You can enable or disable regular expression matching of the Ingress
path
(but not
host
) parameter using the annotation
ncp/use-regex
. If set to
false
, exact path matching will be performed by doing the
equals
match. If set to
true
, regular expression matching will be performed by adding the start of string character (^) and end of string character ($) to the path so that the entire request URI matches the pattern. Note that when using the
OR
operator (|), always specify the scope with parentheses so that ^ and $ apply to all the operands. For example,
path: /(tea|coffee|milk)
. An Ingress specification example:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    kubernetes.io/ingress.class: "nsx"
    #/tea/cup will be served by tea-svc:80
    ncp/use-regex: "True"
spec:
  rules:
  - host: cafe.example.com
    http:
      paths:
      # for this tea and coffee NCP will configure regex rule
      - path: /tea/(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee/(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80
      # for juice and alcohol NCP will configure Exact and Prefix rules
      - path: /juice
        pathType: Exact
        backend:
          service:
            name: juice-svc
            port:
              number: 80
      - path: /alcohol
        pathType: Prefix
        backend:
          service:
            name: bar
              number: 80
Updating Ingresses prior to upgrading NCP
This is required only if you have Ingresses requiring all sub-path matching using the characters '.' and '*'.
Update the Ingresses to include the annotation
ncp/use-regex: true
.
For all sub-path matching, if you have paths such as
/coffee/*
or
/*
, change them to
/coffee/.*
and
/.*
.
/coffee/.*
will match
/coffee/
,
/coffee/a
,
/coffee/b
,
/coffee/a/b
, and so on.
/.*
will match
/coffee
,
/tea
,
/coffee/a
, and so on. Omitting the path will produce the same behavior as
path: /.*
.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    kubernetes.io/ingress.class: "nsx"
    ncp/use-regex: "true"
    #/tea/cup will be rewritten to /cup before sending request to endpoint
    ingress.kubernetes.io/rewrite-target: /$1
spec:
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /tea/(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee/(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

If the annotation is set to
false
, rules will be created for the HTTPS virtual server.
If the annotation is set to
true
or missing, rules will created for both HTTP and HTTPS virtual servers. Note that HTTPS rules will be created only if the TLS section is present in the Ingress specification.

If the annotation is set to
false
, Incoming HTTP traffic (port 80) to HTTP Virtual Server will not be redirected to HTTPS Virtual Server.
If the annotation is set to
true
, Incoming HTTP traffic (port 80) to HTTP Virtual Server will be redirected to HTTPS Virtual Server (port 443).

If the value is
nsx
, this ingress will be handled by NCP. If any other value is specified, the Ingress will be ignored by NCP. For more info see Third-party Ingress Controllers.

Supported in Policy mode only.

When set, an incoming request will only be accepted if its source IP is included in this annotation. Otherwise, traffic will be dropped.

You can specify a combination of CIDR, IP addresses, and IP ranges. For example, 1.1.1.1/24, 2.2.2.2, 3.3.3.3-4.4.4.4.

YAML example:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    kubernetes.io/ingress.class: "nsx"
    #Source IP addresses allowed to access ingress URL
    ncp/allowed-source-range: "192.168.128.0/17, 192.168.64.0-192.168.64.255, 192.168.16.32"
spec:
  tls:
  - hosts:
    - cafe.example.com
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

Supported in Policy mode only.

This annotation applies to all the rules in an Ingress and the load balancer will operate in the selected SSL mode for these rules.

If

ncp/ssl-mode

is set to

reencrypt

or

passthrough

,

kubernetes.io/ingress.allow-http

must be set to

False

. This annnotation cannot be set to

passthrough

if the

ingress.kubernetes.io/rewrite-target

,

ncp/use-regex

or

ncp/allowed-source-range

annotation is set.

If

ncp/ssl-mode

is set to

passthrough

, the attribute

path

in the

rules

specification is not supported.

YAML example for SSL mode

reencrypt

:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  namespace: qe
  annotations:
    kubernetes.io/ingress.class: "nsx"
    kubernetes.io/ingress.allow-http: "False"
    ncp/ssl-mode: "reencrypt"
    ingress.kubernetes.io/rewrite-target: "/$1"
    ncp/use-regex: "true"
spec:
  tls:
  - hosts:
    - cafe.example.com
    secretName: cafe-secret
  defaultBackend:
    service:
      name: default-svc
      port:
        number: 443
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /fo{2}/[abc]+(r|R)/(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 443
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 443

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    kubernetes.io/ingress.class: "nsx"
    #Loadbalancer in passthrough mode
    ncp/ssl-mode: "passthrough"
spec:
  tls:
  - hosts:
    - cafe.example.com
  rules:
  - host: cafe.example.com
    http:
      paths:
      - backend:
          service:
            name: tea-svc
            port:
              number: 443
        pathType: ImplementationSpecific

To enable JWT client authentication for all rules under an Ingress, both
ncp/jwt-alg
and
ncp/jwt-secret
need to be set to a valid value. When enabled, incoming HTTP traffic will only be passed to the backend if bearing valid JSON web token. Otherwise, traffic will be rejected with the 401 status.
This feature is incompatible with the following annotations:
kubernetes.io/ingress.allow-http: true
ncp/http-redirect: true
ncp/ssl-mode: passthrough
ncp/jwt-alg
:
Supported symmetrical algorithms: HS256
Supported asymmetrical algorithms: RS256
ncp/jwt-secret
:
A symmetrical key or public certificate must be configured in a Kubernetes secret with the name specified in this annotation under the same namespace as the Ingress.
For symmetrical algorithms, the secret must be stored in the
jwt.key
field.
For asymmetrical algorithms, the public cert must be stored in the
tls.crt
field.
JWT client authentication will be disabled if the symmetrical secret or public certificate is not stored in the locations mentioned above, or if the data stored in the secret is invalid.
ncp/jwt-token
:
Only one item can be configured in this annotation.
_arg_<param_name>
: For JWT passed in as a URI parameter. Specify the parameter name that contains JWT.
_cookie_<cookie_name>
: For JWT passed in as a cookie. Specify the cookie name that contains JWT.

TCP multiplexing cannot coexist with HTTP NTLM. In NSX, if if a load balancer pool with TCP multiplxing enabled is bound to an NTLM-enabled layer-7 server, the NTLM configuration will take precedence over TCP multiplexing.

YAML example:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    ncp/connection_multiplexing_enabled: "true"
    ncp/connection_multiplexing_number: 100
spec:
  tls:
  - hosts:
    - cafe.example.com
  rules:
  - host: cafe.example.com
    http:
      paths:
      - path: /tea
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee
        backend:
          service:
            name: coffee-svc
            port:
              number: 80