diff --git a/examples/README.md b/examples/README.md index 997a64561..b0cb5497b 100644 --- a/examples/README.md +++ b/examples/README.md @@ -15,6 +15,13 @@ Path routing | URL regex routing | * | Beginner Health checking | configure/optimize health checks | * | Intermediate Pipeline | pipeline cloud and nginx | * | Advanced +## AWS + +Name | Description | Platform | Complexity Level +-----| ----------- | ---------- | ---------------- +AWS | basic deployment | nginx | Intermediate + + ## TLS Name | Description | Platform | Complexity Level diff --git a/examples/aws/nginx/README.md b/examples/aws/nginx/README.md new file mode 100644 index 000000000..d9b1d59d5 --- /dev/null +++ b/examples/aws/nginx/README.md @@ -0,0 +1,22 @@ +# NGINX Ingress running in AWS + +This example shows how is possible to use the nginx ingress controller in AWS behind an ELB configured with Proxy Protocol. + +```console +kubectl create -f ./nginx-ingress-controller.yaml +``` + +This command creates: +- a default backend deployment and service. +- a service with `type: LoadBalancer` configuring Proxy Protocol in the ELB (`service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*'`). +- a configmap for the ingress controller enabling proxy protocol in NGINX (`use-proxy-protocol: "true"`) +- a deployment for the ingress controller + +Is the proxy protocol necessary? + +No but only enabling the procotol is possible to keep the real source IP address requesting the connection. + +### References + +- http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/enable-proxy-protocol.html +- https://www.nginx.com/resources/admin-guide/proxy-protocol/ diff --git a/examples/aws/nginx/nginx-ingress-controller.yaml b/examples/aws/nginx/nginx-ingress-controller.yaml new file mode 100644 index 000000000..2fcee52be --- /dev/null +++ b/examples/aws/nginx/nginx-ingress-controller.yaml @@ -0,0 +1,134 @@ +kind: Service +apiVersion: v1 +metadata: + name: nginx-default-backend + labels: + k8s-addon: ingress-nginx.addons.k8s.io +spec: + ports: + - port: 80 + targetPort: http + selector: + app: nginx-default-backend + +--- + +kind: Deployment +apiVersion: extensions/v1beta1 +metadata: + name: nginx-default-backend + labels: + k8s-addon: ingress-nginx.addons.k8s.io +spec: + replicas: 1 + template: + metadata: + labels: + k8s-addon: ingress-nginx.addons.k8s.io + app: nginx-default-backend + spec: + terminationGracePeriodSeconds: 60 + containers: + - name: default-http-backend + image: gcr.io/google_containers/defaultbackend:1.0 + livenessProbe: + httpGet: + path: /healthz + port: 8080 + scheme: HTTP + initialDelaySeconds: 30 + timeoutSeconds: 5 + resources: + limits: + cpu: 10m + memory: 20Mi + requests: + cpu: 10m + memory: 20Mi + ports: + - name: http + containerPort: 8080 + protocol: TCP + +--- + +kind: ConfigMap +apiVersion: v1 +metadata: + name: ingress-nginx + labels: + k8s-addon: ingress-nginx.addons.k8s.io +data: + use-proxy-protocol: "true" + +--- + +kind: Service +apiVersion: v1 +metadata: + name: ingress-nginx + labels: + k8s-addon: ingress-nginx.addons.k8s.io + annotations: + service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: '*' +spec: + type: LoadBalancer + selector: + app: ingress-nginx + ports: + - name: http + port: 80 + targetPort: http + - name: https + port: 443 + targetPort: https + +--- + +kind: Deployment +apiVersion: extensions/v1beta1 +metadata: + name: ingress-nginx + labels: + k8s-addon: ingress-nginx.addons.k8s.io +spec: + replicas: 1 + template: + metadata: + labels: + app: ingress-nginx + k8s-addon: ingress-nginx.addons.k8s.io + spec: + terminationGracePeriodSeconds: 60 + containers: + - image: gcr.io/google_containers/nginx-ingress-controller:0.9.0-beta.3 + name: ingress-nginx + imagePullPolicy: Always + ports: + - name: http + containerPort: 80 + protocol: TCP + - name: https + containerPort: 443 + protocol: TCP + livenessProbe: + httpGet: + path: /healthz + port: 10254 + scheme: HTTP + initialDelaySeconds: 30 + timeoutSeconds: 5 + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + args: + - /nginx-ingress-controller + - --default-backend-service=$(POD_NAMESPACE)/nginx-default-backend + - --configmap=$(POD_NAMESPACE)/ingress-nginx + - --publish-service=$(POD_NAMESPACE)/ingress-nginx