apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: context-store-ingress
namespace: context-store
labels:
app: persistent-context-store
component: ingress
annotations:
# Ingress controller specific annotations
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/rewrite-target: /
# SSL/TLS configuration
cert-manager.io/cluster-issuer: "letsencrypt-prod"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
# Rate limiting
nginx.ingress.kubernetes.io/rate-limit: "1000"
nginx.ingress.kubernetes.io/rate-limit-window: "1m"
nginx.ingress.kubernetes.io/rate-limit-connections: "100"
# Request size limits
nginx.ingress.kubernetes.io/proxy-body-size: "10m"
nginx.ingress.kubernetes.io/client-max-body-size: "10m"
# Timeouts
nginx.ingress.kubernetes.io/proxy-connect-timeout: "60"
nginx.ingress.kubernetes.io/proxy-send-timeout: "120"
nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
# CORS configuration
nginx.ingress.kubernetes.io/enable-cors: "true"
nginx.ingress.kubernetes.io/cors-allow-origin: "https://contextstore.example.com"
nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
nginx.ingress.kubernetes.io/cors-allow-headers: "Authorization, Content-Type, Accept"
nginx.ingress.kubernetes.io/cors-allow-credentials: "true"
# Security headers
nginx.ingress.kubernetes.io/configuration-snippet: |
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy strict-origin-when-cross-origin always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
# Health check configuration
nginx.ingress.kubernetes.io/health-check-path: "/health"
nginx.ingress.kubernetes.io/health-check-interval: "30s"
nginx.ingress.kubernetes.io/health-check-timeout: "10s"
# Load balancing
nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
nginx.ingress.kubernetes.io/session-cookie-name: "context-store-session"
nginx.ingress.kubernetes.io/session-cookie-max-age: "3600"
spec:
tls:
- hosts:
- api.contextstore.example.com
- contextstore.example.com
secretName: context-store-tls
rules:
# Main API domain
- host: api.contextstore.example.com
http:
paths:
# Health check endpoint (no rate limiting)
- path: /health
pathType: Prefix
backend:
service:
name: context-store-service
port:
number: 3000
# API endpoints
- path: /api
pathType: Prefix
backend:
service:
name: context-store-service
port:
number: 3000
# Root path
- path: /
pathType: Prefix
backend:
service:
name: context-store-service
port:
number: 3000
# Secondary domain (redirect to main)
- host: contextstore.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: context-store-service
port:
number: 3000
---
# Staging environment ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: context-store-staging-ingress
namespace: context-store-staging
labels:
app: persistent-context-store
component: ingress
environment: staging
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/rewrite-target: /
cert-manager.io/cluster-issuer: "letsencrypt-staging"
nginx.ingress.kubernetes.io/ssl-redirect: "true"
# Staging-specific configuration
nginx.ingress.kubernetes.io/rate-limit: "500"
nginx.ingress.kubernetes.io/rate-limit-window: "1m"
nginx.ingress.kubernetes.io/configuration-snippet: |
add_header X-Environment "staging" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;
spec:
tls:
- hosts:
- staging-api.contextstore.example.com
secretName: context-store-staging-tls
rules:
- host: staging-api.contextstore.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: context-store-service
port:
number: 3000
---
# Internal ingress for monitoring and admin
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: context-store-internal-ingress
namespace: context-store
labels:
app: persistent-context-store
component: internal-ingress
annotations:
kubernetes.io/ingress.class: "nginx"
nginx.ingress.kubernetes.io/rewrite-target: /
# Internal access only
nginx.ingress.kubernetes.io/whitelist-source-range: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
# Basic auth for admin endpoints
nginx.ingress.kubernetes.io/auth-type: basic
nginx.ingress.kubernetes.io/auth-secret: context-store-auth
nginx.ingress.kubernetes.io/auth-realm: "Context Store Admin"
spec:
tls:
- hosts:
- internal.contextstore.example.com
secretName: context-store-internal-tls
rules:
- host: internal.contextstore.example.com
http:
paths:
# Admin endpoints
- path: /admin
pathType: Prefix
backend:
service:
name: context-store-service
port:
number: 3000
# Metrics endpoint
- path: /metrics
pathType: Prefix
backend:
service:
name: context-store-metrics
port:
number: 3000
# Performance monitoring
- path: /performance
pathType: Prefix
backend:
service:
name: context-store-service
port:
number: 3000
---
# Basic auth secret for internal access
apiVersion: v1
kind: Secret
metadata:
name: context-store-auth
namespace: context-store
labels:
app: persistent-context-store
component: auth
type: Opaque
data:
# Generated with: htpasswd -c auth admin
# Username: admin, Password: change-me-in-production
auth: YWRtaW46JGFwcjEkSDY1dnl2TzAkSzRnbC4wUmpNQy9LR2QuVEd6bTBNMAo=
