chapter: Common Ingress Configuration

text:
The Ingress Configuration can be performed at various levels:
- Per Component / Chart
`ingress.`
- Per Instance
`global.ingress.`
- Per Environment
`global.environment.ingress.`
This enables you to have configuration yaml files per environment (e.g. for DEV, QA and PROD) setting environment defaults.
You then do not have to touch the Instance configuration.
Example:
```
helm upgrade -i \
--values $SAMPLES/big-instance.yaml \
--values $SAMPLES/applications.yaml \
--values $SAMPLES/dev.yaml \
demo nplus/instance-argo
```
You might have your Instance values in the `big-instance` file, the Apps you want to have deployed to that instance
in the `applications` file, and then you add your default setting for the `dev` stage, potentionally overwriting anything
from the above. The priority in this is *last one wins*.
> The Values are taken by the chart in the following order:
> Component, then Instance, then Environment.
If no value is set, the configuration is dropped from the manifest.
In the following table, you see what value can be defined in which section:
| Key  | Component  | Instance  | Environment |
| ---- | ----------- | ----------- | ----------- |
| backend | ✔ | ✔ | ✔ |
| domain | ✔ | ✔ | ✔ |
| issuer | ✔ | ✔ | ✔ |
| class | ✔ | ✔ | `public` |
| enabled | ✔ | - | - |
| backendProtocol | ✔ | - | - |
| cookie | ✔ | - | - |
| inputPath | ✔ | - | - |
| deny  | ✔ | - | - |
| whitelist | ✔ | ✔ | ✔ |
| namespace | ✔ | ✔ | ✔ |
For the component ingress, you can specify the following values:
| Key | Description | Default |
|-----|-------------|---------|
| backend | chose for either `nginx` or `traefik` as your backend ingress controller, as the annotations differ. | `"nginx"` |
| backendProtocol | choose wether you want http or https as the backend protocol. This will encrypt traffic from the ingress controller to your pods if you set it to https. | `"http"` |
| class | sets the ingressclass to use. e.g. `public` or `nginx` | `"public"` |
| cookie | on component level, set cookie affinity for the ingress example: `XtConLoadBalancerSession` for nscale Web | component dependent |
| domain | sets the ingress domain, like `tenant1.mydomain.com`. If no domain is set, no ingress will be configured automatically | none |
| enabled | on component level, enable or disable the ingress | component dependent |
| inputPath | this defines the path (on component level) for this component Example: `nscale_web` for nscale Web | component dependent |
| issuer | if you use *cert-manager* or any other certificate issuer, you can add the class here to hand certificate issuing requests to this issuer. if you do not set any issuer, the chart will generate a self-signed certificate for your ingress (if you defined a domain) |  |
| deny | you can specify specific paths to be denied by this ingress | component dependent |
| whitelist | optionally specify a list of allowed ip ranges to use an ingress | not restricted |
| namespace | when securing the instance with network policies, you can specify the source namespace of the ingress controller | "ingress" |
| annotations | adds extra annotations||
> Please the the FAQ for information about using a DMZ, where additional cluster configuration will be necessary


chapter: Annotations

text:
You can add extra Annotations to the ingress by adding
```
global:
ingress:
annotations:
nginx.org/proxy-connect-timeout: "30s"
nginx.org/proxy-read-timeout: "20s"
nginx.org/client-max-body-size: "4m"
nginx.org/server-snippets: |
location / {
return 302 /coffee;
}
```