<p>The closest tutorial I can find in getting an SSL terminating Ingress and an nginx based controller running on bare metal (Digital Ocean, for example) is this:</p>

<p><a href="https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx" rel="nofollow">https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx</a></p>

<p>but it leaves so many assumptions unexplained.</p>

<h1>My ingress requirements are simply:</h1>

<ul>
<li>default backend at port 80 for all hosts that:

<ul>
<li>file access to <code>location ^~ /.well-known/acme-challenge/</code> which allows my LetsEncrypt cert renewals to work</li>
<li>404 on <code>location /.well-known/acme-challenge/</code></li>
<li>301 on <code>location /</code></li>
</ul></li>
<li>subdomain based routing to different backend services on port 443</li>
<li>each subdomain points to a different SSL key/cert (generated by my LetsEncrypt, and stored in K8S as a secret I suppose??)</li>
</ul>

<h1>What I think need is this:</h1>

<ul>
<li>full documentation on writing Ingress rules

<ul>
<li>can I configure SSL certs (on port 443) for each backend individually?</li>
<li>is / the "path" that's a catchall for a host?</li>
</ul></li>
<li>updating Ingress rules in place</li>
<li>what nginx controller do I use? nginx? nginx-alpha? nginx-ingress docker container -- and where is the documentation for each of these controllers?

<ul>
<li>is there a base controller image that I can override the nginx.conf template that gets populated by Ingress changes from the API server?</li>
</ul></li>
<li>how do you store SSL keys and certs as secrets?</li>
</ul>

<p>boo my answers apply to <a href="https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx">https://github.com/kubernetes/contrib/tree/master/ingress/controllers/nginx</a></p>

<blockquote>
  <ul>
  <li>default backend at port 80 for all hosts that:
  
  <ul>
  <li>404 on <code>location /.well-known/acme-challenge/</code></li>
  </ul></li>
  </ul>
</blockquote>

<p>this is not possible using Ingress rules</p>

<blockquote>
  <ul>
  <li>301 on <code>location /</code></li>
  </ul>
</blockquote>

<p>This is already supported. If the server contains a SSL certificate it will redirect to <code>https</code>automatically</p>

<blockquote>
  <ul>
  <li>subdomain based routing to different backend services on port 443</li>
  <li>each subdomain points to a different SSL key/cert (generated by my LetsEncrypt, and stored in K8S as a secret I suppose??)</li>
  </ul>
</blockquote>

<p>You need to create multiple Ingress rules, one per subdomain. Each rule can use a different secret name (this will create multiple servers, one per subdomain)</p>

<h1>What I think need is this:</h1>

<blockquote>
  <ul>
  <li>full documentation on writing Ingress rules</li>
  </ul>
</blockquote>

<p><a href="http://kubernetes.io/docs/user-guide/ingress/">http://kubernetes.io/docs/user-guide/ingress/</a> </p>

<p>(I don't know id there's additional information besides the go code)</p>

<blockquote>
  <ul>
  <li>can I configure SSL certs (on port 443) for each backend individually?</li>
  <li>is / the "path" that's a catchall for a host?</li>
  </ul>
</blockquote>

<p>yes</p>

<blockquote>
  <ul>
  <li>updating Ingress rules in place</li>
  <li>what nginx controller do I use? nginx? nginx-alpha? nginx-ingress docker container -- and where is the documentation for each of these controllers?</li>
  </ul>
</blockquote>

<p>This depends on what you need, if you want to build you custom Ingress controller you can use <code>nginx-alpha</code> as reference. If <code>nginx-ingress</code> is not clear in the examples please open an issue and mention what could be improved in the examples or it's missing</p>

<blockquote>
  <ul>
  <li>is there a base controller image that I can override the nginx.conf template that gets populated by Ingress changes from the API server?</li>
  </ul>
</blockquote>

<p>No. The reason for this is that the template is tied to the go code that populates the template. That said, you can build a custom image changing the template but this requires you deploy the image to tests the changes </p>

<blockquote>
  <ul>
  <li>how do you store SSL keys and certs as secrets?</li>
  </ul>
</blockquote>

<p>yes, as secrets like this <a href="http://kubernetes.io/docs/user-guide/ingress/#tls">http://kubernetes.io/docs/user-guide/ingress/#tls</a></p>

<p>For the <code>letsencrypt</code> support please check this comment <a href="https://github.com/kubernetes/kubernetes/issues/19899#issuecomment-184059009">https://github.com/kubernetes/kubernetes/issues/19899#issuecomment-184059009</a></p>

<p>Here is a complete example <a href="https://gist.github.com/aledbf/d88c7f7d0b8d4d032035b14ab0965e26">https://gist.github.com/aledbf/d88c7f7d0b8d4d032035b14ab0965e26</a> <a href="https://github.com/kubernetes/contrib/pull/766">added to examples in #766</a></p>
