Ingress

Kindo’s hosts reach the cluster through your ingress controller and load balancer. You can route them in one of two ways:

• Your own routing. You create the Ingress objects, load-balancer rules, or gateway routes for each host. Print the hosts, backends, ports, and health checks with kindo ingress manifest.
• Kindo-managed ingress. Add an ingress: block to install-contract.yaml, and Kindo creates and manages an Ingress object for every host on each install and upgrade.

Allowlists

Kindo-managed ingress puts every host on one load balancer, and OAuth callbacks on integrations-api.<domain> and /webhook on api.<domain> must stay reachable from the internet. An allowlist set in the contract’s ingress.annotations, such as alb.ingress.kubernetes.io/inbound-cidrs, applies to every host and blocks them. If you restrict your load balancer to an allowlist, keep your own routing.

Header buffer sizes

Kindo’s backend accepts up to 16 KB of request headers. Your ingress controller must pass headers of that size through, and settings that go higher don’t raise this limit. These are controller-wide settings that apply to every host; they aren’t per-Ingress annotations, so they don’t go in the contract’s ingress.annotations.

• ingress-nginx. The default large-client-header-buffers is 4 8k, and a single header line larger than one buffer fails with 400 or 431. Set it in the controller ConfigMap:

  large-client-header-buffers: "4 32k"

  If responses fail with 502 and the controller log shows upstream sent too big header while reading response header from upstream, also set proxy-buffer-size: "32k". This one is also available per Ingress as the nginx.ingress.kubernetes.io/proxy-buffer-size annotation.

• NGINX. Set large_client_header_buffers 4 32k;. For the 502 case, raise proxy_buffer_size together with proxy_buffers, or nginx -t rejects the config:

  large_client_header_buffers 4 32k;
  proxy_buffer_size 32k;
  proxy_buffers 4 32k;

• Envoy and Traefik. The defaults are already above 16 KB: Envoy’s max_request_headers_kb is 60, and Traefik allows about 1 MB. No change is needed unless you lowered them.

Move to Kindo-managed ingress

Make this change on its own, in a maintenance window, on an install that is already running its target version.

1. Back up your current Ingress objects.

   kubectl get ingress -A -o yaml > ingress-backup.yaml

2. Add an ingress: block to install-contract.yaml. Set your ingress class, the load-balancer annotations every host shares, and how TLS terminates. For example, with ingress-nginx and cert-manager:

   ingress:
     enabled: true
     className: nginx
     tls:
       mode: cert-manager
       clusterIssuer: <cluster-issuer>

   With an AWS Application Load Balancer and an ACM certificate:

   ingress:
     enabled: true
     className: alb
     annotations:
       alb.ingress.kubernetes.io/group.name: kindo-shared
       alb.ingress.kubernetes.io/scheme: internet-facing
       alb.ingress.kubernetes.io/target-type: ip
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
       alb.ingress.kubernetes.io/ssl-redirect: '443'
     tls:
       mode: acm
       acmCertificateArn: <certificate-arn>

   tls.mode is none, acm, cert-manager, or secret (one TLS Secret named secretName in every Kindo namespace).

3. Preview the hosts. Compare the output with the hosts you serve today:

   kindo ingress manifest

4. Remove your current routing for Kindo’s hosts. If you installed the kindo-ingress chart, find its release with helm list -A and uninstall it:

   helm uninstall kindo-ingress -n <namespace>

   Otherwise, delete the Ingress objects you created for Kindo’s hosts.

5. Apply the change.

   kindo upgrade --version <installed-version> --apply

6. Check the result. Confirm that kubectl get ingress -A lists every host, that DNS points at the load balancer, and that each host serves a valid certificate.

To go back, set ingress.enabled: false, run the same kindo upgrade command, and reapply ingress-backup.yaml.