k8s_gateway_ingress.yaml

# The ingress says "please HTTP proxy PATH on HOSTNAME to the
# respective service I am specifying."
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: llm-gateway-ingress
  namespace:
    rse # Everything we do will be in the "rse" namespace,
    # which logically separates different uses (like with
    # permissions, resource limits, etc).  Everything
    # below is in the rse namespace.
  annotations:
    # The line below magically gives us letsencrypt certificates for
    # our service!  This is for the CSIT cluster, other clusters may
    # be different.
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    # We can define various things declaratively... this tells the
    # maximum HTTP body size to the ingress.
    # TODO: Might need to adapt this...
    nginx.ingress.kubernetes.io/proxy-body-size: 20m
    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
    # Set upstream host header to make sure saml works properly...
    nginx.ingress.kubernetes.io/upstream-vhost: llm-gateway.k8s-test.cs.aalto.fi
    # Allow access only from within aalto
    nginx.ingress.kubernetes.io/whitelist-source-range: 130.233.0.0/16 
# Spec tells the actual parameters: hosts to listen on, path prefixes.
spec:
  tls:
    - hosts:
        - llm-gateway.k8s-test.cs.aalto.fi
      secretName: llm-gateway-deployment
  rules:
    - host: llm-gateway.k8s-test.cs.aalto.fi
      http:
        paths:
          - path: /
            pathType: Prefix
            # To where do we send these incoming requests?  This
            # defines the target of these requests, and corresponds to
            # the service defined below (matching the name).
            backend:
              service:
                name: llm-gateway-svc
                port:
                  number: 3000