Ingress configuration for k8s in different namespaces

Question

I need to configure Ingress Nginx on azure k8s, and my question is if is possible to have ingress configured in one namespace et. ingress-nginx and some serivces in other namespace eg. resources? My files looks like so:

# ingress-nginx.yaml apiVersion: extensions/v1beta1 kind: Deployment metadata:   name: nginx-ingress-controller   namespace: ingress-nginx spec:   replicas: 3   selector:     matchLabels:       app: ingress-nginx   template:     metadata:       labels:         app: ingress-nginx       annotations:         prometheus.io/port: '10254'         prometheus.io/scrape: 'true'      spec:       containers:         - name: nginx-ingress-controller           image: quay.io/kubernetes-ingress-controller/nginx-ingress-controller:0.12.0           args:             - /nginx-ingress-controller             - --default-backend-service=$(POD_NAMESPACE)/default-http-backend             - --configmap=$(POD_NAMESPACE)/nginx-configuration             - --tcp-services-configmap=$(POD_NAMESPACE)/tcp-services             - --udp-services-configmap=$(POD_NAMESPACE)/udp-services             - --annotations-prefix=nginx.ingress.kubernetes.io             - --publish-service=$(POD_NAMESPACE)/ingress-nginx           env:             - name: POD_NAME               valueFrom:                 fieldRef:                   fieldPath: metadata.name             - name: POD_NAMESPACE               valueFrom:                 fieldRef:                   fieldPath: metadata.namespace           ports:           - name: http             containerPort: 80           - name: https             containerPort: 443           livenessProbe:             failureThreshold: 3             httpGet:               path: /healthz               port: 10254               scheme: HTTP             initialDelaySeconds: 10             periodSeconds: 10             successThreshold: 1             timeoutSeconds: 1           readinessProbe:             failureThreshold: 3             httpGet:               path: /healthz               port: 10254               scheme: HTTP             periodSeconds: 10             successThreshold: 1             timeoutSeconds: 1 

# configmap.yaml kind: ConfigMap apiVersion: v1 metadata:   name: nginx-configuration   namespace: ingress-nginx   labels:     app: ingress-nginx --- kind: ConfigMap apiVersion: v1 metadata:   name: tcp-services   namespace: ingress-nginx --- kind: ConfigMap apiVersion: v1 metadata:   name: udp-services   namespace: ingress-nginx --- # default-backend.yaml apiVersion: extensions/v1beta1 kind: Deployment metadata:   name: default-http-backend   labels:     app: default-http-backend   namespace: ingress-nginx spec:   replicas: 1   selector:     matchLabels:       app: default-http-backend   template:     metadata:       labels:         app: default-http-backend     spec:       terminationGracePeriodSeconds: 60       containers:       - name: default-http-backend         # Any image is permissible as long as:         # 1. It serves a 404 page at /         # 2. It serves 200 on a /healthz endpoint         image: gcr.io/google_containers/defaultbackend:1.4         livenessProbe:           httpGet:             path: /healthz             port: 8080             scheme: HTTP           initialDelaySeconds: 30           timeoutSeconds: 5         ports:         - containerPort: 8080         resources:           limits:             cpu: 10m             memory: 20Mi           requests:             cpu: 10m             memory: 20Mi --- apiVersion: v1 kind: Service metadata:   name: default-http-backend   namespace: ingress-nginx   labels:     app: default-http-backend spec:   ports:   - port: 80     targetPort: 8080   selector:     app: default-http-backend  

kind: Service apiVersion: v1 metadata:   name: ingress-nginx   namespace: ingress-nginx   labels:     app: ingress-nginx spec:   externalTrafficPolicy: Local   type: LoadBalancer   selector:     app: ingress-nginx   ports:   - name: http     port: 80     targetPort: http   - name: https     port: 443     targetPort: https 

        # app-ingress.yaml apiVersion: extensions/v1beta1 kind: Ingress metadata:   name: app-ingress   namespace: ingress-nginx   annotations:     kubernetes.io/ingress.class: nginx     nginx.ingress.kubernetes.io/rewrite-target: / spec:   tls:     - hosts:       - api-sand.fake.com   rules:   - host: api-sand.fake.com     http:       paths:       - backend:           serviceName: api-sand           servicePort: 80         path: /  

And then I have some app running in the resources namespace, and problem is that I am getting the following error

error obtaining service endpoints: error getting service resources/api-sand from the cache: service resources/api-sand was not found  

If I deploy api-sand in the same namespace where ingress is then this service works fine.

Answer 1

I would like to simplify the answer a bit further for those who are reletively new to Kubernetes and its ingress options in particular. There are 2 separate things that need to be present for ingress to work:

1. Ingress Controller(essentially a separate Pod/Deployment along with a Service that can be used to utilize routing and proxying. Based on nginx container for example);
2. Ingress rules(a separate Kubernetes resourse with kind: Ingress. Will only take effect if Ingress Controller is already deployed)

Now, Ingress Controller can be deployed in any namespace and is, in fact, usually deployed in a namespace separate from your app services. It can out-of-the-box see Ingress rules in all namespaces in the cluster and will pick them up.
The Ingress rules, however, must reside in the namespace where the app that they configure reside.

There are some workarounds for that, but this is the most common approach.