From 22b633822d14ad23b463301506da47e75f6f24bc Mon Sep 17 00:00:00 2001 From: Eric Fossum Date: Thu, 24 Apr 2025 00:05:18 -0700 Subject: [PATCH] fix(docs): Fix NGINX YAML examples and Update recommended ingress to NGINX. (#34708) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit **Description** Updates the recommended reverse proxy tool to NGINX. In addition, fixes the example YAML in the NGINX examples. I will add a task, but I could not get the examples to work with the ingressClassByName: true option. **โš™๏ธ Type of change** - [ ] โš™๏ธ Feature/App addition - [ ] ๐Ÿช› Bugfix - [ ] โš ๏ธ Breaking change (fix or feature that would cause existing functionality to not work as expected) - [ ] ๐Ÿ”ƒ Refactor of current code - [x] ๐Ÿ“œ Documentation Changes **๐Ÿงช How Has This Been Tested?** Used markdown preview in VS Code. **๐Ÿ“ƒ Notes:** Wasn't sure if the customise misspelling was a locale thing. I can easily reverse it. **โœ”๏ธ Checklist:** - [x] โš–๏ธ My code follows the style guidelines of this project - [x] ๐Ÿ‘€ I have performed a self-review of my own code - [ ] #๏ธโƒฃ I have commented my code, particularly in hard-to-understand areas - [x] ๐Ÿ“„ I have made changes to the documentation - [ ] ๐Ÿงช I have added tests to this description that prove my fix is effective or that my feature works - [ ] โฌ†๏ธ I increased versions for any altered app according to semantic versioning - [x] I made sure the title starts with `feat(chart-name):`, `fix(chart-name):`, `chore(chart-name):`, `docs(chart-name):` or `fix(docs):` **โž• App addition** If this PR is an app addition please make sure you have done the following. - [ ] ๐Ÿ–ผ๏ธ I have added an icon in the Chart's root directory called `icon.png` --- .../src/content/docs/guides/ingress/index.md | 2 +- .../src/content/docs/guides/ingress/nginx.md | 193 +++++++++--------- 2 files changed, 97 insertions(+), 98 deletions(-) diff --git a/website/src/content/docs/guides/ingress/index.md b/website/src/content/docs/guides/ingress/index.md index 27b2d3aa443..f43db769cbe 100644 --- a/website/src/content/docs/guides/ingress/index.md +++ b/website/src/content/docs/guides/ingress/index.md @@ -9,7 +9,7 @@ Simply put, they specify reverse proxy configuration for a special reverse proxy ## Requirements -Before setting up ingress, we advise you to have an ingress controller already set-up. Our recommended ingress controller is [Traefik](https://github.com/traefik/traefik). +Before setting up ingress, we advise you to have an ingress controller already set-up. Our recommended ingress controller is [Nginx](https://kubernetes.github.io/ingress-nginx/). ## How to Setup diff --git a/website/src/content/docs/guides/ingress/nginx.md b/website/src/content/docs/guides/ingress/nginx.md index 725662d7a22..af83d9266d0 100644 --- a/website/src/content/docs/guides/ingress/nginx.md +++ b/website/src/content/docs/guides/ingress/nginx.md @@ -4,7 +4,7 @@ title: NGINX ## Setup -For NGINX we will setup 2 ingress controllers: Internal and External. +For NGINX we will deploy two ingress controllers: Internal and External. Where External is either forwarded by your router or, for example, a cloudflare tunnel. Internal, however, is not routed anywhere and is used as a safe default to just have charts reached from your internal network only. @@ -16,105 +16,103 @@ Please note the IP variables that need to be set to your specific configuration #### Internal ```yaml - controller: - replicaCount: 2 - service: - externalTrafficPolicy: Local - annotations: - metallb.io/ip-allocated-from-pool: main - metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP} - ingressClassByName: true - watchIngressWithoutClass: true - ingressClassResource: - name: internal - default: true - controllerValue: k8s.io/internal - config: - allow-snippet-annotations: true - annotations-risk-level: Critical - client-body-buffer-size: 100M - client-body-timeout: 120 - client-header-timeout: 120 - enable-brotli: "true" - enable-ocsp: "true" - enable-real-ip: "true" - force-ssl-redirect: "true" - hide-headers: Server,X-Powered-By - hsts-max-age: "31449600" - keep-alive-requests: 10000 - keep-alive: 120 - proxy-body-size: 0 - proxy-buffer-size: 16k - ssl-protocols: TLSv1.3 TLSv1.2 - use-forwarded-headers: "true" - metrics: - enabled: true - extraArgs: - default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard" - publish-status-address: ${NGINX_INTERNAL_IP} - terminationGracePeriodSeconds: 120 - publishService: - enabled: false - resources: - requests: - cpu: 100m - limits: - memory: 500Mi - defaultBackend: - enabled: false +controller: + replicaCount: 2 + service: + externalTrafficPolicy: Local + annotations: + metallb.io/ip-allocated-from-pool: main + metallb.io/loadBalancerIPs: ${NGINX_INTERNAL_IP} + ingressClassByName: true + watchIngressWithoutClass: true + ingressClassResource: + name: internal + default: true + controllerValue: k8s.io/internal + config: + allow-snippet-annotations: true + annotations-risk-level: Critical + client-body-buffer-size: 100M + client-body-timeout: 120 + client-header-timeout: 120 + enable-brotli: "true" + enable-ocsp: "true" + enable-real-ip: "true" + force-ssl-redirect: "true" + hide-headers: Server,X-Powered-By + hsts-max-age: "31449600" + keep-alive-requests: 10000 + keep-alive: 120 + proxy-body-size: 0 + proxy-buffer-size: 16k + ssl-protocols: TLSv1.3 TLSv1.2 + use-forwarded-headers: "true" + metrics: + enabled: true + extraArgs: + default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard" + publish-status-address: ${NGINX_INTERNAL_IP} + terminationGracePeriodSeconds: 120 + publishService: + enabled: false + resources: + requests: + cpu: 100m + limits: + memory: 500Mi +defaultBackend: + enabled: false ``` #### External ```yaml - - values: - controller: - replicaCount: 2 - service: - externalTrafficPolicy: Local - annotations: - metallb.io/ip-allocated-from-pool: main - metallb.io/loadBalancerIPs: ${NGINX_EXTERNAL_IP} - ingressClassByName: true - watchIngressWithoutClass: false - ingressClassResource: - name: external - default: false - controllerValue: k8s.io/external - config: - allow-snippet-annotations: true - annotations-risk-level: Critical - client-body-buffer-size: 100M - client-body-timeout: 120 - client-header-timeout: 120 - enable-brotli: "true" - enable-ocsp: "true" - enable-real-ip: "true" - force-ssl-redirect: "true" - hide-headers: Server,X-Powered-By - hsts-max-age: "31449600" - keep-alive-requests: 10000 - keep-alive: 120 - proxy-body-size: 0 - proxy-buffer-size: 16k - ssl-protocols: TLSv1.3 TLSv1.2 - use-forwarded-headers: "true" - metrics: - enabled: true - extraArgs: - default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard" - publish-status-address: ${NGINX_EXTERNAL_IP} - terminationGracePeriodSeconds: 120 - publishService: - enabled: false - resources: - requests: - cpu: 100m - limits: - memory: 500Mi - defaultBackend: - enabled: false +controller: + replicaCount: 2 + service: + externalTrafficPolicy: Local + annotations: + metallb.io/ip-allocated-from-pool: main + metallb.io/loadBalancerIPs: ${NGINX_EXTERNAL_IP} + ingressClassByName: true + watchIngressWithoutClass: false + ingressClassResource: + name: external + default: false + controllerValue: k8s.io/external + config: + allow-snippet-annotations: true + annotations-risk-level: Critical + client-body-buffer-size: 100M + client-body-timeout: 120 + client-header-timeout: 120 + enable-brotli: "true" + enable-ocsp: "true" + enable-real-ip: "true" + force-ssl-redirect: "true" + hide-headers: Server,X-Powered-By + hsts-max-age: "31449600" + keep-alive-requests: 10000 + keep-alive: 120 + proxy-body-size: 0 + proxy-buffer-size: 16k + ssl-protocols: TLSv1.3 TLSv1.2 + use-forwarded-headers: "true" + metrics: + enabled: true + extraArgs: + default-ssl-certificate: "clusterissuer/certificate-issuer-general-wildcard" + publish-status-address: ${NGINX_EXTERNAL_IP} + terminationGracePeriodSeconds: 120 + publishService: + enabled: false + resources: + requests: + cpu: 100m + limits: + memory: 500Mi +defaultBackend: + enabled: false ``` ### Using the IngressClasses @@ -126,7 +124,7 @@ or ## Annotations Examples -Here we will showcase some annotations you can use to customise your NGINX ingress behavior +Here we will showcase some annotations you can use to customize your NGINX ingress behavior ### Redirect to Https @@ -159,7 +157,8 @@ annotations: ``` For domain-level forward auth, you must configure the embedded outpost first (please refer to -[Authentik's docs](https://truecharts.org/charts/stable/authentik/how_to/)). The basic steps are to create a provider and application, then enable the embedded outpost for your newly created application. +[Authentik's docs](https://truecharts.org/charts/stable/authentik/how_to/)). The basic steps are +to create a provider and application, then enable the embedded outpost for your newly created application. Once that has been done, configure each service you wish to place behind Authentik as follows: