Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nginx.ingress.kubernetes.io/ssl-passthrough annotation compatibility or workaround needed #303

Open
ram4ibm opened this issue May 23, 2024 · 1 comment
Labels
needs more info Issues that require more information

Comments

@ram4ibm
Copy link

ram4ibm commented May 23, 2024

**Is your feature request related to a problem?
Very popular Kubernetes Community Ingress controller provided annotations like nginx.ingress.kubernetes.io/ssl-passthrough: "true" is not available with the nginxinc Operator. I have checked the official documentations https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/ . SSL Passthrough annotations are not available and the following annotations picks up the ports 8083
nginx.org/listen-ports: "8083"
nginx.org/listen-ports-ssl: "8443"
nginx.org/ssl-passthrough: "true"

I had to enable the otion --enable-tls-passthrough=true and use TransportServer to create TLS Passthrough ingress endpoints.

The results and healthchecks for the backend service are different in TransportServer when compared to nginx.ingress.kubernetes.io/ssl-passthrough: "true" annotation . The transportServer creates a unix socket and expects the application to handle the pod availability. Where in nginx.ingress.kubernetes.io/ssl-passthrough: "true" annotation in Kubernetes can validate if the backend pod is available or not and send a 404 when a service is down.

Describe the solution you'd like
nginx.ingress.kubernetes.io/ssl-passthrough: "true" like capability to do the healthcheck for the backend pods and also wider compatibility for other annotations which are commonly used.

Describe alternatives you've considered
We have not considered any non F5 solution yet as we are using this Operator from Openshift and we would like to continue using this operator which comes from the Openshift Platform Vendor

Additional context
NA

@jjngx jjngx added the needs more info Issues that require more information label Jun 4, 2024
@j1m-ryan
Copy link
Member

Hi @ram4ibm, do the global health checks (max-fails and fail-timeout) work for your use case?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs more info Issues that require more information
Projects
None yet
Development

No branches or pull requests

3 participants