Nginx-ingress-controller - Revision history

Chubbard at 19:13, 18 August 2022

2022-08-18T19:13:25Z

← Older revision		Revision as of 12:13, 18 August 2022
Line 69:		Line 69:
	kubectl create -f ./librespeed-ingress-object.yaml		kubectl create -f ./librespeed-ingress-object.yaml
	</pre>		</pre>

			When the SSL expires, or you need to re-add it, you must delete the old secret first and then re-add the certificates. This will need to be done on each of the namespaces.
			<pre>
			kubectl delete secret wc-iwillfearnoevil-com -n nginx-ingress
			kubectl create secret tls wc-iwillfearnoevil-com --namespace nginx-ingress --key ~/ssl/privkey.pem --cert ~/ssl/cert.pem
			</pre>




	[[Category:Kubernetes]]		[[Category:Kubernetes]]

Chubbard at 19:11, 18 August 2022

2022-08-18T19:11:25Z

← Older revision		Revision as of 12:11, 18 August 2022
Line 32:		Line 32:
	Note specifically the namespace we are installing the ingress into. This is NOT the namespace of the ingress-controller application.		Note specifically the namespace we are installing the ingress into. This is NOT the namespace of the ingress-controller application.
	* It is critical to note you have to install the ssl certs into the namespace beforehand to get this to work right away		* It is critical to note you have to install the ssl certs into the namespace beforehand to get this to work right away
	* kubectl create secret tls wc-iwillfearnoevil-com --namespace librespeed --key ~/ssl/privkey.pem --cert ~/ssl/cert.pem
	* in general you want to do your SSL offload at the ingress point, and use straight HTTP internally so you do not have additional SSL certs to fight with. This can be an issue with applications such as ArgoCD itself, as that internally has its own stupid redirect back to a 443 port. That gets disabled in the values.yaml file with an insecure flag for ArgoCD.		* in general you want to do your SSL offload at the ingress point, and use straight HTTP internally so you do not have additional SSL certs to fight with. This can be an issue with applications such as ArgoCD itself, as that internally has its own stupid redirect back to a 443 port. That gets disabled in the values.yaml file with an insecure flag for ArgoCD.

			Add your SSL certificates to a given namespace, for later use within the ingress object you are creating:
			<pre>
			kubectl create secret tls wc-iwillfearnoevil-com --namespace librespeed --key ~/ssl/privkey.pem --cert ~/ssl/cert.pem
			</pre>

			Example working SSL ingress:
	<pre>		<pre>
	apiVersion: networking.k8s.io/v1		apiVersion: networking.k8s.io/v1

Chubbard: Created page with "== Working with nginx ingress controls == The Nginx ingress controller for kubernetes can be an amazing PITA. If we work with nginx as an application that only does the ingre..."

2022-08-18T19:09:41Z

Created page with "== Working with nginx ingress controls == The Nginx ingress controller for kubernetes can be an amazing PITA. If we work with nginx as an application that only does the ingre..."

New page

== Working with nginx ingress controls ==
The Nginx ingress controller for kubernetes can be an amazing PITA. If we work with nginx as an application that only does the ingress, it becomes much easier. This also makes a single spot to install the logic that the other application and namespaces can bind to.

Generic Template to create an ingress
<pre>
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
# Creates information for the ingress
name: test-ingress
# namespace must be the same as where you application resides
namespace: dev
spec:
ingressClassName: nginx
rules:
- host: "demo.apps.mlopshub.com"
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
# must match service name completely. Look in Lens
name: hello-service
port:
# Internal port number to forward to
number: 80
</pre>

A specific example to create an SSL based ingress

Note specifically the namespace we are installing the ingress into. This is NOT the namespace of the ingress-controller application.
* It is critical to note you have to install the ssl certs into the namespace beforehand to get this to work right away
* kubectl create secret tls wc-iwillfearnoevil-com --namespace librespeed --key ~/ssl/privkey.pem --cert ~/ssl/cert.pem
* in general you want to do your SSL offload at the ingress point, and use straight HTTP internally so you do not have additional SSL certs to fight with. This can be an issue with applications such as ArgoCD itself, as that internally has its own stupid redirect back to a 443 port. That gets disabled in the values.yaml file with an insecure flag for ArgoCD.

<pre>
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: librespeed-ingress
namespace: librespeed
spec:
ingressClassName: nginx
tls:
- hosts:
- librespeed.iwillfearnoevil.com
secretName: wc-iwillfearnoevil-com
rules:
- host: "librespeed.iwillfearnoevil.com"
http:
paths:
- pathType: Prefix
path: "/"
backend:
service:
name: librespeed
port:
number: 80
</pre>

Using the ingress you just created:
<pre>
kubectl create -f ./librespeed-ingress-object.yaml
</pre>

[[Category:Kubernetes]]