ingress-auth.yaml

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: ingress-fanout-auth
  annotations:
    # basic auth:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: htsecret
    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"

    nginx.ingress.kubernetes.io/rewrite-target: /

    ### rate limiting
    ### N.B. doesn't work for clusterip services?
    ### externalTrafficPolicy: Local - LoadBalancer and NodePort OK
    ### See: https://github.com/kubernetes/kubernetes/issues/62537#issuecomment-381944569
    ### Also see: https://kubernetes.io/docs/tutorials/services/source-ip/
    # nginx.ingress.kubernetes.io/limit-connections: "100"
    # nginx.ingress.kubernetes.io/limit-rpm: "100"
    # nginx.ingress.kubernetes.io/limit-rps: "5"

    ### nginx rate limiting
    # See: https://stackoverflow.com/questions/54042445/set-limit-req-for-specific-location-in-nginx-ingress
    # Also see: https://www.nginx.com/blog/rate-limiting-nginx/
    http-snippet: |
      map $uri $with_limit_req {
        default 0;
        "~*^/auth$" 1;
      }
      map $with_limit_req $auth_limit_req_key {
        default '';
        '1'     $binary_remote_addr;   # the limit key
      }
      limit_req_zone $binary_remote_addr zone=mylimit:10m rate=5r/s;   # 10 MB cache, 5 requests/sec
      #add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; frame-src 'self'; object-src 'none'";
      nginx.ingress.kubernetes.io/configuration-snippet: |
        limit_req zone=mylimit nodelay;
        # additional headers:
        # TODO - check
        more_set_headers X-XSS-Protection "1; mode=block";

spec:
  rules:

  #rexsystems (0000)
  - host: dev.web.0000.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: rexsystems-web-dev
          servicePort: 3000
      - path: /api
        backend:
          serviceName: rexsystems-api-dev
          servicePort: 8090
  - host: dev.api.0000.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: rexsystems-api-dev
          servicePort: 8090


  #rexapp (0001)
  - host: dev.web.0001.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: rexapp-web-dev
          servicePort: 3000
      - path: /api
        backend:
          serviceName: rexapp-api-dev
          servicePort: 8090
  - host: dev.api.0001.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: rexapp-api-dev
          servicePort: 8090

  #ideahopper (0002)
  - host: dev.web.0002.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: ideahopper-web-dev
          servicePort: 3000
      - path: /api
        backend:
          serviceName: ideahopper-api-dev
          servicePort: 8090
  - host: dev.api.0002.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: ideahopper-api-dev
          servicePort: 8090
  - host: uat.web.0002.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: ideahopper-web-uat
          servicePort: 3000
      - path: /api
        backend:
          serviceName: ideahopper-api-uat
          servicePort: 8090
  - host: uat.api.0002.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: ideahopper-api-uat
          servicePort: 8090
  - host: staging.web.0002.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: ideahopper-web-staging
          servicePort: 3000
      - path: /api
        backend:
          serviceName: ideahopper-api-staging
          servicePort: 8090
  - host: staging.api.0002.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: ideahopper-api-staging
          servicePort: 8090


  #jenkins
  - host: jenkins.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: jenkins
          servicePort: 8080

  #sonarqube
  - host: sonarqube.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: sonarqube
          servicePort: 9000

  #artifactory
  - host: artifactory.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: artifactory
          servicePort: 80

  #kibana
  - host: kibana.rexsystems.co.uk
    http:
      paths:
      - path: /
        backend:
          serviceName: kibana
          servicePort: 5601

  tls:
  - secretName: tls-secret-dev-web-0000-rexsystems-co-uk
  - secretName: tls-secret-dev-api-0000-rexsystems-co-uk
  - secretName: tls-secret-dev-web-0001-rexsystems-co-uk
  - secretName: tls-secret-dev-api-0001-rexsystems-co-uk
  - secretName: tls-secret-dev-web-0002-rexsystems-co-uk
  - secretName: tls-secret-dev-api-0002-rexsystems-co-uk
  - secretName: tls-secret-uat-web-0002-rexsystems-co-uk
  - secretName: tls-secret-uat-api-0002-rexsystems-co-uk
  - secretName: tls-secret-staging-web-0002-rexsystems-co-uk
  - secretName: tls-secret-staging-api-0002-rexsystems-co-uk
  - secretName: tls-secret-jenkins-rexsystems-co-uk
  - secretName: tls-secret-sonarqube-rexsystems-co-uk
  - secretName: tls-secret-artifactory-rexsystems-co-uk
  - secretName: tls-secret-kibana-rexsystems-co-uk