Setting up custom domains

You can configure a custom domain name for your application, replacing the default CStack domain (e.g., gvt-team-app-name.e01.app.gov.sg).

Note: CStack provides IP blacklisting for custom domains based on GITSIR IP blacklists.

Follow these steps:

Register your domain with a domain name provider.
For example, you might want your site to be accessed through {product}.gov.sg or {product}.{agency}.gov.sg.
Generate TLS certificates to ensure that your website is secure.
Create A records on your DNS servers and configure them to point to the Kong Passthrough ingress IPs.
Proceed to set up the Kong Passthrough Ingress on CStack.

Setting up the Kong Passthrough Ingress on CStack

Encrypt your TLS certificates using Kubeseal.
- For Internet apps: https://kubeseal-web.e01.app.gov.sg/
- For GEN apps: https://kubeseal-web.gen-e01.app.gov.sg/
Deploy the sealed certificates into your CStack namespace.
Set up the Kong Passthrough ingress referencing the sealed TLS certificates. Follow the examples in Sample Manifests.

Important: Make sure to avoid manually modifying secrets after they have been sealed, including combining multiple secrets. Also, remember to store your custom domain TLS secrets in a separate repository from your API and database secrets.

Kong Passthrough Ingress IPs

Ingress Class	Description	Staging	Production
kong-passthrough	Ingress controller for tenant to terminate SSL connection at Ingress level which requires the tenant to provide their domain name and SSL cert. Example	Zone 1: `54.251.231.137` Zone 2: `46.137.194.70`	Zone 1: `3.0.140.150` Zone 2: `54.254.88.65`

Ingress Class	Description	Staging	Production
kong-passthrough	Ingress controller for tenant to terminate SSL connection at Ingress level which requires the tenant to provide their domain name and SSL cert. Example	Zone 1: `10.211.4.135` Zone 2: `10.211.4.156`	Zone 1: `10.211.5.11` Zone 2: `10.211.5.24`

Sample Kong Passthrough Manifests

# secret yaml#
apiVersion: v1
data:
  tls.crt: #cert in base64
  tls.key: #key in base64
kind: Secret
metadata:
  name: #secret name
type: kubernetes.io/tls

# Service yaml #
apiVersion: v1
kind: Service
metadata:
  name: #service name
  annotations:
  labels:
    app.kubernetes.io/name: #label name
spec:
  ports:
    - name: #https service name
      port: 443
      protocol: TCP
      targetPort: #same as your container port
  selector:
    app.kubernetes.io/name: #label name
  type: ClusterIP

# Ingress yaml #
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: #ingress name
  labels:
    app.kubernetes.io/name: #label name
spec:
  ingressClassName: kong-passthrough
  rules:
    - host: #host name
      http:
        paths:
          - path: /
            pathType: "Prefix"
            backend:
              service:
                name: #service name
                port:
                  number: 443
  tls:
    - hosts:
      - #same as rules.hostname
      secretName: #secret name

Response transformer

Security Testing for Applications on CStack