External connection management module (NGinx)

In this section you can configure the routing of external connections to the cluster (Ingress Controller). It provides management and routing of incoming traffic from outside to various services and applications deployed in containers.

To configure Ingress Controller in the cluster interface of the Shturval platform, go to the Installed services page of the Services and repositories section.

If the module is not displayed, go to the available charts, on the “shturval” tab, find the “shturval-ingress-controller” chart and click “Install”.

Additional information can be found on official website.

How to replace VIP Ingress with an external balancer #

If, when adding a cluster, you specified an internal virtual IP address and there was a need to replace it with an external balancer, you must:

1. Prepare ShturvalServicePatch for application to the External Connectivity Control Module (shturval-ingress-controller) specification (ssc).

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: <resource-name>
spec:
  shturvalServiceConfigName: shturval-ingress-controller
  customvalues:
    controller:
      hostPort: 
        enabled: true # When enabled, ingress controller pods will also use ports 80 and 443 on cluster nodes
      service:
        nodePorts:
          http: "<your-parameter-value>"
          https: "<your-parameter-value>"
        type: NodePort
      shturval:
        commonName: <your-parameter-value>

2. Load the prepared ShturvalServicePatch into the cluster using import manifests.

Once ShturvalServicePatch is loaded, it will take some time for the configuration to apply. Afterwards, the nodes will be ready to accept ingress traffic on the specified ports (for example, 30080 and 30443).

For an example of configuring an external load balancer (HAProxy) during cluster installation, see HAProxy configuration example.

How to enable the proxy protocol #

All parameters from official documentation, including the proxy protocol. To set the proxy protocol for Ingress Controller in the Shturval platform:

1. Prepare a ShturvalServicePatch to apply to the Control Module specification (ssc)control over external connections (shturval-ingress-controller).

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-ingress-controller-proxy
spec:
  shturvalServiceConfigName: shturval-ingress-controller
  customvalues:
    controller:
      config:
        use-proxy-protocol: true

2. Load the prepared ShturvalServicePatch into the cluster using import manifests.

Once ShturvalServicePatch is downloaded, it will take some time for the changes to take effect.

Configuring worker-processes, CPU, Memory #

By default, in the Shturval platform, the Ingress Controller has a limit on the number of worker-processes and limits on resource requests (CPU, Memory).

controller:
  config:
    worker-processes: 4
  resources:
    limits:
      memory: 400Mi
    requests:
      cpu: 200m
      memory: 300Mi 

If necessary, you can override the default values by replacing them in the parameters worker-processes, memory, cpu. To do this:

1. Prepare a ShturvalServicePatch to apply to the External Connectivity Control Module (shturval-ingress-controller) specification (ssc).

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-ingress-controller-proxy
spec:
  shturvalServiceConfigName: shturval-ingress-controller
  customvalues:
    controller:
      config:
        worker-processes: <your-parameter-value>
      resources:
        limits:
          memory: <your-parameter-value>
        requests:
          cpu: <your-parameter-value>
          memory: <your-parameter-value> 

2. Load the prepared ShturvalServicePatch into the cluster using import manifests.

Once ShturvalServicePatch is downloaded, it will take some time for the changes to take effect.

Setting up a buffer for HTTP headers #

By default, the Shturval platform has a limit on the size of HTTP headers - 2 16k (two 16 KB buffers).

If necessary, you can increase the allowed buffer size for transmitting HTTP headers. For example, so that a user with a token whose size exceeds the specified limit can access the GUI. To do this, override the value of the large-client-header-buffers parameter:

1. Prepare a ShturvalServicePatch to apply to the External Connectivity Control Module (shturval-ingress-controller) specification (ssc).

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: shturval-ingress-controller-large-headers
spec:
  shturvalServiceConfigName: shturval-ingress-controller
  customvalues:
    controller:
      config:
        large-client-header-buffers: <your-parameter-value>

2. Load the prepared ShturvalServicePatch into the cluster using import manifests.

Once ShturvalServicePatch is downloaded, it will take some time for the changes to take effect.

How to enable snippet annotations #

For configured snippet annotations to work in Ingress:

1. Prepare a ShturvalServicePatch to apply to the External Connection Control Module specification (ssc) (shturval-ingress-controller), where you enable the use of snippet annotations (allowSnippetAnnotations) and set the level of risk (Critical) of annotations that can be applied (annotations-risk-level).

apiVersion: ops.shturval.tech/v1beta2
kind: ShturvalServicePatch
metadata:
  name: ingress-controller-snippet
spec:
  shturvalServiceConfigName: shturval-ingress-controller
  customvalues:
    controller:
      allowSnippetAnnotations: true
      config:
        annotations-risk-level: Critical

2. Load the prepared ShturvalServicePatch into the cluster using import manifests.

Once ShturvalServicePatch is downloaded, it will take some time for the changes to take effect.