4 lines
3.7 KiB
HTML
4 lines
3.7 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 16: TLS Ingress</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0016 · 30 minutes · Cluster Setup</p><h1>Route a service through a TLS-enabled Ingress</h1><p class="lede">Ingress TLS is a three-part relationship: the hostname in the rule, the hostname in the TLS section, and the Secret that holds the certificate. A correct backend alone does not secure the public route.</p><div class="callout"><strong>Exam reflex:</strong> use <code>networking.k8s.io/v1</code>. In every HTTP path, specify <code>pathType</code> and the Service backend name and port explicitly.</div><h2>Timed task: 20 minutes</h2><p>Apply <code>lab/lesson-16-fixture.yaml</code>. Create <code>lab/lesson-16-answer.yaml</code> from scratch with a single Ingress in namespace <code>ingress-drill</code>.</p><p>The Ingress must meet all requirements:</p><ul><li>Name: <code>orders</code>; API version: <code>networking.k8s.io/v1</code>.</li><li>Use ingress class <code>nginx</code>.</li><li>Serve only host <code>orders.training.local</code>.</li><li>Configure TLS for that same host using Secret <code>orders-tls</code>.</li><li>Route <code>/api</code> with <code>Prefix</code> path type to Service <code>orders</code> on port <code>8080</code>.</li><li>Route <code>/healthz</code> with <code>Exact</code> path type to the same Service and port.</li></ul><p>Do not add a wildcard host, default backend, or controller-specific annotations. The supplied cluster has no Ingress controller, so this drill validates the API manifest and routing intent rather than an external HTTPS request.</p><h2>Verification</h2><pre><code>kubectl --context kind-cks-lab apply -f .\lab\lesson-16-fixture.yaml
|
||
kubectl --context kind-cks-lab apply --dry-run=server -f .\lab\lesson-16-answer.yaml
|
||
kubectl --context kind-cks-lab -n ingress-drill get ingress orders -o yaml</code></pre><p>After server-side dry run succeeds, apply the answer manifest for inspection. Do not expect an address or TLS handshake without an Ingress controller.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>What must match for the TLS host in an Ingress to cover the public route?</p><label><input type="radio" name="q" value="host">The hostname in <code>spec.tls.hosts</code> must match the hostname in the Ingress rule.</label><label><input type="radio" name="q" value="path">The TLS Secret name must match the backend Service name.</label><label><input type="radio" name="q" value="port">The TLS host must include the backend Service port.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official Kubernetes <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/">Ingress</a> reference to verify the v1 backend and TLS schema.</p><h2>What to send me</h2><p>Paste the Ingress YAML and the server-side dry-run result. I’ll check host/TLS alignment, path semantics, and backend syntax.</p><footer>Previous: <a href="0015-kubelet-endpoint-hardening.html">Kubelet endpoint hardening</a> · CKS domain: Cluster Setup</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='host'){f.textContent='Correct. The TLS section and rule host must align for the certificate to cover the requested hostname.';f.className='feedback good';}else{f.textContent='Not quite. TLS applies to the requested hostname, so the TLS and rule hosts must match.';f.className='feedback bad';}}</script></body></html>
|