Hot answers tagged

6

Im heavily investigating this, and like many people, im discovering that in 2020 there doesn't seem to be so much logic in separating tightly coupled webserver + PHP + app process/code from each other: Two main arguments for separation are scalability and separation of concerns (one process per container). Logically the webserver should only act as webserver ...


2

You can't configure your Ingress to serve static data (from your host files for example) alone because the Ingress resource is just a way to configure a way of understanding for Kubernetes on how to access a specific internal resource from outside the cluster. An API object that manages external access to the services in a cluster, typically HTTP. Ingress ...


2

Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network). A wider answer would primarily depend on whether you trust your Docker host and services on ...


1

Same TLS secret will not be mapped to two ingress at the same time within a namespace.It will map to the first deployed ingress. Create the same secret with a different name and map it to the other ingress for it to work.


1

Set automountServiceAccountToken: true in your pod specification in both of the jobs and the deployment. Ref: https://discuss.kubernetes.io/t/nginx-ingress-install-failure/5379/4


1

Yes Felix. Loosely speaking it "load balance" across your 5 web container instances. If you are using the ECS / Compose integration and you are bringing up this stack with a compose up this is roughly what happens: it creates an ECS cluster it creates task def for the web task and the nginx task it creates a service for web (with 5 tasks in it) it ...


1

I don't think it is the compatibility, need to really see your configuration to be sure. But most likely, you block something wrongly. If you use the default network policy api networking.k8s.io/v1 notice that it only allows what is defined.


1

The ConfigMap and Annotation configuration have different purposes. As per nginx-configuration/configmap/#ssl-protocols: Sets the SSL protocols to use. The default is: TLSv1.2 TLSv1.3 ngx_http_ssl_module.html#ssl_protocols Context: http, server i.e., enable the specified protocols to your Nginx Controller. client --ssl-protocols-> controller --> ...


1

If you see the logs, there's exactly 15s between the calls. Which is what you have configured in you docker compose file. If you don't want it to keep pinging after it finds out that the server is alive, you have two options (which is not recommended to do): Don't use healthcheck, just add your logic in the command part Setup a higher interval for your ...


1

Your listen 443 need to have ssl parameter to tell Nginx that all connections accepted on this port should work in SSL mode. See example at https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server Shown here for convenience: server { listen 80; listen 443 ssl; server_name www.example....


1

The thing I was looking for was external-auth in ingress-nginx. I created a simple service with nodejs which took over all the basic-auth logic. Then I used an external link to this service in k8s annotations for restricted resources. annotation snippet: annotations: nginx.ingress.kubernetes.io/auth-url: http://service-name.default.svc.cluster.local:...


Only top voted, non community-wiki answers of a minimum length are eligible