nginx.ingress.kubernetes.io/service-upstream: "true" annotation for Nginx Ingress resources #9240
-
|
Hi, in order to mesh Nginx I need to set the "nginx.ingress.kubernetes.io/service-upstream" to "true" on the Ingress resource, according to https://linkerd.io/2.11/tasks/using-ingress/#nginx, in addition to enabling the injection on a pod level. I would like to know if I have to enable nginx.ingress.kubernetes.io/service-upstream on every Ingress resource? Or to phrase it differently: Given 2 Ingress non overlapping resources on do I have to annotated them both? Further is it possible to disable meshing for selected Ingress resources (e.g. if already connected via HTTPS)? Thanks |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
So, the annotation changes the behaviour of nginx to address a ClusterIP and Port combination, instead of listing the endpoints available to it. Applying that to all ingress objects could be problematic! For the last bit of your question, there's nothing that requires the service behind the ingress to be meshed, but (for ingress-nginx at least) you have to add the mesh annotation to the controller. You could run multiple controllers if you desperately want to avoid it, but that is a fair bit of extra effort for not much gain. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, thanks for getting back to me. I do understand what is changed by the annotation, but I am unsure why linkerd "requires" this? Why do you consider it problematic to apply that to all ingress objects could be problematic? We do have the ability to automatically label desired object by providing Helm templates / kustomize components within our setup. As we don't need to setup an second ingress controller, we will not do it. Thanks for that info. |
Beta Was this translation helpful? Give feedback.
-
|
Well, if you have a TCP or UDP service (that can't be meshed), if all ingress objects are modified it could/would break. Probably the easiest thing to do in that situation would be to add the label by default in your Helm charts, or to Patch it if using Argo/Flux CD. |
Beta Was this translation helpful? Give feedback.
-
|
I see, well we currently do not expose TCP/UDP services via Ingress resources. But it's good to be aware of it. Thanks for clarifying |
Beta Was this translation helpful? Give feedback.
So, the annotation changes the behaviour of nginx to address a ClusterIP and Port combination, instead of listing the endpoints available to it. Applying that to all ingress objects could be problematic!
Unfortunately there's not a way to automatically label child objects, so you can't add something to a namespace and have it label all subsequent ingress objects either.
For the last bit of your question, there's nothing that requires the service behind the ingress to be meshed, but (for ingress-nginx at least) you have to add the mesh annotation to the controller. You could run multiple controllers if you desperately want to avoid it, but that is a fair bit of extra effort for not much gain.