mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-20 14:34:25 +00:00
61 lines
2.6 KiB
Plaintext
61 lines
2.6 KiB
Plaintext
---
|
|
title: Ingress
|
|
description: "Configure Kubernetes Ingress resources for ZITADEL and Login containers to manage API traffic and UI access"
|
|
sidebar_label: Ingress
|
|
---
|
|
|
|
|
|
|
|
The chart creates standard [Kubernetes Ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) resources. There are separate Ingress resources for the Zitadel container and the Login container.
|
|
|
|
TLS must be terminated at the ingress controller; the Zitadel and Login containers do not handle TLS termination. Both ingresses typically use the same domain and TLS certificate. The Login ingress serves the `/ui/v2/login` path while the Zitadel ingress serves everything else.
|
|
|
|
## Zitadel Ingress
|
|
|
|
The Zitadel ingress handles all API traffic, the console UI, and OIDC endpoints. The example below uses [Traefik](https://traefik.io/traefik/) as the ingress controller:
|
|
|
|
```yaml
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
hosts:
|
|
- host: zitadel.example.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: zitadel-tls
|
|
hosts:
|
|
- zitadel.example.com
|
|
```
|
|
|
|
The `tls.secretName` references a Kubernetes Secret containing your TLS certificate. You can create this secret manually, or have your ingress controller issue certificates automatically. For automatic certificate issuance with [Traefik ACME](https://doc.traefik.io/traefik/https/acme/), add the `traefik.ingress.kubernetes.io/router.tls.certresolver` annotation. For [cert-manager](https://cert-manager.io/), add the `cert-manager.io/cluster-issuer` annotation.
|
|
|
|
## Login Ingress
|
|
|
|
The Login ingress handles the login UI. It must be configured separately:
|
|
|
|
```yaml
|
|
login:
|
|
ingress:
|
|
enabled: true
|
|
className: traefik
|
|
annotations:
|
|
traefik.ingress.kubernetes.io/router.entrypoints: websecure
|
|
traefik.ingress.kubernetes.io/router.tls: "true"
|
|
hosts:
|
|
- host: zitadel.example.com
|
|
paths:
|
|
- path: /ui/v2/login
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: zitadel-tls
|
|
hosts:
|
|
- zitadel.example.com
|
|
```
|
|
|
|
The `tls.secretName` references a Kubernetes Secret containing your TLS certificate. You can use the same secret as the Zitadel ingress since both use the same domain. For automatic certificate issuance with [Traefik ACME](https://doc.traefik.io/traefik/https/acme/), add the `traefik.ingress.kubernetes.io/router.tls.certresolver` annotation. For [cert-manager](https://cert-manager.io/), add the `cert-manager.io/cluster-issuer` annotation.
|