Setting up the Nginx Ingress Controller

This page describes installing Nginx Ingress Controller and configuring SSL in it to use it as a front-end for Webapp Gateway.

Installing the Nginx Ingress Controller

You can set up Nginx Ingress Controller as a front-end for Webapp Gateway to add an extra layer of security while establishing communication between external users and the application. 

Follow the steps given below to set up the Nginx Ingress Controller. 

1. Run the following command to add the Nginx Ingress Controller repository. 

2. Run the following command to create a namespace where you want to install the Ingress Controller.

3. Run the command as shown in the example below to install the Nginx Ingress Controller.

Configuring SSL in Ingress

An important prerequisite for secure communication between the web browser (end user) and the web server is to use Secure Sockets Layer (SSL) certificate. Adeptia Connect microservices also adheres to this requirement. To achieve this, after you've deployed Adeptia Connect, you need to configure SSL in the Kubernetes Ingress Controller.

To configure SSL in Ingress Controller, do the following in the same order:

1. Generate an SSL certificate to create a secret for securing the Ingress Controller.
2. Create secret to use in the Ingress Rule.
3. Create Ingress rule.
4. Map your Adeptia Connect domain to the Ingress External IP.

Creating secret for ingress SSL

You can secure Ingress Controller by specifying a secret that contains a TLS private key (tls.key) and certificate (tls.crt). Follow the steps below to create the secret:

You need to make sure the TLS secret you created came from a certificate that contains a Common Name (CN), also known as a Fully Qualified Domain Name (FQDN), for example, dummy.adeptia.com.

1. Go to the directory where you kept the certificate and the private key.

2. Create secret to use in the ingress rule.

   

3. Run the following command to view the secret you created.

Creating ingress rule

You can send requests to the application using the application UI as well as an API. The requests sent using the UI are routed through the Webapp Gateway, while the API ones are routed through the API Gateway. To send the requests, you can either use a single domain or two separate domains to route the requests via Webapp Gateway and the API Gateway. When you have Ingress in place, you need to create an ingress rule to define if you want to use a single domain or two separate domains to send your requests.   

Creating Ingress rule when using single domain setup

1. Copy the following YAML script to a notepad.

   In this example, ac47.adeptia.com is the application's domain name, and aks-ingress-tls is the name of the secret.

2. Update the host parameter as shown below:
   

3. Update the hosts and the secretName parameters at the bottom of the file. 
   

4. Save the file as YAML.

5. Go to the directory where you saved the YAML file.

6. Run the following command to apply the ingress rule.

Mapping Adeptia Connect domain to the Ingress External IP

After configuring the Ingress resource, you must map your Adeptia Connect domain to the External IP exposed by the NGINX Ingress Controller. This ensures that all requests sent to your configured domain are routed correctly to the application inside the Kubernetes cluster.

1. Retrieve the Ingress Controller External IP
   Run the following command to view the External IP assigned to the NGINX Ingress Controller Service:

   Locate the EXTERNAL-IP field for the Ingress Controller Service.

2. Update your DNS provider
   Create a DNS A record that points your Adeptia Connect domain, for example, ac47.adeptia.com, to the External IP returned in the previous step.
   If you are using multiple domains, create a separate A record for each domain.

3. Verify the DNS mapping
   After DNS propagation, run the following command to verify that the domain resolves to the correct IP:

   Ensure the output shows the same External IP address of the Ingress Controller.

Once the mapping is complete and DNS has propagated, your Adeptia Connect application will be accessible through the configured domain.

---