Isolated apps in kubernaties for end users - kubernetes

Question

I have tradional server app stack:
database
app (ruby)
microservice (node)
App is avaible by https://example.com
My users wants isolated personal apps (for high availability) with full database access by connection string
So we need server app stacks:
- personal (isolated) databases
- personal (isolated) apps
- personal (isolated) microservices
Apps must be avaible by http://cloud.example.com/userX, where userX is user's login
I think each user should have their own namespace. Thus, the personal database, application, and microserver belong to this namespace.
Also I have one Ingress (in namespace: kube-public) now for all users apps:
# ? apiVersion: networking.k8s.io/v1beta1
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: mgrs
namespace: kube-public
annotations:
kubernetes.io/ingress.class: "nginx"
cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
tls:
- hosts:
- cloud.example.com
secretName: cloud-tls
rules:
- host: cloud.example.com
http:
paths:
- path: /user1
backend:
serviceName: user1-service
servicePort: 80
- path: /user2
backend:
serviceName: user2-service
servicePort: 80
...
How it is possible with Kubernetes? Maybe I need several Ingress for each users?
Maybe it is more easy make paths
userX.example.com instead cloud.example.com/userX ?

Answer 1

One approach is use one Ngnix as a dynamic proxy to services, for that you cloud add a ConfigMap to dynamicaly rote to user service,
If you use one namespace and put the user name in the service name you should use this config:
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-config-dns-file
data:
nginx.conf: |
server {
listen 80;
resolver kube-dns.kube-system.svc.cluster.local valid=5s;
location ~ /(.*) {
proxy_pass http://$1-service.default.svc.cluster.local;
}
}
If you use one namespace per user and put the user name in the service name you should use something like this config:
apiVersion: v1
kind: ConfigMap
metadata:
name: nginx-config-dns-file
data:
nginx.conf: |
server {
listen 80;
resolver kube-dns.kube-system.svc.cluster.local valid=5s;
location ~ /(.*) {
proxy_pass http://$1-service.$1.svc.cluster.local;
}
}
Another possibility aligned with this one is to use a Nginx-Ingress controller and take advantages of Ngnix as ingress controller and the possibilities of apply some configuration to achieve what you wish.