<p>I'm trying to set up Graylog within my Kubernetes cluster as described <a href="https://github.com/mouaadaassou/K8s-Graylog" rel="nofollow noreferrer">here</a>. The problem I'm running into is the definition of the environment variable GRAYLOG_HTTP_EXTERNAL_URI. The documentation tells me to enter "my IP adress" and from what I was able to find out, the variable is ment to tell the browser where to find the Graylog API.</p>

<p>But my cluster is accessed through a NGINX reverse proxy serving as an ingress controller, which means the browser can't access the Graylog pod directly and even less through http, so it don't really know what value I should assing there. I tried the public IP address of the ingress controller but all I'm getting is a 503. <strong>Is there a way to allow access to the Graylog API while still keeping the service protected behind the ingress controller?</strong></p>

TigersEye120
<p>It really depends on how are you exposing it. By default it's not exposed to the outside world. We have <code>graylog3</code> service of type <code>NodePort</code>, so we have only an internal IP that can be accessed from another pod or used to expose it with ingress. </p>

<pre><code>$ kubectl get service -o wide
NAME         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)                          AGE   SELECTOR
es6          NodePort    10.23.244.28    &lt;none&gt;        9200:30001/TCP,9300:30002/TCP    54m   service=es-deploy
graylog3     NodePort    10.23.242.128   &lt;none&gt;        9000:30003/TCP,12201:30004/TCP   54m   service=graylog-deploy
kubernetes   ClusterIP   10.23.240.1     &lt;none&gt;        443/TCP                          57m   &lt;none&gt;
mongo        ClusterIP   10.23.243.160   &lt;none&gt;        27017/TCP                        54m   service=mongo-deploy
</code></pre>

<p>If we curl this service and port from another pod we have the following output: </p>

<pre><code>$ kubectl exec -ti ubuntu -- curl 10.23.242.128:9000
&lt;!DOCTYPE html&gt;
&lt;html&gt;
  &lt;head&gt;
    &lt;meta http-equiv="X-UA-Compatible" content="IE=edge"&gt;
    &lt;meta name="robots" content="noindex, nofollow"&gt;
    &lt;meta charset="UTF-8"&gt;
    &lt;title&gt;Graylog Web Interface&lt;/title&gt;
    &lt;link rel="shortcut icon" href="http://your_ip_address:30003/assets/favicon.png"&gt;

  &lt;/head&gt;
  &lt;body&gt;
    &lt;script src="http://your_ip_address:30003/config.js"&gt;&lt;/script&gt;

    &lt;script src="http://your_ip_address:30003/assets/vendor.4024e2a8db732781a971.js"&gt;&lt;/script&gt;

    &lt;script src="http://your_ip_address:30003/assets/polyfill.a5e2fb591e8fd54ee4ef.js"&gt;&lt;/script&gt;

    &lt;script src="http://your_ip_address:30003/assets/builtins.a5e2fb591e8fd54ee4ef.js"&gt;&lt;/script&gt;

    &lt;script src="http://your_ip_address:30003/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.b864ba54b438ac0bdc48.js"&gt;&lt;/script&gt;

    &lt;script src="http://your_ip_address:30003/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.bcc87290018e859a8a9e.js"&gt;&lt;/script&gt;

    &lt;script src="http://your_ip_address:30003/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.8ae7cb13983ce33eeb5b.js"&gt;&lt;/script&gt;

    &lt;script src="http://your_ip_address:30003/assets/app.a5e2fb591e8fd54ee4ef.js"&gt;&lt;/script&gt;

  &lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>As can be seen, there is a reference for <code>http://your_ip_address:30003</code>. If we leave it this way, the application will break because it's referencing something nonexistent. </p>

<p>So I'll change 2 things, make it visible from the outside world with an ingress and change <code>GRAYLOG_HTTP_EXTERNAL_URI</code> to the correct IP I'll get:</p>

<p>1 - Creating ingress rule to expose Graylog: </p>

<p>This is how my ingress manifest is looking</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: graylog
spec:
  backend:
    serviceName: graylog3
    servicePort: 9000
</code></pre>

<pre><code>$ kubectl get ingresses 
NAME      HOSTS   ADDRESS          PORTS   AGE
graylog   *       34.107.139.231   80      56s
</code></pre>

<p>2 - Edit our <code>GRAYLOG_HTTP_EXTERNAL_URI</code> and substitute <code>http://your_ip_address:30003</code> for <code>http://34.107.139.231:80</code>. </p>

<p>Observe that here I'm changing port from <code>30003</code> to <code>80</code> since our ingress rule is exposing on port <code>80</code>.</p>

<pre><code>$ kubectl edit deployments graylog-deploy 
</code></pre>

<p>Changes made, now let's curl this port from any console (give it some time for the pods to be recreated): </p>

<pre><code>$ curl 34.107.139.231:80
&lt;!DOCTYPE html&gt;
&lt;html&gt;
  &lt;head&gt;
    &lt;meta http-equiv="X-UA-Compatible" content="IE=edge"&gt;
    &lt;meta name="robots" content="noindex, nofollow"&gt;
    &lt;meta charset="UTF-8"&gt;
    &lt;title&gt;Graylog Web Interface&lt;/title&gt;
    &lt;link rel="shortcut icon" href="http://34.107.139.231:80/assets/favicon.png"&gt;

  &lt;/head&gt;
  &lt;body&gt;
    &lt;script src="http://34.107.139.231:80/config.js"&gt;&lt;/script&gt;

    &lt;script src="http://34.107.139.231:80/assets/vendor.4024e2a8db732781a971.js"&gt;&lt;/script&gt;

    &lt;script src="http://34.107.139.231:80/assets/polyfill.a5e2fb591e8fd54ee4ef.js"&gt;&lt;/script&gt;

    &lt;script src="http://34.107.139.231:80/assets/builtins.a5e2fb591e8fd54ee4ef.js"&gt;&lt;/script&gt;

    &lt;script src="http://34.107.139.231:80/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.b864ba54b438ac0bdc48.js"&gt;&lt;/script&gt;

    &lt;script src="http://34.107.139.231:80/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.bcc87290018e859a8a9e.js"&gt;&lt;/script&gt;

    &lt;script src="http://34.107.139.231:80/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.8ae7cb13983ce33eeb5b.js"&gt;&lt;/script&gt;

    &lt;script src="http://34.107.139.231:80/assets/app.a5e2fb591e8fd54ee4ef.js"&gt;&lt;/script&gt;

  &lt;/body&gt;
&lt;/html&gt;
</code></pre>

<p>Now we can see <code>http://34.107.139.231:80/</code> as expected and the page can be loaded perfectly. </p>

<p>If you have a domain name that's redirecting to your application IP, put it in this variable. </p>
