cmFCcHlVT2orcndPQm9HTmhrOWhrcXlFNHRaSEdiVjUvaUlwNnQ3VitwSnlka3F3bE8yVHNTRkcwZApXZTN1YnhHQU5FK3JzeGVqR2ZkMk1vN3MvSXdBczFpZmR1MW1PS2orSk9ZMHlwTWt5a0lvUzlLeXdZZDZ2NDBICldMNTdJQzVJVE1CM1RFYzRwVE9KbTVQeU9vYkhnVmM2WW9malFsaDJreXJVLy9YUG9WNDVuZVhaL3JsUHNJS2kKckQrOG1IWjU1cHQzeXZUMHdTR3c0RFpSa1RSZ0JRWTk5amNLWDg5d2F3MWlOR1IxdmlNcWJoZ09OT3FCZDlVWApreU1QV1VOcUViZllJdzJtcUxpamRLanN2WUlJS3k0bXkrVERVRUpDdm9tMHdNZDBjUEYydVdFdmpSUVcvM2tTClM3M2FWRDZSQWdNQkFBRUNnZ0VBQTFkNHJsdzJHRktwSEJPR2NFYkJhclVDQk8vTzR5Uis0bDVpbVNpMWJQa3YKb0hWRm5NU0NqV1FNeXZ1ZnVsUTJabkdHdzM1d3lhY2c2UFo0YUhkTE9SaTlMTHhhekIvYWhZeTYzb21lWitOSwoxeUN3WENSNm1rNnBBZWhTK2dBNVpOVWM3WjFyNG1QOXk0dVhjZlVCOGE1dURVT1VvN2M4YThzQ28zNGcxc21RCkZNYXJxS1dXRGVFZlF2NW5NTzlPRzZvOVdkR2pDaTZ4a3lCK244WmdSR0N0ZllPRWdPNVNEY3hCc2dMVWF2RisKTHd2K3hDZ0x5SkN0dE1nTzF2SGJucmRQSDJ1UFlWcmxpYmJYYktmSnhhVktwQWFybHV3MEFkMTdNWGpwR3ZEagpXMEZPdXRSand3V1BtWVV3WHV4Q2NlYU9lcjJ2S1VJVmptYm4xRStVU1FLQmdRRCsxbms5V1A1L1lmR1pYVWhyCkQwVytJOEZkMW9iKzNxVlRFc2lESG5iY0tJay93ZUd3ME93dlNRbFhGOURVT3l2cFlHNzdJSytTdkV2Tm8rVUsKazhRUjhoejU4cXExdms3bDZBcWxFTEtqTElmYmxTTXdsbVdqWG5nbW8zMVpnemF0Z2orMHdKNTcveVFSQTZXSApQa0FQNW1MNU9rMnJ5YU1NQ3RtWHRHYmwzd0tCZ1FDMmkyNHJWVHk3WHhETTFXdDFleGREQXk0akVBQ3QvWFoyCm9Zd3d5dk5Kc2h2Mmo3ZTZVUEYwdDQ0LzIreGhvdlNTYld2VWVtR29PWUVTTzFnRFdGcmtmY3A3YWhLVE9Ca2MKYldSbEh6Q2FmNEFkRUswd2FuUkFFOUN5YmNONkNGQUlJYnJyN0o3ZkhTeFBRUW95S3k1M2FJZng2N0ppMVl6dwpIS3lPVDlzSmp3S0JnUUNnOFhjVWhaWUZnU2dDZ2VWd3ArNldEU0xjVHRabk5Ob1l3eTRia1N2a0V6M0xKSG1UCkgvOXFSYWcrZHU0T2UyaGFOZXNoY3gwdmdQZ200YkdQb284Yi9scktpTFhEbm5OWnc5aWxNd3grL1dxNEJWSjYKSnlIOXNYWVVnUUJ6ZmVrVVg4UTROY1poN1ZzcjI2KzQ0Rm01TVBtbENXdHdhU0l1UXRQMWVadmE1UUtCZ1FDTApVa0dFV3lyZUN3R0VoRUxleUZLSnQ4eW53QmYwczJXTngyQjdBUHJNUFY3d1FPSkdGbThpMk5GOTFibEZENTFBCmdMankwM0RqZHZnVzFTb29hMi83d2pJZkhXY042NXZtd1dzRmJ0ZW1vemRCZDYvbkt1aU0yMUxHUzlZTXRubDIKcTEvQm5yZm1xNXBjNXRRRVZFYkRwZ2xUejhNM2dhdHV1MFBMM2hEYjZ3S0JnRTBKK2o0RGlxRGFqUGlCWkNDbQpMQ2hEeDA1WTFOMTF5bC9haWNsZnVVSjZheTFDQU5NKy9wRkZ0RHdoQzc1R3JvZzJoS242SVN1N1IxUTdPZjZ1CnpITDU5SXQ0UkRXdlREQlpaTk9FU2szemdueVJwOGgxb29lNitjeUJ3dXowQ0w1ekFjTFNPVnhYQ2N6ZUorYkEKSTgxZ1ZsNkc0MzBROHVWc1FOcmlUVGdrCi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0=
+kind: Secret
+metadata:
+  name: ca-key-pair
+  namespace: default
+type: Opaque
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: self-signed
+  namespace: default
+spec:
+  ca:
+    secretName: ca-key-pair
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: self-signed-cert
+  namespace: default
+spec:
+  subject:
+    organizations:
+    - shiny
+  dnsNames:
+  - shiny
+  - auth0
+  - staging-shiny.unbound.se
+  - staging-shiny-api.unbound.se
+  secretName: self-signed-cert-tls
+  issuerRef:
+    name: self-signed

k8s/app/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- certificates.yaml
+- secrets-store.yaml
+- local-proxy.yaml

k8s/app/local-proxy.yaml

@@ -0,0 +1,79 @@
+# Local development proxy configuration
+# Proxies traffic from KinD cluster to host machine for local development
+#
+# Add to /etc/hosts:
+#   192.168.228.2 staging-shiny.unbound.se staging-shiny-api.unbound.se
+#
+# Apply with: kubectl apply -f local-proxy.yaml
+# Delete with: kubectl delete -f local-proxy.yaml
+
+---
+# Frontend proxy (port 3300)
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend-external
+spec:
+  type: ExternalName
+  externalName: host.docker.internal
+  ports:
+    - port: 3300
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: frontend
+  annotations:
+    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:3300"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - staging-shiny.unbound.se
+      secretName: self-signed-cert-tls
+  rules:
+    - host: staging-shiny.unbound.se
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: frontend-external
+                port:
+                  number: 3300
+---
+# API proxy (port 4444)
+apiVersion: v1
+kind: Service
+metadata:
+  name: api-external
+spec:
+  type: ExternalName
+  externalName: host.docker.internal
+  ports:
+    - port: 4444
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: api
+  annotations:
+    nginx.ingress.kubernetes.io/upstream-vhost: "localhost:4444"
+spec:
+  ingressClassName: nginx
+  tls:
+    - hosts:
+        - staging-shiny-api.unbound.se
+      secretName: self-signed-cert-tls
+  rules:
+    - host: staging-shiny-api.unbound.se
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: api-external
+                port:
+                  number: 4444

k8s/app/secrets-store.yaml

@@ -0,0 +1,38 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata:
+  name: external-secrets
+spec:
+  provider:
+    fake:
+      data:
+      - key: "applications/shiny/accounting-service"
+        value: '{}'
+      - key: "applications/shiny/authz-service"
+        value: '{}'
+      - key: "applications/shiny/company-service"
+        value: '{}'
+      - key: "applications/shiny/consumer-service"
+        value: '{}'
+      - key: "applications/shiny/employee-service"
+        value: '{}'
+      - key: "applications/shiny/invoice-service"
+        value: '{}'
+      - key: "applications/shiny/notification-service"
+        value: '{}'
+      - key: "applications/shiny/salary-service"
+        value: '{}'
+      - key: "applications/shiny/supplier-service"
+        value: '{}'
+      - key: "applications/shiny/supplier-invoice-service"
+        value: '{}'
+      - key: "applications/shiny/time-service"
+        value: '{}'
+      - key: "applications/shiny/gateway"
+        value: '{"API_KEY": "us_ak_vUj37A1ukjIfhkJH"}'
+      - key: "rds/postgres/prod-psql"
+        value: '{"POSTGRES_URL": "postgres://postgres:postgres@postgres:5432/postgres?sslmode=disable", "DB_HOST": "postgres", "DB_NAME": "postgres", "DB_PASSWORD": "postgres", "DB_PORT": "5432", "DB_USERNAME": "postgres"}'
+      - key: "mq/rabbit/prod"
+        value: '{"AMQP_URL": "amqp://user:password@rabbitmq:5672/"}'
+      - key: "services/schemas"
+        value: '{"ISSUER": "auth0", "STRICT_SSL": "false"}'

k8s/infra/kustomization.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- postgres.yaml
+- rabbitmq.yaml
+- namespaces.yaml
+helmCharts:
+- name: external-secrets
+  namespace: external-secrets
+  includeCRDs: true
+  releaseName: external-secrets
+  repo: https://charts.external-secrets.io
+  version: 1.1.1
+- name: cert-manager
+  namespace: cert-manager
+  includeCRDs: true
+  releaseName: cert-manager
+  repo: https://charts.jetstack.io
+  version: v1.19.2
+  valuesInline:
+    crds:
+      enabled: true

k8s/infra/namespaces.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager

k8s/infra/postgres.yaml

@@ -0,0 +1,106 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: shared-postgres
+data:
+  DB_HOST: "postgres-postgresql"
+  DB_PORT: "5432"
+  DB_USER: "postgres"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgres-init
+data:
+  initdb.sh: |-
+    #!/usr/bin/env bash
+    set -e
+
+    psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" <<-EOSQL
+    	CREATE DATABASE schemas WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE accounting WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE banking WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE authz WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE company WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE consumer WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE employee WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE invoice WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE notification WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE salary WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE supplier WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE supplier_invoice WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE tax WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE time WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE dancefinder WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE hifi WITH OWNER postgres ENCODING utf8;
+    	CREATE DATABASE sloth WITH OWNER postgres ENCODING utf8;
+    EOSQL
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgres
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: postgres
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: postgres
+    spec:
+      containers:
+      - name: postgres
+        image: postgres:18.1-alpine@sha256:eca6fb2d91fda290eb8cfb8ba53dd0dcbf3508a08011e30adb039ea7c8e1e9f2
+        args:
+        - -c
+        - shared_buffers=384MB
+        - -c
+        - max_connections=300
+        imagePullPolicy: "IfNotPresent"
+        resources:
+          requests:
+            memory: 400Mi
+          limits:
+            memory: 600Mi
+        ports:
+        - containerPort: 5432
+        env:
+        - name: POSTGRES_DB
+          value: postgres
+        - name: POSTGRES_USER
+          value: postgres
+        - name: POSTGRES_PASSWORD
+          value: postgres
+        - name: LANG
+          value: sv_SE.utf8
+        - name: POSTGRES_INITDB_ARGS
+          value: --locale-provider=icu --icu-locale=sv-SE
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/postgresql
+        - mountPath: /docker-entrypoint-initdb.d/initdb.sh
+          name: initdb
+          subPath: initdb.sh
+      volumes:
+      - name: data
+        hostPath:
+          path: /data/postgres
+      - name: initdb
+        configMap:
+          name: postgres-init
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  labels:
+    app.kubernetes.io/name: postgres
+spec:
+  ports:
+  - port: 5432
+    nodePort: 5432
+  selector:
+    app.kubernetes.io/name: postgres
+  type: NodePort

k8s/infra/rabbitmq.yaml

@@ -0,0 +1,166 @@
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: shared-rabbitmq
+data:
+  RABBITMQ_SERVERS: rabbitmq
+  RABBITMQ_VHOST: /
+  RABBITMQ_USERNAME: user
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: rabbitmq-env-config
+data:
+  memory.conf: |-
+    total_memory_available_override_value = 1GB
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: rabbitmq
+stringData:
+  AMQP_URL: "amqp://user:password@rabbitmq:5672/"
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  labels:
+    app.kubernetes.io/name: rabbitmq
+    release: rabbitmq
+  name: rabbitmq
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: rabbitmq
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: rabbitmq
+    spec:
+      securityContext:
+        fsGroup: 999
+        runAsUser: 999
+        runAsGroup: 999
+      containers:
+      - env:
+        - name: RABBITMQ_DEFAULT_USER
+          value: user
+        - name: RABBITMQ_DEFAULT_PASS
+          value: password
+        - name: RABBITMQ_NODE_PORT_NUMBER
+          value: "5672"
+        - name: RABBITMQ_NODE_TYPE
+          value: stats
+        - name: RABBITMQ_NODENAME
+          value: rabbit@localhost
+        - name: RABBITMQ_CLUSTER_NODE_NAME
+        - name: RABBITMQ_DEFAULT_VHOST
+          value: /
+        - name: RABBITMQ_MANAGER_PORT_NUMBER
+          value: "15672"
+        - name: RABBITMQ_DISK_FREE_LIMIT
+          value: '"8GiB"'
+        - name: RABBITMQ_CONFIG_FILES
+          value: /etc/rabbitmq/conf.d
+        image: rabbitmq:4.2.1-management@sha256:86fa2b761fc3a71a2b73090d7e45ad820f611fc829c1cb8cf087e09258fb65c1
+        imagePullPolicy: Always
+        livenessProbe:
+          exec:
+            command:
+            - rabbitmqctl
+            - status
+          failureThreshold: 6
+          initialDelaySeconds: 120
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 5
+        name: rabbitmq
+        ports:
+        - containerPort: 4369
+          name: epmd
+          protocol: TCP
+        - containerPort: 5672
+          name: amqp
+          protocol: TCP
+        - containerPort: 25672
+          name: dist
+          protocol: TCP
+        - containerPort: 15672
+          name: stats
+          protocol: TCP
+        readinessProbe:
+          httpGet:
+            port: 15672
+            path: /api/aliveness-test/%2F
+            httpHeaders:
+            - name: "Authorization"
+              value: "Basic dXNlcjpwYXNzd29yZA=="
+          failureThreshold: 3
+          initialDelaySeconds: 10
+          periodSeconds: 5
+          successThreshold: 1
+          timeoutSeconds: 3
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - name: data
+          mountPath: /var/lib/rabbitmq
+        - name: config
+          mountPath: /etc/rabbitmq/conf.d/20-memory.conf
+          subPath: memory.conf
+          readOnly: true
+      volumes:
+      - name: data
+        hostPath:
+          path: /data/rabbitmq
+      - name: config
+        configMap:
+          name: rabbitmq-env-config
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: rabbitmq
+    release: rabbitmq
+  name: rabbitmq
+spec:
+  externalTrafficPolicy: Cluster
+  ports:
+  - name: epmd
+    nodePort: 31799
+    port: 4369
+    protocol: TCP
+    targetPort: epmd
+  - name: amqp
+    nodePort: 5672
+    port: 5672
+    protocol: TCP
+    targetPort: amqp
+  - name: dist
+    nodePort: 32687
+    port: 25672
+    protocol: TCP
+    targetPort: dist
+  - name: stats
+    nodePort: 15672
+    port: 15672
+    protocol: TCP
+    targetPort: stats
+  selector:
+    app.kubernetes.io/name: rabbitmq
+  sessionAffinity: None
+  type: NodePort

k8s/nginx/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- namespaces.yaml
+helmCharts:
+- name: ingress-nginx
+  namespace: ingress-nginx
+  includeCRDs: true
+  releaseName: ingress-nginx
+  repo: https://kubernetes.github.io/ingress-nginx
+  version: 4.14.1
+  valuesFile: https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/hack/manifest-templates/provider/kind/values.yaml

k8s/nginx/namespaces.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ingress-nginx