K8s Ingress Controller

[arm4b]

Moved from https://github.com/StackStorm/k8s-st2/issues/31

As part of templating Helm Charts, we'll need a K8s Ingress controller (https://kubernetes.io/docs/concepts/services-networking/ingress/) to allow user configuring inbound access to StackStorm Web UI/APIs from the outside world and have more granular configuration comparing to LoadBalancer type.

The Plan

Per #44 (comment) discussion we want to:

1. Expose Ingress controller settings via Helm values.yaml to allow users to configure the SSL/TLS negotiation layer on their own (optional).
2. Change st2web Docker image so it will respond on HTTP by default (currently HTTPS).

https://github.com/StackStorm/stackstorm-enterprise-ha/blob/d5e34fc28e820e39097d5eaac7dcadcc4a481f2b/values.yaml#L204-L205

https://github.com/StackStorm/stackstorm-enterprise-ha/blob/d5e34fc28e820e39097d5eaac7dcadcc4a481f2b/templates/ingress.yaml#L1

Resources

• https://kubernetes.io/docs/concepts/services-networking/ingress/
• https://github.com/kubernetes/ingress-nginx
• https://kubernetes.github.io/ingress-nginx/ingress-controller-catalog/
• https://blog.getambassador.io/kubernetes-ingress-nodeport-load-balancers-and-ingress-controllers-6e29f1c44f2d
• https://akomljen.com/kubernetes-nginx-ingress-controller/

[arm4b]

Overview of different K8s Service types and when to use what:
https://medium.com/@pczarkowski/kubernetes-services-exposed-86d45c994521

Providing my feedback since this one is still open.
with changes to values.yaml it was easy to expose service behind st2web to outside.

  service:
    type: "LoadBalancer"
    hostname: "example.domain.com"

I can also wish for a way to set Ingress controller inside values.yaml but I am not sure how feasible that is considering all services depending on st2web load balancing capability.

ingress:
  enabled: true
  path: /
  annotations:
    kubernetes.io/ingress.class: nginx
    certmanager.k8s.io/issuer:  my-issuer
    nginx.ingress.kubernetes.io/proxy-body-size: 50m
    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
    nginx.ingress.kubernetes.io/proxy-buffering: "on"
    nginx.ingress.kubernetes.io/configuration-snippet: |\

  hosts:
    - example.domain.com
  tls:
    - secretName: tls-secret
      hosts:
        - example.domain.com