From bb69db804176c95e0e0113af1229d2b253906aa2 Mon Sep 17 00:00:00 2001 From: ahmza Date: Thu, 3 Sep 2026 04:44:41 +0100 Subject: [PATCH] Route demo app through Ingress at demo.ahmza.com --- apps/demo/ingress.yaml | 28 ++++++++++++++++++++++++++++ apps/demo/service.yaml | 22 ++++++---------------- docs/network.md | 25 ++++++++++++++++++++----- 3 files changed, 54 insertions(+), 21 deletions(-) create mode 100644 apps/demo/ingress.yaml diff --git a/apps/demo/ingress.yaml b/apps/demo/ingress.yaml new file mode 100644 index 0000000..678b1bf --- /dev/null +++ b/apps/demo/ingress.yaml @@ -0,0 +1,28 @@ +# Routes requests for demo.ahmza.com through ingress-nginx (docs/11-ingress.md) +# to the demo Service's ClusterIP, on ingress-nginx's one shared address +# (10.10.60.12) instead of this app having its own dedicated MetalLB address. +# +# No ingressClassName is set here because apps/ingress-nginx/values.yaml +# marks its IngressClass as this cluster's default — the same "don't repeat +# yourself" convenience Longhorn gives PVCs that don't name a +# storageClassName. +# +# No TLS yet — see docs/12-cert-manager.md for adding a real HTTPS +# certificate for this exact hostname. +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: demo + namespace: demo +spec: + rules: + - host: demo.ahmza.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: demo + port: + number: 80 diff --git a/apps/demo/service.yaml b/apps/demo/service.yaml index 9436eee..9f7dbe5 100644 --- a/apps/demo/service.yaml +++ b/apps/demo/service.yaml @@ -3,28 +3,18 @@ # time. This Service selects any Pod labelled app: demo (see # deployment.yaml) and forwards traffic to it. # -# type: LoadBalancer asks the cluster for a real, dedicated IP address that -# anything on your network can reach directly. On a cloud provider that -# would provision an actual cloud load balancer; on bare metal there's -# nothing to provision it, which is exactly the gap MetalLB -# (apps/metallb.yaml) fills — it watches for LoadBalancer Services and -# hands them an address from the pool configured in -# apps/metallb/templates/ipaddresspool.yaml. Until that pool exists, this -# Service's address will show as ; see docs/05-metallb.md. +# type is omitted here, so Kubernetes defaults to ClusterIP — reachable +# only from inside the cluster, no dedicated address of its own. That's +# deliberate now: docs/11-ingress.md routes this app through ingress-nginx's +# one shared address (10.10.60.12) by hostname instead, via ingress.yaml +# in this same folder. Compare with apps/whoami/service.yaml (deleted, but +# see docs/08) for what a dedicated type: LoadBalancer Service looked like. apiVersion: v1 kind: Service metadata: name: demo namespace: demo - annotations: - # Requests this specific address from MetalLB's pool, so it stays - # predictable across rebuilds instead of getting whatever's next free. - # Must fall inside the range in - # apps/metallb/templates/ipaddresspool.yaml, or MetalLB will never - # satisfy the request. - metallb.io/loadBalancerIPs: "10.10.60.11" spec: - type: LoadBalancer selector: app: demo ports: diff --git a/docs/network.md b/docs/network.md index 453b128..a362f79 100644 --- a/docs/network.md +++ b/docs/network.md @@ -49,13 +49,28 @@ This dedicated service range is advertised to the MikroTik at | Address | What | Namespace | Port(s) | URL | Source | |---|---|---|---|---|---| | `10.10.60.10` | Argo CD UI/API (`argocd-server`) | `argocd` | 443 | `https://10.10.60.10` | Patched to `LoadBalancer` by hand — see [`docs/05-metallb.md`](05-metallb.md) | -| `10.10.60.11` | Demo app | `demo` | 80 | `http://10.10.60.11` | [`apps/demo/service.yaml`](../apps/demo/service.yaml) | | `10.10.60.12` | ingress-nginx (shared, routes by hostname) | `ingress-nginx` | 80, 443 | `http://10.10.60.12`, `https://10.10.60.12` | [`apps/ingress-nginx/values.yaml`](../apps/ingress-nginx/values.yaml) — see [`docs/11-ingress.md`](11-ingress.md) | -Add a row here every time you add a new app with a `LoadBalancer` Service -(see [`docs/08-adding-new-apps.md`](08-adding-new-apps.md)). Leave the URL -column's port number off only when it's the protocol default (80 for -`http://`, 443 for `https://`) — include it otherwise. +Add a row here every time you add a new app with its own dedicated +`LoadBalancer` Service (see [`docs/08-adding-new-apps.md`](08-adding-new-apps.md)). +Most apps should route through ingress-nginx by hostname instead — see the +table below — and only need a dedicated address if they can't speak HTTP +(a raw TCP service, for example). Leave the URL column's port number off +only when it's the protocol default (80 for `http://`, 443 for `https://`) +— include it otherwise. + +## Hostnames routed through ingress-nginx + +Every real DNS record pointing at ingress-nginx's shared address +(`10.10.60.12`), and which app it reaches. All hosted on Cloudflare. + +| Hostname | App | Namespace | TLS | Source | +|---|---|---|---|---| +| `demo.ahmza.com` | Demo app | `demo` | Not yet — see [`docs/12-cert-manager.md`](12-cert-manager.md) | [`apps/demo/ingress.yaml`](../apps/demo/ingress.yaml) | + +Add a row here every time you point a new hostname at this cluster (see +[`docs/11-ingress.md`](11-ingress.md)). The DNS record itself lives in +Cloudflare, not in this repo — this table is just the log of what's real. ## Free in the pool