Ingress and TLS
- Docker & Kubernetes course
- Advanced
- Lesson 63/70
- 4 min
Write TLS termination with Ingress.
Ingress and TLS
Web and API are published under a single domain name: /api goes to the API, the rest to web. cert-manager gets the certificate from Let's Encrypt. The template only produces the Ingress if ingress.enabled is true:
{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: magaza
annotations:
cert-manager.io/cluster-issuer: letsencrypt
spec:
ingressClassName: nginx
tls:
- hosts: [{{ .Values.ingress.host }}]
secretName: magaza-tls
rules:
- host: {{ .Values.ingress.host }}
http:
paths:
- path: /api
pathType: Prefix
backend: {service: {name: api, port: {number: 8000}}}
- path: /
pathType: Prefix
backend: {service: {name: web, port: {number: 80}}}
{{- end }}Testing the template
Conditional templates are rendered and checked with both values; -s shows the output of only one template file:
helm template magaza ./magaza -s templates/ingress.yaml
# (empty: ingress.enabled false)
helm template magaza ./magaza -f values-prod.yaml -s templates/ingress.yaml | head -6
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: magazaPractice Test the Ingress template
Write two commands: render only the templates/ingress.yaml template of the ./magaza chart with the release name magaza and values-prod.yaml; list the Ingresses in the magaza namespace.
Starter code
# buraya yazSample solution
helm template magaza ./magaza -f values-prod.yaml -s templates/ingress.yaml
kubectl get ingress -n magazaExpected output
--- # Source: magaza/templates/ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: magaza NAME CLASS HOSTS ADDRESS PORTS AGE magaza nginx magaza.example.com 203.0.113.10 80, 443 2m
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What does the {{- if .Values.ingress.enabled }} ... {{- end }} block provide?
- That the Ingress is produced only if the value is true Correct answer
- It always produces the Ingress
- It deletes the Ingress
- It turns off TLS
Explanation: The Ingress can be off in development and on in production.
2 Render only one template file.
helm template magaza ./magaza -f values-prod.yaml ____ templates/ingress.yamlhelm template magaza ./magaza -f values-prod.yaml -s templates/ingress.yamlExplanation: -s (--show-only) shows a single template.
3 Match.
| Term | Meaning |
|---|---|
{{- if }} |
Conditional rendering |
cert-manager annotation |
Automatic certificate |
/api → api:8000 |
API path |
-s |
Single template |