Im heavily investigating this, and like many people, im discovering that in 2020 there doesn't seem to be so much logic in separating tightly coupled webserver + PHP + app process/code from each other:
Two main arguments for separation are scalability and separation of concerns (one process per container).
Logically the webserver should only act as webserver ...
You can't configure your Ingress to serve static data (from your host files for example) alone because the Ingress resource is just a way to configure a way of understanding for Kubernetes on how to access a specific internal resource from outside the cluster.
An API object that manages external access to the services in a cluster, typically HTTP.
Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network).
A wider answer would primarily depend on whether you trust your Docker host and services on ...
Same TLS secret will not be mapped to two ingress at the same time within a namespace.It will map to the first deployed ingress. Create the same secret with a different name and map it to the other ingress for it to work.
Yes Felix. Loosely speaking it "load balance" across your 5 web container instances. If you are using the ECS / Compose integration and you are bringing up this stack with a compose up this is roughly what happens:
it creates an ECS cluster
it creates task def for the web task and the nginx task
it creates a service for web (with 5 tasks in it)
I don't think it is the compatibility, need to really see your configuration to be sure. But most likely, you block something wrongly. If you use the default network policy api networking.k8s.io/v1 notice that it only allows what is defined.
The ConfigMap and Annotation configuration have different purposes.
As per nginx-configuration/configmap/#ssl-protocols:
Sets the SSL protocols to use. The default is: TLSv1.2 TLSv1.3
Context: http, server
i.e., enable the specified protocols to your Nginx Controller.
client --ssl-protocols-> controller --> ...
If you see the logs, there's exactly 15s between the calls. Which is what you have configured in you docker compose file.
If you don't want it to keep pinging after it finds out that the server is alive, you have two options (which is not recommended to do):
Don't use healthcheck, just add your logic in the command part
Setup a higher interval for your ...
Your listen 443 need to have ssl parameter to tell Nginx that all connections accepted on this port should work in SSL mode.
See example at https://nginx.org/en/docs/http/configuring_https_servers.html#single_http_https_server
Shown here for convenience:
listen 443 ssl;
The thing I was looking for was external-auth in ingress-nginx. I created a simple service with nodejs which took over all the basic-auth logic. Then I used an external link to this service in k8s annotations for restricted resources.