CODEWITHSUNDEEP
kubernetes
ss1
ss1

Reputation: 1191

How to expose a single path of a service via ingress? (not the whole service)

I want my Jenkins to be only accessible in the private network via VPN to protect it from the dangers of the public internet. Nonetheless, I also want to use GitHub webhooks. So the Jenkins needs to expose a single path to the public internet.

To expose the whole service I could simply create an ingress rule like:

  rules:
    - host: example.com
      http:
        paths:
        - path: /jenkins
          pathType: Prefix
          backend:
            service:
              name: jenkins-service
              port:
                number: 80

This would expose the WHOLE service at https://example.com/jenkins. But this is bad from a security perspective. Therefore I would like to expose only the webhook path of the service. I.e. /generic-webhook-trigger/invoke. So that it is the only URL you can reach from the public internet. Like this:

curl https://example.com/generic-webhook-trigger/invoke

Is that possible? Thanks for any suggestion!

Upvotes: 0

Views: 723

Answers (1)

ss1
ss1

Reputation: 1191

So this doesn't seem to be possible with the native ingress functionalities but requires an ingress controller, like the Nginx Ingress Controller. These come with additional functionalities, like URI rewrite rules (see here).

In case of the Nginx Ingress Controller you need the nginx.ingress.kubernetes.io/rewrite-target and rewrite your ingress path to the desired path.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: jenkins-ingress
  namespace: jenkins
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /jenkins/generic-webhook-trigger/invoke
spec:
  ingressClassName: nginx

  rules:
    - host: example.com
      http:
        paths:
        - path: /jenkins
          pathType: Prefix
          backend:
            service:
              name: jenkins-service
              port:
                number: 80

If you now visit https://example.com/jenkins then it will get internally rewritten to https://example.com/jenkins/generic-webhook-trigger/invoke. No redirects involved.

Upvotes: 2

Related Questions