Kubernetes 入口：如何限制虚拟主机名包含用户自己的命名空间？

Question

Background

We have a server with one external IP, microk8s and k8s ingress (nginx) configured for name-based virtual hosts. The machine is intended as a playground for several devs for testing container technologies. A problem quickly emerged of route names collisions, with two users trying to set up the same route (like test or dev). One solution would be to include namespaces in the hostnames, but users would still have to cooperate (as opposed to using someone else's namespace).

Question

How to restrict user-generated host names (set up with Ingress config files) to include only user's own namespace in name-based virtual hosting (preferably using Nginx ingress)? It seems to be possible, because this is how our corporate Openshift routes (auto-generated hostnames that include namespaces) work: it is not possible to create a route in a namespace without having access (controlled by RBAC) to it.

Answer 1

In openshift 3.x docs is mentioned:

If a host name is not provided as part of the route definition, then OpenShift Container Platform automatically generates one for you. The generated host name is of the form:

 <route-name>[-<namespace>].<suffix>

So I guess that what you want is to do the same; generate hostname when one is not provided.

Unfortunately for you, this is not supported by k8s and k8s nginx ingress as far as I know.

What you might want to do is create a mutating webhook to mutate the object in flight when applying to k8s (it can eg generate a host field if one is not provided), or use validating webhook to validate if the object meets the requirements.

Here is a tutorial you might want to check out: kube-mutating-webhook-tutorial

You can also try to find a different ingress controller that supports the feature you want.

One other solution involves removing access to create ingress objects from developers, and pick only one person that will be responsible for creation and validation of ingress objects (probably bad idea but it is a solution).