CS Launch Ingress

Introduction

This is guide a supplement to the HowTo:CS Launch guide. It goes into more detail about CS Launch Ingress support.

You can modify the behavior of your ingress using kubernetes annotations on your ingress resource. A common example is to restrict access to certain IP ranges. A full list of annotations and their descriptions can be found at: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md

You apply annotations by modifying the ingress resource object.

Navigate to your Cluster Dashboard
Click on Service Discovery from the menu on the left.
Click on Ingresses from the sub-menu on the left.
Click on the Kebab menu for the ingress you want to edit, and select Edit Config.
Click on the Labels & Annotations tab.
Click on the Add Annotation button.
Fill in the Key and Value fields.
Alternatively, you can modify your YAML specification directly, example:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2

nginx.ingress.kubernetes.io/whitelist-source-range
- Restricts ingress access to a specific set of IP ranges
- https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#whitelist-source-range
- To allow access from anywhere, set value to 0.0.0.0/0,::/0
- Example restricts to VT campus and VPN addresses: nginx.ingress.kubernetes.io/whitelist-source-range: 128.173.0.0/16,198.82.0.0/16,172.16.0.0/12,45.3.120.0/21,2001:468:c80::/48,2607:b400::/40

nginx.ingress.kubernetes.io/rewrite-target
- Modifies the URL path before sending upstream. For example, to remove a leading path.
- https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#rewrite
- Example removes all path from request -- container sees the request to root path: nginx.ingress.kubernetes.io/rewrite-target: /

nginx.ingress.kubernetes.io/proxy-read-timeout
- Increase timeout for proxy actions, defaults to 30 seconds
- https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md#custom-timeouts
- Example increase timeout to 60 seconds: nginx.ingress.kubernetes.io/proxy-read-timeout: 60

By default ingresses on the Discovery cluster are IP limited to VT campus and VT VPN. You can use nginx.ingress.kubernetes.io/whitelist-source-range (see above) to restrict or expand this IP range.