How to setup multiple Ingresses for the same domain but with different ports

[hahahannes]

Hi,

I run an old version of the ingress controller and have two ingresses for the same host domain but they run with different ports (e.g. both ingresses run on foo.bar but on ports 8096 and 8097). As this will cause a host name collision, I cannot use it anymore. I thought to use the mergeable ingresses with a master and minion ingress but there the nginx.org/listen-ports-ssl is not allowed for minion ingresses. What is the supposed configuration for this usecase.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: foo
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.org/listen-ports-ssl: "8096"
spec:
  tls:
    - hosts:
        - foo.bar
      secretName: tls
  rules:
    - host: foo.bar
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: foo
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.org/listen-ports-ssl: "8097"
spec:
  tls:
    - hosts:
        - foo.bar
      secretName: tls
  rules:
    - host: foo.bar

[brianehlert]

According to the documentation listen_ports and listen_ports_ssl are arrays.
https://docs.nginx.com/nginx-ingress-controller/configuration/ingress-resources/advanced-configuration-with-annotations/#listeners

I have not tried this, but you should be able to have one hosts entry and define both ports with a single annotation in the same Master Ingress (or single Ingress if not doing master/minion).

In the master / minion model, the master always holds the hostname. And the minions are individual paths that get unique settings.

[hahahannes]

Ah, I see that the ingress ressources dont have the port specified :/ Might it be possible to make the host name collision check optional?

[brianehlert]

I see where you are going with the #3313 comment.
NGINX will always perform the hostname check it isn't necessarily something in the controller logic.
There is probably a way to do this, we just have to find it.

[hahahannes]

In case someone else stumbles across this. We switched to Istio. Here is an example replacement for an ingress

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: gateway
spec:
  hosts:
    - '*'
  gateways:
    - gateway
  http:
    - match:
        - port: 1234
      route:
        - destination:
            host: foo-server
            port:
              number: 8080

[jasonwilliams14]

@hahahannes You can use snippets to add another port to the virtualServer. You can use something like the following:

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: cafe
spec:
  host: cafe.example.com
  tls:
    secret: cafe-secret
  server-snippets: |
    listen 8081;

That will add 8081 to the cafe.example.com server block.

The full example:

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: cafe
spec:
  host: cafe.example.com
  tls:
    secret: cafe-secret
  server-snippets: |
    listen 8081;
  upstreams:
  - name: tea
    service: tea-svc
    port: 80
  - name: coffee
    service: coffee-svc
    port: 80
  routes:
  - path: /tea
    action:
      pass: tea
  - path: /coffee
    action:
      pass: coffee

Our host field also supports wildcards:

https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/

HTH

[hahahannes]

Hi @jasonwilliams14 Thank you very much for your help! I think I can not apply your solution to our usecase. We want to route traffic going to one domain cafe.example.com but to different ports 8081 and 8082. But we also dont want to route per path like in your example with path: /tea, because we deploy several tools behind the ports like UIs where we cant deal with different base URLs that are caused by this path based routing.

[hahahannes]

I can understand that most ingress controllers are desgined to handle the standard http/https ports. But in our case, this port based routing was the most comfortable way. A subdomain based routing was not possible unfortunately because of some institutional reasons (the application is deployed in an internal network, we dont get wildcard certificates and the process is very cumbersome when you have lots of subdomains)

[hihoak]

@hahahannes you can deploy different ingress classes to your cluster.

for example 3 containers in one pod of nginx ingress controller with different ingress-class

• debug
• http
• grpc

and after that you can create 3 different VirtualServer with different ingressClassName what makes possible to you use same path /