|
| 1 | +# Upstreams in foreign namespaces |
| 2 | + |
| 3 | +In this example we use the [VirtualServer and |
| 4 | +VirtualServerRoute](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/) |
| 5 | +resources to configure load balancing for the modified cafe application from the [Basic |
| 6 | +Configuration](../basic-configuration/) example. We have put the load balancing configuration as well as the deployments |
| 7 | +and services into multiple namespaces. Instead of one namespace, we now use three: `tea`, `coffee`, and `cafe`. |
| 8 | + |
| 9 | +- In the tea namespace, we create the tea deployment and service. |
| 10 | +- In the coffee namespace, we create the coffee deployment and service. |
| 11 | +- In the cafe namespace, we create the cafe secret with the TLS certificate and key and the load-balancing configuration |
| 12 | + for the cafe application. That configuration references the coffee and tea configurations. |
| 13 | + |
| 14 | +**Note:** When using upstreams in foreign namespaces, ensure that the NGINX Ingress Controller is configured to watch all the relevant namespaces. If you are using the `-watch-namespace` flag, make sure to include all namespaces that contain services referenced by your VirtualServer resources (in this case: `tea`, `coffee`, and `cafe`). |
| 15 | + |
| 16 | +## Prerequisites |
| 17 | + |
| 18 | +1. Follow the [installation](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/) |
| 19 | + instructions to deploy the Ingress Controller with custom resources enabled. |
| 20 | +1. Save the public IP address of the Ingress Controller into a shell variable: |
| 21 | + |
| 22 | + ```console |
| 23 | + IC_IP=XXX.YYY.ZZZ.III |
| 24 | + ``` |
| 25 | + |
| 26 | +1. Save the HTTPS port of the Ingress Controller into a shell variable: |
| 27 | + |
| 28 | + ```console |
| 29 | + IC_HTTPS_PORT=<port number> |
| 30 | + ``` |
| 31 | + |
| 32 | +## Step 1 - Create Namespaces |
| 33 | + |
| 34 | +Create the required tea, coffee, and cafe namespaces: |
| 35 | + |
| 36 | +```console |
| 37 | +kubectl create -f namespaces.yaml |
| 38 | +``` |
| 39 | + |
| 40 | +## Step 2 - Deploy the Cafe Application |
| 41 | + |
| 42 | +1. Create the tea deployment and service in the tea namespace: |
| 43 | + |
| 44 | + ```console |
| 45 | + kubectl create -f tea.yaml |
| 46 | + ``` |
| 47 | + |
| 48 | +1. Create the coffee deployment and service in the coffee namespace: |
| 49 | + |
| 50 | + ```console |
| 51 | + kubectl create -f coffee.yaml |
| 52 | + ``` |
| 53 | + |
| 54 | +## Step 3 - Configure Load Balancing and TLS Termination |
| 55 | + |
| 56 | +1. Create the secret with the TLS certificate and key in the cafe namespace: |
| 57 | + |
| 58 | + ```console |
| 59 | + kubectl create -f cafe-secret.yaml |
| 60 | + ``` |
| 61 | + |
| 62 | +1. Create the VirtualServer resource for the cafe app in the cafe namespace: |
| 63 | + |
| 64 | + ```console |
| 65 | + kubectl create -f cafe-virtual-server.yaml |
| 66 | + ``` |
| 67 | + |
| 68 | +## Step 4 - Test the Configuration |
| 69 | + |
| 70 | +1. Check that the configuration has been successfully applied by inspecting the events of the VirtualServer: |
| 71 | + |
| 72 | + ```console |
| 73 | + kubectl describe virtualserver cafe -n cafe |
| 74 | + ``` |
| 75 | + |
| 76 | + ```text |
| 77 | + . . . |
| 78 | + Events: |
| 79 | + Type Reason Age From Message |
| 80 | + ---- ------ ---- ---- ------- |
| 81 | + Normal AddedOrUpdated 1m nginx-ingress-controller Configuration for cafe/cafe was added or updated |
| 82 | + ``` |
| 83 | + |
| 84 | +1. Access the application using curl. We'll use curl's `--insecure` option to turn off certificate verification of our |
| 85 | + self-signed certificate and `--resolve` option to set the IP address and HTTPS port of the Ingress Controller to the |
| 86 | + domain name of the cafe application: |
| 87 | + |
| 88 | + To get coffee: |
| 89 | + |
| 90 | + ```console |
| 91 | + curl --resolve cafe.example.com:$IC_HTTPS_PORT:$IC_IP https://cafe.example.com:$IC_HTTPS_PORT/coffee --insecure |
| 92 | + ``` |
| 93 | + |
| 94 | + ```text |
| 95 | + Server address: 10.16.1.193:80 |
| 96 | + Server name: coffee-7dbb5795f6-mltpf |
| 97 | + ... |
| 98 | + ``` |
| 99 | + |
| 100 | + If you prefer tea: |
| 101 | + |
| 102 | + ```console |
| 103 | + curl --resolve cafe.example.com:$IC_HTTPS_PORT:$IC_IP https://cafe.example.com:$IC_HTTPS_PORT/tea --insecure |
| 104 | + ``` |
| 105 | + |
| 106 | + ```text |
| 107 | + Server address: 10.16.0.157:80 |
| 108 | + Server name: tea-7d57856c44-674b8 |
| 109 | + ... |
![pre-commit-ci[bot]](https://avatars.githubusercontent.com/in/68672?v=4&size=40){kind=avatar}
0 commit comments