Skip to content

Commit e9d7c1c

Browse files
haywoodshpre-commit-ci[bot]CopilotvepatelAlexFenlon
authored
Support namespaced upstream service reference in VirtualServer (#8453)
* support namespaced upstream service Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * add example and fix comments Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * update readme Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> * handle exception Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> * Remove the commented-out code Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> * typo Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> * update docs Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> * update readme to add reminder about -watch-namespace flag Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> --------- Signed-off-by: Haywood Shannon <5781935+haywoodsh@users.noreply.github.com> Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Venktesh Shivam Patel <ve.patel@f5.com> Co-authored-by: AlexFenlon <a.fenlon@f5.com>
1 parent e8ed067 commit e9d7c1c

File tree

25 files changed

+1127
-62
lines changed

25 files changed

+1127
-62
lines changed

‎config/crd/bases/k8s.nginx.org_virtualserverroutes.yaml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1095,12 +1095,13 @@ spec:
10951095
ConfigMap key.
10961096
type: string
10971097
service:
1098-
description: The name of a service. The service must belong
1099-
to the same namespace as the resource. If the service doesn’t
1100-
exist, NGINX will assume the service has zero endpoints and
1101-
return a 502 response for requests for this upstream. For
1102-
NGINX Plus only, services of type ExternalName are also supported
1103-
.
1098+
description: The name of a service. If the Service belongs to
1099+
a different namespace than the VirtualServer or VirtualServerRoute,
1100+
you need to include the namespace. For example, tea-namespace/tea.
1101+
If the service doesn’t exist, NGINX will assume the service
1102+
has zero endpoints and return a 502 response for requests
1103+
for this upstream. For NGINX Plus only, services of type ExternalName
1104+
are also supported in the same namespace.
11041105
type: string
11051106
sessionCookie:
11061107
description: The SessionCookie field configures session persistence

‎config/crd/bases/k8s.nginx.org_virtualservers.yaml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1284,12 +1284,13 @@ spec:
12841284
ConfigMap key.
12851285
type: string
12861286
service:
1287-
description: The name of a service. The service must belong
1288-
to the same namespace as the resource. If the service doesn’t
1289-
exist, NGINX will assume the service has zero endpoints and
1290-
return a 502 response for requests for this upstream. For
1291-
NGINX Plus only, services of type ExternalName are also supported
1292-
.
1287+
description: The name of a service. If the Service belongs to
1288+
a different namespace than the VirtualServer or VirtualServerRoute,
1289+
you need to include the namespace. For example, tea-namespace/tea.
1290+
If the service doesn’t exist, NGINX will assume the service
1291+
has zero endpoints and return a 502 response for requests
1292+
for this upstream. For NGINX Plus only, services of type ExternalName
1293+
are also supported in the same namespace.
12931294
type: string
12941295
sessionCookie:
12951296
description: The SessionCookie field configures session persistence

‎deploy/crds.yaml‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2133,12 +2133,13 @@ spec:
21332133
ConfigMap key.
21342134
type: string
21352135
service:
2136-
description: The name of a service. The service must belong
2137-
to the same namespace as the resource. If the service doesn’t
2138-
exist, NGINX will assume the service has zero endpoints and
2139-
return a 502 response for requests for this upstream. For
2140-
NGINX Plus only, services of type ExternalName are also supported
2141-
.
2136+
description: The name of a service. If the Service belongs to
2137+
a different namespace than the VirtualServer or VirtualServerRoute,
2138+
you need to include the namespace. For example, tea-namespace/tea.
2139+
If the service doesn’t exist, NGINX will assume the service
2140+
has zero endpoints and return a 502 response for requests
2141+
for this upstream. For NGINX Plus only, services of type ExternalName
2142+
are also supported in the same namespace.
21422143
type: string
21432144
sessionCookie:
21442145
description: The SessionCookie field configures session persistence
@@ -3551,12 +3552,13 @@ spec:
35513552
ConfigMap key.
35523553
type: string
35533554
service:
3554-
description: The name of a service. The service must belong
3555-
to the same namespace as the resource. If the service doesn’t
3556-
exist, NGINX will assume the service has zero endpoints and
3557-
return a 502 response for requests for this upstream. For
3558-
NGINX Plus only, services of type ExternalName are also supported
3559-
.
3555+
description: The name of a service. If the Service belongs to
3556+
a different namespace than the VirtualServer or VirtualServerRoute,
3557+
you need to include the namespace. For example, tea-namespace/tea.
3558+
If the service doesn’t exist, NGINX will assume the service
3559+
has zero endpoints and return a 502 response for requests
3560+
for this upstream. For NGINX Plus only, services of type ExternalName
3561+
are also supported in the same namespace.
35603562
type: string
35613563
sessionCookie:
35623564
description: The SessionCookie field configures session persistence

‎docs/crd/k8s.nginx.org_virtualserverroutes.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ The `.spec` object supports the following fields:
209209
| `upstreams[].queue.timeout` | `string` | The timeout of the queue. A request cannot be queued for a period longer than the timeout. The default is 60s. |
210210
| `upstreams[].read-timeout` | `string` | The timeout for reading a response from an upstream server. The default is specified in the proxy-read-timeout ConfigMap key. |
211211
| `upstreams[].send-timeout` | `string` | The timeout for transmitting a request to an upstream server. The default is specified in the proxy-send-timeout ConfigMap key. |
212-
| `upstreams[].service` | `string` | The name of a service. The service must belong to the same namespace as the resource. If the service doesn’t exist, NGINX will assume the service has zero endpoints and return a 502 response for requests for this upstream. For NGINX Plus only, services of type ExternalName are also supported . |
212+
| `upstreams[].service` | `string` | The name of a service. If the Service belongs to a different namespace than the VirtualServer or VirtualServerRoute, you need to include the namespace. For example, tea-namespace/tea. If the service doesn’t exist, NGINX will assume the service has zero endpoints and return a 502 response for requests for this upstream. For NGINX Plus only, services of type ExternalName are also supported in the same namespace. |
213213
| `upstreams[].sessionCookie` | `object` | The SessionCookie field configures session persistence which allows requests from the same client to be passed to the same upstream server. The information about the designated upstream server is passed in a session cookie generated by NGINX Plus. |
214214
| `upstreams[].sessionCookie.domain` | `string` | The domain for which the cookie is set. |
215215
| `upstreams[].sessionCookie.enable` | `boolean` | Enables session persistence with a session cookie for an upstream server. The default is false. |

‎docs/crd/k8s.nginx.org_virtualservers.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@ The `.spec` object supports the following fields:
244244
| `upstreams[].queue.timeout` | `string` | The timeout of the queue. A request cannot be queued for a period longer than the timeout. The default is 60s. |
245245
| `upstreams[].read-timeout` | `string` | The timeout for reading a response from an upstream server. The default is specified in the proxy-read-timeout ConfigMap key. |
246246
| `upstreams[].send-timeout` | `string` | The timeout for transmitting a request to an upstream server. The default is specified in the proxy-send-timeout ConfigMap key. |
247-
| `upstreams[].service` | `string` | The name of a service. The service must belong to the same namespace as the resource. If the service doesn’t exist, NGINX will assume the service has zero endpoints and return a 502 response for requests for this upstream. For NGINX Plus only, services of type ExternalName are also supported . |
247+
| `upstreams[].service` | `string` | The name of a service. If the Service belongs to a different namespace than the VirtualServer or VirtualServerRoute, you need to include the namespace. For example, tea-namespace/tea. If the service doesn’t exist, NGINX will assume the service has zero endpoints and return a 502 response for requests for this upstream. For NGINX Plus only, services of type ExternalName are also supported in the same namespace. |
248248
| `upstreams[].sessionCookie` | `object` | The SessionCookie field configures session persistence which allows requests from the same client to be passed to the same upstream server. The information about the designated upstream server is passed in a session cookie generated by NGINX Plus. |
249249
| `upstreams[].sessionCookie.domain` | `string` | The domain for which the cookie is set. |
250250
| `upstreams[].sessionCookie.enable` | `boolean` | Enables session persistence with a session cookie for an upstream server. The default is false. |

‎examples/custom-resources/foreign-namespace-upstreams/README.md‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
# Upstreams in foreign namespaces
2+
3+
In this example we use the [VirtualServer and
4+
VirtualServerRoute](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/)
5+
resources to configure load balancing for the modified cafe application from the [Basic
6+
Configuration](../basic-configuration/) example. We have put the load balancing configuration as well as the deployments
7+
and services into multiple namespaces. Instead of one namespace, we now use three: `tea`, `coffee`, and `cafe`.
8+
9+
- In the tea namespace, we create the tea deployment and service.
10+
- In the coffee namespace, we create the coffee deployment and service.
11+
- In the cafe namespace, we create the cafe secret with the TLS certificate and key and the load-balancing configuration
12+
for the cafe application. That configuration references the coffee and tea configurations.
13+
14+
**Note:** When using upstreams in foreign namespaces, ensure that the NGINX Ingress Controller is configured to watch all the relevant namespaces. If you are using the `-watch-namespace` flag, make sure to include all namespaces that contain services referenced by your VirtualServer resources (in this case: `tea`, `coffee`, and `cafe`).
15+
16+
## Prerequisites
17+
18+
1. Follow the [installation](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/)
19+
instructions to deploy the Ingress Controller with custom resources enabled.
20+
1. Save the public IP address of the Ingress Controller into a shell variable:
21+
22+
```console
23+
IC_IP=XXX.YYY.ZZZ.III
24+
```
25+
26+
1. Save the HTTPS port of the Ingress Controller into a shell variable:
27+
28+
```console
29+
IC_HTTPS_PORT=<port number>
30+
```
31+
32+
## Step 1 - Create Namespaces
33+
34+
Create the required tea, coffee, and cafe namespaces:
35+
36+
```console
37+
kubectl create -f namespaces.yaml
38+
```
39+
40+
## Step 2 - Deploy the Cafe Application
41+
42+
1. Create the tea deployment and service in the tea namespace:
43+
44+
```console
45+
kubectl create -f tea.yaml
46+
```
47+
48+
1. Create the coffee deployment and service in the coffee namespace:
49+
50+
```console
51+
kubectl create -f coffee.yaml
52+
```
53+
54+
## Step 3 - Configure Load Balancing and TLS Termination
55+
56+
1. Create the secret with the TLS certificate and key in the cafe namespace:
57+
58+
```console
59+
kubectl create -f cafe-secret.yaml
60+
```
61+
62+
1. Create the VirtualServer resource for the cafe app in the cafe namespace:
63+
64+
```console
65+
kubectl create -f cafe-virtual-server.yaml
66+
```
67+
68+
## Step 4 - Test the Configuration
69+
70+
1. Check that the configuration has been successfully applied by inspecting the events of the VirtualServer:
71+
72+
```console
73+
kubectl describe virtualserver cafe -n cafe
74+
```
75+
76+
```text
77+
. . .
78+
Events:
79+
Type Reason Age From Message
80+
---- ------ ---- ---- -------
81+
Normal AddedOrUpdated 1m nginx-ingress-controller Configuration for cafe/cafe was added or updated
82+
```
83+
84+
1. Access the application using curl. We'll use curl's `--insecure` option to turn off certificate verification of our
85+
self-signed certificate and `--resolve` option to set the IP address and HTTPS port of the Ingress Controller to the
86+
domain name of the cafe application:
87+
88+
To get coffee:
89+
90+
```console
91+
curl --resolve cafe.example.com:$IC_HTTPS_PORT:$IC_IP https://cafe.example.com:$IC_HTTPS_PORT/coffee --insecure
92+
```
93+
94+
```text
95+
Server address: 10.16.1.193:80
96+
Server name: coffee-7dbb5795f6-mltpf
97+
...
98+
```
99+
100+
If you prefer tea:
101+
102+
```console
103+
curl --resolve cafe.example.com:$IC_HTTPS_PORT:$IC_IP https://cafe.example.com:$IC_HTTPS_PORT/tea --insecure
104+
```
105+
106+
```text
107+
Server address: 10.16.0.157:80
108+
Server name: tea-7d57856c44-674b8
109+
...

‎examples/custom-resources/foreign-namespace-upstreams/cafe-secret.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../common-secrets/cafe-secret-cafe-ns.example.com.yaml

‎examples/custom-resources/foreign-namespace-upstreams/cafe-virtual-server.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
apiVersion: k8s.nginx.org/v1
2+
kind: VirtualServer
3+
metadata:
4+
name: cafe
5+
namespace: cafe
6+
spec:
7+
host: cafe.example.com
8+
tls:
9+
secret: cafe-secret
10+
routes:
11+
- path: /coffee
12+
action:
13+
pass: coffee
14+
- path: /tea
15+
action:
16+
pass: tea
17+
upstreams:
18+
- name: coffee
19+
service: coffee/coffee-svc
20+
port: 80
21+
- name: tea
22+
service: tea/tea-svc
23+
port: 80

‎examples/custom-resources/foreign-namespace-upstreams/coffee.yaml‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: coffee
5+
namespace: coffee
6+
spec:
7+
replicas: 3
8+
selector:
9+
matchLabels:
10+
app: coffee
11+
template:
12+
metadata:
13+
labels:
14+
app: coffee
15+
spec:
16+
containers:
17+
- name: coffee
18+
image: nginxdemos/nginx-hello:plain-text
19+
ports:
20+
- containerPort: 8080
21+
---
22+
apiVersion: v1
23+
kind: Service
24+
metadata:
25+
name: coffee-svc
26+
namespace: coffee
27+
spec:
28+
ports:
29+
- port: 80
30+
targetPort: 8080
31+
protocol: TCP
32+
name: http
33+
selector:
34+
app: coffee
35+
36+
---
37+
apiVersion: apps/v1
38+
kind: Deployment
39+
metadata:
40+
name: coffee
41+
namespace: coffee2
42+
spec:
43+
replicas: 3
44+
selector:
45+
matchLabels:
46+
app: coffee
47+
template:
48+
metadata:
49+
labels:
50+
app: coffee
51+
spec:
52+
containers:
53+
- name: coffee
54+
image: nginxdemos/nginx-hello:plain-text
55+
ports:
56+
- containerPort: 8080
57+
---
58+
apiVersion: v1
59+
kind: Service
60+
metadata:
61+
name: coffee-svc
62+
namespace: coffee2
63+
spec:
64+
ports:
65+
- port: 80
66+
targetPort: 8080
67+
protocol: TCP
68+
name: http
69+
selector:
70+
app: coffee

‎examples/custom-resources/foreign-namespace-upstreams/namespaces.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: v1
2+
kind: Namespace
3+
metadata:
4+
name: cafe
5+
---
6+
apiVersion: v1
7+
kind: Namespace
8+
metadata:
9+
name: tea
10+
---
11+
apiVersion: v1
12+
kind: Namespace
13+
metadata:
14+
name: coffee

0 commit comments

Comments
 (0)