Cross-namespace Configuration using Ingress&VirtualServer

[hahahannes]

Hi everyone!

I am following the instructions on https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/cross-namespace-configuration/ to spread ingress configs across namespaces. There are two example for ingress ressources and VirtualServer. But does anyone know how to do it with both?

Something like

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: server
  namespace: server-ns
  annotations:
    nginx.org/mergeable-ingress-type: "minion"

[jasonwilliams14]

@hahahannes VirtualServer and VirtualServerRoute is what you are looking for in order to do cross-namespace-routing.
The mergeable-ingress-type is only meant to be used with Ingress resource, not with our CRDs (virtualServer and virtualserverroute)
Take a look here on how to do cross-namespace routing with our CRDs:

https://github.com/nginxinc/kubernetes-ingress/tree/v2.4.1/examples/custom-resources/cross-namespace-configuration

[hahahannes]

Hi! Thank you very much for the fast help! I hoped that it might be possible to do cross namespace routing with Ingress and VirtualServer as I have some old ingress resources but also newer VirtualServers. But I guess I have to move the old ingresses to virtualservers.

Thanks!

[hahahannes]

Its really tricky. If I understand it correctly, it is not possible to use the same host for multiple virtualservers. And the recommended solution is to use the VirtualServerRoutes. But with these, it is not possible to set the port, which I want to do in order to expose multiple services with different ports and for one host. And I cant use only Ingress resources as I need the mTLS functionality from the VirtualServer

[jasonwilliams14]

@hahahannes

If I understand it correctly, it is not possible to use the same host for multiple virtualservers
Correct. You will run into host collisions.
You can think of it this way in terms of NGINX

virtualServer is the server block in NGINX terms, where the host is defined.
virtualServerRoute is the location section within the server block.

But with these, it is not possible to set the port, which I want to do in order to expose multiple services with different ports and for one host.
You can change the port NIC is listening on itself. For the upstream services, you can specify the port. Simple example:

  upstreams:
  - name: tea
    service: tea-svc
    port: 80
  - name: coffee
    service: coffee-svc
    port: 80

That tells NIC which port to connect to on the service

resources as I need the mTLS functionality from

are you using a different port for mTLS than 443?

[hahahannes]

@jasonwilliams14 Sorry, I meant, I want to expose my cluster on multiple ports so that I can map different services to them
like CLUSTER_IP:8000 -> tea-svc and CLUSTER_IP:8001 -> coffee-svc. And for one port I want to use mTLS for authentication