Ingress controller - temporal coupling of KongIngress and Ingress rules

Kubernetes
1

I am just posting this for the purpose of it being on someone’s radar and there being a note of it.

With the state of the current implementation, the declaration of KongIngress rule needs to happen BEFORE the declaration of Ingress rule in Kubernetes resource file.

If not, then any additional properties from the KongIngress rule, say upstream.hash_on: header will be ignored.

I am not completely sure about the guarantees kubernetes gives regarding the synchronous addition of resources as in - will it wait for one rule to be added and confirmed before it adds the next. As otherwise if this guarantee is weak one can still think of a case where there will be a race-condition of Ingress rule being processed before KongIngress.

I think this is due to the update case not being handled. On addition of each individual rule the Ingress controller resync should run and it should then consider the “full picture” (Ingress rules + KongIngress combined). However in current code, the sync of the upstream will not run except for if its a completely new rule (create).

Not sure if this is a bug as the code says:
// TODO: check if an update is required (change in KongIngress)

It boils down to the code only being able to add rules and not update them.

Vice versa, if you delete a KongIngress rule then the extra properties it contained will never be reset to defaults. The old configuration will remain in the database.

2

Hello @jdevalk2,

Thank you for the post.

I think this is due to the update case not being handled. On addition of each individual rule the Ingress controller resync should run and it should then consider the “full picture” (Ingress rules + KongIngress combined). However in current code, the sync of the upstream will not run except for if its a completely new rule (create).

Your assumptions and expected behaviors are correct and the ingress controller needs to do a better job of handling these cases properly. You can expect such behaviors to improve in Kong Ingress controller over time, PRs are warmly welcomed!

Vice versa, if you delete a KongIngress rule then the extra properties it contained will never be reset to defaults. The old configuration will remain in the database.

This will be solved in future by putting default values used by Kong into the ingress controller and syncing them up properly.

Stay tuned for enhancements and fixes!