Ingress controller configuration

6.10. Ingress controller configuration#

You can use multiple ingress controllers with Nubus for Kubernetes. Univention develops and tests Nubus for Kubernetes with Traefik and NGINX.

6.10.1. Rate limit externally exposed services#

Configure rate limits on the ingress resources that expose Nubus HTTP services outside the Kubernetes cluster. This section provides an example for the NGINX Ingress Controller.

For general guidance on designing and monitoring rate limits, see Generic implementation guide in Univention Nubus - Nubus Manual [6].

The following examples illustrate the shape of a configuration, not concrete values or a specific product recommendation. Determine an appropriate approach and values for your environment based on the expected legitimate traffic and the capacity of the backing service.

Nubus for Kubernetes supports the NGINX ingress controller, see NGINX Ingress Controller. If you use it, you can add rate limiting to a specific Ingress resource through annotations, as shown in Listing 6.27.

If you use a different ingress controller, an API gateway, or a standalone reverse proxy in front of your cluster, apply the equivalent rate-limiting configuration that this component provides.

Listing 6.27 Illustrative example for rate-limit annotations on an NGINX Ingress resource#
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "<requests per second per client IP>"
    nginx.ingress.kubernetes.io/limit-burst-multiplier: "<allowed burst, as a multiplier of limit-rps>"
    nginx.ingress.kubernetes.io/limit-connections: "<concurrent connections per client IP>"

See also

NGINX Ingress Controller Annotations for rate limiting

for the full reference of the rate-limiting annotations of the NGINX ingress controller.

6.10.2. Buffer size requirements#

Nubus components use the default buffer sizes that common ingress controllers provide. However, the following components have specific requirements:

UDM HTTP REST API

Set a response header buffer size of at least 64 KiB to handle large HTTP response headers.

Keycloak

Set a proxy buffer size of at least 8 KiB for large JWT tokens and authentication headers. Most ingress controllers provide this by default.

6.10.3. Traefik Ingress Controller#

To use Traefik with Nubus, set the ingress class in your custom_values.yaml file, as shown in Listing 6.28. To apply the configuration, follow the steps in Apply configuration. You don’t need additional configuration. Traefik automatically configures the buffer sizes that Nubus components need.

Listing 6.28 Configure Traefik as ingress controller#
global:
  ingressClass: "traefik"

See also

Traefik Kubernetes Ingress

for information about Traefik ingress configuration.

6.10.4. NGINX Ingress Controller#

NGINX is the default ingress controller for Nubus. The Helm Chart includes NGINX-specific annotations that automatically configure appropriate buffer sizes for all components.

If you use NGINX, you don’t need additional configuration. The default settings work without changes.

For custom buffer size settings, refer to the ingress section in the Helm Chart reference for configuration options.

See also

NGINX Ingress Controller Annotations

for information about NGINX ingress annotations.

On this page