Skip to main content

Ingress & TLS

OpenBox does not prescribe an ingress controller. Pick the one your team already runs (or the one that fits your cluster). All three options below are cloud-agnostic — differ only in annotations and CRDs.

Option A — Istio (chart default)​

Prerequisites: Istio installed, target namespace labeled for sidecar injection.

kubectl label namespace openbox istio-injection=enabled
kubectl rollout restart deployment -n openbox    # if pods already running

Values:

global:
  ingress:
    type: istio
    domain: openbox.mycompany.internal
    tls:
      # Reference existing K8s Secret containing tls.crt + tls.key
      # Chart does NOT create the secret — bring your own OR use cert-manager
      secretName: openbox-tls

Chart emits a Gateway + VirtualService per service. mTLS between services is automatic via sidecar.

Option B — NGINX Ingress​

Prerequisites: NGINX Ingress Controller installed.

Values:

global:
  ingress:
    type: nginx
    className: nginx
    domain: openbox.mycompany.internal
    annotations:
      nginx.ingress.kubernetes.io/ssl-redirect: "true"
      nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    tls:
      # If using cert-manager:
      certManager:
        clusterIssuer: letsencrypt-prod
      # OR reference existing secret:
      # secretName: openbox-tls

Chart emits standard networking.k8s.io/v1 Ingress resources. cert-manager fills in the secret if clusterIssuer is set.

Option C — AWS ALB Ingress Controller​

Prerequisites: AWS Load Balancer Controller installed + IAM permissions for ELB.

Values:

global:
  ingress:
    type: nginx                # ALB Controller reads standard Ingress objects
    className: alb
    domain: openbox.mycompany.internal
    annotations:
      alb.ingress.kubernetes.io/scheme: internet-facing
      alb.ingress.kubernetes.io/target-type: ip
      alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
      alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:123456789012:certificate/xxx
      alb.ingress.kubernetes.io/ssl-redirect: "443"

ACM cert must be provisioned separately (or via Terraform snippet 05). No cert-manager needed.

DNS​

Regardless of ingress choice, point your DNS to the ingress endpoint:

# NGINX / Istio (usually a Service of type LoadBalancer):
kubectl get svc -n ingress-nginx    # or istio-ingress
# Grab EXTERNAL-IP or LoadBalancer hostname

# ALB Controller:
kubectl get ingress -n openbox openbox -o jsonpath='{.status.loadBalancer.ingress[0].hostname}'
# CNAME your domain to that hostname

Verify TLS​

curl -sfI https://openbox.mycompany.internal/
# Expect: HTTP/2 200 (or 302 redirect to /auth/login)

# TLS cert details:
openssl s_client -connect openbox.mycompany.internal:443 -servername openbox.mycompany.internal < /dev/null \
  | openssl x509 -noout -subject -issuer -dates

What OpenBox does NOT prescribe​

  • ❌ CloudFront / CDN in front of the ingress (your edge decision)
  • ❌ WAF / bot management (your security choice)
  • ❌ mTLS enforcement between ingress and OpenBox pods (Istio does this natively; NGINX/ALB would need extra config — your call)
  • ❌ Rate limiting policies (add via ingress annotations if needed)

See AWS integration surface — non-goals for the full boundary.

Troubleshooting​

Certificate stuck in Pending — see S2 troubleshooting #6.

Ingress ADDRESS empty — controller may not be running, or Service type: LoadBalancer is stuck (cloud LB provisioning issue). Check controller logs.

503 from ingress — backend Service selector may not match pod labels. kubectl describe svc <name> -n openbox and cross-check endpoints.