Combining routes of frontend and backend - kubernetes

I have a React front-end and Flask API as back-end.
I wish to have both front-end and back-end routes accessible at same address. E.g frontend at myapp.web.com and backend at myapp.web.com/api.
It will have different deployments for them. I want to know how to do this.

Yes, you can have the same domain that can point to multiple services based on the path.
Normally this can help you to resolve the CORS issue.
API
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
name: backend-ingress
namespace: backend-api
spec:
rules:
- host: myapp.web.com
http:
paths:
- backend:
service:
name: backend-service-name
port:
number: 80
path: /api
pathType: Prefix
tls:
- hosts:
- myapp.web.com
secretName: my-secret-tls
Frontend ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.class: nginx
kubernetes.io/tls-acme: "true"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
name: frontend-service
namespace: frontend-service
spec:
rules:
- host: myapp.web.com
http:
paths:
- backend:
service:
name: frontend-service-name
port:
number: 80
path: /
pathType: Prefix
tls:
- hosts:
- myapp.web.com
secretName: my-secret-tls
so in this case, all the requests that start with /api will route to the backend app and rest of the requests will route to frontend.

Related

Ingress-Nginx: Subpath for host is not working without '/'

I have an instance of home-assistant being server from home..com. Using k8s-at-home helm chart I added a code-server sidecar to be served from home..com/codeserver. Both of these ingresses use ingress-nginx. The codeserver ingress redirects to home assistant root path when using home..com/codeserver, but when using home..com/codeserver/ it properly redirects to the code-server ingress. I would like not to have to explain that the last '/' is necessary. What can I do to make .com/codeserver work?
Here is the codeserver ingress:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: home-assistant-codeserver
namespace: home
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /$2
nginx.ingress.kubernetes.io/use-regex: 'true'
spec:
ingressClassName: nginx
tls:
- hosts:
- home.<DOMAIN>.com
secretName: home-tls
rules:
- host: home.<DOMAIN>.com
http:
paths:
- path: /codeserver(/|$)(.*)
pathType: Prefix
backend:
service:
name: home-assistant-codeserver
port:
number: 12321
Here is the home-assistant ingress:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: home-assistant
namespace: home
spec:
ingressClassName: nginx
tls:
- hosts:
- home.<DOMAIN>.com
secretName: home-tls
rules:
- host: home.<DOMAIN>.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: home-assistant
port:
number: 8123
I've been playing around with the nginx.ingress.kubernetes.io/rewrite-target annotation, but with no luck. What I have above seems to be the best solution from what I've seen online, but I'm still having this issue.

Kubernetes Ingress path route to different services in different namespaces

currently I'm trying the following setup:
I have:
one cluster
one Ingress Controller
one url (myapp.onazure.com)
two namespaces for two applications default and default-test
two deployments, ingress objects, services for the namespaces
I can easily reach my app from the default namespace with path based routing '/' as a prefix rule
Now i have tried to configure the second namespace and following rule: /testing to hit another service
Unfortunately i get an HTTP404 when i try to hit the following URL myapp.onazure.com/testing/openapi.json
What did I miss?
Working Ingress 1
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
name: liveapi-ingress-object
namespace: default
annotations:
kubernetes.io/ingress.class: public-nginx
spec:
tls:
- hosts:
- myapp-region1.onazure.com
- myapp-region2.onazure.com
secretName: ingress-tls-csi
rules:
- host: - myapp-region1.onazure.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: liveapi-svc
port:
number: 8080
- host: myapp-region2.onazure.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: liveapi-svc
port:
number: 8080
Not working Ingress 2
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
name: liveapi-ingress-object-testing
namespace: default-testing
annotations:
kubernetes.io/ingress.class: public-nginx
#nginx.ingress.kubernetes.io/rewrite-target: /testing
spec:
tls:
- hosts:
- myapp-region1.onazure.com
- myapp-region2.onazure.com
secretName: ingress-tls-csi-testing
rules:
- host: myapp-region1.onazure.com
http:
paths:
- path: /testing
#pathType: Prefix
backend:
service:
name: liveapi-svc-testing
port:
number: 8080
- host: myapp-region2.onazure.com
http:
paths:
- path: /testing
#pathType: Prefix
backend:
service:
name: liveapi-svc-testing
port:
number: 8080
Maybe I am missing a rewrite target to simply '/' in the testing namespace ingress?
Finally I figured out the missing part. I had to add the following statement to the not working ingress object:
annotations:
kubernetes.io/ingress.class: public-nginx
nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$1
Please see the complete ingress object:
kind: Ingress
apiVersion: networking.k8s.io/v1
metadata:
name: liveapi-ingress-object
namespace: default-testing
annotations:
kubernetes.io/ingress.class: public-nginx
nginx.ingress.kubernetes.io/use-regex: "true"
nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
tls:
- hosts:
- myapp.onazure.com
secretName: ingress-tls-csi-testing
rules:
- host: myapp.onazure.com
http:
paths:
- path: /testing/(.*)
pathType: Prefix
backend:
service:
name: liveapi-svc-testing
port:
number: 8000
Use full DNS name of a service,
$SERVICE.$NAMESPACE.svc.cluster.local
But you need to make sure your ignress controller has acccess to the desired namespace.

nginx-ingress: Redirect host URI based on request header for specific range of IPs

I am new to K8s and learning the concepts.
I need to achieve the following requirements using nginx-ingress in K8s
Whenever we receive request to abc.com/api it should get redirected to example.com/api, if the request is not from whitelisted IP range.
Kindly assist me with suggestions or feedback on this.
Thank you
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
kubernetes.io/ingress.allow-http: "false"
kubernetes.io/ingress.class: nginx
meta.helm.sh/release-name: static-web
meta.helm.sh/release-namespace: default
nginx.ingress.kubernetes.io/rewrite-target: /404.html
nginx.ingress.kubernetes.io/ssl-redirect: "true"
labels:
app.kubernetes.io/managed-by: Helm
name: internal-ingress
namespace: default
spec:
rules:
- host: abc.com
http:
paths:
- backend:
service:
name: nginx-svc
port:
number: 8000
path: /api/user-service
pathType: Prefix
- backend:
service:
name: nginx-svc
port:
number: 8000
path: /api/notification-service
pathType: Prefix
tls:
- hosts:
- abc.com
secretName: ingress-secret-tls

How to disable tls for specific traefik ingress in kubernetes?

I am using traefik ingress controller in Kubernetes. It is configured to redirect all request to https and terminate tls connection before passing the request to backend service.
Is it possible to only enable http for one particular ingress config but https for other ingresses ? Any example would be helpful.
I only want to enable http(no https) for this ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: test-ingress
spec:
rules:
- host: testdomain.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: test-service
port:
number: 8080
You can create the one ingress with the config like
apiVersion: networking.k8s.io/v1
kind: Ingress
annotation:
kubernetes.io/ingress.class: "traefik"
ingress.kubernetes.io/force-ssl-redirect: "false"
ingress.kubernetes.io/ssl-redirect: "false"
traefik.ingress.kubernetes.io/frontend-entry-points: http
metadata:
name: test-ingress
spec:
rules:
- host: testdomain.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: test-service
port:
number: 8080
you can get more idea about the annotation from here : https://doc.traefik.io/traefik/v1.6/configuration/backends/kubernetes/

K8s Ingress with one http and one https backend

I've got a K8s ingress and one http and one https backend.
browser -> https -> ingress -> http -> sonarqube
browser -> https -> ingress -> https -> unifi controller
If I'm using this config:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: '0'
name: ingress-test
spec:
rules:
- host: sonar.app.singel.home
http:
paths:
- backend:
service:
name: sonar-service
port:
number: 9000
path: /
pathType: Prefix
- host: unifi.app.singel.home
http:
paths:
- backend:
service:
name: unifi-controller
port:
number: 8443
path: /
pathType: Prefix
Then the http backend will work (sonarQube), and the https backend will not.
Now if I add the annotation:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
Then the https backend will work (unifi controller), and the http backend will not.
I guess I want the annotation to only apply to one of the rules, but I'm not sure this is possible?
You can use the tls as said in k8s doc
For ex:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: '0'
name: ingress-test
spec:
tls:
- hosts:
- sonar.app.singel.home
secretName: test-tls
rules:
- host: sonar.app.singel.home
http:
paths:
- backend:
service:
name: sonar-service
port:
number: 9000
path: /
pathType: Prefix
My assumption was that you can have only one ingress config. But you can have multiple. So the solution is to create two configs and load these, each with their own annotation. Like so:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/backend-protocol: HTTPS
name: ingress-1
spec:
rules:
- host: unifi.app.singel.home
http:
paths:
- backend:
service:
name: unifi-controller
port:
number: 8443
path: /
pathType: Prefix
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: '0'
name: ingress-2
spec:
rules:
- host: sonar.app.singel.home
http:
paths:
- backend:
service:
name: sonar-service
port:
number: 9000
path: /
pathType: Prefix