<p><em>Background</em></p>
<p>We have a server with one external IP, microk8s and k8s ingress (nginx) configured for name-based virtual hosts. The machine is intended as a playground for several devs for testing container technologies. A problem quickly emerged of route names collisions, with two users trying to set up the same route (like test or dev). One solution would be to include namespaces in the hostnames, but users would still have to cooperate (as opposed to using someone else's  namespace).</p>
<p><em>Question</em></p>
<p>How to restrict user-generated host names (set up with Ingress config files) to include only user's own namespace in name-based virtual hosting (preferably using Nginx ingress)? It seems to be possible, because this is how our corporate Openshift routes (auto-generated hostnames that include namespaces) work: it is not possible to create a route in a namespace without having access (controlled by RBAC) to it.</p>

mirekphd
<p>In <a href="https://docs.openshift.com/container-platform/3.9/architecture/networking/routes.html" rel="nofollow noreferrer">openshift 3.x docs</a> is mentioned:</p>
<blockquote>
<p>If a host name is not provided as part of the route definition, then
OpenShift Container Platform automatically generates one for you. The
generated host name is of the form:</p>
<pre><code>&lt;route-name&gt;[-&lt;namespace&gt;].&lt;suffix&gt;
</code></pre>
</blockquote>
<p>So I guess that what you want is to do the same; generate hostname when one is not provided.</p>
<p>Unfortunately for you, this is not supported by k8s and k8s nginx ingress as far as I know.</p>
<p>What you might want to do is create a <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook" rel="nofollow noreferrer">mutating webhook</a> to mutate the object in flight when applying to k8s (it can e.g. generate a host field if one is not provided), or use <a href="https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#validatingadmissionwebhook" rel="nofollow noreferrer">validating webhook</a> to validate if the object meets the requirements.</p>
<p>Here is a tutorial you might want to check out: <a href="https://github.com/morvencao/kube-mutating-webhook-tutorial" rel="nofollow noreferrer">kube-mutating-webhook-tutorial</a></p>
<p>You can also try to find a different ingress controller that supports the feature you want.</p>
<p>One other solution involves removing access to create ingress objects from developers, and pick only one person that will be responsible for creation and validation of ingress objects (probably bad idea but it is a solution).</p>
