NGINX入口控制器：我可以终止TLS并传递非HTTP流量吗？

Question

I'm attempting to deploy a DNP3 server (an industrial protocol) within Kubernetes. DNP3 uses TCP communications but is a stateful protocol. I'm currently working on deploying the ingress controller configuration.

I realize that ingress controllers are intended for http/https traffic, but I'd like to use them if possible and take advantage of some of the inherent features (eg mutual TLS, whitelisting, etc.). Does the NGINX ingress controller require that incoming traffic be formatted as http traffic (eg having a header, etc.)? If it receives random TCP (non-http) traffic can it simply pass the traffic along to backend service?

The annotations I'm trying to work with include:

ingress.kubernetes.io/auth-tls-secret: default/client-secret
ingress.kubernetes.io/auth-tls-verify-depth: "3"
kubernetes.io/ingress.class: nginx-private
nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true"
nginx.ingress.kubernetes.io/auth-tls-verify-client: "on"
nginx.org/lb-method: ip_hash

A few notes:

• I realize that the auth-tls-pass-certificate annotation would add a header. My hope is that I can read the cert information from the header and then strip the header/other https data from the message.
• I'm hoping ot use the ip_hash lb-method in order to allow for the application to be stateful (a client with a consistent IP address is always routed to the same backend server).

Answer 1

Unfortunately, based on the information I've found, there is no good way to provide Ingress for TCP services, and there seem to be no plans to add that in the nearest feature. Actually, this is still an open issue on GitHub.

There have been some approaches to map TCP or UDP traffic to a Kubernetes service using ConfigMaps described in this StackOverflow question.