Policies for Kubernetes Nginx Ingress Controller Running in Host-network Mode
Secure Workload enforces policies both at the nginx ingress controller and at the backend pods when the pods are exposed to the external clients using Kubernetes ingress object.
|
If the ingress controller is not running in host network mode refer IngressControllerAPI |
|
|
IBM-ICP uses Kubernetes Nginx Ingress controller by default and runs on control plane nodes in host network mode. |
Following are the steps to enforce the policy using the Kubernetes Nginx Ingress controller.
Procedure
| 1 |
Create an external orchestrator for Kubernetes/OpenShift as described here. 
|
| 2 |
Create an ingress object in the Kubernetes cluster. A snapshot of the yaml file used to create the ingress object is provided in the following picture. 
|
| 3 |
Deploy Kubernetes Nginx Ingress controller in the Kubernetes cluster. IBM-ICP Ingress controller pods are running on control plane nodes by default. 
|
| 4 |
Create a backend service which will be accessed by the consumers outside the cluster. In the example provided below we have created a simple svc-ce2e-teeksitlbiwlc (http-echo) service. 
|
| 5 |
Create a policy between external consumer and backend service. 
|
| 6 |
When you are ready, enforce the policy. |
| 7 |
In case of Nginx ingress controller Secure Workload software applies the appropriate allow/drop rule where the source will be consumer specified in the above step and destination will be corresponding Ingress controller pod IP. In case of backend pods, Secure Workload software will apply the appropriate allow/drop rule where the source will be Ingress pod and destination will be the backend pod IP. |