Exposing FastCGI Servers and change webroot from /var/www/html to /var/www/html/public

[agustin-caylent]

Is this a request for help? No

What keywords did you search in NGINX Ingress controller issues before filing this one? fcgi root /var/www/html

---

Is this a BUG REPORT or FEATURE REQUEST? (choose one): FEATURE REQUEST

• Describe in detail the feature/behavior/change you'd like to see.

Using annotations described here https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services/ we were able to get the traffic to the php pod. However, we need the root changed from "/var/www/html" to "/var/www/html/public".

NGINX Ingress controller version: "0.26.1"

Kubernetes version (use kubectl version): "1.14"

Environment: production (migrating to kubernetes)

• Cloud provider or hardware configuration: AWS EKS
• OS (e.g. from /etc/os-release): php app running in php:7.3-fpm docker image (debian based)
• Kernel (e.g. uname -a): "Linux php-689789df4b-scgpb 4.14.152-127.182.amzn2.x86_64 Basic structure  #1 SMP Thu Nov 14 17:32:43 UTC 2019 x86_64 GNU/Linux"
• Install tools:
• Others:

What happened:
Traffic gets routed to our php pod, while putting annotations and configmap for FGCI, but we need to change the default nginx root from "/var/www/html" to "/var/www/html/public" in order to have the application working properly.

What you expected to happen:
To change the nginx root to ""/var/www/html" to "/var/www/html/public".

How to reproduce it (as minimally and precisely as possible):
We can deploy our application locally manually deploying an nginx docker image, and modify the FCGI in the "/etc/nginx/conf.d/default.conf" as well as "root /var/www/html/public;"

Anything else we need to know:
We tried with annotations such as nginx.ingress.kubernetes.io/rewrite-target or nginx.ingress.kubernetes.io/app-root but neither of these seem to get along well with the FGCI annotations

[aledbf]

Closing. Please check https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services/
I think the param you want to change is DOCUMENT_ROOT (using a configmap to define custom FastCGI params)

[agustin-caylent]

thanks @aledbf ! I have already checked that documentation, and it had no direct comment on which other directives could be changed using configmap. For future references, I added:

DOCUMENT_ROOT: /var/www/html/public

And it changed that. But still not working, probably because of other FastCGI params. Where can I find which can I change using configmap?

For example if I need to change fastcgi_buffer_size and fastcgi_buffers , do I just set them same way in the configmap?

FASTCGI_BUFFER_SIZE: "16k"
FASTCGI_BUFFERS: "4 16k"

[agustin-caylent]

And how about the location? For example this is what I got in the /etc/nginx/nginx.conf from the nginx-ingress controller pod:

		location / {

			set $namespace      "prod";
			set $ingress_name   "php";
			set $service_name   "php";
			set $service_port   "9000";
			set $location_path  "/";

...

			include /etc/nginx/fastcgi_params;
			fastcgi_index "index.php";
			fastcgi_param DOCUMENT_ROOT "/var/www/html/public";

I want that location / { to be ~ \.php$ { Can that be changed ?

Thanks!!

[aledbf]

Where can I find which can I change using configmap?

There is no documentation for that. You can set any fastcgi_param defined in the nginx manual https://www.nginx.com/resources/wiki/start/topics/examples/phpfcgi/

Edit: the FastCGI feature just mirrors what nginx provides. If you already are using nginx to expose the php app you should just add those settings in the configmap

[aledbf]

I want that location / { to be ~ .php$ { Can that be changed ?

Why? Unless you have other routes in the ingress, doing that change means only .php URLs will work and any other will get 404.

[aledbf]

For example if I need to change fastcgi_buffer_size and fastcgi_buffers , do I just set them same way in the configmap?

No. If you need to change fastcgi settings I suggest you use the configuration snippet annotation https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#configuration-snippet

[agustin-caylent]

Thank @aledbf !! You saved our day!

One last thing, now we are getting 404 on trying to access files that are actually there. In our local nginx custom deploy we have the following modified in the default.conf

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

How could we address that?

We get

10.40.11.228 -  11/Dec/2019:16:17:50 +0000 "GET /dist/css/app.css" 404

On the php FastCGI pod, even when that file (and others) are there.

Thanks again!!

[aledbf]

10.40.11.228 - 11/Dec/2019:16:17:50 +0000 "GET /dist/css/app.css" 404

If you see that output in the log, it means the php app is returning 404.
I suggest you use curl from the ingress controller pod to check the response, like
kubectl exec -it -n ingress-nginx <ingress pod> curl php.prod.svc.cluster.local:9000/dist/css/app.css

[aledbf]

try_files $uri $uri/ /index.php?$query_string;

try_files directive makes no sense in ingress-nginx. Your backend application must be able to serve any URL.

[agustin-caylent]

and could it be the fact that the FastCGI annotations are messing with that ability to serve other URLs or not?

[agustin-caylent]

curl -v php.prod.svc.cluster.local:9000/dist/css/app.css
*   Trying 172.20.131.158...
* TCP_NODELAY set
* Connected to php.prod.svc.cluster.local (172.20.131.158) port 9000 (#0)
> GET /dist/css/app.css HTTP/1.1
> Host: php.prod.svc.cluster.local:9000
> User-Agent: curl/7.52.1
> Accept: */*
>
* Recv failure: Connection reset by peer
* Curl_http_done: called premature == 1
* stopped the pause stream!
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer

[aledbf]

@agustin-caylent from that output is clear the PHP FastCGI configuration only process PHP files (which makes sense). I think you should add (again) nginx in your app but only to serve the static assets.

That said, I prefer to serve static assets using Cloudfront (from an S3 bucket) in a subdomain, avoiding this traffic in the cluster. (In general, FastCGI or not)

[agustin-caylent]

Yes, moving statics to S3 + CDN is on the plan, and we will do. This was SUPER helpful, thanks much @aledbf !!

[oleg-filiutsich]

@agustin-caylent You save you root content in php-fpm pod?

[robertwt7]

@agustin-caylent Hey bro, did you manage to get laravel working with the config? I've been trying for the past 2 days to bypass our nginx container with ingress controller FCGI straightaway but I still got 404 from nginx.. no logs form the pods at all

Mind sharing working config from your app?

here's mine that's not working:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: ingress-cm
data:
  DOCUMENT_ROOT: "/var/www/public"
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: salt-operation-ingress
  labels:
    app: salt-operation-ingress
  annotations:
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/backend-protocol: "FCGI"
    nginx.ingress.kubernetes.io/fastcgi-index: "index.php"
    nginx.ingress.kubernetes.io/fastcgi-params-configmap: "ingress-cm"
    nginx.ingress.kubernetes.io/fastcgi_buffers: "16 16k"
    nginx.ingress.kubernetes.io/fastcgi_buffer_size: "32k"
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
    # nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
    # nginx.ingress.kubernetes.io/from-to-www-redirect: "true"
spec:
  rules:
  - host: message-parser.app.com.au
    http:
      paths:
      - path: /*
        backend:
          serviceName: message-parser-service
          servicePort: fastcgi
  - host: backend.app.com.au
    http:
      paths:
      - path: /*
        backend:
          serviceName: operation-service
          servicePort: fastcgi

[viktor-lt]

@agustin-caylent Hey bro, did you manage to get laravel working with the config? I've been trying for the past 2 days to...

Have you managed to make it work ?

I am still unable.. (#8207)