default ingress controller

[weatherhog]

We as Giantswarm want to be able to provide a default ingress controller.

Discovery:

how to deploy a default ingress controller?

• Deploy it like any other default app. Make sure it's configurable by the customer in case they want to use their own ingress controller Do we need an extra LB?
• What does "extra" mean? Generally an ingress only makes sense if it's bound to a LB on the provider side. How to have multiple IC running as smooth as possible?
• Observe best practices regarding running multiple ingress controller. Utilize kyverno to prevent known issues like resolving foreign ingress classes. Highly depends on the specific case.

In regards to requirements for default ingress controller for SSO we started a live doc: https://docs.google.com/document/d/1T5BaiX5adnKGZobpIqvkovE1vUb8QcTPBG-KZbjPFHY/edit

[ced0ps]

This is phrased kind of ambiguously.

1. Do we want to provide a default ingress controller for customers to use?
2. Does our infrastructure (e.g. dex) require a default ingress controller on WCs?

As we see no point in "forcing" an ingress controller on the customer if they can just as well install it themselves if the need one, we're assuming that it's about GS requiring a default ingress controller.

[ced0ps]

If this is about having an ingress route to WC clusters for GS requirements we also discussed the option of having a central ingress controller on the MC that routs traffic to the WC. That way we only need one provider LB for alll WCs

[ced0ps]

Next steps:

1. Please get answers for the outlined questions from the stakeholders
2. We want to investigate if one ingress controller can resolve multiple ingress classes
3. Get specific requirements from Big Mac regarding SSO

[weatherhog]

also see this issue https://github.com/giantswarm/giantswarm/issues/20858