ingress | WIP Caddy 2 ingress controller for Kubernetes | Load Balancing library

The answer is posted in the comment:

Well, /link1/ is not a prefix of /link1 because a prefix must be the same length or longer than the target string

If you have

If the first service tries to access the second service by the second service's public IP, then the traffic will to out to the Internet and back, which will destroy the association with the network traffic's association with the origin security group.

To keep the traffic inside the VPC, and to make sure the security group rules apply as intended, the first service needs to connect to the second service via the second service's private IP.

If you are using a load balancer for the second service, then it needs to be an internal load balancer, not an external load balancer.

GCP Ingress supports multiple paths. This is also well described in Setting up HTTP(S) Load Balancing with Ingress. For my test I've used both Hello-world v1 and v2.

There are 3 possible issues.

• Issue is with container ports opened. You can check it using netstat:

In your ingress.yaml put quotes around the host key.

If you can call the Lambda function from API Gateway, then your question title "how to connect an aws api gateway to a private lambda function inside a vpc" is already complete and working.

It appears that your actual problem is simply accessing Secrets Manager from inside a Lambda function running in a VPC.

It's also strange that you are assigning a "db" security group to the Lambda function. What are the inbound/outbound rules of this Security Group?

It is entirely unclear why you created a VPC endpoint. What are we supposed to make of service_name = "foo"? What is service "foo"? How is this VPC endpoint related to the Lambda function in any way? If this is supposed to be a VPC endpoint for Secrets Manager, then the service name should be "com.amazonaws.YOUR-REGION.secretsmanager".

If you need more help you need to edit your question to provide the following: The inbound and outbound rules of any relevant security groups, and the Lambda function code that is trying to call SecretsManager.

Update: After clarifications in comments and the updated question, I think the problem is you are missing any subnet assignments for the VPC Endpoint. Also, since you are adding a VPC policy with full access, you can just leave that out entirely, as the default policy is full access. I suggest changing the VPC endpoint to the following:

AFAIK istio collects only ingress HTTP logs by default.

In the istio documentation there is an old article (from 2018) describing how to enable egress traffic HTTP logs.

Please keep in mind that some of the information may be outdated, however I believe this is the part that you are missing.

I had similar issues with Minikube's Ingress, but I was using Windows.

After indepth search, I discovered that the problem came from Docker's driver.

I changed the driver to VirtualBox and Ingress started behaving as expected.

This entry provides further details.

The ingress controller supports case insensitive regular expressions in the spec.rules.http.paths.path field. This can be enabled by setting the nginx.ingress.kubernetes.io/use-regex annotation to true (the default is false). For more information please check here

Using the nginx.ingress.kubernetes.io/use-regex annotation will indicate whether or not the paths defined on an Ingress use regular expressions. The default value is false.

The following will indicate that regular expression paths are being used:

Changes has been appeared exactly in 1.0.5 related to sanitizing annotation inputs.

You may want to check CVE-2021-25742: Ingress-nginx custom snippets. I put in bold interested for you part.

annotation-value-word-blocklist defaults are "load_module,lua_package,_by_lua,location,root,proxy_pass,serviceaccount,{,},',"

Users from mod_security and other features should be aware that some blocked values may be used by those features and must be manually unblocked by the Ingress Administrator.

It seems to me your issue related to mod_security + above blocklist, that contains ' symbol.

For more details please check https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist

In order to fix your issue you should either

• set the value of annotation-value-word-blocklist to an empty string ""

or

• change the value of annotation-value-word-blocklist and remove ' from its list.