CODEWITHSUNDEEP
kubernetesnginx-ingress
Vishal
Vishal

Reputation: 804

Kubernetes expose a service on a port over tls

I have my application https://myapp.com deployed on K8S, with an nginx ingress controller. HTTPS is resolved at nginx.

Now there is a need to expose one service on a specific port for example https://myapp.com:8888. Idea is to keep https://myapp.com secured inside the private network and expose only port number 8888 to the internet for integration.

Is there a way all traffic can be handled by the ingress controller, including tls termination, and it can also expose 8888 port and map it to a service?

Or I need another nginx terminating tls and exposed on nodeport? I am not sure if I can access services like https://myapp.com:<node_port> with https.

Is using multiple ingress controllers an option?

What is the best practice to do this in Kubernetes?

Upvotes: 2

Views: 1444

Answers (3)

SonDang
SonDang

Reputation: 1597

It is not a best practices to expose custom port over internet.

Instead, create a sub-domain (i.e https://custom.myapp.com) which point to internal service in port 8888.

Then to create separate nginx ingress (not ingress controller) which point to that "https://custom.myapp.com" sub domain

Example manifest file as follow:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-myapp-service
  namespace: abc
  rules:
    - host: custom.myapp.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp-service
                port:
                  number: 8888

Hope this helps.

Upvotes: 1

Ernst
Ernst

Reputation: 334

So you have service foo on some port, which you want to have available on your internal network. Then service bar, which runs on port 8888 in that same pod.

It's as simple as setting up two services to that pod, with different spec.ports[].targetPort values. My example assumes a svc foo pointing at port 80, and svc bar pointing at port 8888 on the pod.

Take care that generally, the ingress controller only services HTTP and HTTPS connections on ports 80 and 443. That is a network setting generally defined for the nodes that are running the ingress controller. TCP/UDP are not serviced out-of-the-box by the ingress controller

My advice is to use something like this, and use path to expose the required service.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-wildcard-host
spec:
  rules:
  - host: "myapp.com"
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: foo
            port:
              number: 80
      - pathType: Prefix
        path: "/bar"
        backend:
          service:
            name: bar
            port:
              number: 80

If you would want to further secure your network, you should probably take a look at networkpolicies. They allow configuration of granular access to pods and services. You can, for example, only allow external ingress to that pod to port 8888.

Upvotes: 0

P Ekambaram
P Ekambaram

Reputation: 17689

Use sidecar proxy pattern to add HTTPS support to the application running inside the pod.

Refer the below diagram as a reference

enter image description here

Run nginx as a sidecar proxy container fronting the application container inside the same pod. Access the application through port 8888 on nginx proxy. nginx would route the traffic to the application.

Find below the post showing how it can be implemented

https://vorozhko.net/kubernetes-sidecar-pattern-nginx-ssl-proxy-for-nodejs

Upvotes: 1

Related Questions