Ingress behind LoadBalancer X-Forwared-For routing

1
votes

Our nginx ingress controller is behind a loadbalancer. The Loadbalancer ist setting the the origing Host in the X-Forwarded-For Headers. For example: "x-forwarded-host": "www.portal-app.de".

I have have also set use-forwarded-headers: "true" in ingress.

My Ingress Rule:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: kd-portal-ingress
  namespace: kd-portal-prod
spec:
  rules:
  - host: www.portal-app.de
    http:
      paths:
      - backend:
          serviceName: my-portal-app
          servicePort: 5050

When i call the Url we get allways the nginx default 404 Page.

It try too explain the scenario. www.portal-app.de is landing on a apache loadbalancer. This LB will proxy the request to the ip where k8s and ingresscontroller is running. The proxy set the origin host infos in the x-forward headers. My Rule does not have any effect, i am allways hitting the default backend

Is it possible to define a hostbased routing behind a loadbalancer in ingress?

2
kubernetes-ingressnginx-ingress
I think it would be more complex than just setting use-forwarded-headers: "true" , take a look at this example. There is related documentation about that in kubernetes ingress documentation. Additionally take a look here. Could you try with that and let me know if it worked? – Jakub

2 Answers

1
votes

I have solved this by activating the apache directive https://httpd.apache.org/docs/2.4/mod/mod_proxy.html#proxypreservehost

0
votes

Yes ingress primary usage is for that only. You specify domains in rules. As you can see it rule in an array, so you can add many domains and it will redirect on the backend service you specified.Also You can create seperate ingress objects too.

Example:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    ingress.kubernetes.io/ssl-redirect: "true"
  name: ingress
spec:
  rules:
  - host: your_domain_name
    http:
    paths:
      - backend:
          serviceName: your_service_name
          servicePort: 8080
        path: /
  tls:
  - hosts:
    - your_domain_name
    secretName: tls-certificate