Configure Nginx Ingress :: Kloudfuse Docs

Configure Nginx Ingress

An ingress controller is required for external access to the Kloudfuse cluster. For HTTPS and TLS configuration, see HTTPS/TLS Setup.

X-Request-ID Forwarding

The bundled ingress-nginx controller forwards a request-correlation header to Kloudfuse automatically. If you disable it (see the Disable option below) and run your own NGINX controller — for example the standalone setup in Standalone Nginx Ingress — you must reproduce this configuration yourself.
Kloudfuse expects every request that reaches its services to carry an
X-Request-ID header, and its authentication subrequest relies on the same
header. The bundled ingress-nginx controller is configured to do this
automatically. A NGINX controller that you manage yourself is not — without the
configuration below the header can arrive empty, and the Kloudfuse services that
depend on it fail to resolve it.
If you run your own NGINX ingress configuration, add the following to the
controller so it preserves an incoming X-Request-ID (or generates one when the
header is missing) and forwards it to every backend:		 
controller:
  # Forward X-Request-ID to all backends.
  proxySetHeaders:
    X-Request-ID: $kf_req_id
  config:
    # Keep generate-request-id at its default ("true"). The built-in $req_id is
    # used by the auth subrequest and error pages; disabling it leaves those with
    # an empty X-Request-ID when the incoming header is missing.
    generate-request-id: "true"
    http-snippet: |
      # Preserve incoming X-Request-ID; generate one (via the core $request_id,
      # which is always present) when the header is missing.
      map $http_x_request_id $kf_req_id {
        default $http_x_request_id;
        ""      $request_id;
      }

Ingress Internal Annotations

By default, the ingress internal service is disabled. If you enable it, you must annotate it with cloud-specific values.

Include one of these configurations in your custom_values.yaml file:

The internal ingress service must be annotated with Google’s load balancer information.

Update the custom_values.yaml with this configuration:

ingress-nginx:
  controller:
    service:
      internal:
        enabled: true
        annotations:
          networking.gke.io/load-balancer-type: "Internal"
          cloud.google.com/load-balancer-type: "Internal"

The internal ingress service must be annotated with AWS load balancer information.

Update the custom_values.yaml with this configuration:

ingress-nginx:
  controller:
    service:
      internal:
        enabled: true
        annotations:
          service.beta.kubernetes.io/aws-load-balancer-internal: "true"

To ensure that Kloudfuse is available on a public endpoint, create a public IP address in the same resource group as the AKS cluster. Add inbound security rules for HTTP and HTTPS as required.

The internal ingress service must be annotated with Azure load balancer information.

Update the custom_values.yaml with this configuration:

ingress-nginx:
  controller:
    service:
      loadBalancerIP: "<<PUBLIC IP ADDRESS>>"
      externalTrafficPolicy: "Local"
      internal:
        enabled: true
        annotations:
          service.beta.kubernetes.io/azure-load-balancer-internal: "true"

On Azure, you must disable TLS verification for the observability agent.

Update the custom_values.yaml with this configuration:

kfuse-observability-agent:
  datadog:
    datadog:
      kubelet:
        tlsVerify: false

In some cases, having the Kloudfuse installed Nginx Ingress is not preferred.

Update the custom_values.yaml with this configuration:

ingress-nginx:
  enabled: false