Ingress and TLS

Write TLS termination with Ingress.

Ingress and TLS

Web and API are published under a single domain name: /api goes to the API, the rest to web. cert-manager gets the certificate from Let's Encrypt. The template only produces the Ingress if ingress.enabled is true:

{{- if .Values.ingress.enabled }}
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: magaza
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  ingressClassName: nginx
  tls:
    - hosts: [{{ .Values.ingress.host }}]
      secretName: magaza-tls
  rules:
    - host: {{ .Values.ingress.host }}
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend: {service: {name: api, port: {number: 8000}}}
          - path: /
            pathType: Prefix
            backend: {service: {name: web, port: {number: 80}}}
{{- end }}

Testing the template

Conditional templates are rendered and checked with both values; -s shows the output of only one template file:

helm template magaza ./magaza -s templates/ingress.yaml
# (empty: ingress.enabled false)
helm template magaza ./magaza -f values-prod.yaml -s templates/ingress.yaml | head -6
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: magaza

Exercise Test the Ingress template

Write two commands: render only the templates/ingress.yaml template of the ./magaza chart with the release name magaza and values-prod.yaml; list the Ingresses in the magaza namespace.

Show example solution

helm template magaza ./magaza -f values-prod.yaml -s templates/ingress.yaml
kubectl get ingress -n magaza

Test yourself

What does the {{- if .Values.ingress.enabled }} ... {{- end }} block provide?
- That the Ingress is produced only if the value is true
- It always produces the Ingress
- It deletes the Ingress
- It turns off TLS
Show answer

That the Ingress is produced only if the value is true — The Ingress can be off in development and on in production.

Render only one template file.

helm template magaza ./magaza -f values-prod.yaml ____ templates/ingress.yaml

Show answer

helm template magaza ./magaza -f values-prod.yaml -s templates/ingress.yaml

Match.

{{- if }}

Conditional rendering
cert-manager annotation

Automatic certificate
/api → api:8000

API path
-s

Single template

Next lesson: Scaling with HPA

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies