<p>New to K8s and facing an implementation dilemma. I need to deploy a K8s cluster for multiple NGINX-PHP websites, each with its own domain. The number of websites hosted can increase/decrease regularly, with hundreds/thousands of them deployed at any given time. I have excluded the PHP part to keep the question simple.</p>

<p><strong>Scenario 1 - vhost and SSL termination at ingress</strong></p>

<ul>
<li>Create a new Namespace containing a new Service and a Deployment (NGINX pods) for every new website</li>
<li>Setup the virtual host on NGINX Ingress and route it to the service responsible for the website based on the hostname</li>
</ul>

<p><em>Pros:</em></p>

<ul>
<li>Pod/Container level isolation for each website</li>
</ul>

<p><em>Possibly a con?</em></p>

<ul>
<li>Each website requires a new service and a deployment. This can result in hundreds or thousands of services/deployments</li>
</ul>

<p><strong>Scenario 2 - vhost and SSL termination at pod level</strong></p>

<ul>
<li>Create a single NGINX Service and a Deployment (with pods running a single NGINX container)</li>
<li>Each pod has access to shared configmap and tls-secret which contains NGINX config and tls certs for every virtual host</li>
<li>Ingress routes all traffic to the NGINX service</li>
<li>The pod running NGINX serves the website content from the document root for the desired virtual host</li>
</ul>

<p><em>Pros:</em></p>

<ul>
<li>Single service and deployment</li>
<li>State less pods</li>
</ul>

<p><em>Cons:</em></p>

<ul>
<li>NGINX instance in each pod shall require a reload to load a new vhost config/ssl certs on addition of a new website, thus resulting in a management nightmare</li>
</ul>

<p>Which one of above scenario is better suited? Are there any other possible scenarios for given problem?</p>

John
<p>If you'd like to just avoid having hundreds of services you can set up a single <a href="https://github.com/kubernetes/ingress-nginx" rel="noreferrer">nginx ingress controller</a> (with a single ingress class in your cluster) and then create multiple <a href="https://kubernetes.io/docs/concepts/services-networking/ingress/" rel="noreferrer">Ingresses</a> using the single ingress controller. (It can also be a single Ingress if you'd like, with hostname-based routing)</p>

<p>This controller basically runs in a deployment with multiple pods and can scale up and down (for example using an <a href="https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/" rel="noreferrer">HPA</a> or/and the <a href="https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler" rel="noreferrer">cluster autoscaler</a> or/and the <a href="https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler" rel="noreferrer">VPA</a>). </p>

<p>The nginx controller takes care of reloading nginx with the new configs everytime you changed them (with no downtime). You can also have an SSL termination per Kubernetes Ingress, so if you have multiple domains that can also be handled.</p>

<p>Hope it helps!</p>
