Homework: Ingress Resources

Task 1 — Production Ingress Chart

Create a Helm chart for a microservices application called storefront that exposes three services through a single Ingress resource.

Requirements

• Three hosts: shop.storefront.io, api.storefront.io, and admin.storefront.io
• shop.storefront.io routes / (Prefix) to a frontend service on port 3000
• api.storefront.io routes /v1 (Prefix) to an API service on port 8080 and /healthz (Exact) to the same service
• admin.storefront.io routes / (Prefix) to an admin service on port 4000
• TLS enabled for all three hosts using a wildcard secret storefront-wildcard-tls
• Annotations for: ssl-redirect, proxy-body-size of 25m, and a rewrite-target of /
• A default backend pointing to a service called storefront-404 on port 80
• The entire Ingress is conditional on ingress.enabled

Deliverables

1. The templates/ingress.yaml template file
2. The values.yaml with the complete ingress configuration
3. Output of helm template storefront . showing the rendered Ingress resource

Self-Check

Criterion	Pass
Template wrapped in if .Values.ingress.enabled
Three hosts with correct paths and pathTypes
Different port numbers per host (3000, 8080, 4000)
Single TLS entry with wildcard covering all three hosts
All three annotations present in rendered output
Default backend configured for storefront-404:80
helm template renders without errors
Setting ingress.enabled=false produces no Ingress output

Task 2 — cert-manager Integration

Extend a Helm Ingress template to support automated certificate provisioning with cert-manager, controlled entirely through values.

Requirements

• Add a certManager section to values.yaml with fields: enabled (bool), clusterIssuer (string)
• When certManager.enabled is true, the template should automatically add the annotation cert-manager.io/cluster-issuer with the configured issuer name
• The cert-manager annotation should merge with any user-provided annotations (not replace them)
• When certManager.enabled is false, no cert-manager annotation should appear
• Create two values files: values-staging.yaml (using letsencrypt-staging) and values-prod.yaml (using letsencrypt-prod)

Hint

You will need to merge annotations from two sources. Consider building a dict in the template:

{{- $annotations := .Values.ingress.annotations | default dict }}
{{- if .Values.ingress.certManager.enabled }}
  {{- $_ := set $annotations "cert-manager.io/cluster-issuer"
      .Values.ingress.certManager.clusterIssuer }}
{{- end }}

Self-Check

Criterion	Pass
values.yaml has certManager.enabled and certManager.clusterIssuer
cert-manager annotation appears only when certManager.enabled: true
User-provided annotations are preserved alongside cert-manager annotation
Staging values use letsencrypt-staging, prod values use letsencrypt-prod
Both helm template . -f values-staging.yaml and -f values-prod.yaml render cleanly

Task 3 — Environment-Specific Ingress Values

Create three environment-specific values files that demonstrate how the same Ingress template adapts across development, staging, and production.

Requirements

• values-dev.yaml: Ingress disabled (developers use port-forward)
• values-staging.yaml: Single host staging.myapp.internal, no TLS, basic auth enabled via annotations (using a secret called staging-auth), rate limit of 20 rps
• values-prod.yaml: Two hosts (myapp.com and api.myapp.com), TLS with cert-manager (letsencrypt-prod), ssl-redirect enabled, proxy-body-size 100m, no rate limiting

Deliverables

1. All three values files
2. Run helm template with each file and confirm:
   • Dev: no Ingress resource in output
   • Staging: Ingress with basic auth annotations and rate limiting
   • Prod: Ingress with two hosts, TLS block, and cert-manager annotation

Self-Check

Criterion	Pass
Dev values produce zero Ingress resources
Staging Ingress has basic auth annotations (auth-type, auth-secret, auth-realm)
Staging Ingress has limit-rps: "20"
Prod Ingress has two host rules
Prod Ingress has TLS block with cert-manager annotation
Prod Ingress has proxy-body-size: "100m"
All three files render without Helm errors