[nginx] Support for multiple Namespaces

[ghost]

Currently it is possible to use Ingresses either from all namespaces or from one individual namespace (--force-namespace-isolation). In our environment we only have the rights to access all namespaces except kube-system, so it's not possible to retrieve Ingresses cluster-wide.

It would really help if it would be possible to specify a list of namespaces from which the Nginx Ingress Controller retrieves Ingress. The only alternative for us, would be to deploy one Ingress Controller per namespace.

[aledbf]

@stefanbueringer sadly this is not possible. This is a restriction of the library we use to reach api server (client-go). In particular the expose API provides an abstraction called informer, click here to see an example, where only is possible to specify one particular namespace (as filter) or get information about all the existing namespaces.

The only alternative for us, would be to deploy one Ingress Controller per namespace.

This is the correct way to handle this scenario.

[ghost]

@aledbf I guess creating one informer per object type and one for every namespaces is no real option here.

[aledbf]

@stefanbueringer no because the informers are not created dinamically.
Please check https://github.com/kubernetes/ingress/blob/master/core/pkg/ingress/controller/controller.go#L275-L297

[ghost]

@aledbf I'm aware how its currently implemented. I guess creating these informers dynamically per namespaces (e.g. by looping over the namespaces) is either a bad hack or just not possible with Go (I'm new to the Go language)

[aledbf]

I guess creating these informers dynamically per namespaces (e.g. by looping over the namespaces)

This is not a good idea because each informer instance consumes resources in the api server (basically we use watch) and also please keep in mind that making this change adds an unnecessary complexity to the code (we need to merge all the information stored in the informers to build one configuration)

[ghost]

Ok thx for the information, that makes sense.

[skonto]

I think this feature would be pretty useful for operators and the multi-tenancy story but it could be provided by the k8s watch api.