slawek/ok-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: update Ingress configuration to enable HTTPS and preserve client IP for ok-server

Browse Source
This commit is contained in:
slawek
2026-07-26 21:41:26 +02:00
parent e0c5cd32d9
commit 11e983f26b
2 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+20 -9
View File
@@ -118,27 +118,38 @@ Expose the app with one of the two options below.
#### Option 1: Traefik Ingress #### Option 1: Traefik Ingress
k3s includes the Traefik ingress controller. The ClusterIP Service and Ingress k3s includes the Traefik ingress controller. The ClusterIP Service and Ingress
in [k3s/expose-ingress.yaml](k3s/expose-ingress.yaml) expose the app on port 80 in [k3s/expose-ingress.yaml](k3s/expose-ingress.yaml) expose the app over HTTPS
for the host name `ok-server.example.org`. Change the `host` value in the on port 443 for the host name `ok-server.example.org`. Change the `host` value
Ingress to your own FQDN and point its DNS record at the node's IP address: in the Ingress to your own FQDN and point its DNS record at the node's IP
address:
```bash ```bash
kubectl apply -f k3s/expose-ingress.yaml kubectl apply -f k3s/expose-ingress.yaml
curl -si "http://ok-server.example.org/" curl -si "https://ok-server.example.org/"
``` ```
Without a DNS record you can still test the host rule by mapping the name to Without a DNS record you can still test the host rule by mapping the name to
the node's IP address on the curl command line: the node's IP address on the curl command line (`-k` skips certificate
verification, since no certificate can be issued before DNS works):
```bash ```bash
curl -si --resolve ok-server.example.org:80:<node-ip> "http://ok-server.example.org/" curl -sik --resolve ok-server.example.org:443:<node-ip> "https://ok-server.example.org/"
``` ```
The TLS certificate comes from a Traefik certificate resolver named `le`,
referenced by the `traefik.ingress.kubernetes.io/router.tls.certresolver`
annotation on the Ingress. Configuring the resolver is out of scope for this
project; it is expected to already exist in your Traefik installation. If your
resolver has a different name, change the annotation value accordingly. To
serve plain HTTP instead, remove the three `traefik.ingress.kubernetes.io`
annotations from the Ingress.
By default the app sees a cluster-internal address (for example `10.42.0.1`) By default the app sees a cluster-internal address (for example `10.42.0.1`)
instead of the real client IP, because the Traefik Service runs with instead of the real client IP, because the Traefik Service runs with
`externalTrafficPolicy: Cluster`. To preserve the client IP, set `externalTrafficPolicy: Cluster`. The `HelmChartConfig` in
`externalTrafficPolicy: Local` on the Traefik Service through a [k3s/traefik-config.yaml](k3s/traefik-config.yaml) sets
`HelmChartConfig`, as in [k3s/traefik-config.yaml](k3s/traefik-config.yaml). `externalTrafficPolicy: Local` on the Traefik Service to preserve the client
IP.
A cluster can hold only one `HelmChartConfig` named `traefik`, so first check A cluster can hold only one `HelmChartConfig` named `traefik`, so first check
whether one already exists: whether one already exists:
k3s/expose-ingress.yaml
+3
View File
@@ -13,6 +13,9 @@ apiVersion: networking.k8s.io/v1
kind: Ingress kind: Ingress
metadata: metadata:
name: ok-server name: ok-server
annotations:
traefik.ingress.kubernetes.io/router.entrypoints: websecure
traefik.ingress.kubernetes.io/router.tls.certresolver: le
spec: spec:
rules: rules:
- host: ok-server.example.org - host: ok-server.example.org