Ingress annotations for customization in Kubernetes - Commands & Configuration

Introduction

Ingress annotations let you add extra settings to control how your Kubernetes Ingress works. They help customize behavior like SSL, timeouts, or redirects without changing the main Ingress rules.

When you want to enable HTTPS with automatic redirects on your web app.

When you need to set a timeout for backend requests to avoid hanging connections.

When you want to add custom headers to requests or responses for security or tracking.

When you want to control load balancing behavior like session affinity.

When you want to enable or disable features like WebSocket support or client IP forwarding.

Config File - ingress.yaml

ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "30"
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "X-Custom-Header: myvalue";
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: example-service
            port:
              number: 80
  tls:
  - hosts:
    - example.com
    secretName: example-tls-secret

The annotations section adds extra settings to customize the Ingress controller behavior:

• nginx.ingress.kubernetes.io/ssl-redirect: "true" forces HTTP requests to redirect to HTTPS.
• nginx.ingress.kubernetes.io/proxy-read-timeout: "30" sets the timeout for reading a response from the backend to 30 seconds.
• nginx.ingress.kubernetes.io/configuration-snippet lets you add custom NGINX configuration, here adding a custom header to responses.

The spec defines the routing rules and TLS settings.

Commands

This command creates or updates the Ingress resource with the custom annotations to control SSL redirect, timeout, and add a custom header.

Terminal

kubectl apply -f ingress.yaml

Expected Output

ingress.networking.k8s.io/example-ingress created

This command checks that the Ingress resource is created and shows its basic details like hosts and addresses.

Terminal

kubectl get ingress example-ingress

Expected Output

NAME              CLASS    HOSTS         ADDRESS        PORTS   AGE

example-ingress   <none>   example.com   192.168.1.100  80,443  10s

This command shows detailed information about the Ingress, including the annotations that customize its behavior.

Terminal

kubectl describe ingress example-ingress

Expected Output

Name:             example-ingress

Namespace:        default

Address:          192.168.1.100

Default backend:  <none>

Rules:

  Host        Path  Backends

  ----        ----  --------

  example.com

              /   example-service:80 (10.1.1.5:80)

Annotations:

  nginx.ingress.kubernetes.io/ssl-redirect:        true

  nginx.ingress.kubernetes.io/proxy-read-timeout:  30

  nginx.ingress.kubernetes.io/configuration-snippet:

    more_set_headers "X-Custom-Header: myvalue";

Events:  <none>

Key Concept

If you remember nothing else from this pattern, remember: Ingress annotations let you easily add or change features like SSL redirects and timeouts without changing your main routing rules.

Common Mistakes

Using incorrect annotation keys or typos in annotation names

The Ingress controller ignores unknown annotations, so your customization won't apply.

Always check the official Ingress controller documentation for exact annotation names and spelling.

Not quoting numeric annotation values like timeouts

Annotations are strings; missing quotes can cause parsing errors or ignored settings.

Always put numeric values in quotes, e.g., "30" for timeouts.

Adding annotations that are not supported by your Ingress controller

Different Ingress controllers support different annotations; unsupported ones have no effect.

Verify your Ingress controller type (e.g., NGINX, Traefik) and use only supported annotations.

Summary

Create an Ingress resource with annotations to customize behavior like SSL redirect and timeouts.

Apply the Ingress YAML file using kubectl to create or update the resource.

Verify the Ingress and its annotations with kubectl get and kubectl describe commands.

Practice

1. What is the main purpose of using annotations in a Kubernetes Ingress resource?

easy

A. To specify the IP address of the Ingress controller

B. To define the backend services for routing traffic

C. To customize the behavior of the Ingress controller without changing the main spec

D. To set resource limits for the Ingress pod

Solution

1. Step 1: Understand the role of annotations in Kubernetes

   Annotations are key-value pairs used to add metadata or customize behavior without changing the main resource spec.

2. Step 2: Apply this to Ingress resources

   In Ingress, annotations allow customization of controller behavior like SSL settings or rewrite rules without modifying the core routing rules.

3. Final Answer:

   To customize the behavior of the Ingress controller without changing the main spec -> Option C

4. Quick Check:

   Ingress annotations = customization without spec change [OK]

Hint: Annotations customize Ingress behavior without touching main config [OK]

Common Mistakes:

• Confusing annotations with service definitions
• Thinking annotations set IP addresses
• Assuming annotations control pod resources

2. Which of the following is the correct syntax to add an annotation for enabling SSL redirect in a Kubernetes Ingress YAML?

easy

A. metadata:
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"

B. spec:
annotations:
ssl-redirect: true

C. metadata:
labels:
nginx.ingress.kubernetes.io/ssl-redirect: true

D. annotations:
ssl-redirect: "true"

Solution

1. Step 1: Locate where annotations belong in Ingress YAML

   Annotations must be under metadata.annotations as key-value pairs.

2. Step 2: Check correct key and value format

   The key for SSL redirect in nginx ingress is nginx.ingress.kubernetes.io/ssl-redirect and the value should be a string "true".

3. Final Answer:

   metadata: annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" -> Option A

4. Quick Check:

   Annotations under metadata.annotations with string values [OK]

Hint: Annotations go under metadata.annotations as string key-values [OK]

Common Mistakes:

• Placing annotations under spec instead of metadata
• Using labels instead of annotations
• Using boolean true instead of string "true"

3. Given this Ingress snippet with annotations:

metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: "/"
    nginx.ingress.kubernetes.io/ssl-redirect: "false"

What will be the effect on incoming HTTP requests?

medium

A. Requests will be redirected to HTTPS and paths rewritten to root

B. Requests will not redirect to HTTPS and paths will be rewritten to root

C. Requests will redirect to HTTPS but paths will not be rewritten

D. Requests will neither redirect to HTTPS nor rewrite paths

Solution

1. Step 1: Analyze the ssl-redirect annotation

   The annotation nginx.ingress.kubernetes.io/ssl-redirect: "false" disables automatic HTTP to HTTPS redirection.

2. Step 2: Analyze the rewrite-target annotation

   The annotation nginx.ingress.kubernetes.io/rewrite-target: "/" rewrites the path of incoming requests to root (/).

3. Final Answer:

   Requests will not redirect to HTTPS and paths will be rewritten to root -> Option B

4. Quick Check:

   ssl-redirect false disables HTTPS redirect; rewrite-target "/" rewrites paths [OK]

Hint: ssl-redirect false disables HTTPS redirect; rewrite-target changes path [OK]

Common Mistakes:

• Assuming ssl-redirect false still redirects
• Ignoring rewrite-target effect
• Confusing rewrite-target with redirect

4. You added this annotation to your Ingress:

nginx.ingress.kubernetes.io/ssl-redirect: true

But HTTPS redirection is not working. What is the most likely cause?

medium

A. The annotation value should be a string "true", not boolean true

B. The annotation must be under spec.annotations, not metadata.annotations

C. The Ingress controller does not support this annotation

D. You need to restart the Ingress controller pod

Solution

1. Step 1: Check annotation value type

   Annotations require string values, so boolean true is invalid and ignored.

2. Step 2: Confirm correct placement and support

   The annotation must be under metadata.annotations and nginx ingress supports this annotation.

3. Final Answer:

   The annotation value should be a string "true", not boolean true -> Option A

4. Quick Check:

   Annotation values must be strings, not booleans [OK]

Hint: Annotation values must be strings, not booleans [OK]

Common Mistakes:

• Placing annotations under spec instead of metadata
• Assuming controller restart fixes annotation issues
• Ignoring controller support for annotation

5. You want to customize your Ingress to add a custom header X-Frame-Options: DENY for security. Which annotation and value should you add to achieve this with nginx ingress controller?

hard

A. nginx.ingress.kubernetes.io/custom-header: "X-Frame-Options=DENY"

B. nginx.ingress.kubernetes.io/add-headers: "X-Frame-Options: DENY"

C. nginx.ingress.kubernetes.io/headers: "X-Frame-Options: DENY"

D. nginx.ingress.kubernetes.io/configuration-snippet: "more_set_headers \"X-Frame-Options: DENY\";"

Solution

1. Step 1: Identify how to add custom headers in nginx ingress

   The nginx ingress controller supports adding custom headers via the configuration-snippet annotation using nginx directives.

2. Step 2: Use the correct syntax for setting headers

   The directive more_set_headers "X-Frame-Options: DENY"; correctly adds the header.

3. Final Answer:

   nginx.ingress.kubernetes.io/configuration-snippet: "more_set_headers \"X-Frame-Options: DENY\";" -> Option D

4. Quick Check:

   Use configuration-snippet with more_set_headers for custom headers [OK]

Hint: Use configuration-snippet with nginx directive for custom headers [OK]

Common Mistakes:

• Using non-existent annotation keys
• Incorrect syntax for header setting
• Confusing add-headers with configuration-snippet