Ingress annotations for customization in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Purpose of Ingress Annotations

What is the primary purpose of using annotations in a Kubernetes Ingress resource?

A To define the backend services for the Ingress rules

B To customize the behavior of the Ingress controller without changing the Ingress spec

C To specify the namespace where the Ingress is deployed

D To create persistent storage for the Ingress resource

💡 Hint

Think about how you can change settings like SSL or timeouts without modifying the main rules.

Annotations allow you to add extra configuration to the Ingress controller, such as SSL settings, timeouts, or rewrite rules, without altering the core Ingress specification.

💻 Command Output

intermediate

Output of Ingress with SSL Redirect Annotation

Given this Ingress snippet with annotation nginx.ingress.kubernetes.io/ssl-redirect: "true", what effect does this have on HTTP requests?

Kubernetes

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: example-service
            port:
              number: 80

A All HTTP requests are redirected to HTTPS automatically

B HTTP requests are blocked and return 403 Forbidden

C HTTP requests are served normally without redirection

D Ingress controller disables HTTPS for this host

💡 Hint

Consider what 'ssl-redirect: true' means for incoming traffic.

The annotation nginx.ingress.kubernetes.io/ssl-redirect: "true" tells the NGINX Ingress controller to redirect all HTTP requests to HTTPS automatically.

❓ Configuration

advanced

Correct Annotation for Custom Timeout

You want to set a custom proxy read timeout of 120 seconds on an NGINX Ingress. Which annotation correctly sets this timeout?

A nginx.ingress.kubernetes.io/proxy-read-timeout: "120"

B nginx.ingress.kubernetes.io/proxy-read-timeout-seconds: "120"

C nginx.ingress.kubernetes.io/proxy-timeout: "120"

D nginx.ingress.kubernetes.io/proxy-read-timeout-ms: "120000"

💡 Hint

Look for the exact annotation name used by NGINX Ingress for read timeout.

The correct annotation to set the proxy read timeout in seconds is nginx.ingress.kubernetes.io/proxy-read-timeout. The value is in seconds as a string.

❓ Troubleshoot

advanced

Why is the Rewrite Annotation Not Working?

You added the annotation nginx.ingress.kubernetes.io/rewrite-target: / to your Ingress, but the URL paths are not rewritten as expected. What is a common cause?

A The annotation value must be a full URL, not just '/'

B The backend service must be named 'rewrite-service' for this to work

C Rewrite annotation only works with HTTP, not HTTPS

D The Ingress path is not defined with a regex pathType

💡 Hint

Check the pathType used in the Ingress rule when using rewrite-target.

The rewrite-target annotation requires the Ingress path to be defined as a regex pathType to match and rewrite the URL path correctly.

✅ Best Practice

expert

Best Practice for Securing Ingress with Annotations

Which annotation combination is best practice to enhance security by enabling HTTP Strict Transport Security (HSTS) with a max age of 6 months and including subdomains on an NGINX Ingress?

A

nginx.ingress.kubernetes.io/hsts: "enabled"
nginx.ingress.kubernetes.io/hsts-max-age: "15768000"
nginx.ingress.kubernetes.io/hsts-include-subdomains: "enabled"

B

nginx.ingress.kubernetes.io/hsts: "true"
nginx.ingress.kubernetes.io/hsts-max-age: "15768000"
nginx.ingress.kubernetes.io/hsts-include-subdomains: "true"

C nginx.ingress.kubernetes.io/configuration-snippet: 'add_header Strict-Transport-Security "max-age=15768000; includeSubDomains" always;'

D

nginx.ingress.kubernetes.io/enable-hsts: "yes"
nginx.ingress.kubernetes.io/hsts-duration: "15768000"
nginx.ingress.kubernetes.io/hsts-subdomains: "yes"

💡 Hint

NGINX Ingress does not have built-in hsts annotations; custom headers are added via configuration-snippet.

NGINX Ingress does not support dedicated HSTS annotations. The best practice is to add the HSTS header using the configuration-snippet annotation with the correct header syntax.