In our previous articles we had covered in detail the process of installing and configuring Ansible AWX on container platforms such as Kubernetes. The links to the articles are shared below.

Many guys on the comments section had requested we do a separate article on Ingress configuration. We understand there are many Ingress solutions for Kubernetes, but this guide will be specific to Nginx Ingress. In our future content we shall consider doing guides on other Ingress solutions.

Step 1: Deploy Ingress Controller in Kubernetes

Before you can proceed with this article you’ll need to install and configure Nginx Ingress Controller in your Kubernetes cluster. Follow the article in the link below to perform this installation.

Confirm Ingress service is deployed successfully as per steps captured in the article.

$ kubectl get svc -n ingress-nginx
NAME                                 TYPE           CLUSTER-IP      EXTERNAL-IP    PORT(S)                      AGE
ingress-nginx-controller             LoadBalancer   10.233.62.202   192.168.1.30   80:32504/TCP,443:30189/TCP   50d
ingress-nginx-controller-admission   ClusterIP      10.233.1.104    <none>         443/TCP                      50d

Step 2: Configure DNS Name for AWX

Mapping of an A record to Nginx Ingress IP address (In this case LB service IP) is mandatory to use DNS name when accessing AWX service. Our setup is based on the following variable.

  • Hostname: awx.apps.k8s.cloudlabske.io
  • Ingress Controller LB IP: 192.168.1.30

A sample configuration snippet pulled from FreeIPA server is shown below.

awx nginx ingress 01

Notice we’re using a wildcard DNS name but you can use awx name when adding record to the zone.

awx nginx ingress 02

Let’s confirm we can ping DNS name.

$ ping -c 3 awx.apps.k8s.cloudlabske.io
PING awx.apps.k8s.cloudlabske.io (192.168.1.30): 56 data bytes
64 bytes from 192.168.1.30: icmp_seq=0 ttl=63 time=8.405 ms
64 bytes from 192.168.1.30: icmp_seq=1 ttl=63 time=47.933 ms
64 bytes from 192.168.1.30: icmp_seq=2 ttl=63 time=19.875 ms

--- awx.apps.k8s.cloudlabske.io ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 8.405/25.404/47.933/16.604 ms

Step 3: Create Ingress resource for AWX

List all the services in awx namespace:

$ kubectl get services -n awx
NAME                                              TYPE           CLUSTER-IP      EXTERNAL-IP    PORT(S)        AGE
awx-lb-service                                    LoadBalancer   10.233.2.203    192.168.1.32   80:30791/TCP   30h
awx-operator-controller-manager-metrics-service   ClusterIP      10.233.25.242   <none>         8443/TCP       31h
awx-postgres-13                                   ClusterIP      None            <none>         5432/TCP       31h
awx-service                                       NodePort       10.233.28.124   <none>         80:30080/TCP   31h

Create ingress configuration manifest for AWX.

vim awx-nginx-ingress.yaml

Add and modify the contents below to suit your use case.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: awx-ingress
  namespace: awx
spec:
  ingressClassName: nginx
  rules:
  - host: awx.apps.k8s.cloudlabske.io
    http:
      paths:
        - path: /
          pathType: Prefix
          backend:
            service:
              name: awx-service
              port:
                number: 80

Apply configuration file to create the resource.

$ kubectl apply -f awx-nginx-ingress.yaml
ingress.networking.k8s.io/awx-ingress created

Check available ingress in the namespace after creation.

$ kubectl get ingress -n awx
NAME          CLASS   HOSTS                         ADDRESS   PORTS   AGE
awx-ingress   nginx   awx.apps.k8s.cloudlabske.io             80      21s

Test connection to AWX service using DNS name configured.

awx nginx ingress 03

Step 4: Generate SSL Certificate for AWX (Recommended)

There is also an option of securing connection to AWX using hostname and SSL certificate.

Option 1) Using Self-signed SSL certificate

For self-signed certificates we’ll consider OpenSSL and pfSense certificates generation process.

1. OpenSSL generated certificate

For OpenSSL generated certificate you can create a configuration file.

$