simply change the 0.9.0 tag to the version you wish to upgrade to.
The easiest way to do this is e.g. (do note you may need to change the name parameter according to your installation):
kubectl set image deployment/nginx-ingress-controller \ - nginx-ingress-controller=nginx:quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.17.1 + nginx-ingress-controller=nginx:quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.18.0
This annotation allows to return a permanent redirect instead of sending data to the upstream. For example nginx.ingress.kubernetes.io/permanent-redirect: https://www.google.com would redirect everything to Google.
This annotation allows you to modify the status code used for permanent redirects. For example nginx.ingress.kubernetes.io/permanent-redirect-code: '308' would return your permanet-redirect with a 308.
This annotation allows you to modify the status code used for permanent redirects. For example nginx.ingress.kubernetes.io/permanent-redirect-code: '308' would return your permanent-redirect with a 308.
The annotation nginx.ingress.kubernetes.io/ssl-passthrough allows to configure TLS termination in the pod and not in NGINX.
Attention
The use of this annotation requires the flag --enable-ssl-passthrough (By default it is disabled).
Please use nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
By default NGINX uses plain HTTP to reach the services.
Adding the annotation nginx.ingress.kubernetes.io/secure-backends: "true" in the Ingress rule changes the protocol to HTTPS.
If you want to validate the upstream against a specific certificate, you can create a secret with it and reference the secret with the annotation nginx.ingress.kubernetes.io/secure-verify-ca-secret.
nginx.ingress.kubernetes.io/lua-resty-waf-i
For details on how to write WAF rules, please refer to https://github.com/p0pr0ck5/lua-resty-waf.
-gRPC backend¶
+gRPC backend DEPRECATED (since 0.18.0)¶
+Please use nginx.ingress.kubernetes.io/backend-protocol: "GRPC" or nginx.ingress.kubernetes.io/backend-protocol: "GRPCS"
Since NGINX 1.13.10 it is possible to expose gRPC services natively
You only need to add the annotation nginx.ingress.kubernetes.io/grpc-backend: "true" to enable this feature.
Additionally, if the gRPC service requires TLS, add nginx.ingress.kubernetes.io/secure-backends: "true".
@@ -2356,18 +2376,27 @@ using the nginx-i
nginx.ingress.kubernetes.io/enable-influxdb: "true"
nginx.ingress.kubernetes.io/influxdb-measurement: "nginx-reqs"
nginx.ingress.kubernetes.io/influxdb-port: "8089"
-nginx.ingress.kubernetes.io/influxdb-host: "influxdb"
+nginx.ingress.kubernetes.io/influxdb-host: "127.0.0.1"
nginx.ingress.kubernetes.io/influxdb-server-name: "nginx-ingress"
For the influxdb-host parameter you have two options:
-To use the module in the Kubernetes Nginx ingress controller, you have two options:
-- Use an InfluxDB server configured to enable the UDP protocol.
+- Use an InfluxDB server configured with the UDP protocol enabled.
- Deploy Telegraf as a sidecar proxy to the Ingress controller configured to listen UDP with the socket listener input and to write using
-anyone of the outputs plugins
+anyone of the outputs plugins like InfluxDB, Apache Kafka,
+Prometheus, etc.. (recommended)
+It's important to remember that there's no DNS resolver at this stage so you will have to configure
+an ip address to nginx.ingress.kubernetes.io/influxdb-host. If you deploy Influx or Telegraf as sidecar (another container in the same pod) this becomes straightforward since you can directly use 127.0.0.1.
+Backend Protocol¶
+Using backend-protocol annotations is possible to indicate how NGINX should communicate with the backend service.
+Valid Values: HTTP, HTTPS, GRPC, GRPCS and AJP
+By default NGINX uses HTTP.
+Example:
+nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+
diff --git a/user-guide/nginx-configuration/configmap/index.html b/user-guide/nginx-configuration/configmap/index.html
index 3fe8f95bb..9b108ed60 100644
--- a/user-guide/nginx-configuration/configmap/index.html
+++ b/user-guide/nginx-configuration/configmap/index.html
@@ -3457,7 +3457,7 @@ To create a ticket: openssl rand 80 | openssl enc -A -b
use-proxy-protocol¶
Enables or disables the PROXY protocol to receive client connection (real IP address) information passed through proxy servers and load balancers such as HAProxy and Amazon Elastic Load Balancer (ELB).
proxy-protocol-header-timeout¶
-Sets the timeout value for receiving the proxy-protocol headers. The default of 5 seconds prevents the TLS passthrough handler from waiting indefinetly on a dropped connection.
+
Sets the timeout value for receiving the proxy-protocol headers. The default of 5 seconds prevents the TLS passthrough handler from waiting indefinitely on a dropped connection.
default: 5s
use-gzip¶
Enables or disables compression of HTTP responses using the "gzip" module.
diff --git a/user-guide/third-party-addons/modsecurity/index.html b/user-guide/third-party-addons/modsecurity/index.html
index 8e61bbf30..9c2ff144b 100644
--- a/user-guide/third-party-addons/modsecurity/index.html
+++ b/user-guide/third-party-addons/modsecurity/index.html
@@ -1043,7 +1043,7 @@
The default ModSecurity configuration file is located in /etc/nginx/modsecurity/modsecurity.conf. This is the only file located in this directory and contains the default recommended configuration. Using a volume we can replace this file with the desired configuration.
To enable the ModSecurity feature we need to specify enable-modsecurity: "true" in the configuration configmap.
-Note: the default configuration use detection only, because that minimises the chances of post-installation disruption.
+
Note: the default configuration use detection only, because that minimizes the chances of post-installation disruption.
The file /var/log/modsec_audit.log contains the log of ModSecurity.
The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts.