Use nginx for kubernetes ingress

[micw]

What type of PR?

enhancement

What does this PR do?

Currently, kubernetes uses a complex ingress setting which is not portable across different ingress controllers. This PR simplifies the ingress and delegates everythins special to Mailu to the front container,

Related issue(s)

• closes Proxy rspamd through admin ui for security reasons #1121
• closes Admin ui path #1117
• closes Kuebernetes Admin UI URL in redirect loop #1021
• closes Kubernetes manifest update #1045

Prerequistes

• In case of feature or enhancement: documentation updated accordingly
• Unless it's docs or a minor change: add [changelog]

[mergify]

Thanks for submitting this pull request.
Bors-ng will now build test images. When it succeeds, we will continue to review and test your PR.

bors try

Note: if this build fails, read this.

[mergify]

Thanks for submitting this pull request.
Bors-ng will now build test images. When it succeeds, we will continue to review and test your PR.

bors try

Note: if this build fails, read this.

[bors]

try

Already running a review

[bors]

try

Build succeeded

• continuous-integration/travis-ci/push

[kaiyou]

This looks really good. I am setting up a testing k8s at home so hopefully I can test and provide feedback.

[micw]

also closes #1158

[kaiyou]

Well. This is #1158 🤔

[micw]

@kaiyou Recursion: see recursion ;-)

I meant: also closes #1128

[fionera]

I tried this but since Nginx wants to bind to :80 and the Pod is configured to use the host network, it fails when having an nginx-ingress handler...

[micw]

@fionera Thank you for pointing this out. Indeed is "host network" a bad choice for this setup. I have changed it in my own setup but somehow forgot to put this change in the PR. I have updated the PR, you don't need to rebuild the images, just change and redeploy front.yaml

Please let me know if you have further issues. I'd like to have this PR in the master as soon as it's possible, so any testers are highly welcome ;-)

On my setup I'm running a helm chart which is work-in-progress. Once it's finished, it will be a much better way to deploy mailu on kubernetes (no need to edit deployment yaml files, clean upgrade path). This PR is one missing piece to finish it.

Best regards,
Michael.

[kaiyou]

There are so many things that need improving on the k8s side, and your PR is definitely showing the way. After crawling my way through setting the proper pvc and specifying the node affinity rule, it somehow runs fine. I am all for merging this and going forward with improving the k8s docs.

[fionera]

@micw Yeah now it nearly work out of the box, there are only some problems now... The front.yaml is missing the port 80 definition, webmail-ingress is missing and antispam returns a 502

[micw]

@fionera
There's no webmail ingress, it's handled by front nginx. If you pass WEBMAIL env to front, it should be there (

Mailu/core/nginx/conf/nginx.conf

Line 104 in 44837fc

{% if WEBMAIL != 'none' %}

)

[micw]

No idea why antispam returns 502. Are you logged in as admin?

[micw]

I have added the missing port in front.yml

Pull request has been modified.

[fionera]

I use a different domain for the webmail to make it easier. Regarding antispam, yes I am logged it as Admin in Mailu, but as soon as I try to load the antispam I get a 502...

[kaiyou]

Webmail ingress will probably not return, we have debated this a couple times already and it makes things difficult to maintain. We could of course have different flavors but that is not the current direction: we are trying to do simple things well before we do anything complex.

[micw]

@fionera Can you see in the 502 error if it comes from traefik or from nginx? I'm quite sure it's from nginx. If so, please check and provide the following details:

• nginx logs when you access the rspamd
• generated nginx configuration, especially the rspamd part
• verify that the antispam address is correct in nginx config and it's reachable from the front container

Regarding webmail ingress: you are always free just to deploy another ingress that points to http://front/webmail/. For traefik, you can also add the traefik.ingress.kubernetes.io/app-root annotation to it, so that you get redirected from / to /webmail on the webmail domain.

[micw]

I have it running by using my helm chart: https://github.com/micw/charts/tree/mailu/incubator/mailu
Webmail, antispam and admin-ui are reachable without any problems.

@kaiyou If you are fine with that, you can merge it. If any unexpected issues occur, I'd fix it in separate issues.

[kaiyou]

bors merge

[bors]

Build succeeded

• continuous-integration/travis-ci/push