November 3, 2023 By Brad Manning
Shenzhe Duan
Lucas Copi
Theodora Cheng
5 min read

When scaling up the number of applications you manage, it can feel like there are a lot of moving parts to ensure that your APIs are going through to the right applications in a secure manner.

To make this easier, IBM Cloud® Kubernetes exposes various API integrations, which are already available through the command line interface (CLI) and Terraform.

We are excited to announce that these features are now accessible through the user interface (UI).

An overview of Ingress

First, let’s review the relevant Ingress components.

When clients send requests to an endpoint, the traffic is directed from the domain to the respective load balancer. The load balancer forwards these requests to the Ingress controller, where they undergo request termination using a transport layer security (TLS) secret. A “secret” stores sensitive data, such as a password, authentication token, key or certificate. These requests are then distributed across the available service pods.

Our suite of managed integrations offers APIs to automate cluster setup and management:

  1. Domains: Link a custom domain to your cluster’s load balancer by using (CIS). This integration ensures automatic renewal of corresponding TLS certificates.
  2. Ingress Controller Application Load Balancers (ALB): Manage your ALBs with features such as version control, custom configurations, and both horizontal and vertical scaling capabilities.
  3. Secrets: Securely store managed TLS certificates and secrets in your instance, with automatic synchronization to your Kubernetes secrets.

The table outlines the actions available for each API. Use these actions to streamline your cluster management.

DomainsALBSecrets
DefaultEstablish a default Ingress domain. The default domain is automatically updated with the load balancer addresses for your public ALBs or Red Hat® OpenShift® routers.An ALB is automatically created for each public zone in the cluster. ALBs are automatically updated to the latest versions to keep your cluster up to date and protected. The ALB update policies can be configured following this guide.Establish a default Secrets Manager instance for the storage of TLS certificates generated for managed domains.
CreateRegister a domain to a load balancer using CIS, Cloudflare or Akamai.Create an ALB. This will provision a load balancer service and an ALB instance.Register a secret that facilitates automatic synchronization between a Secrets Manager secret and a Kubernetes secret.
ReadGet a list of domains or specific information about a domain.Get a list of ALBs or specific information about an ALB.Get a list of secrets or specific details about a particular secret.
UpdateUpdate the configuration of a domain.Update an ALB version for a specific ALB. This action is only available if ALB autoupdate is disabled for the cluster.Update the Kubernetes secret definition by adding or removing fields or updating the referenced Secrets Manager CRN for a TLS secret. Sync the values in the Kubernetes secret with the values stored in the corresponding Secrets Manager secret.
DeleteDelete a domain. This will delete the corresponding domain name system (DNS) record and the TLS certificates will no longer continue to be renewed.Delete an ALB. The load balancer service and ALB instance will be removed.  Delete a secret. This will remove the corresponding Kubernetes secret from the cluster.
ReferencesUI and CLICLI and Terraform  CLI and Terraform—Instance, TLS Secret and Opaque Secret
Scroll to view full table

Configuring a multi-tenant microservices environment in IBM Cloud

Let’s dive into a practical scenario. Imagine you’re assigned the task of configuring a multi-tenant environment within IBM Cloud to support a new product built on a microservices architecture, catering to various teams. The architecture is best depicted in the following high-level diagram.

Each team operates distinct microservices that serve specific components. These services are deployed within individual team namespaces, with “echo” representing one team’s namespace and “foxtrot” dedicated to another. You’ve implemented a production cluster to make services accessible to users. After careful consideration, you’ve decided that employing an Ingress Controller — specifically an ALB — is the optimal choice to serve as the API gateway for your team’s requirements.

The “echo” team has reached out for your assistance in establishing a new microservice to be accessible in the production environment via any requests at the “echo” endpoint at techcorp.com/echo/*. The application is currently operational within the “echo” namespace, exposed behind the “echo” service. In this example, we’ll examine the configuration of an Ingress resource to understand how to securely expose this API endpoint within your cluster.

> kubectl get ingress echo-ingress -o yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: public-iks-k8s-nginx // 2. ALB
  generation: 1
  name: echo-ingress
  namespace: echo-namespace
spec:
  rules:
  - host: techcorp.com // 1. Domain
    http:
      paths:
      - backend:
          service:
            name: echo-service
            port:
              number: 8080
        path: /echo
        pathType: Prefix
  tls:
  - hosts:
    - techcorp.com
    secretName: echo-secret // 3. Secret

Begin by navigating to your IBM Cloud clusters and selecting the correct cluster to access the cluster overview page. Note the cluster-wide default Ingress configurations.

From the left-hand navigation menu, select the “Ingress” tab. Note that all your Ingress components in the overview page are currently healthy.

Now, follow these steps:

1. Set up the domain for your Ingress host. If you have already set up a CIS instance and have an active domain (for guidance on creating one, refer to this getting started guide), configure the necessary service-to-service IAM authorization and designate it as the default domain for your cluster. This ensures that all future ALB changes are automatically reflected in your domain configuration and will generate managed TLS certificates.

2. Navigate to the ALBs tab and locate an enabled public ALB. Verify that the Ingress class in the Ingress resource maps to the managed ALB. Verify that the “autoupdate” feature is enabled by default by attempting to run Update version. This will allow you to promptly address any known vulnerabilities. If this is a private application, you can enable a private ALB and link it to your domain.

3. The “echo-secret” needs to live in the “echo-namespace”. Navigate to the secrets tab and take note of the “techcorp” TLS secret. To copy the managed TLS secret into the “echo-namespace”, create a secret in the “echo-namespace”. Note: If a secret ID doesn’t exist within the secret detail, ensure that a default instance is registered.

4. Test the techcorp.com/echo endpoint and confirm that the application is correctly exposed at the “echo” endpoint.

5. Configure monitoring for your ALB traffic (refer to the setup monitoring guide), which enables you to monitor the load and traffic on your ALB, facilitating informed decisions regarding scaling.

With everything configured in the cluster, you are now ready to start serving your users.

Join the conversation

This blog post serves as a primer to showcase the benefits and functionality of using these integrations in the UI. Hopefully it helped you gain an understanding around the capabilities in the UI regarding your Ingress resources. If you have questions, you can engage our team by registering here and joining the discussion in the “#general” channel on our public IBM Cloud Kubernetes Service Slack.

Run Kubernetes at enterprise scale
Was this article helpful?
YesNo

More from Cloud

IBM Cloud Virtual Servers and Intel launch new custom cloud sandbox

4 min read - A new sandbox that use IBM Cloud Virtual Servers for VPC invites customers into a nonproduction environment to test the performance of 2nd Gen and 4th Gen Intel® Xeon® processors across various applications. Addressing performance concerns in a test environment Performance testing is crucial to understanding the efficiency of complex applications inside your cloud hosting environment. Yes, even in managed enterprise environments like IBM Cloud®. Although we can deliver the latest hardware and software across global data centers designed for…

10 industries that use distributed computing

6 min read - Distributed computing is a process that uses numerous computing resources in different operating locations to mimic the processes of a single computer. Distributed computing assembles different computers, servers and computer networks to accomplish computing tasks of widely varying sizes and purposes. Distributed computing even works in the cloud. And while it’s true that distributed cloud computing and cloud computing are essentially the same in theory, in practice, they differ in their global reach, with distributed cloud computing able to extend…

How a US bank modernized its mainframe applications with IBM Consulting and Microsoft Azure

9 min read - As organizations strive to stay ahead of the curve in today's fast-paced digital landscape, mainframe application modernization has emerged as a critical component of any digital transformation strategy. In this blog, we'll discuss the example of a US bank which embarked on a journey to modernize its mainframe applications. This strategic project has helped it to transform into a more modern, flexible and agile business. In looking at the ways in which it approached the problem, you’ll gain insights into…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters