You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Reference the policy in the VirtualServer [`spec`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserver-specification). It is not allowed to reference an IngressMTLS policy in a [`route `](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserver-route) or in a VirtualServerRoute [`subroute`](/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroute-subroute).
268
+
269
+
If the conditions above are not met, NGINX will send `500` error response to clients.
270
+
271
+
> Note: The feature is implemented using the NGINX [ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html).
272
+
273
+
```eval_rst
274
+
.. list-table::
275
+
:header-rows: 1
276
+
277
+
* - Field
278
+
- Description
279
+
- Type
280
+
- Required
281
+
* - ``clientCertSecret``
282
+
- The name of the Kubernetes secret that stores the CA certificate. It must be in the same namespace as the Policy resource. The certificate must be stored in the secret under the key ``ca.crt``, otherwise the secret will be rejected as invalid.
283
+
- ``string``
284
+
- Yes
285
+
* - ``verifyClient``
286
+
- Verification for the client. Possible values are ``on``, ``off``, ``optional``, ``optional_no_ca``. The default is ``on``.
287
+
- ``string``
288
+
- No
289
+
* - ``verifyDepth``
290
+
- Sets the verification depth in the client certificates chain. The default is ``1``.
291
+
- ``int``
292
+
- No
293
+
```
294
+
295
+
#### IngressMTLS Merging Behavior
296
+
297
+
A VirtualServer can reference only a single IngressMTLS policy. Every subsequent reference will be ignored. For example, here we reference two policies:
298
+
```yaml
299
+
policies:
300
+
- name: ingress-mtls-policy-one
301
+
- name: ingress-mtls-policy-two
302
+
```
303
+
In this example the Ingress Controller will use the configuration from the first policy reference `ingress-mtls-policy-one`, and ignores `ingress-mtls-policy-two`.
304
+
247
305
## Using Policy
248
306
249
307
You can use the usual `kubectl` commands to work with Policy resources, just as with built-in Kubernetes resources.
In this example, we deploy a web application, configure load balancing for it via a VirtualServer, and apply an Ingress MTLS policy.
4
+
5
+
## Prerequisites
6
+
7
+
1. Follow the [installation](https://docs.nginx.com/nginx-ingress-controller/installation/installation-with-manifests/) instructions to deploy the Ingress Controller.
8
+
1. Save the public IP address of the Ingress Controller into a shell variable:
9
+
```
10
+
$ IC_IP=XXX.YYY.ZZZ.III
11
+
```
12
+
1. Save the HTTP port of the Ingress Controller into a shell variable:
13
+
```
14
+
$ IC_HTTPS_PORT=<port number>
15
+
```
16
+
17
+
## Step 1 - Deploy a Web Application
18
+
19
+
Create the application deployment and service:
20
+
```
21
+
$ kubectl apply -f webapp.yaml
22
+
```
23
+
24
+
## Step 2 - Deploy the Ingress MLTS Secret
25
+
26
+
Create a secret with the name `ingress-mtls-secret` that will be used for Ingress MTLS validation:
27
+
```
28
+
$ kubectl apply -f ingress-mtls-secret.yaml
29
+
```
30
+
31
+
## Step 3 - Deploy the Ingress MTLS Policy
32
+
33
+
Create a policy with the name `ingress-mtls-policy` that references the secret from the previous step:
34
+
```
35
+
$ kubectl apply -f ingress-mtls.yaml
36
+
```
37
+
38
+
## Step 4 - Configure Load Balancing and TLS Termination
39
+
1. Create the secret with the TLS certificate and key:
40
+
```
41
+
$ kubectl create -f tls-secret.yaml
42
+
```
43
+
44
+
2. Create a VirtualServer resource for the web application:
45
+
```
46
+
$ kubectl apply -f virtual-server.yaml
47
+
```
48
+
49
+
Note that the VirtualServer references the policy `ingress-mtls-policy` created in Step 3.
50
+
51
+
## Step 5 - Test the Configuration
52
+
53
+
If you attempt to access the application without providing a valid Client certificate and key, NGINX will reject your requests for that VirtualServer:
0 commit comments