Skip to main contentCúram on Kubernetes

Ingress Controller

Ingress Controller

An ingress controller is required to manage external HTTP/HTTPS access to Cúram services running in the Kubernetes cluster.

Cúram on Kubernetes uses the F5 NGINX Ingress Controller (f5-nginx-ingress).

Migrating from ingress-nginx: If you are upgrading from a previous deployment that used the community ingress-nginx controller, you must update your ingress annotations before deploying. See the Annotation Migration section below.

Installation

Refer to the F5 NGINX Ingress Controller documentation for installation instructions appropriate to your target platform.

Ensure the ingress controller is running and healthy in your cluster before deploying the Cúram Helm charts:

kubectl get pods -n nginx-ingress

SSL Services

The F5 NGINX Ingress Controller uses the nginx.org/ssl-services annotation to identify which backend services communicate over HTTPS.

See the F5 NGINX ssl-services example for further details.

The Helm chart (helm-charts/spm/templates/ingress.yaml) includes a commented-out nginx.org/ssl-services annotation listing all Cúram backend services. Before deploying, uncomment this annotation and replace {release-name} with your Helm release name, including only the services you have enabled:

nginx.org/ssl-services: "spm-apps-curam,spm-apps-rest,spm-uawebapp,spm-web"

The full list of possible services is:

ServiceEnabled by default
{release-name}-apps-curamYes
{release-name}-apps-restNo
{release-name}-apps-citizenportalNo
{release-name}-apps-curamwebservicesNo
{release-name}-apps-curambirtviewerNo
{release-name}-apps-cpmexternalnsNo
{release-name}-apps-cpmexternalsNo
{release-name}-apps-navigatornsNo
{release-name}-apps-navigatorsNo
{release-name}-apps-mdtworkspaceNo
{release-name}-apps-samplepublicaccessNo
{release-name}-uawebappNo
{release-name}-webYes

Sticky Cookie Services

The F5 NGINX Ingress Controller uses the nginx.org/sticky-cookie-services annotation to enable session affinity per service. Only stateful Liberty app services require sticky sessions — the web and uawebapp services serve static content and do not need to be included.

See the F5 NGINX session-persistence example for further details. The cookie parameters (cookieName, expires, domain, httponly, secure, path) follow the same syntax as the NGINX sticky directive.

The Helm chart (helm-charts/spm/templates/ingress.yaml) includes a commented-out nginx.org/sticky-cookie-services annotation. Before deploying, uncomment it and replace {release-name} with your Helm release name, including only the apps services you have enabled:

nginx.org/sticky-cookie-services: "serviceName=spm-apps-curam srv_id expires=1h path=/Curam"

Multiple services are separated by ;. The full list of possible apps services is:

ServiceEnabled by default
{release-name}-apps-curamYes
{release-name}-apps-restNo
{release-name}-apps-citizenportalNo
{release-name}-apps-curamwebservicesNo
{release-name}-apps-curambirtviewerNo
{release-name}-apps-cpmexternalnsNo
{release-name}-apps-cpmexternalsNo
{release-name}-apps-navigatornsNo
{release-name}-apps-navigatorsNo
{release-name}-apps-mdtworkspaceNo
{release-name}-apps-samplepublicaccessNo

Annotation Migration

This section is for clients migrating from the community ingress-nginx controller to the F5 NGINX Ingress Controller.

The Helm chart retains the community ingress-nginx annotations for backwards compatibility and includes the F5 equivalents commented out. When you are ready to migrate, replace the community annotations with the F5 equivalents as shown below.

Note: F5 NGINX uses two annotation namespaces. nginx.org/ is used for F5-specific features such as SSL services and session persistence. nginx.org/ is used for standard NGINX configuration such as timeouts and server snippets. Both are required as part of a full migration.

Before (community ingress-nginx)

annotations:
  nginx.ingress.kubernetes.io/affinity: cookie
  nginx.ingress.kubernetes.io/backend-protocol: HTTPS
  nginx.ingress.kubernetes.io/session-cookie-path: /
  nginx.ingress.kubernetes.io/proxy-read-timeout: "150"
  nginx.ingress.kubernetes.io/server-snippet: |
    gzip on;
    gzip_types application/atom+xml application/javascript ...;

After (F5 NGINX Ingress Controller)

annotations:
  nginx.org/ssl-services: "spm-apps-curam,spm-apps-rest,spm-uawebapp,spm-web"
  nginx.org/sticky-cookie-services: "serviceName=spm-apps-curam srv_id expires=1h path=/;serviceName=spm-apps-rest srv_id expires=1h path=/"
  nginx.org/proxy-read-timeout: "150s"
  nginx.org/server-snippets: |
    gzip on;
    gzip_types application/atom+xml application/javascript ...;

Key differences:

  • HTTPS backends — replace nginx.ingress.kubernetes.io/backend-protocol: HTTPS with nginx.org/ssl-services listing each backend service by name.
  • Session affinity — replace nginx.ingress.kubernetes.io/affinity: cookie and session-cookie-path with nginx.org/sticky-cookie-services, which combines affinity and cookie configuration per service in a single annotation.
  • Read timeout — replace nginx.ingress.kubernetes.io/proxy-read-timeout: "150" with nginx.org/proxy-read-timeout: "150s". Note the unit suffix is required by F5 NGINX.
  • Server config — replace nginx.ingress.kubernetes.io/server-snippet with nginx.org/server-snippets. Multi-line blocks are supported in both.
Previous
Prerequisites: Bitnami Secure
Next
Cúram application: Installing Cúram software