NGINX Inc Ingress Controller PHP-FPM support

[uGiFarukh]

Hello,

After doing some research I found that the nginx inc ingress controller does not have php-fpm fastcgi support by default. I am trying to deploy wordpress php fpm container using the nginx ingress controller in my kubernetes cluster without using any intermediate nginx container as a passthrough for the fpm. But it will need server snippets to be enabled on the ingress controller which is not advised according to the nginx.org ingress controller documentations. The documentation asks for configuring everything through annotations but I am unable to find the suitable annotations for configuring my ingress resource to support fpm and just work with the wordpress phh fpm container. Any ideas suggestion regarding this will be very helpful. How do I achieve fpm pass through configuration without the use of server snippets and by only using ingress resource annotations?

Thank You.

[brianehlert]

Snippets are required to unlock some capabilities of NGINX Ingress Controller.
The message about snippets is a cautionary warning, that if the deployment has snippets enabled that anyone with access to your K8s API and the Ingress or NGINX Ingress Controller CRDs (any K8s admin) could introduce a malicious configuration. That is all. A note to you to take proper precautions.

In this case, only include the additional functionality that is necessary - only those settings in the proper context of either the Ingress or Virtual Server resource.

Using the VirtualServer resource is the easiest way to introduce the snippets you mention: https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#using-snippets

[uGiFarukh]

I am a bit confused how virtualserver and ingress will work together in this context. Do I create a virtualserver resource with my required snippets and someone ask the nginx inc ingress resource to point to that virtual server? Please share any good examples of combining these two in any use cases if possible. Thank you so much for your reply explaining the precaution part of this server-snippets annotation. Really appreciate it.

[uGiFarukh]

Also, if I may ask, the enable-snippets command line argument is also needed for adding snippets to virtualserver resources? For example the http-snippets part?

[brianehlert]

VirtualServer is a CRD provided by this project.
You use it instead of an Ingress resource for a particular hostname.

From an nginx.conf perspective a VirtualServer is equivalent to the http server block in scope.

enable-snippets is a global setting, and must be enabled at deployment time. Thus it is a conscious decision you make for the deployment.

Ingress resources and VirtualServer resources can be combined. You can have some hostnames defined with each. But only one will win for a particular hostname. For example: you can define foo.com using Ingress and bar.com using VirtualServer. But you cannot define example.com with both at the same time.

Our project recommends you use the Custom Resources that have been provided, because they are a easier to use and richer in capabilities.

[uGiFarukh]

So, basically you are suggesting that I should enable custom server snippets in the ingress controller and use the custom virtualserver crd to create the fastcgi configuration and run wp that way. Let me know if I understood your suggestion correctly. Thank you so much for the information provided. Really helpful.

[jasonwilliams14]

@uGiFarukh What @brianehlert is recommending is that you use our CRDs for NGINX Ingress controller and use snippets to fill in the specifics you need for your application.
here is an example of using our CRDs (VirtualServer/VirtualServerRoute) and snippets when needed.

https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#using-snippets

HTH

[janisii]

@uGiFarukh did you manage to setup php-fpm to redirect traffic to php-fpm deployment?