How to Expose NGINX Ingress Controller via Azure Front Door and Azure Private Link Service
Introduction
When deploying a Kubernetes cluster in Azure, it is common to use an Ingress Controller to provide external access to applications running in the cluster. The NGINX Ingress Controller is one of the most popular open-source solutions for this purpose. While it is relatively straightforward to configure the Ingress Controller to provide access to applications, what isn’t so clear is how to provide access to the Ingress Controller itself.
In this blog post, I will explain how to configure Azure Front Door and Azure Private Link Service to expose the NGINX Ingress Controller as a secure service which is accessible from outside of the Azure Virtual Network.
Configuring the NGINX Ingress Controller
Before we can configure Azure Front Door and Azure Private Link Service, we need to configure the NGINX Ingress Controller. The configuration process is relatively straightforward, but there are a few steps that need to be followed.
First, we need to deploy the NGINX Ingress Controller in the cluster. This can be done by running the following command:
kubectl apply -f https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/master/deployments/common/ns-and-sa.yaml [https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/master/deployments/common/ns-and-sa.yaml]
Once the controller is deployed, we need to create an Ingress resource which will define how requests are routed to the Ingress Controller. The Ingress resource should look something like this:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: ingress-controller
namespace: default
spec:
rules:
*
* host: example.com
http:
paths: *
* path: /
backend:
serviceName: ingress-controller
servicePort: 80
Finally, we need to configure the NGINX Ingress Controller to use the Ingress resource we just created. This can be done by running the following command:
kubectl edit deployment -n default nginx-ingress-controller
The configuration should look something like this:
spec:
…
template:
…
spec:
…
containers:
– args:
– /nginx-ingress-controller
– –default-backend-service=$(POD_NAMESPACE)/default-http-backend
– –configmap=$(POD_NAMESPACE)/nginx-configuration
– –ingress-class=nginx
– –ingress-resource=ingress-controller
Configuring Azure Front Door
Now that we have the NGINX Ingress Controller configured, we can configure Azure Front Door to expose it as a secure service. To do this, we need to create an Azure Front Door instance, which can be done using the Azure CLI or the Azure Portal.
Once the instance is created, we need to create a Frontend Host, which will define how requests are routed to the NGINX Ingress Controller. The Frontend Host should look something like this:
HostName: example.com
Paths: /*
Backend Pool: ingress-controller
Backend Host Header: example.com
Configuring Azure Private Link Service
Finally, we need to configure Azure Private Link Service to provide secure access to the NGINX Ingress Controller. To do this, we need to create an Azure Private Link Service instance, which can be done using the Azure CLI or the Azure Portal.
Once the instance is created, we need to create a Private Endpoint, which will define how requests are routed to the NGINX Ingress Controller. The Private Endpoint should look something like this:
Name: ingress-controller
IP Address: 10.0.0.1
Subnet: default
VNET: default
Frontend IP Configuration: frontendIPConfig
Conclusion
In this blog post, I have explained how to configure Azure Front Door and Azure Private Link Service to expose the NGINX Ingress Controller as a secure service which is accessible from outside of the Azure Virtual Network. By following the steps outlined in this post, you can quickly and easily configure your own secure Ingress Controller solution.
The process of configuring the NGINX Ingress Controller, Azure Front Door, and Azure Private Link Service is relatively straightforward, and should not take more than a few minutes of your time. Once the configuration is complete, you will be able to securely access your applications running in the Kubernetes cluster from outside of the Azure Virtual Network.
References:
How to expose NGINX Ingress Controller via Azure Front Door and Azure Private Link Service
.
1. Azure Ingress Controller
2. NGINX Ingress Controller
3
