Ingresses and Ingress Controllers

Operation, configuration, monitoring and management of the cluster ingress controller that ESS Pro uses is entirely the responsibility of the cluster administrators of the cluster ESS Pro is being installed into.

Annotations

ESS Pro provides the ability to configure Ingress annotations both globally or on a per-Ingress basis so that ingress controller specific configuration can be passed through.

e.g.

ingress:
  annotations:
    traefik.ingress.kubernetes.io/router.tls.options: "traefik-tls13@kubernetescrd"

Would configure all Ingresses managed by ESS with that annotation with a Traefik specific annotation to use a specific TLSOptions configuration.

However, e.g.

elementWeb:
  ingress:
    annotations:
      nginx.ingress.kubernetes.io/ssl-redirect: "true"

Would configure just the Element Web Ingress to do a HTTP -> HTTPS redirect using an ingress-nginx specific annotation but leave all other Ingresses alone.

The available set of annotations and their values depends entirely on the ingress controller used in your cluster.

Ingress Class Names

ESS Pro also provides the ability to configure the ingressClassName either globally or on a per-Ingress basis so that the exact ingress controller being used can be specified. e.g.

ingress:
  className: traefik-public

elementAdmin:
  ingress:
    className: traefik-vpn

The exact IngressClasses available in your cluster will vary depending on what ingress controllers your cluster administrator has installed and how they have configured them.

If no configuration is provided, ESS Pro uses the the default IngressClass (the one annotated with ingressclass.kubernetes.io/is-default-class: "true").

TLS

ESS Pro provides several options to allow you to provide and manage TLS certificates for each Ingress.

Existing certificate in cluster

An existing certificate in a Secret in the cluster can be used for a given Ingress:

synapse:
  ingress:
    tlsSecret: name-of-secret-containing-certificate

Alternatively if you have a wildcard certificate covering all the hostnames in use, it could be configured globally:

ingress:
  tlsSecret: name-of-secret-containing-wildcard

Using cert-manager

cert-manager is a common way of managing TLS certificates in a Kubernetes cluster.

When using cert-manager the name of a ClusterIssuer or an Issuer in the same namespace is provided

certManager:
  clusterIssuer: name-of-existing-clusterissuer
  # OR
  issuer: name-of-issuer

This is applied to all Ingresses managed by ESS Pro if an existing TLS Secret isn't configured.

TLS terminated outside of the cluster

In some setups the ingress controller in the cluster does not terminate TLS and it is terminated upstream, outside of the cluster.

ESS Pro can be configured to omit the TLS Secret on its Ingresses in these setups:

ingress:
  tlsEnabled: false