Ingress NGINX Single
Ingress NGINX is an Ingress Controller for NGINX web server and reverse-proxy, it manages NGINX in a Kubernetes native manner. This package deploys Ingress Controller for clusters created with
- Kubernetes >=
- Kustomize >=
Image repository and tag
- Ingress NGINX image:
- Ingress NGINX repo: https://github.com/kubernetes/ingress-nginx
Ingress NGINX single is deployed with the following default configuration:
- Maximum allowed size of the client request body:
- HTTP status code used in redirects:
- Metrics are scraped by Prometheus every
- Validating Admission webhook that validates an ingress definition does not break NGINX configuration.
⚠️ You'll need to have deployed
cert-managerfirst, the validating webhook needs to have TLS communication with the API server.
- Add the module to your
- name: ingress/nginx
furyctldocumentation for additional details about
furyctl vendor -Hto download the packages
Inspect the download packages under
kustomization.yamlthat includes the
./vendor/katalog/ingress/nginxdirectory as resource.
Apply the necessary patches. You can find a list of common customization here.
To deploy the packages to your cluster, execute:
kustomize build . | kubectl apply -f -
You are now ready to expose your applications using Kubernetes
nginx package is deployed by default as a
DaemonSet, meaning that it will deploy 1 ingress-controller pod on every worker node.
This is probably NOT what you want, standard Fury clusters have at least 1
infra node (nodes that are dedicated to Fury infrastructural components, like Prometheus, OpenSearch, and the Ingress Controllers).
If your cluster has
infra nodes you should patch the DaemonSet adding the
NodeSelector for the
infra nodes to the Ingress
DaemonSet. You can do this using the following kustomize patch:
If you don't have infra nodes and you don't want to run ingress controllers on all your worker nodes, you should probably label some nodes and adjust the previous
Followings Prometheus alerts are already defined for this package.
NGINX Ingress Controller Alert Rules
|This alert fires if Prometheus target discovery was not able to reach ingress-nginx-metrics in the last 15 minutes.||critical||15m|
|This alert fires if the failure rate (the rate of 5xx responses) measured on a time window of 2 minutes was higher than 10% in the last 10 minutes.||critical||10m|
|This alert fires if the ingress' configuration reload failed in the last 10 minutes.||warning||10m|
|This alert fires if the ingress 99th percentile latency was more than 5 seconds in the last 10 minutes.||warning||10m|
|This alert fires if the ingress 99th percentile latency was more than 10 seconds in the last 10 minutes.||critical||10m|
|This alert fires if the certificate for a given host is expiring in less than 7 days.||warning|
|This alert fires if the certificate for a given host is expiring in less than 1 day.||critical|