Configure Nginx Ingress

An ingress controller is required for external access to the Kloudfuse cluster. For HTTPS and TLS configuration, see HTTPS/TLS Setup.

X-Request-ID Forwarding

The bundled ingress-nginx controller forwards a request-correlation header to Kloudfuse automatically. If you disable it (see the Disable option below) and run your own NGINX controller — for example the standalone setup in Standalone Nginx Ingress — you must reproduce this configuration yourself.

Kloudfuse expects every request that reaches its services to carry an X-Request-ID header, and its authentication subrequest relies on the same header. The bundled ingress-nginx controller is configured to do this automatically. A NGINX controller that you manage yourself is not — without the configuration below the header can arrive empty, and the Kloudfuse services that depend on it fail to resolve it.

If you run your own NGINX ingress configuration, add the following to the controller so it preserves an incoming X-Request-ID (or generates one when the header is missing) and forwards it to every backend:

 
controller:
  # Forward X-Request-ID to all backends.
  proxySetHeaders:
    X-Request-ID: $kf_req_id
  config:
    # Keep generate-request-id at its default ("true"). The built-in $req_id is
    # used by the auth subrequest and error pages; disabling it leaves those with
    # an empty X-Request-ID when the incoming header is missing.
    generate-request-id: "true"
    http-snippet: |
      # Preserve incoming X-Request-ID; generate one (via the core $request_id,
      # which is always present) when the header is missing.
      map $http_x_request_id $kf_req_id {
        default $http_x_request_id;
        ""      $request_id;
      }
yaml

Ingress Internal Annotations

By default, the ingress internal service is disabled. If you enable it, you must annotate it with cloud-specific values.

Include one of these configurations in your custom_values.yaml file:

The internal ingress service must be annotated with Google’s load balancer information.

Update the custom_values.yaml with this configuration:

ingress-nginx:
  controller:
    service:
      internal:
        enabled: true
        annotations:
          networking.gke.io/load-balancer-type: "Internal"
          cloud.google.com/load-balancer-type: "Internal"
yaml