Ingress

If you have an Ingress Controller that supports Passthrough TLS, you can access a LittleHorse Cluster using the spec.server.listeners[].infrastructure.ingress field.

tip

Many Ingress controllers, such as NGINX, do not support both TLS Passthrough and TLS Termination on the same port. Most users of Ingress don't use TLS Passthrough. This unfortunately means that if you wish to use Ingress to allow external traffic into your LittleHorse Clusters, you will likely need to deploy a separate Ingress Controller.

You will need:

1. An Ingress Controller with TLS Passthrough enabled, and the name of the relevant IngressClass.
2. A listener with TLS configured as per our docs.

Creating Ingress Resources

An example LHCluster using Ingress is shown below.

apiVersion: littlehorse.io/v1
kind: LHCluster
metadata:
  name: basic-ingress
  namespace: littlehorse
spec:
  server:
    listeners:
    - name: external
      infrastructure:
        ingress:
          ingressClassName: my-passthrough
          ingressAnnotations:
            nginx.ingress.kubernetes.io/backend-protocol: "GRPCS"
            nginx.ingress.kubernetes.io/ssl-passthrough: "true"
      advertisedListeners:
        serverHostSuffix: ".test.littlehorse.cloud"
      port: 2443
      tls:
        # specified as per our docs...
        # ...
  # ...

Note that the ingressClassName should match the name of the IngressClass reconciled by your Passthrough TLS controller.

This will result in the Operator creating:

• An Ingress that is configured for bootstrap.test.littlehorse.cloud which round-robins across all LittleHorse Kernel instances.
• An Ingress resource for each LittleHorse Kernel instance at lh-X.test.littlehorse.cloud (where X is the LittleHorse Kernel Instance number).

tip

For NGINX, it is required to set the nginx.ingress.kubernetes.io/backend-protocol and nginx.ingress.kubernetes.io/ssl-passthrough annotations as we did in our example. For other Ingress Controllers, please consult their documentation.