Ingress Dual NGINX
Ingress NGINX is an Ingress Controller for NGINX webserver and reverse proxy, it manages NGINX in a Kubernetes native manner. This package deploys 2 NGINX Controllers, one with ingress class
external to serve public traffic, and one with ingress class
internal to serve internal traffic.
- Kubernetes >=
- Kustomize >=
Image repository and tag
- Ingress NGINX image:
- Ingress NGINX repo: https://github.com/kubernetes/ingress-nginx
Ingress NGINX Double is deployed with the following default configuration:
- Maximum allowed size of the client request body:
- HTTP status code used in redirects:
- Metrics are scraped by Prometheus every
- Validating Admission webhook that validates an ingress definition does not break NGINX configuration.
- Add the module to your
dual-nginxdepends on the
nginxpackage, so we need to download both of them.
- name: ingress/nginx
- name: ingress/dual-nginx
furyctldocumentation for additional details about
furyctl vendor -Hto download the packages
Inspect the download packages under
kustomization.yamlthat includes the
./vendor/katalog/ingress/dual-nginxdirectory as resource.
Apply the necessary patches. You can find a list of common customization here.
To deploy the packages to your cluster, execute:
kustomize build . | kubectl apply -f -
Your are now ready to expose your applications using Kubernetes
nginx package is deployed by default as a
DaemonSet, meaning that it will deploy 1 ingress-controller pod on every worker node.
This is probably NOT what you want, standard Fury clusters have at least 1
infra node (nodes that are dedicated to run Fury infrastructural components, like Prometheus, elasticsearch, and the ingress controllers).
If your cluster has
infra nodes you should patch the daemonset adding the
NodeSelector for the
infra nodes to the Ingress
DaemonSet. You can do this usiing the following kustomize patch:
If you don't have infra nodes and you don't want to run ingress-controllers on all your worker nodes, you should probably label some nodes and adjust the previous
Followings Prometheus alerts are already defined for this package.
|This alert fires if Prometheus target discovery was not able to reach ingress-nginx-metrics in the last 15 minutes.||critical||15m|
|This alert fires if the failure rate (the rate of 5xx responses) measured on a time window of 2 minutes was higher than 10% in the last 10 minutes.||critical||10m|
|This alert fires if the ingress' configuration reload failed in the last 10 minutes.||warning||10m|
|This alert fires if the ingress 99th percentile latency was more than 5 seconds in the last 10 minutes.||warning||10m|
|This alert fires if the ingress 99th percentile latency was more than 10 seconds in the last 10 minutes.||critical||10m|
|This alert fires if the certificate for a given host is expiring in less than 7 days.||warning|
|This alert fires if the certificate for a given host is expiring in less than 1 day.||critical|