E57A Add `ip` as an option to listeners for `VirtualServer` (#6180) · nginx/kubernetes-ingress@c1e2906 · GitHub
[go: up one dir, main page]
Skip to content

Commit c1e2906

Browse files
AlexFenlonAlexFenlon
authored
Add ip as an option to listeners for VirtualServer (#6180)
1 parent 75cfc6f commit c1e2906

25 files changed

+4058
-75
lines changed

‎charts/nginx-ingress/templates/controller-globalconfiguration.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{ if .Values.controller.globalConfiguration.create }}
2-
apiVersion: k8s.nginx.org/v1alpha1
2+
apiVersion: k8s.nginx.org/v1
33
kind: GlobalConfiguration
44
metadata:
55
name: {{ include "nginx-ingress.controller.fullname" . }}

‎charts/nginx-ingress/values.schema.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -994,6 +994,22 @@
994994
"examples": [
995995
"dns-tcp"
996996
]
997+
},
998+
"ipv4ip": {
999+
"type": "string",
1000+
"default": "",
1001+
"title": "The ipv4 ip",
1002+
"examples": [
1003+
"127.0.0.1"
1004+
]
1005+
},
1006+
"ipv6ip": {
1007+
"type": "string",
1008+
"default": "",
1009+
"title": "The ipv6 ip",
1010+
"examples": [
1011+
"::1"
1012+
]
9971013
}
9981014
}
9991015
}

‎config/crd/bases/k8s.nginx.org_globalconfigurations.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,10 @@ spec:
4646
items:
4747
description: Listener defines a listener.
4848
properties:
49+
ipv4:
50+
type: string
51+
ipv6:
52+
type: string
4953
name:
5054
type: string
5155
port:

‎deploy/crds.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,10 @@ spec:
142142
items:
143143
description: Listener defines a listener.
144144
properties:
145+
ipv4:
146+
type: string
147+
ipv6:
148+
type: string
145149
name:
146150
type: string
147151
port:

‎docs/content/configuration/global-configuration/globalconfiguration-resource.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,9 @@ The `listeners:` key defines a listener (a combination of a protocol and a port)
7474
| *port* | The port of the listener. The port must fall into the range ``1..65535`` with the following exceptions: ``80``, ``443``, the [status port](/nginx-ingress-controller/logging-and-monitoring/status-page), the [Prometheus metrics port](/nginx-ingress-controller/logging-and-monitoring/prometheus). Among all listeners, only a single combination of a port-protocol is allowed. | *int* | Yes |
7575
| *protocol* | The protocol of the listener. Supported values: ``TCP``, ``UDP`` and ``HTTP``. | *string* | Yes |
7676
| *ssl* | Configures the listener with SSL. This is currently only supported for ``HTTP`` listeners. Default value is ``false`` | *bool* | No |
77+
| *ipv4* | Specifies the IPv4 address to listen on. This is currently only supported for ``HTTP`` or ``HTTPS`` listeners. | *string* | No |
78+
| *ipv6* | Specifies the IPv6 address to listen on. This is currently only supported for ``HTTP`` or ``HTTPS`` listeners. | *string* | No |
79+
7780
{{</bootstrap-table>}}
7881

7982
---
@@ -173,3 +176,8 @@ Events:
173176
```
174177

175178
The events section includes a Warning event with the AddedOrUpdatedWithError reason.
179+
180+
181+
## Using IPV4 and IPV6 Addresses with GlobalConfiguration
182+
183+
You can customize the IPv4 and IPv6 Address listeners in the global configuration and apply them to your VirtualServer resources. See the corresponding example [here](https://github.com/nginxinc/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/custom-ip-listeners/virtualserver/)

‎examples/custom-resources/custom-ip-listeners/virtualserver/README.md‎

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
# Custom IPv4 and IPv6 Address Listeners
2+
3+
In this example, we will configure a VirtualServer resource with custom IPv4 and IPv6 Address using HTTP/HTTPS listeners.
4+
This will allow IPv4 and/or IPv6 address using HTTP and/or HTTPS based requests to be made on non-default ports using separate IPs.
5+
6+
## Prerequisites
7+
8+
1. Follow the [installation](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
9+
instructions to deploy the Ingress Controller with custom resources enabled.
10+
2. Ensure the Ingress Controller is configured with the `-global-configuration` argument:
11+
12+
```console
13+
args:
14+
- -global-configuration=$(POD_NAMESPACE)/nginx-configuration
15+
```
16+
17+
3. If you have a NodePort or Loadbalancer service deployed, ensure they are updated to include the custom listener ports.
18+
Example YAML for a LoadBalancer:
19+
20+
```yaml
21+
apiVersion: v1
22+
kind: Service
23+
metadata:
24+
name: nginx-ingress
25+
namespace: nginx-ingress
26+
spec:
27+
type: LoadBalancer
28+
ports:
29+
- port: 8083
30+
targetPort: 8083
31+
protocol: TCP
32+
name: ip-listener-1-http
33+
- port: 8443
34+
targetPort: 8443
35+
protocol: TCP
36+
name: ip-listener-2-https
37+
selector:
38+
app: nginx-ingress
39+
```
40+
41+
**Note:**
42+
43+
- **No Updates for GC:** If a GlobalConfiguration resource already exists, delete the previous one before applying the new configuration.
44+
- **Single Replica:** Only one replica is allowed when using this configuration.
45+
46+
## Step 1 - Deploy the GlobalConfiguration resource
47+
48+
Similar to how listeners are configured in our [custom-listeners](../../custom-listeners) examples,
49+
here we deploy a GlobalConfiguration resource with the listeners we want to use in our VirtualServer.
50+
51+
```yaml
52+
apiVersion: k8s.nginx.org/v1
53+
kind: GlobalConfiguration
54+
metadata:
55+
name: nginx-configuration
56+
namespace: nginx-ingress
57+
spec:
58+
listeners:
59+
- name: ip-listener-1-http
60+
port: 8083
61+
protocol: HTTP
62+
ipv4: 127.0.0.1
63+
- name: ip-listener-2-https
64+
port: 8443
65+
protocol: HTTP
66+
ipv4: 127.0.0.2
67+
ipv6: ::1
68+
ssl: true
69+
```
70+
71+
```console
72+
kubectl create -f global-configuration.yaml
73+
```
74+
75+
## Step 2 - Deploy the Cafe Application
76+
77+
Create the coffee and the tea deployments and services:
78+
79+
```console
80+
kubectl create -f cafe.yaml
81+
```
82+
83+
## Step 3 - Deploy the VirtualServer with custom listeners
84+
85+
The VirtualServer in this example is set to use the listeners defined in the GlobalConfiguration resource
86+
that was deployed in Step 1. Below is the yaml of this example VirtualServer:
87+
88+
```yaml
89+
apiVersion: k8s.nginx.org/v1
90+
kind: VirtualServer
91+
metadata:
92+
name: cafe
93+
spec:
94+
listener:
95+
http: ip-listener-1-http
96+
https: ip-listener-2-https
97+
host: cafe.example.com
98+
tls:
99+
secret: cafe-secret
100+
upstreams:
101+
- name: tea
102+
service: tea-svc
103+
port: 80
104+
- name: coffee
105+
service: coffee-svc
106+
port: 80
107+
routes:
108+
- path: /tea
109+
action:
110+
pass: tea
111+
- path: /coffee
112+
action:
113+
pass: coffee
114+
```
115+
116+
1. Create the secret with the TLS certificate and key:
117+
118+
```console
119+
kubectl create -f cafe-secret.yaml
120+
```
121+
122+
2. Create the VirtualServer resource:
123+
124+
```console
125+
kubectl create -f cafe-virtual-server.yaml
126+
```
127+
128+
## Step 4 - Test the Configuration
129+
130+
1. Check that the configuration has been successfully applied by inspecting the events of the VirtualServer and the GlobalConfiguration:
131+
132+
```console
133+
kubectl describe virtualserver cafe
134+
```
135+
136+
Below you will see the events as well as the new `Listeners` field
137+
138+
```console
139+
. . .
140+
Spec:
141+
Host: cafe.example.com
142+
Listener:
143+
Http: ip-listener-1-http
144+
Https: ip-listener-2-https
145+
. . .
146+
Routes:
147+
. . .
148+
Events:
149+
Type Reason Age From Message
150+
---- ------ ---- ---- -------
151+
Normal AddedOrUpdated 2s nginx-ingress-controller Configuration for default/cafe was added or updated
152+
```
153+
154+
```console
155+
kubectl describe globalconfiguration nginx-configuration -n nginx-ingress
156+
```
157+
158+
```console
159+
. . .
160+
Spec:
161+
Listeners:
162+
ipv4: 127.0.0.1
163+
Name: ip-listener-1-http
164+
Port: 8083
165+
Protocol: HTTP
166+
ipv4: 127.0.0.2
167+
ipv6: ::1
168 1004E +
Name: ip-listener-2-https
169+
Port: 8443
170+
Protocol: HTTP
171+
Ssl: true
172+
Events:
173+
Type Reason Age From Message
174+
---- ------ ---- ---- -------
175+
Normal Updated 14s nginx-ingress-controller GlobalConfiguration nginx-ingress/nginx-configuration was added or updated
176+
```
177+
178+
2. Since the deployed VirtualServer is using ports `8083` and `8443` in this example. you can see that the specific ips and ports
179+
are set and listening by using the below commands:
180+
181+
Access the NGINX Pod:
182+
183+
```console
184+
kubectl get pods -n nginx-ingress
185+
```
186+
187+
```text
188+
NAME READY STATUS RESTARTS AGE
189+
nginx-ingress-65cd79bb8f-crst4 1/1 Running 0 97s
190+
```
191+
192+
```console
193+
kubectl debug -it nginx-ingress-65cd79bb8f-crst4 --image=busybox:1.28 --target=nginx-ingress
194+
```
195+
196+
```console
197+
/ # netstat -tulpn
198+
Active Internet connections (only servers)
199+
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
200+
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN -
201+
tcp 0 0 127.0.0.1:8083 0.0.0.0:* LISTEN -
202+
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN -
203+
tcp 0 0 127.0.0.2:8443 0.0.0.0:* LISTEN -
204+
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
205+
tcp 0 0 :::8081 :::* LISTEN -
206+
tcp 0 0 :::8080 :::* LISTEN -
207+
tcp 0 0 :::8083 :::* LISTEN -
208+
tcp 0 0 ::1:8443 :::* LISTEN -
209+
tcp 0 0 :::443 :::* LISTEN -
210+
tcp 0 0 :::80 :::* LISTEN -
211+
tcp 0 0 :::9113 :::* LISTEN -
212+
```
213+
214+
We can see here that the two IPv4s (`127.0.0.1:8083` and `127.0.0.2:8443`) and the one IPv6 (`::1:8443`) that are set and listening.
215+
216+
3. Examine the NGINX config using the following command:
217+
218+
```console
219+
kubectl exec -it nginx-ingress-65cd79bb8f-crst4 -n nginx-ingress -- cat /etc/nginx/conf.d/vs_default_cafe.conf
220+
```
221+
222+
```console
223+
...
224+
server {
225+
listen 127.0.0.1:8083;
226+
listen [::]:8083;
227+
228+
229+
server_name cafe.example.com;
230+
231+
set $resource_type "virtualserver";
232+
set $resource_name "cafe";
233+
set $resource_namespace "default";
234+
listen 127.0.0.2:8443 ssl;
235+
listen [::1]:8443 ssl;
236+
...
237+
```

‎examples/custom-resources/custom-ip-listeners/virtualserver/cafe-secret.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: cafe-secret
5+
type: kubernetes.io/tls
6+
data:
7+
tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURMakNDQWhZQ0NRREFPRjl0THNhWFdqQU5CZ2txaGtpRzl3MEJBUXNGQURCYU1Rc3dDUVlEVlFRR0V3SlYKVXpFTE1Ba0dBMVVFQ0F3Q1EwRXhJVEFmQmdOVkJBb01HRWx1ZEdWeWJtVjBJRmRwWkdkcGRITWdVSFI1SUV4MApaREViTUJrR0ExVUVBd3dTWTJGbVpTNWxlR0Z0Y0d4bExtTnZiU0FnTUI0WERURTRNRGt4TWpFMk1UVXpOVm9YCkRUSXpNRGt4TVRFMk1UVXpOVm93V0RFTE1Ba0dBMVVFQmhNQ1ZWTXhDekFKQmdOVkJBZ01Ba05CTVNFd0h3WUQKVlFRS0RCaEpiblJsY201bGRDQlhhV1JuYVhSeklGQjBlU0JNZEdReEdUQVhCZ05WQkFNTUVHTmhabVV1WlhoaApiWEJzWlM1amIyMHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDcDZLbjdzeTgxCnAwanVKL2N5ayt2Q0FtbHNmanRGTTJtdVpOSzBLdGVjcUcyZmpXUWI1NXhRMVlGQTJYT1N3SEFZdlNkd0kyaloKcnVXOHFYWENMMnJiNENaQ0Z4d3BWRUNyY3hkam0zdGVWaVJYVnNZSW1tSkhQUFN5UWdwaW9iczl4N0RsTGM2SQpCQTBaalVPeWwwUHFHOVNKZXhNVjczV0lJYTVyRFZTRjJyNGtTa2JBajREY2o3TFhlRmxWWEgySTVYd1hDcHRDCm42N0pDZzQyZitrOHdnemNSVnA4WFprWldaVmp3cTlSVUtEWG1GQjJZeU4xWEVXZFowZXdSdUtZVUpsc202OTIKc2tPcktRajB2a29QbjQxRUUvK1RhVkVwcUxUUm9VWTNyemc3RGtkemZkQml6Rk8yZHNQTkZ4MkNXMGpYa05MdgpLbzI1Q1pyT2hYQUhBZ01CQUFFd0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFLSEZDY3lPalp2b0hzd1VCTWRMClJkSEliMzgzcFdGeW5acS9MdVVvdnNWQTU4QjBDZzdCRWZ5NXZXVlZycTVSSWt2NGxaODFOMjl4MjFkMUpINnIKalNuUXgrRFhDTy9USkVWNWxTQ1VwSUd6RVVZYVVQZ1J5anNNL05VZENKOHVIVmhaSitTNkZBK0NuT0Q5cm4yaQpaQmVQQ0k1ckh3RVh3bm5sOHl3aWozdnZRNXpISXV5QmdsV3IvUXl1aTlmalBwd1dVdlVtNG52NVNNRzl6Q1Y3ClBwdXd2dWF0cWpPMTIwOEJqZkUvY1pISWc4SHc5bXZXOXg5QytJUU1JTURFN2IvZzZPY0s3TEdUTHdsRnh2QTgKN1dqRWVxdW5heUlwaE1oS1JYVmYxTjM0OWVOOThFejM4Zk9USFRQYmRKakZBL1BjQytHeW1lK2lHdDVPUWRGaAp5UkU9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
8+
tls.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBcWVpcCs3TXZOYWRJN2lmM01wUHJ3Z0pwYkg0N1JUTnBybVRTdENyWG5LaHRuNDFrCkcrZWNVTldCUU5semtzQndHTDBuY0NObzJhN2x2S2wxd2k5cTIrQW1RaGNjS1ZSQXEzTVhZNXQ3WGxZa1YxYkcKQ0pwaVJ6ejBza0lLWXFHN1BjZXc1UzNPaUFRTkdZMURzcGRENmh2VWlYc1RGZTkxaUNHdWF3MVVoZHErSkVwRwp3SStBM0kreTEzaFpWVng5aU9WOEZ3cWJRcCt1eVFvT05uL3BQTUlNM0VWYWZGMlpHVm1WWThLdlVWQ2cxNWhRCmRtTWpkVnhGbldkSHNFYmltRkNaYkp1dmRySkRxeWtJOUw1S0Q1K05SQlAvazJsUkthaTAwYUZHTjY4NE93NUgKYzMzUVlzeFR0bmJEelJjZGdsdEkxNURTN3lxTnVRbWF6b1Z3QndJREFRQUJBb0lCQVFDUFNkU1luUXRTUHlxbApGZlZGcFRPc29PWVJoZjhzSStpYkZ4SU91UmF1V2VoaEp4ZG01Uk9ScEF6bUNMeUw1VmhqdEptZTIyM2dMcncyCk45OUVqVUtiL1ZPbVp1RHNCYzZvQ0Y2UU5SNThkejhjbk9SVGV3Y290c0pSMXBuMWhobG5SNUhxSkpCSmFzazEKWkVuVVFmY1hackw5NGxvOUpIM0UrVXFqbzFGRnM4eHhFOHdvUEJxalpzVjdwUlVaZ0MzTGh4bndMU0V4eUZvNApjeGI5U09HNU9tQUpvelN0Rm9RMkdKT2VzOHJKNXFmZHZ5dGdnOXhiTGFRTC94MGtwUTYyQm9GTUJEZHFPZVBXCktmUDV6WjYvMDcvdnBqNDh5QTFRMzJQem9idWJzQkxkM0tjbjMyamZtMUU3cHJ0V2wrSmVPRmlPem5CUUZKYk4KNHFQVlJ6NWhBb0dCQU50V3l4aE5DU0x1NFArWGdLeWNrbGpKNkY1NjY4Zk5qNUN6Z0ZScUowOXpuMFRsc05ybwpGVExaY3hEcW5SM0hQWU00MkpFUmgySi9xREZaeW5SUW8zY2czb2VpdlVkQlZHWTgrRkkxVzBxZHViL0w5K3l1CmVkT1pUUTVYbUdHcDZyNmpleHltY0ppbS9Pc0IzWm5ZT3BPcmxEN1NQbUJ2ek5MazRNRjZneGJYQW9HQkFNWk8KMHA2SGJCbWNQMHRqRlhmY0tFNzdJbUxtMHNBRzR1SG9VeDBlUGovMnFyblRuT0JCTkU0TXZnRHVUSnp5K2NhVQprOFJxbWRIQ2JIelRlNmZ6WXEvOWl0OHNaNzdLVk4xcWtiSWN1YytSVHhBOW5OaDFUanNSbmU3NFowajFGQ0xrCmhIY3FIMHJpN1BZU0tIVEU4RnZGQ3haWWRidUI4NENtWmlodnhicFJBb0dBSWJqcWFNWVBUWXVrbENkYTVTNzkKWVNGSjFKelplMUtqYS8vdER3MXpGY2dWQ0thMzFqQXdjaXowZi9sU1JxM0hTMUdHR21lemhQVlRpcUxmZVpxYwpSMGlLYmhnYk9jVlZrSkozSzB5QXlLd1BUdW14S0haNnpJbVpTMGMwYW0rUlk5WUdxNVQ3WXJ6cHpjZnZwaU9VCmZmZTNSeUZUN2NmQ21mb09oREN0enVrQ2dZQjMwb0xDMVJMRk9ycW40M3ZDUzUxemM1em9ZNDR1QnpzcHd3WU4KVHd2UC9FeFdNZjNWSnJEakJDSCtULzZzeXNlUGJKRUltbHpNK0l3eXRGcEFOZmlJWEV0LzQ4WGY2ME54OGdXTQp1SHl4Wlp4L05LdER3MFY4dlgxUE9ucTJBNWVpS2ErOGpSQVJZS0pMWU5kZkR1d29seHZHNmJaaGtQaS80RXRUCjNZMThzUUtCZ0h0S2JrKzdsTkpWZXN3WEU1Y1VHNkVEVXNEZS8yVWE3ZlhwN0ZjanFCRW9hcDFMU3crNlRYcDAKWmdybUtFOEFSek00NytFSkhVdmlpcS9udXBFMTVnMGtKVzNzeWhwVTl6WkxPN2x0QjBLSWtPOVpSY21Vam84UQpjcExsSE1BcWJMSjhXWUdKQ2toaVd4eWFsNmhZVHlXWTRjVmtDMHh0VGwvaFVFOUllTktvCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

‎examples/custom-resources/custom-ip-listeners/virtualserver/cafe-virtual-server.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: k8s.nginx.org/v1
2+
kind: VirtualServer
3+
metadata:
4+
name: cafe
5+
spec:
6+
listener:
7+
http: ip-listener-1-http
8+
https: ip-listener-2-https
9+
host: cafe.example.com
10+
tls:
11+
secret: cafe-secret
12+
upstreams:
13+
- name: tea
14+
service: tea-svc
15+
port: 80
16+
- name: coffee
17+
service: coffee-svc
18+
port: 80
19+
routes:
20+
- path: /tea
21+
action:
22+
pass: tea
23+
- path: /coffee
24+
action:
25+
pass: coffee

0 commit comments

Comments
 (0)
0