Deploy GitHub Pages
This commit is contained in:
Travis Bot
parent
7356ddd980
commit
7e487c12b5
38 changed files with 1815 additions and 276 deletions
|
|
@ -1109,11 +1109,11 @@
|
|||
</tr>
|
||||
<tr>
|
||||
<td><code class="codehilite">--default-backend-service string</code></td>
|
||||
<td>Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form "namespace/name". The controller configures NGINX to forward requests to the first port of this Service.</td>
|
||||
<td>Service used to serve HTTP requests not matching any known server name (catch-all). Takes the form "namespace/name". The controller configures NGINX to forward requests to the first port of this Service. If not specified, 404 page will be returned diretly from Nginx.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code class="codehilite">--default-server-port int</code></td>
|
||||
<td>Port to use for exposing the default server (catch-all). (default 8181)</td>
|
||||
<td>When <code class="codehilite">default-backend-service</code> is not specified or specified service does not have any endpoint, a local endpoint with this port will be used to serve 404 page from inside Nginx.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><code class="codehilite">--default-ssl-certificate string</code></td>
|
||||
|
|
|
|||
|
|
@ -1086,7 +1086,13 @@
|
|||
<p>It is also possible to use a number or the name of the port. The two last fields are optional.
|
||||
Adding <code class="codehilite">PROXY</code> in either or both of the two last fields we can use Proxy Protocol decoding (listen) and/or encoding (proxy_pass) in a TCP service (https://www.nginx.com/resources/admin-guide/proxy-protocol/).</p>
|
||||
<p>The next example shows how to expose the service <code class="codehilite">example-go</code> running in the namespace <code class="codehilite">default</code> in the port <code class="codehilite">8080</code> using the port <code class="codehilite">9000</code></p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">kind</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">ConfigMap</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">tcp-services</span>
|
||||
|
|
@ -1094,10 +1100,17 @@ Adding <code class="codehilite">PROXY</code> in either or both of the two last f
|
|||
<span class="l l-Scalar l-Scalar-Plain">data</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">9000</span><span class="p p-Indicator">:</span> <span class="s">"default/example-go:8080"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Since 1.9.13 NGINX provides <a href="https://www.nginx.com/blog/announcing-udp-load-balancing/">UDP Load Balancing</a>.
|
||||
The next example shows how to expose the service <code class="codehilite">kube-dns</code> running in the namespace <code class="codehilite">kube-system</code> in the port <code class="codehilite">53</code> using the port <code class="codehilite">53</code></p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">kind</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">ConfigMap</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">udp-services</span>
|
||||
|
|
@ -1105,9 +1118,35 @@ The next example shows how to expose the service <code class="codehilite">kube-d
|
|||
<span class="l l-Scalar l-Scalar-Plain">data</span><span class="p p-Indicator">:</span>
|
||||
<span class="err"> </span><span class="l l-Scalar l-Scalar-Plain">53</span><span class="p p-Indicator">:</span> <span class="s">"kube-system/kube-dns:53"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>If TCP/UDP proxy support is used, then those ports need to be exposed in the Service defined for the Ingress.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">v1</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">kind</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">Service</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">ingress-nginx</span>
|
||||
|
|
@ -1134,6 +1173,7 @@ The next example shows how to expose the service <code class="codehilite">kube-d
|
|||
<span class="l l-Scalar l-Scalar-Plain">app.kubernetes.io/name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">ingress-nginx</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">app.kubernetes.io/part-of</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">ingress-nginx</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1192,51 +1192,74 @@
|
|||
<p>The Prometheus server must be configured so that it can discover endpoints of services. If a Prometheus server is already running in the cluster and if it is configured in a way that it can find the ingress controller pods, no extra configuration is needed.</p>
|
||||
<p>If there is no existing Prometheus server running, the rest of this tutorial will guide you through the steps needed to deploy a properly configured Prometheus server.</p>
|
||||
<p>Running the following command deploys the prometheus configuration in Kubernetes:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/monitoring/configuration.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/monitoring/configuration.yaml</span>
|
||||
<span class="go">configmap "prometheus-configuration" created</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Running the following command deploys prometheus in Kubernetes:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/monitoring/prometheus.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/monitoring/prometheus.yaml</span>
|
||||
<span class="go">clusterrole "prometheus-server" created</span>
|
||||
<span class="go">serviceaccount "prometheus-server" created</span>
|
||||
<span class="go">clusterrolebinding "prometheus-server" created</span>
|
||||
<span class="go">deployment "prometheus-server" created</span>
|
||||
<span class="go">service "prometheus-server" created</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="prometheus-dashboard">Prometheus Dashboard<a class="headerlink" href="#prometheus-dashboard" title="Permanent link">¶</a></h3>
|
||||
<p>Open Prometheus dashboard in a web browser:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl get svc -n ingress-nginx</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl get svc -n ingress-nginx</span>
|
||||
<span class="go">NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE</span>
|
||||
<span class="go">default-http-backend ClusterIP 10.103.59.201 <none> 80/TCP 3d</span>
|
||||
<span class="go">ingress-nginx NodePort 10.97.44.72 <none> 80:30100/TCP,443:30154/TCP,10254:32049/TCP 5h</span>
|
||||
<span class="go">prometheus-server NodePort 10.98.233.86 <none> 9090:32630/TCP 1m</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Obtain the IP address of the nodes in the running cluster:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl get nodes -o wide</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl get nodes -o wide</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>In some cases where the node only have internal IP adresses we need to execute:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl get nodes --selector=kubernetes.io/role!=master -o jsonpath={.items[*].status.addresses[?\(@.type==\"InternalIP\"\)].address}</span>
|
||||
<p>In some cases where the node only have internal IP addresses we need to execute:</p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl get nodes --selector=kubernetes.io/role!=master -o jsonpath={.items[*].status.addresses[?\(@.type==\"InternalIP\"\)].address}</span>
|
||||
<span class="go">10.192.0.2 10.192.0.3 10.192.0.4</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Open your browser and visit the following URL: <em>http://{node IP address}:{prometheus-svc-nodeport}</em> to load the Prometheus Dashboard.</p>
|
||||
<p>According to the above example, this URL will be http://10.192.0.3:32630</p>
|
||||
<p><img alt="Dashboard" src="../../images/prometheus-dashboard.png" /></p>
|
||||
<h3 id="grafana">Grafana<a class="headerlink" href="#grafana" title="Permanent link">¶</a></h3>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/monitoring/grafana.yaml</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/monitoring/grafana.yaml</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl get svc -n ingress-nginx</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl get svc -n ingress-nginx</span>
|
||||
<span class="go">NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE</span>
|
||||
<span class="go">default-http-backend ClusterIP 10.103.59.201 <none> 80/TCP 3d</span>
|
||||
<span class="go">ingress-nginx NodePort 10.97.44.72 <none> 80:30100/TCP,443:30154/TCP,10254:32049/TCP 5h</span>
|
||||
<span class="go">prometheus-server NodePort 10.98.233.86 <none> 9090:32630/TCP 10m</span>
|
||||
<span class="go">grafana NodePort 10.98.233.87 <none> 3000:31086/TCP 10m</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Open your browser and visit the following URL: <em>http://{node IP address}:{grafana-svc-nodeport}</em> to load the Grafana Dashboard.
|
||||
According to the above example, this URL will be http://10.192.0.3:31086</p>
|
||||
|
|
|
|||
|
|
@ -1129,18 +1129,26 @@
|
|||
<p>If you're running multiple ingress controllers, or running on a cloud provider that natively handles ingress such as GKE,
|
||||
you need to specify the annotation <code class="codehilite">kubernetes.io/ingress.class: "nginx"</code> in all ingresses that you would like the ingress-nginx controller to claim.</p>
|
||||
<p>For instance,</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">foo</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">annotations</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">kubernetes.io/ingress.class</span><span class="p p-Indicator">:</span> <span class="s">"gce"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>will target the GCE controller, forcing the nginx controller to ignore it, while an annotation like</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">foo</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">annotations</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">kubernetes.io/ingress.class</span><span class="p p-Indicator">:</span> <span class="s">"nginx"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>will target the nginx controller, forcing the GCE controller to ignore it.</p>
|
||||
<p>To reiterate, setting the annotation to any value which does not match a valid ingress class will force the NGINX Ingress controller to ignore your Ingress.
|
||||
|
|
@ -1150,18 +1158,27 @@ If you are only running a single NGINX ingress controller, this can be achieved
|
|||
<p>This mechanism also provides users the ability to run <em>multiple</em> NGINX ingress controllers (e.g. one which serves public traffic, one which serves "internal" traffic).
|
||||
To do this, the option <code class="codehilite">--ingress-class</code> must be changed to a value unique for the cluster within the definition of the replication controller.
|
||||
Here is a partial example:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">spec</span><span class="p p-Indicator">:</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">spec</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">template</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">spec</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">containers</span><span class="p p-Indicator">:</span>
|
||||
<span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">nginx-ingress-internal-controller</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">args</span><span class="p p-Indicator">:</span>
|
||||
<span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/nginx-ingress-controller</span>
|
||||
<span class="p p-Indicator">-</span> <span class="s">'--default-backend-service=ingress/nginx-ingress-default-backend'</span>
|
||||
<span class="p p-Indicator">-</span> <span class="s">'--election-id=ingress-controller-leader-internal'</span>
|
||||
<span class="p p-Indicator">-</span> <span class="s">'--ingress-class=nginx-internal'</span>
|
||||
<span class="p p-Indicator">-</span> <span class="s">'--configmap=ingress/nginx-ingress-internal-controller'</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="admonition important">
|
||||
<p class="admonition-title">Important</p>
|
||||
|
|
|
|||
|
|
@ -2037,16 +2037,19 @@ So, at reload, if upstream servers have changed, index values are not guaranteed
|
|||
<h3 id="authentication">Authentication<a class="headerlink" href="#authentication" title="Permanent link">¶</a></h3>
|
||||
<p>Is possible to add authentication adding additional annotations in the Ingress rule. The source of the authentication is a secret that contains usernames and passwords inside the key <code class="codehilite">auth</code>.</p>
|
||||
<p>The annotations are:
|
||||
<div class="codehilite"><pre><span></span>nginx.ingress.kubernetes.io/auth-type: [basic|digest]
|
||||
</pre></div></p>
|
||||
<p>Indicates the <a href="https://tools.ietf.org/html/rfc2617">HTTP Authentication Type: Basic or Digest Access Authentication</a>.</p>
|
||||
<div class="codehilite"><pre><span></span>nginx.ingress.kubernetes.io/auth-secret: secretName
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>nginx.ingress.kubernetes.io/auth-type: [basic|digest]
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>Indicates the <a href="https://tools.ietf.org/html/rfc2617">HTTP Authentication Type: Basic or Digest Access Authentication</a>.</p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>nginx.ingress.kubernetes.io/auth-secret: secretName
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>The name of the Secret that contains the usernames and passwords which are granted access to the <code class="codehilite">path</code>s defined in the Ingress rules.
|
||||
This annotation also accepts the alternative form "namespace/secretName", in which case the Secret lookup is performed in the referenced namespace instead of the Ingress namespace.</p>
|
||||
<div class="codehilite"><pre><span></span>nginx.ingress.kubernetes.io/auth-realm: "realm string"
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>nginx.ingress.kubernetes.io/auth-realm: "realm string"
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="admonition example">
|
||||
<p class="admonition-title">Example</p>
|
||||
|
|
@ -2110,9 +2113,11 @@ Only one of the Ingress rules should define annotations to configure the upstrea
|
|||
</div>
|
||||
<h3 id="configuration-snippet">Configuration snippet<a class="headerlink" href="#configuration-snippet" title="Permanent link">¶</a></h3>
|
||||
<p>Using this annotation you can add additional configuration to the NGINX location. For example:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="p p-Indicator">:</span> <span class="p p-Indicator">|</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/configuration-snippet</span><span class="p p-Indicator">:</span> <span class="p p-Indicator">|</span>
|
||||
<span class="no">more_set_headers "Request-Id: $req_id";</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="default-backend">Default Backend<a class="headerlink" href="#default-backend" title="Permanent link">¶</a></h3>
|
||||
<p>The ingress controller requires a <a href="../../default-backend/">default backend</a>.
|
||||
|
|
@ -2180,7 +2185,20 @@ the new server configuration will take place over the alias configuration.</p>
|
|||
<p>For more information please see <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#server_name">the <code class="codehilite">server_name</code> documentation</a>.</p>
|
||||
<h3 id="server-snippet">Server snippet<a class="headerlink" href="#server-snippet" title="Permanent link">¶</a></h3>
|
||||
<p>Using the annotation <code class="codehilite">nginx.ingress.kubernetes.io/server-snippet</code> it is possible to add custom configuration in the server configuration block.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">extensions/v1beta1</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">apiVersion</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">extensions/v1beta1</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">kind</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">Ingress</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">metadata</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">annotations</span><span class="p p-Indicator">:</span>
|
||||
|
|
@ -2195,6 +2213,7 @@ the new server configuration will take place over the alias configuration.</p>
|
|||
<span class="l l-Scalar l-Scalar-Plain">return 301 https://m.example.com;</span>
|
||||
<span class="err">}</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="admonition attention">
|
||||
<p class="admonition-title">Attention</p>
|
||||
|
|
@ -2222,8 +2241,9 @@ applied to each location provided in the ingress rule.</p>
|
|||
<p>For more information please see <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_buffer_size">http://nginx.org</a></p>
|
||||
<h3 id="external-authentication">External Authentication<a class="headerlink" href="#external-authentication" title="Permanent link">¶</a></h3>
|
||||
<p>To use an existing service that provides authentication the Ingress rule can be annotated with <code class="codehilite">nginx.ingress.kubernetes.io/auth-url</code> to indicate the URL where the HTTP request should be sent.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/auth-url</span><span class="p p-Indicator">:</span> <span class="s">"URL</span><span class="nv"> </span><span class="s">to</span><span class="nv"> </span><span class="s">the</span><span class="nv"> </span><span class="s">authentication</span><span class="nv"> </span><span class="s">service"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/auth-url</span><span class="p p-Indicator">:</span> <span class="s">"URL</span><span class="nv"> </span><span class="s">to</span><span class="nv"> </span><span class="s">the</span><span class="nv"> </span><span class="s">authentication</span><span class="nv"> </span><span class="s">service"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Additionally it is possible to set:</p>
|
||||
<ul>
|
||||
|
|
@ -2336,8 +2356,9 @@ otherwise, both annotations must be used in unison. Note that each annotation mu
|
|||
<p>For NGINX, an 413 error will be returned to the client when the size in a request exceeds the maximum allowed size of the client request body. This size can be configured by the parameter <a href="http://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size"><code class="codehilite">client_max_body_size</code></a>.</p>
|
||||
<p>To configure this setting globally for all Ingress rules, the <code class="codehilite">proxy-body-size</code> value may be set in the <a href="../configmap/">NGINX ConfigMap</a>.
|
||||
To use custom values in an Ingress rule define these annotation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/proxy-body-size</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">8m</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/proxy-body-size</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">8m</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="proxy-cookie-domain">Proxy cookie domain<a class="headerlink" href="#proxy-cookie-domain" title="Permanent link">¶</a></h3>
|
||||
<p>Sets a text that <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_cookie_domain">should be changed in the domain attribute</a> of the "Set-Cookie" header fields of a proxied server response.</p>
|
||||
|
|
@ -2347,58 +2368,67 @@ To use custom values in an Ingress rule define these annotation:</p>
|
|||
By default proxy buffering is disabled in the NGINX config.</p>
|
||||
<p>To configure this setting globally for all Ingress rules, the <code class="codehilite">proxy-buffering</code> value may be set in the <a href="../configmap/">NGINX ConfigMap</a>.
|
||||
To use custom values in an Ingress rule define these annotation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/proxy-buffering</span><span class="p p-Indicator">:</span> <span class="s">"on"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/proxy-buffering</span><span class="p p-Indicator">:</span> <span class="s">"on"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="proxy-buffer-size">Proxy buffer size<a class="headerlink" href="#proxy-buffer-size" title="Permanent link">¶</a></h3>
|
||||
<p>Sets the size of the buffer <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size"><code class="codehilite">proxy_buffer_size</code></a> used for reading the first part of the response received from the proxied server.
|
||||
By default proxy buffer size is set as "4k"</p>
|
||||
<p>To configure this setting globally, set <code class="codehilite">proxy-buffer-size</code> in <a href="../configmap/">NGINX ConfigMap</a>. To use custom values in an Ingress rule, define this annotation:
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/proxy-buffer-size</span><span class="p p-Indicator">:</span> <span class="s">"8k"</span>
|
||||
</pre></div></p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/proxy-buffer-size</span><span class="p p-Indicator">:</span> <span class="s">"8k"</span>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<h3 id="ssl-ciphers">SSL ciphers<a class="headerlink" href="#ssl-ciphers" title="Permanent link">¶</a></h3>
|
||||
<p>Specifies the <a href="http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ciphers">enabled ciphers</a>.</p>
|
||||
<p>Using this annotation will set the <code class="codehilite">ssl_ciphers</code> directive at the server level. This configuration is active for all the paths in the host.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/ssl-ciphers</span><span class="p p-Indicator">:</span> <span class="s">"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/ssl-ciphers</span><span class="p p-Indicator">:</span> <span class="s">"ALL:!aNULL:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="connection-proxy-header">Connection proxy header<a class="headerlink" href="#connection-proxy-header" title="Permanent link">¶</a></h3>
|
||||
<p>Using this annotation will override the default connection header set by NGINX.
|
||||
To use custom values in an Ingress rule, define the annotation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/connection-proxy-header</span><span class="p p-Indicator">:</span> <span class="s">"keep-alive"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/connection-proxy-header</span><span class="p p-Indicator">:</span> <span class="s">"keep-alive"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="enable-access-log">Enable Access Log<a class="headerlink" href="#enable-access-log" title="Permanent link">¶</a></h3>
|
||||
<p>Access logs are enabled by default, but in some scenarios access logs might be required to be disabled for a given
|
||||
ingress. To do this, use the annotation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/enable-access-log</span><span class="p p-Indicator">:</span> <span class="s">"false"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/enable-access-log</span><span class="p p-Indicator">:</span> <span class="s">"false"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="enable-rewrite-log">Enable Rewrite Log<a class="headerlink" href="#enable-rewrite-log" title="Permanent link">¶</a></h3>
|
||||
<p>Rewrite logs are not enabled by default. In some scenarios it could be required to enable NGINX rewrite logs.
|
||||
Note that rewrite logs are sent to the error_log file at the notice level. To enable this feature use the annotation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/enable-rewrite-log</span><span class="p p-Indicator">:</span> <span class="s">"true"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/enable-rewrite-log</span><span class="p p-Indicator">:</span> <span class="s">"true"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<h3 id="lua-resty-waf">Lua Resty WAF<a class="headerlink" href="#lua-resty-waf" title="Permanent link">¶</a></h3>
|
||||
<p>Using <code class="codehilite">lua-resty-waf-*</code> annotations we can enable and control the <a href="https://github.com/p0pr0ck5/lua-resty-waf">lua-resty-waf</a>
|
||||
Web Application Firewall per location.</p>
|
||||
<p>Following configuration will enable the WAF for the paths defined in the corresponding ingress:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf</span><span class="p p-Indicator">:</span> <span class="s">"active"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf</span><span class="p p-Indicator">:</span> <span class="s">"active"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>In order to run it in debugging mode you can set <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf-debug</code> to <code class="codehilite">"true"</code> in addition to the above configuration.
|
||||
The other possible values for <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf</code> are <code class="codehilite">inactive</code> and <code class="codehilite">simulate</code>.
|
||||
In <code class="codehilite">inactive</code> mode WAF won't do anything, whereas in <code class="codehilite">simulate</code> mode it will log a warning message if there's a matching WAF rule for given request. This is useful to debug a rule and eliminate possible false positives before fully deploying it.</p>
|
||||
<p><code class="codehilite">lua-resty-waf</code> comes with predefined set of rules <a href="https://github.com/p0pr0ck5/lua-resty-waf/tree/84b4f40362500dd0cb98b9e71b5875cb1a40f1ad/rules">https://github.com/p0pr0ck5/lua-resty-waf/tree/84b4f40362500dd0cb98b9e71b5875cb1a40f1ad/rules</a> that covers ModSecurity CRS.
|
||||
You can use <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf-ignore-rulesets</code> to ignore a subset of those rulesets. For an example:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf-ignore-rulesets</span><span class="p p-Indicator">:</span> <span class="s">"41000_sqli,</span><span class="nv"> </span><span class="s">42000_xss"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf-ignore-rulesets</span><span class="p p-Indicator">:</span> <span class="s">"41000_sqli,</span><span class="nv"> </span><span class="s">42000_xss"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>will ignore the two mentioned rulesets.</p>
|
||||
<p>It is also possible to configure custom WAF rules per ingress using the <code class="codehilite">nginx.ingress.kubernetes.io/lua-resty-waf-extra-rules</code> annotation. For an example the following snippet will configure a WAF rule to deny requests with query string value that contains word <code class="codehilite">foo</code>:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf-extra-rules</span><span class="p p-Indicator">:</span> <span class="s">'[=[</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"access":</span><span class="nv"> </span><span class="s">[</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"actions":</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"disrupt"</span><span class="nv"> </span><span class="s">:</span><span class="nv"> </span><span class="s">"DENY"</span><span class="nv"> </span><span class="s">},</span><span class="nv"> </span><span class="s">"id":</span><span class="nv"> </span><span class="s">10001,</span><span class="nv"> </span><span class="s">"msg":</span><span class="nv"> </span><span class="s">"my</span><span class="nv"> </span><span class="s">custom</span><span class="nv"> </span><span class="s">rule",</span><span class="nv"> </span><span class="s">"operator":</span><span class="nv"> </span><span class="s">"STR_CONTAINS",</span><span class="nv"> </span><span class="s">"pattern":</span><span class="nv"> </span><span class="s">"foo",</span><span class="nv"> </span><span class="s">"vars":</span><span class="nv"> </span><span class="s">[</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"parse":</span><span class="nv"> </span><span class="s">[</span><span class="nv"> </span><span class="s">"values",</span><span class="nv"> </span><span class="s">1</span><span class="nv"> </span><span class="s">],</span><span class="nv"> </span><span class="s">"type":</span><span class="nv"> </span><span class="s">"REQUEST_ARGS"</span><span class="nv"> </span><span class="s">}</span><span class="nv"> </span><span class="s">]</span><span class="nv"> </span><span class="s">}</span><span class="nv"> </span><span class="s">],</span><span class="nv"> </span><span class="s">"body_filter":</span><span class="nv"> </span><span class="s">[],</span><span class="nv"> </span><span class="s">"header_filter":[]</span><span class="nv"> </span><span class="s">}</span><span class="nv"> </span><span class="s">]=]'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/lua-resty-waf-extra-rules</span><span class="p p-Indicator">:</span> <span class="s">'[=[</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"access":</span><span class="nv"> </span><span class="s">[</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"actions":</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"disrupt"</span><span class="nv"> </span><span class="s">:</span><span class="nv"> </span><span class="s">"DENY"</span><span class="nv"> </span><span class="s">},</span><span class="nv"> </span><span class="s">"id":</span><span class="nv"> </span><span class="s">10001,</span><span class="nv"> </span><span class="s">"msg":</span><span class="nv"> </span><span class="s">"my</span><span class="nv"> </span><span class="s">custom</span><span class="nv"> </span><span class="s">rule",</span><span class="nv"> </span><span class="s">"operator":</span><span class="nv"> </span><span class="s">"STR_CONTAINS",</span><span class="nv"> </span><span class="s">"pattern":</span><span class="nv"> </span><span class="s">"foo",</span><span class="nv"> </span><span class="s">"vars":</span><span class="nv"> </span><span class="s">[</span><span class="nv"> </span><span class="s">{</span><span class="nv"> </span><span class="s">"parse":</span><span class="nv"> </span><span class="s">[</span><span class="nv"> </span><span class="s">"values",</span><span class="nv"> </span><span class="s">1</span><span class="nv"> </span><span class="s">],</span><span class="nv"> </span><span class="s">"type":</span><span class="nv"> </span><span class="s">"REQUEST_ARGS"</span><span class="nv"> </span><span class="s">}</span><span class="nv"> </span><span class="s">]</span><span class="nv"> </span><span class="s">}</span><span class="nv"> </span><span class="s">],</span><span class="nv"> </span><span class="s">"body_filter":</span><span class="nv"> </span><span class="s">[],</span><span class="nv"> </span><span class="s">"header_filter":[]</span><span class="nv"> </span><span class="s">}</span><span class="nv"> </span><span class="s">]=]'</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>For details on how to write WAF rules, please refer to <a href="https://github.com/p0pr0ck5/lua-resty-waf">https://github.com/p0pr0ck5/lua-resty-waf</a>.</p>
|
||||
<h3 id="grpc-backend-deprecated-since-0180">gRPC backend DEPRECATED (since 0.18.0)<a class="headerlink" href="#grpc-backend-deprecated-since-0180" title="Permanent link">¶</a></h3>
|
||||
|
|
@ -2414,12 +2444,17 @@ Exposing a gRPC service using HTTP is not supported.</p>
|
|||
<h3 id="influxdb">InfluxDB<a class="headerlink" href="#influxdb" title="Permanent link">¶</a></h3>
|
||||
<p>Using <code class="codehilite">influxdb-*</code> annotations we can monitor requests passing through a Location by sending them to an InfluxDB backend exposing the UDP socket
|
||||
using the <a href="https://github.com/influxdata/nginx-influxdb-module/">nginx-influxdb-module</a>.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/enable-influxdb</span><span class="p p-Indicator">:</span> <span class="s">"true"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/enable-influxdb</span><span class="p p-Indicator">:</span> <span class="s">"true"</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/influxdb-measurement</span><span class="p p-Indicator">:</span> <span class="s">"nginx-reqs"</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/influxdb-port</span><span class="p p-Indicator">:</span> <span class="s">"8089"</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/influxdb-host</span><span class="p p-Indicator">:</span> <span class="s">"127.0.0.1"</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/influxdb-server-name</span><span class="p p-Indicator">:</span> <span class="s">"nginx-ingress"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>For the <code class="codehilite">influxdb-host</code> parameter you have two options:</p>
|
||||
<ul>
|
||||
|
|
@ -2435,8 +2470,9 @@ an ip address to <code class="codehilite">nginx.ingress.kubernetes.io/influxdb-h
|
|||
Valid Values: HTTP, HTTPS, GRPC, GRPCS and AJP</p>
|
||||
<p>By default NGINX uses <code class="codehilite">HTTP</code>.</p>
|
||||
<p>Example:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/backend-protocol</span><span class="p p-Indicator">:</span> <span class="s">"HTTPS"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">nginx.ingress.kubernetes.io/backend-protocol</span><span class="p p-Indicator">:</span> <span class="s">"HTTPS"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1361,6 +1361,27 @@
|
|||
|
||||
</li>
|
||||
|
||||
<li class="md-nav__item">
|
||||
<a href="#block-cidrs" title="block-cidrs" class="md-nav__link">
|
||||
block-cidrs
|
||||
</a>
|
||||
|
||||
</li>
|
||||
|
||||
<li class="md-nav__item">
|
||||
<a href="#block-user-agents" title="block-user-agents" class="md-nav__link">
|
||||
block-user-agents
|
||||
</a>
|
||||
|
||||
</li>
|
||||
|
||||
<li class="md-nav__item">
|
||||
<a href="#block-referers" title="block-referers" class="md-nav__link">
|
||||
block-referers
|
||||
</a>
|
||||
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -2718,6 +2739,27 @@
|
|||
|
||||
</li>
|
||||
|
||||
<li class="md-nav__item">
|
||||
<a href="#block-cidrs" title="block-cidrs" class="md-nav__link">
|
||||
block-cidrs
|
||||
</a>
|
||||
|
||||
</li>
|
||||
|
||||
<li class="md-nav__item">
|
||||
<a href="#block-user-agents" title="block-user-agents" class="md-nav__link">
|
||||
block-user-agents
|
||||
</a>
|
||||
|
||||
</li>
|
||||
|
||||
<li class="md-nav__item">
|
||||
<a href="#block-referers" title="block-referers" class="md-nav__link">
|
||||
block-referers
|
||||
</a>
|
||||
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -2743,10 +2785,13 @@
|
|||
components for the nginx-controller.</p>
|
||||
<p>In order to overwrite nginx-controller configuration values as seen in <a href="https://github.com/kubernetes/ingress-nginx/blob/master/internal/ingress/controller/config/config.go">config.go</a>,
|
||||
you can add key-value pairs to the data section of the config-map. For Example:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">data</span><span class="p p-Indicator">:</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="l l-Scalar l-Scalar-Plain">data</span><span class="p p-Indicator">:</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">map-hash-bucket-size</span><span class="p p-Indicator">:</span> <span class="s">"128"</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">ssl-protocols</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">SSLv2</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<div class="admonition important">
|
||||
<p class="admonition-title">Important</p>
|
||||
|
|
@ -3351,6 +3396,21 @@ Same for numbers, like "100".</p>
|
|||
<td align="left">string</td>
|
||||
<td align="left">"/.well-known/acme-challenge"</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left"><a href="#block-cidrs">block-cidrs</a></td>
|
||||
<td align="left">[]string</td>
|
||||
<td align="left">""</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left"><a href="#block-user-agents">block-user-agents</a></td>
|
||||
<td align="left">[]string</td>
|
||||
<td align="left">""</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td align="left"><a href="#block-referers">block-referers</a></td>
|
||||
<td align="left">[]string</td>
|
||||
<td align="left">""</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<h2 id="add-headers">add-headers<a class="headerlink" href="#add-headers" title="Permanent link">¶</a></h2>
|
||||
|
|
@ -3723,6 +3783,20 @@ Supported codes are <a href="https://developer.mozilla.org/docs/Web/HTTP/Status/
|
|||
<h2 id="no-auth-locations">no-auth-locations<a class="headerlink" href="#no-auth-locations" title="Permanent link">¶</a></h2>
|
||||
<p>A comma-separated list of locations that should not get authenticated.
|
||||
<em><strong>default:</strong></em> "/.well-known/acme-challenge"</p>
|
||||
<h2 id="block-cidrs">block-cidrs<a class="headerlink" href="#block-cidrs" title="Permanent link">¶</a></h2>
|
||||
<p>A comma-separated list of IP addresses (or subnets), requestst from which have to be blocked globally.</p>
|
||||
<p><em>References:</em>
|
||||
<a href="http://nginx.org/en/docs/http/ngx_http_access_module.html#deny">http://nginx.org/en/docs/http/ngx_http_access_module.html#deny</a></p>
|
||||
<h2 id="block-user-agents">block-user-agents<a class="headerlink" href="#block-user-agents" title="Permanent link">¶</a></h2>
|
||||
<p>A comma-separated list of User-Agent, requestst from which have to be blocked globally.
|
||||
It's possible to use here full strings and regular expressions. More details about valid patterns can be found at <code class="codehilite">map</code> Nginx directive documentation.</p>
|
||||
<p><em>References:</em>
|
||||
<a href="http://nginx.org/en/docs/http/ngx_http_map_module.html#map">http://nginx.org/en/docs/http/ngx_http_map_module.html#map</a></p>
|
||||
<h2 id="block-referers">block-referers<a class="headerlink" href="#block-referers" title="Permanent link">¶</a></h2>
|
||||
<p>A comma-separated list of Referers, requestst from which have to be blocked globally.
|
||||
It's possible to use here full strings and regular expressions. More details about valid patterns can be found at <code class="codehilite">map</code> Nginx directive documentation.</p>
|
||||
<p><em>References:</em>
|
||||
<a href="http://nginx.org/en/docs/http/ngx_http_map_module.html#map">http://nginx.org/en/docs/http/ngx_http_map_module.html#map</a></p>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1086,7 +1086,17 @@
|
|||
<p>The NGINX template is located in the file <code class="codehilite">/etc/nginx/template/nginx.tmpl</code>.</p>
|
||||
<p>Using a <a href="https://kubernetes.io/docs/concepts/storage/volumes/">Volume</a> it is possible to use a custom template.
|
||||
This includes using a <a href="https://kubernetes.io/docs/concepts/storage/volumes/#example-pod-with-a-secret-a-downward-api-and-a-configmap">Configmap</a> as source of the template</p>
|
||||
<div class="codehilite"><pre><span></span> <span class="l l-Scalar l-Scalar-Plain">volumeMounts</span><span class="p p-Indicator">:</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11</pre></div></td><td class="code"><div class="codehilite"><pre><span></span> <span class="l l-Scalar l-Scalar-Plain">volumeMounts</span><span class="p p-Indicator">:</span>
|
||||
<span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mountPath</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">/etc/nginx/template</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">nginx-template-volume</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">readOnly</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">true</span>
|
||||
|
|
@ -1098,6 +1108,7 @@ This includes using a <a href="https://kubernetes.io/docs/concepts/storage/volum
|
|||
<span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">key</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">nginx.tmpl</span>
|
||||
<span class="l l-Scalar l-Scalar-Plain">path</span><span class="p p-Indicator">:</span> <span class="l l-Scalar l-Scalar-Plain">nginx.tmpl</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p><strong>Please note the template is tied to the Go code. Do not change names in the variable <code class="codehilite">$cfg</code>.</strong></p>
|
||||
<p>For more information about the template syntax please check the <a href="https://golang.org/pkg/text/template/">Go template package</a>.
|
||||
|
|
|
|||
|
|
@ -1084,13 +1084,19 @@
|
|||
|
||||
<h1 id="log-format">Log format<a class="headerlink" href="#log-format" title="Permanent link">¶</a></h1>
|
||||
<p>The default configuration uses a custom logging format to add additional information about upstreams, response time and status.</p>
|
||||
<div class="codehilite"><pre><span></span><span class="x">log_format upstreaminfo</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="x">log_format upstreaminfo</span>
|
||||
<span class="x"> '</span><span class="cp">{{</span> <span class="k">if</span> <span class="err">$</span><span class="nv">cfg.useProxyProtocol</span> <span class="cp">}}</span><span class="x">$proxy_protocol_addr</span><span class="cp">{{</span> <span class="k">else</span> <span class="cp">}}</span><span class="x">$remote_addr</span><span class="cp">{{</span> <span class="nv">end</span> <span class="cp">}}</span><span class="x"> - '</span>
|
||||
<span class="x"> '[$the_real_ip] - $remote_user [$time_local] "$request" '</span>
|
||||
<span class="x"> '$status $body_bytes_sent "$http_referer" "$http_user_agent" '</span>
|
||||
<span class="x"> '$request_length $request_time [$proxy_upstream_name] $upstream_addr '</span>
|
||||
<span class="x"> '$upstream_response_length $upstream_response_time $upstream_status';</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<table>
|
||||
<thead>
|
||||
|
|
|
|||
|
|
@ -1187,18 +1187,42 @@
|
|||
By default this feature is disabled.</p>
|
||||
<h2 id="usage">Usage<a class="headerlink" href="#usage" title="Permanent link">¶</a></h2>
|
||||
<p>To enable the instrumentation we must enable opentracing in the configuration configmap:
|
||||
<div class="codehilite"><pre><span></span><span class="n">data</span><span class="o">:</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="n">data</span><span class="o">:</span>
|
||||
<span class="n">enable</span><span class="o">-</span><span class="n">opentracing</span><span class="o">:</span> <span class="s2">"true"</span>
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>We must also set the host to use when uploading traces:</p>
|
||||
<div class="codehilite"><pre><span></span>zipkin-collector-host: zipkin.default.svc.cluster.local
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>zipkin-collector-host: zipkin.default.svc.cluster.local
|
||||
jaeger-collector-host: jaeger-collector.default.svc.cluster.local
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Next you will need to deploy a distributed tracing system which uses OpenTracing. Both <a href="https://github.com/openzipkin/zipkin">Zipkin</a> and
|
||||
<a href="https://github.com/jaegertracing/jaeger">Jaeger</a> have been tested.</p>
|
||||
<p>Other optional configuration options:
|
||||
<div class="codehilite"><pre><span></span># specifies the port to use when uploading traces
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21</pre></div></td><td class="code"><div class="codehilite"><pre><span></span># specifies the port to use when uploading traces
|
||||
zipkin-collector-port
|
||||
|
||||
# specifies the service name to use for any traces created, Default: nginx
|
||||
|
|
@ -1219,19 +1243,31 @@ jaeger-sampler-type
|
|||
|
||||
# specifies the argument to be passed to the sampler constructor, Default: 1
|
||||
jaeger-sampler-param
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<h2 id="examples">Examples<a class="headerlink" href="#examples" title="Permanent link">¶</a></h2>
|
||||
<p>The following examples show how to deploy and test different distributed tracing systems. These example can be performed
|
||||
using Minikube.</p>
|
||||
<h3 id="zipkin">Zipkin<a class="headerlink" href="#zipkin" title="Permanent link">¶</a></h3>
|
||||
<p>In the <a href="https://github.com/rnburn/zipkin-date-server">rnburn/zipkin-date-server</a>
|
||||
github repository is an example of a dockerized date service. To install the example and zipkin collector run:</p>
|
||||
<div class="codehilite"><pre><span></span>kubectl create -f https://raw.githubusercontent.com/rnburn/zipkin-date-server/master/kubernetes/zipkin.yaml
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>kubectl create -f https://raw.githubusercontent.com/rnburn/zipkin-date-server/master/kubernetes/zipkin.yaml
|
||||
kubectl create -f https://raw.githubusercontent.com/rnburn/zipkin-date-server/master/kubernetes/deployment.yaml
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Also we need to configure the NGINX controller configmap with the required values:</p>
|
||||
<div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s1">'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s1">'</span>
|
||||
<span class="s1">apiVersion: v1</span>
|
||||
<span class="s1">kind: ConfigMap</span>
|
||||
<span class="s1">data:</span>
|
||||
|
|
@ -1242,6 +1278,7 @@ kubectl create -f https://raw.githubusercontent.com/rnburn/zipkin-date-server/ma
|
|||
<span class="s1"> namespace: kube-system</span>
|
||||
<span class="s1">'</span> <span class="p">|</span> kubectl replace -f -
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>In the zipkin interface we can see the details:
|
||||
<img alt="zipkin screenshot" src="../../../images/zipkin-demo.png" title="zipkin collector screenshot" /></p>
|
||||
|
|
@ -1249,17 +1286,40 @@ kubectl create -f https://raw.githubusercontent.com/rnburn/zipkin-date-server/ma
|
|||
<ol>
|
||||
<li>
|
||||
<p>Enable Ingress addon in minikube:
|
||||
<div class="codehilite"><pre><span></span>$ minikube addons <span class="nb">enable</span> ingress
|
||||
</pre></div></p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ minikube addons <span class="nb">enable</span> ingress
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
</li>
|
||||
<li>
|
||||
<p>Add minikube IP to /etc/hosts:
|
||||
<div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s2">"</span><span class="k">$(</span>minikube ip<span class="k">)</span><span class="s2"> example.com"</span> <span class="p">|</span> sudo tee -a /etc/hosts
|
||||
</pre></div></p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s2">"</span><span class="k">$(</span>minikube ip<span class="k">)</span><span class="s2"> example.com"</span> <span class="p">|</span> sudo tee -a /etc/hosts
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
</li>
|
||||
<li>
|
||||
<p>Apply a Basic Service and Ingress Resource:
|
||||
<div class="codehilite"><pre><span></span># Create Echoheaders Deployment
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22</pre></div></td><td class="code"><div class="codehilite"><pre><span></span># Create Echoheaders Deployment
|
||||
$ kubectl run echoheaders --image=k8s.gcr.io/echoserver:1.4 --replicas=1 --port=8080
|
||||
|
||||
# Expose as a Cluster-IP
|
||||
|
|
@ -1281,11 +1341,22 @@ $ echo '
|
|||
servicePort: 80
|
||||
path: /echo
|
||||
' | kubectl apply -f -
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
</li>
|
||||
<li>
|
||||
<p>Enable OpenTracing and set the zipkin-collector-host:
|
||||
<div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s1">'</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ <span class="nb">echo</span> <span class="s1">'</span>
|
||||
<span class="s1"> apiVersion: v1</span>
|
||||
<span class="s1"> kind: ConfigMap</span>
|
||||
<span class="s1"> data:</span>
|
||||
|
|
@ -1296,16 +1367,46 @@ $ echo '
|
|||
<span class="s1"> name: nginx-load-balancer-conf</span>
|
||||
<span class="s1"> namespace: kube-system</span>
|
||||
<span class="s1"> '</span> <span class="p">|</span> kubectl replace -f -
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
</li>
|
||||
<li>
|
||||
<p>Apply the Jaeger All-In-One Template:
|
||||
<div class="codehilite"><pre><span></span>$ kubectl apply -f https://raw.githubusercontent.com/jaegertracing/jaeger-kubernetes/master/all-in-one/jaeger-all-in-one-template.yml
|
||||
</pre></div></p>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ kubectl apply -f https://raw.githubusercontent.com/jaegertracing/jaeger-kubernetes/master/all-in-one/jaeger-all-in-one-template.yml
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
</li>
|
||||
<li>
|
||||
<p>Make a few requests to the Service:
|
||||
<div class="codehilite"><pre><span></span>$ curl example.com/echo -d <span class="s2">"meow"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span> 1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7
|
||||
8
|
||||
9
|
||||
10
|
||||
11
|
||||
12
|
||||
13
|
||||
14
|
||||
15
|
||||
16
|
||||
17
|
||||
18
|
||||
19
|
||||
20
|
||||
21
|
||||
22
|
||||
23
|
||||
24
|
||||
25
|
||||
26
|
||||
27
|
||||
28
|
||||
29</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ curl example.com/echo -d <span class="s2">"meow"</span>
|
||||
|
||||
CLIENT VALUES:
|
||||
<span class="nv">client_address</span><span class="o">=</span><span class="m">172</span>.17.0.5
|
||||
|
|
@ -1334,14 +1435,18 @@ x-real-ip<span class="o">=</span><span class="m">192</span>.168.99.1
|
|||
x-scheme<span class="o">=</span>http
|
||||
BODY:
|
||||
meow
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
</li>
|
||||
<li>
|
||||
<p>View the Jaeger UI:
|
||||
<div class="codehilite"><pre><span></span>$ minikube service jaeger-query --url
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ minikube service jaeger-query --url
|
||||
|
||||
http://192.168.99.100:30183
|
||||
</pre></div></p>
|
||||
</pre></div>
|
||||
</td></tr></table></p>
|
||||
<p>In the jaeger interface we can see the details:
|
||||
<img alt="jaeger screenshot" src="../../../images/jaeger-demo.png" title="jaeger collector screenshot" /></p>
|
||||
</li>
|
||||
|
|
|
|||
|
|
@ -1239,12 +1239,14 @@
|
|||
<h2 id="tls-secrets">TLS Secrets<a class="headerlink" href="#tls-secrets" title="Permanent link">¶</a></h2>
|
||||
<p>Anytime we reference a TLS secret, we mean a PEM-encoded X.509, RSA (2048) secret.</p>
|
||||
<p>You can generate a self-signed certificate and private key with with:</p>
|
||||
<div class="codehilite"><pre><span></span>$ openssl req -x509 -nodes -days <span class="m">365</span> -newkey rsa:2048 -keyout <span class="si">${</span><span class="nv">KEY_FILE</span><span class="si">}</span> -out <span class="si">${</span><span class="nv">CERT_FILE</span><span class="si">}</span> -subj <span class="s2">"/CN=</span><span class="si">${</span><span class="nv">HOST</span><span class="si">}</span><span class="s2">/O=</span><span class="si">${</span><span class="nv">HOST</span><span class="si">}</span><span class="s2">"</span><span class="sb">`</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>$ openssl req -x509 -nodes -days <span class="m">365</span> -newkey rsa:2048 -keyout <span class="si">${</span><span class="nv">KEY_FILE</span><span class="si">}</span> -out <span class="si">${</span><span class="nv">CERT_FILE</span><span class="si">}</span> -subj <span class="s2">"/CN=</span><span class="si">${</span><span class="nv">HOST</span><span class="si">}</span><span class="s2">/O=</span><span class="si">${</span><span class="nv">HOST</span><span class="si">}</span><span class="s2">"</span><span class="sb">`</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>Then create the secret in the cluster via:</p>
|
||||
<div class="codehilite"><pre><span></span>kubectl create secret tls <span class="si">${</span><span class="nv">CERT_NAME</span><span class="si">}</span> --key <span class="si">${</span><span class="nv">KEY_FILE</span><span class="si">}</span> --cert <span class="si">${</span><span class="nv">CERT_FILE</span><span class="si">}</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span>kubectl create secret tls <span class="si">${</span><span class="nv">CERT_NAME</span><span class="si">}</span> --key <span class="si">${</span><span class="nv">KEY_FILE</span><span class="si">}</span> --cert <span class="si">${</span><span class="nv">CERT_FILE</span><span class="si">}</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>The resulting secret will be of type <code class="codehilite">kubernetes.io/tls</code>.</p>
|
||||
<h2 id="default-ssl-certificate">Default SSL Certificate<a class="headerlink" href="#default-ssl-certificate" title="Permanent link">¶</a></h2>
|
||||
|
|
@ -1306,8 +1308,9 @@ replaced by <a href="https://github.com/jetstack/cert-manager/">cert-manager</a>
|
|||
<p><a href="https://github.com/jetstack/kube-lego">Kube-Lego</a> automatically requests missing or expired certificates from <a href="https://letsencrypt.org">Let's Encrypt</a>
|
||||
by monitoring ingress resources and their referenced secrets.</p>
|
||||
<p>To enable this for an ingress resource you have to add an annotation:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="go">kubectl annotate ing ingress-demo kubernetes.io/tls-acme="true"</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="go">kubectl annotate ing ingress-demo kubernetes.io/tls-acme="true"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
<p>To setup Kube-Lego you can take a look at this <a href="https://github.com/jetstack/kube-lego/tree/master/examples">full example</a>.
|
||||
The first version to fully support Kube-Lego is Nginx Ingress controller 0.8.</p>
|
||||
|
|
@ -1321,7 +1324,13 @@ May 2018, <a href="https://developer.android.com/about/dashboards/#Platform">app
|
|||
are not compatible with nginx-ingress's default configuration.</p>
|
||||
<p>To change this default behavior, use a <a href="../nginx-configuration/configmap/">ConfigMap</a>.</p>
|
||||
<p>A sample ConfigMap fragment to allow these older clients to connect could look something like the following:</p>
|
||||
<div class="codehilite"><pre><span></span><span class="n">kind</span><span class="o">:</span> <span class="n">ConfigMap</span>
|
||||
<table class="codehilitetable"><tr><td class="linenos"><div class="linenodiv"><pre><span></span>1
|
||||
2
|
||||
3
|
||||
4
|
||||
5
|
||||
6
|
||||
7</pre></div></td><td class="code"><div class="codehilite"><pre><span></span><span class="n">kind</span><span class="o">:</span> <span class="n">ConfigMap</span>
|
||||
<span class="n">apiVersion</span><span class="o">:</span> <span class="n">v1</span>
|
||||
<span class="n">metadata</span><span class="o">:</span>
|
||||
<span class="n">name</span><span class="o">:</span> <span class="n">nginx</span><span class="o">-</span><span class="n">config</span>
|
||||
|
|
@ -1329,6 +1338,7 @@ are not compatible with nginx-ingress's default configuration.</p>
|
|||
<span class="n">ssl</span><span class="o">-</span><span class="n">ciphers</span><span class="o">:</span> <span class="s2">"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"</span>
|
||||
<span class="n">ssl</span><span class="o">-</span><span class="n">protocols</span><span class="o">:</span> <span class="s2">"TLSv1 TLSv1.1 TLSv1.2"</span>
|
||||
</pre></div>
|
||||
</td></tr></table>
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue