Clarity on Ingress Values about helm-charts

[maraino]

Hi @shairozan, using an ingress is not a common configuration, a better option is to use a LoadBalancer service or a NodePort. But in case you want to use a ingress you will need to take into account that the service and the pod are expecting TLS.

For example, using the Nginx ingress controller, the configuration requires nginx.ingress.kubernetes.io/backend-protocol: "HTTPS". And the ingress object looks like this:

ingress:
  enabled: true
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  hosts:
  - host: ca.mydomain.com
    paths: 
    - path: /
  tls:
  - hosts: 
    - ca.mydomain.com
    secretName: ingress-tls

Probably a better option would be to passthrough HTTPS with nginx.ingress.kubernetes.io/ssl-passthrough: "true" but this is disabled by default, see https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#ssl-passthrough

[shairozan]

Sadly not usable for me as everywhere I've used it handles automatic DNS registration with ingress class as well as SSL termination by hostname + class. Ingress wouldn't work for me here then since the goal would be to let the K8s annotations on the ingress drive certificate acquisition / assignment. Thanks for the clarification though!

[maraino]

If you can use HTTPS as the backend protocol, and you get a certificate from the CA to your ingress using cert-manager + step-issuer, you should be able to use the ingress.

Another option is to use an ingress in Layer 4 mode, so it proxies the TCP level.

With a Layer 7 ingress, if it gets an SSL certificate from a different CA, let's say let's encrypt, it won't work at the moment.

[zolech]

Hi @shairozan, using an ingress is not a common configuration, a better option is to use a LoadBalancer service or a NodePort. But in case you want to use a ingress you will need to take into account that the service and the pod are expecting TLS.

For example, using the Nginx ingress controller, the configuration requires nginx.ingress.kubernetes.io/backend-protocol: "HTTPS". And the ingress object looks like this:

ingress:
  enabled: true
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
  hosts:
  - host: ca.mydomain.com
    paths: 
    - path: /
  tls:
  - hosts: 
    - ca.mydomain.com
    secretName: ingress-tls

It would be helpful if your helm chart support options for LoadBalancer service type. I can see PR for that but with no reponse #32

Probably a better option would be to passthrough HTTPS with nginx.ingress.kubernetes.io/ssl-passthrough: "true" but this is disabled by default, see https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#ssl-passthrough

It is possible to do that with traefik ingress controller. You can set their crd ingressrouteTCP with tls passthrough