Ingress Traffic

Ingress exposes services to your workload. You need to do a number of steps to do so, which you may refer to Kubernetes documentation. For more information about Ingress, you may visit Kubernetes Ingress documentation.

What Cstack provides

By default, the internet and gen-routable environments are available to users at the subdomain of e01.app.gov.sg and gen-e01.app.gov.sg respectively. When creating an ingress, you can specify the hostname of application within the manifest.

Depending on which environment and network compartment you are hosting on, the domain is prefix with the name of the env (except production) such as env.e01.app.gov.sg or env.gen-e01.app.gov.sg

When declaring an ingress controller, you will need to annotate kubernetes.io/ingress.class. To find out which class to use, you may proceed to Ingress Classes.

Container Stack is using Kong Ingress Controller and there are a few components that it can handle such as KongPlugins.

Types of Ingress Classes

Ingress Class	Description	Staging	Production
kong	Ingress controller for the provided domain. Example	`*.stg.e01.app.gov.sg`	`*.e01.app.gov.sg`
kong-passthrough	Ingress controller for tenant to terminate SSL connection at Ingress level which requires the tenant to provide their domain name and SSL cert. Example	Zone 1: `54.251.231.137` Zone 2: `46.137.194.70`	Zone 1: `3.0.140.150` Zone 2: `54.254.88.65`
kong-http2	Ingress controller for gRPC connection which requires the tenant to provide their domain name and SSL cert. Example	Zone 1: `13.212.0.75` Zone 2: `52.76.249.103`	Zone 1: `18.140.185.109` Zone 2: `52.76.126.106`

Ingress Class	Description	Staging	Production
kong	Ingress controller for the provided domain. Example	`*.stg.gen-e01.app.gov.sg` Zone 1: `10.211.4.138` Zone 2: `10.211.4.148`	`*.gen-e01.app.gov.sg` Zone 1: `10.211.4.138` Zone 2: `10.211.4.148`
kong-internal	Ingress Controller for ArgoCD. To only whitelist	`*.stg.gen-e01.container.stack.gov.sg` Zone 1: `10.211.4.221` Zone 2: `10.211.4.254`	`*.gen-e01.container.stack.gov.sg` Zone 1: `10.211.5.94` Zone 2: `10.211.5.121`
kong-passthrough	Ingress controller for tenant to terminate SSL connection at Ingress level which requires the tenant to provide their domain name and SSL cert. Example	Zone 1: `10.211.4.135` Zone 2: `10.211.4.156`	Zone 1: `10.211.5.11` Zone 2: `10.211.5.24`
kong-http2	Ingress controller for gRPC connection which requires the tenant to provide their domain name and SSL cert. Example	Zone 1: `10.211.4.136` Zone 2: `10.211.4.157`	Zone 1: `10.211.5.7` Zone 2: `10.211.5.20`

Sample - kong

# service yaml #
apiVersion: v1
kind: Service
metadata:
  name: #service name
  labels:
    app.kubernetes.io/name: #label name
spec:
  ports:
    - name: #https port name
      port: 443
      protocol: TCP
      targetPort: #same as your container port
  selector:
    app.kubernetes.io/name: #label name
  type: ClusterIP

# ingress yaml #
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: #name of ingress
  labels:
    app.kubernetes.io/name: #label name
spec:
  ingressClassName: kong
  rules:
    - host: #name of host
      http:
        paths:
          - path: /
            pathType: "Prefix"
            backend:
              service:
                name: #service name
                port:
                  number: 443

Sample - kong-passthrough

# secret yaml#
apiVersion: v1
data:
  tls.crt: #cert in base64
  tls.key: #key in base64
kind: Secret
metadata:
  name: #secret name
type: kubernetes.io/tls

# Service yaml #
apiVersion: v1
kind: Service
metadata:
  name: #service name
  annotations:
  labels:
    app.kubernetes.io/name: #label name
spec:
  ports:
    - name: #https service name
      port: 443
      protocol: TCP
      targetPort: #same as your container port
  selector:
    app.kubernetes.io/name: #label name
  type: ClusterIP

# Ingress yaml #
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: #ingress name
  labels:
    app.kubernetes.io/name: #label name
spec:
  ingressClassName: kong-passthrough
  rules:
    - host: #host name
      http:
        paths:
          - path: /
            pathType: "Prefix"
            backend:
              service:
                name: #service name
                port:
                  number: 443
  tls:
    - hosts:
      - #same as rules.hostname
      secretName: #secret name

Sample - kong-http2

# secret yaml#
apiVersion: v1
data:
  tls.crt: #cert in base64
  tls.key: #key in base64
kind: Secret
metadata:
  name: #secret name
type: kubernetes.io/tls

# Service yaml #
apiVersion: v1
kind: Service
metadata:
  name: #service name
  annotations:
    konghq.com/protocol: "grpc"
  labels:
    app.kubernetes.io/name: #label name
spec:
  ports:
    - name: #https service name
      port: 443
      protocol: TCP
      targetPort: #same as your container port
  selector:
    app.kubernetes.io/name: #label name
  type: ClusterIP

# Ingress yaml #
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: #ingress name
  labels:
    app.kubernetes.io/name: #label name
  annotations:
    konghq.com/protocols: "grpc"
spec:
  ingressClassName: kong-http2
  rules:
    - host: #host name
      http:
        paths:
          - path: /
            pathType: "Prefix"
            backend:
              service:
                name: #service name
                port:
                  number: 443
  tls:
    - hosts:
      - #same as rules.hostname
      secretName: #secret name

Plugins supported by Kong

Kong can support plugins and here are the list of plugins in improving your security and access to some of your services.

For our Kong Ingress Class, we have a default response-transformer running. This is an added security to headers that have headers details made known.

Note: The KongPlugin resource only needs to be defined once and can be applied to any Service, Consumer, or Route in the namespace.

For black/white listing, you may read up on IP Restriction.
For tracking of transaction and/or preventing backend from overloading, you may read up on Rate Limiting.
For customising of headers, you may read up on Response Transformer.

More plugins are available at Kong Docs.

Disk

Egress Traffic