You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* **type**: – select the Endpoint type, possible options are `ingress`, `openshiftRoute` and `service`; this parameter is also configured through the **Configuration Tool**
324
-
* **ingress**: - specify the Ingress configuration, required when **type** is set to `ingress`
325
-
* **openshiftRoute**: - specify the OpenShift Route configuration, required when **type** is set to `openshiftRoute`
326
-
* **annotations**: - optional, can be used to specify the Ingress or OpenShift Route annotations, can be a template: `{{.Name}}` will be replaced with the name of the CR for the Mendix app, and {{.Domain}} will be replaced with the application's domain name
327
-
* **serviceAnnotations**: - optional, can be used to specify the Service annotations, can be a template: `{{.Name}}` will be replaced with the name of the CR for the Mendix app, and {{.Domain}} will be replaced with the application's domain name
328
-
* **ingressClassName**: - optional, can be used to specify the Ingress Class name
329
-
* **path**: - optional, can be used to specify the Ingress path; default value is `/`
330
-
* **pathType**: - optional, can be used to specify the Ingress pathType; if not set, no pathType will be specified in Ingress objects
331
-
* **domain**: - optional for `openshiftRoute`, required for `ingress`, used to generate the app domain in case no app URL is specified; if left empty when using OpenShift Routes, the default OpenShift `apps` domain will be used; this parameter is also configured through the **Configuration Tool**
332
-
* **enableTLS**: - allows you to enable or disable TLS for the Mendix App's Ingress or OpenShift Route
333
-
* **tlsSecretName**: - optional name of a `kubernetes.io/tls` secret containing the TLS certificate, can be a template: `{{.Name}}` will be replaced with the name of the CR for the Mendix app; if left empty, the default TLS certificate from the Ingress Controller or OpenShift Router will be used
334
-
* **serviceType**: - can be used to specify the Service type, possible options are `ClusterIP` and `LoadBalancer`; if not specified, Services will be created with the `ClusterIP` type
335
-
* **servicePorts**: - can be used to specify a list of custom ports for the Service; if not specified, Services will use be created with port `8080`
219
+
For information on using advanced network configuration settings, see [Network Ingress Settings section](/developerportal/deploy/private-cloud-cluster/private-cloud-ingress-settings/).
336
220
337
221
{{% alert color="info" %}}
338
222
When switching between Ingress and OpenShift Routes, you need to [restart the Mendix Operator](#restart-after-changing-network-cr) for the changes to be fully applied.
@@ -938,6 +822,54 @@ Alternatively, for Standalone clusters, pod labels can be specified in the `Mend
938
822
The Mendix Operator uses some labels for internal use. To avoid conflicts with these internal pod labels, please avoid using labels starting with the `privatecloud.mendix.com/` prefix.
939
823
{{% /alert %}}
940
824
825
+
### Pod Annotations (General) {#pod-annotations}
826
+
827
+
Mendix Operator version 2.27.0 or above allows you to specify default pod annotations for task pods (build and storage provisioners) and runtime (app) pods.
828
+
829
+
To specify the default pod annotations for a namespace, specify them in `customPodAnnotations.general` in `OperatorConfiguration`:
830
+
831
+
```yaml
832
+
apiVersion: privatecloud.mendix.com/v1alpha1
833
+
kind: OperatorConfiguration
834
+
spec:
835
+
# ...
836
+
# Other configuration options values
837
+
# Optional: custom pod annotations
838
+
customPodAnnotations:
839
+
# Optional: general pod annotations (applied to all app-related pods)
840
+
general:
841
+
# Example: use FQDN instead of IP addresses when communicating with the Kubernetes API server
Alternatively, for Standalone clusters, pod annotations for an app can be specified in the `MendixApp` CR.
846
+
847
+
{{% alert color="warning" %}}
848
+
The Mendix Operator uses some annotations for internal use. To avoid conflicts with these internal pod annotations, please avoid using labels starting with the `privatecloud.mendix.com/` prefix.
849
+
{{% /alert %}}
850
+
851
+
### Node Selector (General) {#node-selector}
852
+
853
+
Mendix Operator version 2.27.0 or above allows you to specify the default `nodeSelector` for task pods (build and storage provisioners) and runtime (app) pods.
854
+
855
+
To configure the default pod `nodeSelector` for a namespace, specify them in `customPodNodeSelector.general` in `OperatorConfiguration`:
856
+
857
+
```yaml
858
+
apiVersion: privatecloud.mendix.com/v1alpha1
859
+
kind: OperatorConfiguration
860
+
spec:
861
+
# ...
862
+
# Other configuration options values
863
+
# Optional: custom pod nodeSelector
864
+
customPodNodeSelector:
865
+
# Optional: general pod nodeSelector (applied to all app-related pods)
866
+
general:
867
+
# Example: use Amazon EKS Auto Mode
868
+
eks.amazonaws.com/compute-type: auto
869
+
```
870
+
871
+
Alternatively, for Standalone clusters, pod `nodeSelector` configuration can be specified in the `MendixApp` CR for a specific app.
872
+
941
873
### Delaying App Shutdown {#termination-delay}
942
874
943
875
In some situations, shutting down a replica immediately can cause isses. For example, the [Azure Gateway Ingress Controller](https://azure.github.io/application-gateway-kubernetes-ingress/how-tos/minimize-downtime-during-deployments/) needs up to 90 seconds to remove a pod from its routing table. Stopping an app pod immediately would still send traffic to the pod for a few minutes, causing random 502 errors to appear in the client web browser.
Copy file name to clipboardExpand all lines: content/en/docs/deployment/private-cloud/private-cloud-cluster/networking/_index.md
+18-12Lines changed: 18 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,7 +8,7 @@ weight: 10
8
8
9
9
## Introduction
10
10
11
-
Based on your organization's networking and security needs, you must configure the available networking components of your Mendix web applications to be accessible to end users, either over a private network or the Internet. This article describes three possible network configurations: Kubernetes Ingress, OpenShift Routes, and Service-Only. Each configuration is tailored to meet specific use cases.
11
+
Based on your organization's networking and security needs, you must configure the available networking components of your Mendix web applications to be accessible to end users, either over a private network or the Internet. This article describes three possible network configurations: Kubernetes Ingress, Gateway Routes, OpenShift Routes, and Service-Only. Each configuration is tailored to meet specific use cases.
12
12
13
13
## Prerequisites
14
14
@@ -22,6 +22,8 @@ Mendix on Kubernetes supports the following Ingress configurations:
*[Gateway Routes](/developerportal/deploy/private-cloud-cluster/private-cloud-ingress-settings/gateway-route/) - A next generation Kubernetes standard for Ingresses and load balancing. Supported by Mendix Operator v2.27.0 or later versions.
26
+
25
27
*[OpenShift Routes](/developerportal/deploy/private-cloud-cluster/private-cloud-ingress-settings/openshift/) - The OpenShift-native method for exposing services externally provides a more streamlined setup, though it offers less flexibility compared to Kubernetes Ingress.
@@ -42,17 +44,17 @@ The following table compares the functionality of the three supported options, i
42
44
When switching between Ingress, OpenShift Routes, and Service Only, you must restart the Mendix Operator for the changes to be fully applied.
43
45
{{% /alert %}}
44
46
45
-
| Feature | Kubernetes Ingress | Openshift Routes | Service Only |
46
-
| --- | --- | --- | --- |
47
-
| Ease of use | Requires setup, but offers more flexibility. | Simplest option for OpenShift users, built-in. | Fine-grained control over networking and security offers maximum flexibility, but requires significant effort and expertise to configure and maintain. Note that the networking setup beyond the Mendix Operator's scope, up to the service object, is not supported by Mendix. |
48
-
| Native cloud integration | Can integrate with cloud-native services like AWS Application Load Balancer. | No direct integration with cloud providers. | Full control over networking setup. |
49
-
| Performance and scalability | Scales with cloud load balancers, better supports horizontal scaling. | Limited to OpenShift Router performance. | Full flexibility - scales according to your load balancer and proxy setup. |
| TLS/SSL termination | Can leverage cloud provider-managed TLS; supports Cert-Manager. | Supported with OpenShift's HAProxy router. | Fully flexible but requires manual setup; TLS can terminate at application load balancer, network load balancer, or app level |
52
-
| Security (WAF, ACLs, Auth) | More advanced security integrations (for example AWS Web Application Firewall, authentication). | Basic access control via OpenShift OAuth. | Full control - can integrate with AWS Web Application Firewall, API Gateway, authentication proxies with manual configuration. |
53
-
| Traffic splitting | Fully supported through ingress rules. | Supported through HAProxy-based Route annotations. | Depends on external networking setup. |
54
-
| External DNS support | Some ingress controllers (for example, application load balancers) support native DNS updates. | Requires ExternalDNS integration. | Fully configurable - can use ExternalDNS, Amazon Route 53, or others. |
| Feature | Kubernetes Ingress |Gateway Routes |Openshift Routes | Service Only |
48
+
| --- | --- | --- | --- | --- |
49
+
| Ease of use | Requires setup, but offers more flexibility. |Requires setup, offers flexibility with separation of scope by [roles and personas](https://gateway-api.sigs.k8s.io/docs/concepts/roles-and-personas/)|Simplest option for OpenShift users, built-in. | Fine-grained control over networking and security offers maximum flexibility, but requires significant effort and expertise to configure and maintain. Note that the networking setup beyond the Mendix Operator's scope, up to the service object, is not supported by Mendix. |
50
+
| Native cloud integration | Can integrate with cloud-native services like AWS Application Load Balancer. |Can integrate with cloud-native services like AWS Application Load Balancer. |No direct integration with cloud providers. | Full control over networking setup. |
51
+
| Performance and scalability | Scales with cloud load balancers, better supports horizontal scaling. |Scales with cloud load balancers, better supports horizontal scaling. |Limited to OpenShift Router performance. | Full flexibility - scales according to your load balancer and proxy setup. |
| TLS/SSL termination | Can leverage cloud provider-managed TLS; supports Cert-Manager. |Configured in the Gateway [listener](https://gateway-api.sigs.k8s.io/guides/user-guides/tls/#listeners-and-tls) by the cluster operator |Supported with OpenShift's HAProxy router. | Fully flexible but requires manual setup; TLS can terminate at application load balancer, network load balancer, or app level |
54
+
| Security (WAF, ACLs, Auth) | More advanced security integrations (for example AWS Web Application Firewall, authentication). |Provided by the Gateway implementation |Basic access control via OpenShift OAuth. | Full control - can integrate with AWS Web Application Firewall, API Gateway, authentication proxies with manual configuration. |
55
+
| Traffic splitting | Fully supported through ingress rules. |Fully supported. |Supported through HAProxy-based Route annotations. | Depends on external networking setup. |
56
+
| External DNS support | Some ingress controllers (for example, application load balancers) support native DNS updates. |Fully configurable - can use ExternalDNS, Amazon Route 53, or others. |Requires ExternalDNS integration. | Fully configurable - can use ExternalDNS, Amazon Route 53, or others. |
57
+
| Custom annotations | Supports Kubernetes Ingress annotations, provider-specific features.| Gateway implementations typically use vendor-specific CRDs, annotations are supported as well. | Supports OpenShift-specific annotations. | No restrictions - fully customizable in external networking. |
56
58
57
59
## Recommended Configuration
58
60
@@ -75,6 +77,9 @@ While OpenShift Routes are a viable option, we recommend NGINX Ingress Controlle
75
77
OpenShift Routes remain a suitable choice if meet your current needs and you do not require advanced features.
76
78
{{% /alert %}}
77
79
80
+
If your cluster has a configured and working Gateway API implementation, using it might be a preferrable option.
81
+
The Gateway API standardized typical use cases, and the Mendix Operator only uses HTTPRoute features defined in the [v1.4 standard](https://gateway-api.sigs.k8s.io/reference/api-spec/1.4/spec/), without relying on any vendor-specific feature.
82
+
78
83
## Known Issues
79
84
80
85
* AWS Application Load Balancers do not work correctly with HTTP2 WebSockets.
@@ -83,3 +88,4 @@ OpenShift Routes remain a suitable choice if meet your current needs and you do
83
88
84
89
* Some application load balancer firewall rules can block file uploads or other Mendix app features.
85
90
* Linkerd does not work correctly with AWS Application Load Balancer and Azure Gateway Ingress Controller.
91
+
* Some Gateway API implementations do not fully implement the base v1.4 spec, or are experimental (unsupported).
Copy file name to clipboardExpand all lines: content/en/docs/deployment/private-cloud/private-cloud-cluster/networking/private-cloud-advanced-ingress-settings.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: "Advanced Ingress Settings in Mendix on Kubernetes"
0 commit comments