automation-suite
2023.4
false
- Overview
- Requirements
- Kubernetes cluster and nodes
- Proxy
- SQL database
- Caching
- Storage
- Configuring NGINX ingress controller
- Certificate requirements
- Installation
- Prerequisite checks
- Downloading the installation packages
- uipathctl cluster
- uipathctl cluster maintenance
- uipathctl cluster maintenance disable
- uipathctl cluster maintenance enable
- uipathctl cluster maintenance is-enabled
- uipathctl cluster upgrade
- uipathctl config
- uipathctl config alerts
- uipathctl config alerts add-email
- uipathctl config alerts remove-email
- uipathctl config alerts update-email
- uipathctl config additional-ca-certificates get
- uipathctl config tls-certificates get
- uipathctl config orchestrator
- uipathctl config orchestrator get-config
- uipathctl config orchestrator update-config
- uipathctl config additional-ca-certificates update
- uipathctl config tls-certificates update
- uipathctl health
- uipathctl health bundle
- uipathctl health check
- uipathctl health diagnose
- uipathctl health test
- uipathctl identity
- uipathctl identity add-host-admin
- uipathctl identity enable-basic-auth
- uipathctl identity get-saml-certificate
- uipathctl identity get-token-signing-certificate
- uipathctl identity rotate-saml-certificates
- uipathctl identity rotate-token-signing-certificates
- uipathctl identity update-saml-certificate
- uipathctl identity update-token-signing-certificate
- uipathctl manifest
- uipathctl manifest apply
- uipathctl manifest diff
- uipathctl manifest get
- uipathctl manifest list-applications
- uipathctl manifest render
- uipathctl prereq
- uipathctl prereq create
- uipathctl prereq run
- uipathctl resource
- uipathctl resource report
- uipathctl snapshot
- uipathctl snapshot backup
- uipathctl snapshot backup create
- uipathctl snapshot backup disable
- uipathctl snapshot backup enable
- uipathctl snapshot delete
- uipathctl snapshot list
- uipathctl snapshot restore
- uipathctl snapshot restore create
- uipathctl snapshot restore delete
- uipathctl snapshot restore history
- uipathctl snapshot restore logs
- uipathctl sso
- uipathctl sso generate-connector
- uipathctl sso generate-overlays
- uipathctl sso generate-rbac
- uipathctl version
- Post-installation
- Migration and upgrade
- Upgrading Automation Suite on EKS/AKS
- Migration options
- Step 1: Moving the Identity organization data from standalone to Automation Suite
- Step 2: Restoring the standalone product database
- Step 3: Backing up the platform database in Automation Suite
- Step 4: Merging organizations in Automation Suite
- Step 5: Updating the migrated product connection strings
- Step 6: Migrating standalone Insights
- Step 7: Deleting the default tenant
- B) Single tenant migration
- Monitoring and alerting
- Cluster administration
- Product-specific configuration
- Troubleshooting
Configuring NGINX ingress controller
Automation Suite on EKS/AKS Installation Guide
Last updated Sep 12, 2024
Configuring NGINX ingress controller
In standard configuration, Automation Suite provisions a Load Balancer Kubernetes service type configured with Istio Gateway as an ingress controller for the requests coming from the network load balancer.
If you already have an NGINX ingress controller in your cluster and want to continue to use it, you must configure the Kubernetes
service_type
as cluster_IP
instead of Load Balancer. This document provides the necessary changes required for that configuration.
Important:
To manage large headers, adjust the
proxy-buffer-size
in the ingress annotation as follows:
nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
nginx.ingress.kubernetes.io/proxy-buffer-size: "8k"
You must update your NGINX specification with
istio-ingressgateway
as a backend service and specify the port number 80. Additionally, if you have your own Network Policies,make sure they are
configured correctly to allow NGINX and Istio routing.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress
namespace: istio-system
spec:
ingressClassName: nginx
tls:
- hosts:
- "<FQDN>"
- "*.<FQDN>"
secretName: nginx-tls
rules:
- host: "<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
number: 80
- host: "*.<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
number: 80
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress
namespace: istio-system
spec:
ingressClassName: nginx
tls:
- hosts:
- "<FQDN>"
- "*.<FQDN>"
secretName: nginx-tls
rules:
- host: "<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
number: 80
- host: "*.<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
number: 80
You must update your NGINX specification with
istio-ingressgateway
as a backend service and specify https
as the port name.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress
namespace: istio-system
annotations:
nginx.ingress.kubernetes.io/backend-protocol: "https"
nginx.ingress.kubernetes.io/proxy-ssl-name: "<FQDN>"
nginx.ingress.kubernetes.io/proxy-ssl-server-name: "on"
nginx.ingress.kubernetes.io/proxy-ssl-secret: "istio-system/istio-ingressgateway-certs"
nginx.ingress.kubernetes.io/proxy-ssl-verify: "on"
spec:
ingressClassName: nginx
tls:
- hosts:
- "<FQDN>"
- "*.<FQDN>"
secretName: nginx-tls
rules:
- host: "<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
name: https
- host: "*.<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
name: https
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: nginx-ingress
namespace: istio-system
annotations:
nginx.ingress.kubernetes.io/backend-protocol: "https"
nginx.ingress.kubernetes.io/proxy-ssl-name: "<FQDN>"
nginx.ingress.kubernetes.io/proxy-ssl-server-name: "on"
nginx.ingress.kubernetes.io/proxy-ssl-secret: "istio-system/istio-ingressgateway-certs"
nginx.ingress.kubernetes.io/proxy-ssl-verify: "on"
spec:
ingressClassName: nginx
tls:
- hosts:
- "<FQDN>"
- "*.<FQDN>"
secretName: nginx-tls
rules:
- host: "<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
name: https
- host: "*.<FQDN>"
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: istio-ingressgateway
port:
name: https