## <span style="color:#038d99">Ingress Controller Upgrade</span>  --- ## <span style="color:#038d99">Agenda 📜</span> 1. Reverse Proxy overview <!-- Renzo --> 2. Reverse Proxy configuration 3. Reverse Proxy Kubernetes resources 5. Ingress route <!-- Rihards --> 6. Middlewares 7. DDos mitigation rules --- ### <span style="color:#038d99">Reverse Proxy overview 👀</span> A reverse proxy (also known as Edge Router) is a server that sits in front of web servers and forwards client to those web servers Reverse proxy protects the web server’s identity  --- ### <span style="color:#038d99">Main reasons for us to have the reverse proxy</span> <ul style="font-size:3.2rem"> - Single entrypoint 🚪 - Beta and RC can remain public, however only admin users can have an access to them 🔒 - Internal servers does not need HTTPS conection - Distribute load from incoming requests to each of several servers that supports its own application area - Perform :ab: testing without inserting JavaScript into pages - Mitigation DDos attack 🏴‍☠️ </ul> --- ### <span style="color:#038d99">Reverse Proxy configuration ⚙️</span>  --- We are using TOML syntax inside of YAML to configure our reverse proxy ``` values.yaml chart.yaml templates: config.yaml definitions.yaml deployment.yaml ma.yaml middleware.yaml pvc.yaml service.yaml ``` --- ### **config.yaml ⚙️** ```metadata: name: {{ .Chart.Name }}-config namespace: {{ .Values.namespace }} ``` **static configurations** ```data: static.toml: | [entryPoints] [entryPoints.web] address = ":80" [entryPoints.web.http] [entryPoints.web.http.redirections] [entryPoints.web.http.redirections.entryPoint] to = "websecure" scheme = "https" [entryPoints.websecure] address = ":443" [entryPoints.websecure.http.tls] ``` --- **Definition of http connection** [entryPoints.web] address = ":80" **Definition of https connecton** [entryPoints.websecure] address = ":443" [entryPoints.websecure.http.tls] --- --- ### Certificates ```{{ if or (eq .Values.env "beta") (eq .Values.env "rc") }} certResolver = "staging" [[entryPoints.websecure.http.tls.domains]] main = "{{ .Values.env }}.apolitical.co" sans = ["*.{{ .Values.env }}.apolitical.co"] {{ end }} ``` --- ### Dynamic configurations ```dynamic.toml: | {{ if or (eq .Values.env "beta") (eq .Values.env "rc") }} [tls.options] [tls.options.default] [tls.options.default.clientAuth] caFiles = ["/etc/ma/engineeringCA.crt", "/etc/ma/internalCA.crt"] clientAuthType = "RequireAndVerifyClientCert" {{ else }} [[tls.certificates]] certFile = "/etc/certificates/apolitical.co.cert" keyFile = "/etc/certificates/apolitical.co.key" {{ end }} ``` --- ### Middlerware configurations ```apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: name: secure-headers namespace: {{ .Values.namespace }} spec: headers: frameDeny: true sslRedirect: true customFrameOptionsValue: SAMEORIGIN --- apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: name: cors-headers namespace: {{ .Values.namespace }} spec: headers: # accessControlAllowMethods: # - "GET" # accessControlAllowOriginList: # - "https://example.org" accessControlMaxAge: 100 addVaryHeader: true ``` --- ### <span style="color:#038d99">Reverse Proxy Kubernetes resources ⛵️</span> Latest version of Treafik support Kubernetes Custom Resource Definition (kubernetesCRD). CRD allows to configure access to a Kubernetes cluster in a better way. When using KubernetesCRD as a provider, Traefik uses Custom Resource Definition to retrieve its routing configuration. --- ### <span style="color:#038d99">Ingress route</span> Is the CRD implementation of a Traefik HTTP router. --- ### <span style="color:#038d99">Middlewares</span>  --- ### Code exapmle from Approvals API ```apiVersion: traefik.containo.us/v1alpha1 kind: Middleware metadata: name: {{ .Chart.Name }} namespace: {{ .Values.namespace }} labels: k8s-app: {{ .Chart.Name }} spec: stripPrefix: prefixes: - {{ .Values.ingress.basePath }} ``` --- ### <span style="color:#038d99">DDos mitigation rules</span> --- ## <span style="color:#038d99">Thank you! 🙏</span> ### Any Question