Ingress Module

Ingress Module provides Ingress Controllers to expose services and TLS certificate management solutions for SIGHUP Distribution (SD).

If you are new to SD please refer to the official documentation on how to get started with SD.

Overview

Ingress Module uses CNCF recommended, Cloud Native projects, such as Ingress NGINX and HAProxy Ingress Controller as URL path-based routing reverse proxies and load balancers, and cert-manager to automate the issuing and renewal of TLS certificates from various issuing sources.

The module also includes additional tools like Forecastle, a web-based global directory of all the services offered by your cluster, and ExternalDNS to manage DNS records natively from Kubernetes.

Architecture

The reference architecture used to deploy the Ingress Module is shown below:

flowchart LR
    User([End users])
    LB[Load Balancer]
    subgraph cluster[Kubernetes Cluster]
        direction LR
        IC[Ingress Controller]
        SVC[Service]
        P1[Pod 1]
        P2[Pod 2]
        P3[Pod 3]
        IC --> SVC
        SVC --> P1
        SVC --> P2
        SVC --> P3
    end
    User --> LB
    LB --> IC

Loading

• The traffic from end users arrives first at a Load Balancer that distributes the traffic between the available Ingress Controllers (usually, one for each availability zone).
• Once the traffic reaches the Ingress Controller, the Ingress proxies the traffic to the Kubernetes service based on the URL path of the request.
• The service is a Kubernetes abstraction that makes the traffic arrive at the pods where the actual application is running, usually using iptables rules.

For more information, please refer to the Kubernetes Ingress official documentation.

Packages

The following packages are included in Ingress Module:

Package	Version	Description
nginx	v1.15.10-chainguard	The NGINX Ingress Controller for Kubernetes provides delivery services for Kubernetes applications.
dual-nginx	v1.15.10-chainguard	Deploys two identical NGINX ingress controllers but with two different scopes: public/external and private/internal.
cert-manager	v1.21.2	cert-manager is a Kubernetes add-on to automate the management and issuance of TLS certificates from various issuing sources.
external-dns	v0.21.0	external-dns allows you to manage DNS records natively from Kubernetes.
haproxy	v3.2.15	The HAProxy Ingress Controller for Kubernetes, supporting single and dual deployment modes.
forecastle	v1.0.159	Forecastle gives you access to a control panel where you can see your ingresses and access them on Kubernetes.
aws-cert-manager	-	Terraform module for managing IAM permissions on AWS for cert-manager.
aws-external-dns	-	Terraform module for managing IAM permissions on AWS for external-dns.

Click on each package to see its full documentation.

Compatibility

Kubernetes Version	Compatibility	Notes
1.33.x	✅	No known issues
1.34.x	✅	No known issues
1.35.x	✅	No known issues
1.36.x	✅	No known issues

Check the compatibility matrix for additional information about previous releases of the module.

Usage

Ingress Module is part of SIGHUP Distribution (SD) and is deployed automatically by furyctl when you create or update a cluster. You don't need to download, vendor or install its packages manually.

Configuration

You configure the module under spec.distribution.modules.ingress in your furyctl.yaml. You set the baseDomain and choose the ingress controller via nginx.type (or haproxy.type): single, dual, or none to disable it. The other fields are optional and fall back to sensible defaults.

apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
  distribution:
    modules:
      ingress:
        baseDomain: example.dev
        nginx:
          type: dual
          tls:
            provider: certManager
        certManager:
          clusterIssuer:
            name: letsencrypt
            email: example@sighup.io
            type: http01
        forecastle: {}

To use HAProxy as the ingress controller instead of NGINX, configure the haproxy block (and set nginx.type: none):

apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
  distribution:
    modules:
      ingress:
        baseDomain: example.dev
        nginx:
          type: none
        haproxy:
          type: dual
          tls:
            provider: certManager
        certManager:
          clusterIssuer:
            name: letsencrypt
            email: example@sighup.io
            type: http01
        forecastle: {}

See the configuration reference for your cluster kind for the full list of available options: EKSCluster, KFDDistribution or OnPremises.

To install SD from scratch, follow the Getting started guide.

Contributing

Before contributing, please read first the Contributing Guidelines.

Reporting Issues

In case you experience any problem with the module, please open a new issue.

License

This module is open-source and it's released under the following LICENSE.