Skip to main content

Ingress overrides

Chart supports 4 ingress modes via global.ingress.type. This page covers per-mode override snippets. For an install-time walkthrough see S3 → Ingress & TLS.

Global ingress config​

global:
  ingress:
    type: nginx            # nginx | traefik | istio | none
    className: nginx       # ingressClassName (auto-inferred from type if empty)
    domain: openbox.example.com
    annotations: {}
    tls:
      secretName: openbox-tls          # OR
      certManager: { clusterIssuer: letsencrypt-prod }

Per-service ingress overrides layer on top:

openbox-backend:
  ingress:
    host: api.openbox.example.com    # override default subdomain
    annotations:
      nginx.ingress.kubernetes.io/proxy-body-size: "50m"

Preset — NGINX Ingress + cert-manager​

global:
  ingress:
    type: nginx
    className: nginx
    domain: openbox.example.com
    annotations:
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
      nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    tls:
      certManager:
        clusterIssuer: letsencrypt-prod

Preset — AWS ALB Ingress Controller​

global:
  ingress:
    type: nginx                        # ALB Controller reads networking.k8s.io/v1 Ingress
    className: alb
    domain: openbox.example.com
    annotations:
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
      alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:123456789012:certificate/xxxx
      alb.ingress.kubernetes.io/ssl-redirect: "443"
      alb.ingress.kubernetes.io/healthcheck-path: /health

Preset — Istio Gateway​

global:
  ingress:
    type: istio
    domain: openbox.example.com
    istio:
      gatewayName: openbox-gateway      # existing Gateway to reuse
      # OR let chart create one:
      # gatewaySelector: { istio: ingressgateway }
    tls:
      secretName: openbox-tls           # cert in istio-system namespace

Remember to label the namespace: kubectl label namespace openbox istio-injection=enabled.

Preset — Traefik​

global:
  ingress:
    type: traefik
    className: traefik
    domain: openbox.example.com
    annotations:
      traefik.ingress.kubernetes.io/router.entrypoints: websecure
      traefik.ingress.kubernetes.io/router.tls: "true"

Preset — None (dev / port-forward)​

global:
  ingress:
    type: none

Chart skips all ingress resources. Access via kubectl port-forward:

kubectl port-forward -n openbox svc/openbox-backend 3000:3000

Rate limiting​

Chart does NOT emit rate-limit configs — your ingress controller does. Examples:

NGINX:

annotations:
  nginx.ingress.kubernetes.io/limit-rps: "10"
  nginx.ingress.kubernetes.io/limit-connections: "50"

Istio: use EnvoyFilter + local rate-limiter (out of chart scope).

WAF / bot management​

Not a chart concern. Configure at your edge:

  • AWS ALB → attach AWS WAF
  • CloudFront → attach AWS WAF managed rules
  • Cloudflare → configure WAF rules in Cloudflare dashboard

Openbox docs don't prescribe an edge stack (non-goals).

Verify​

kubectl get ingress -n openbox -o wide
# Look for HOSTS + ADDRESS columns populated

curl -sfI https://openbox.example.com/health
# Expect: HTTP/2 200