APISIX setup

Apache APISIX is the API gateway in front of every Domino Workspace component. HCL Domino manages its own routes through the APISIX Admin API and requires specific gateway capabilities to be enabled up front.

Requires cert-manager for the public-facing TLS certificate (see below), and a working load balancer — without one, the service.type: LoadBalancer Service below stays in <pending> state.

The dom-router plugin required by Domino ships with its own separate installation instructions.

Install

helm repo add apisix https://charts.apiseven.com
helm repo update

Create apisix-values.yaml with the minimum values needed by the Domino Workspace charts:

service:
  type: LoadBalancer
  # -- Preserve client source IPs for HTTP routes, needed by features such as
  # apisix.smtpIpRestriction in the Domino chart. Whether source IPs are also
  # preserved on the TCP stream routes below depends on the load balancer
  # implementation — some require PROXY protocol; check with the load balancer's
  # own documentation.
  externalTrafficPolicy: Local
  stream:
    # -- Enable the TCP stream proxy for non-HTTP protocols
    enabled: true
    tcp:
      - 25   # SMTP
      - 636  # LDAPS
      - addr: 993
        tls: true  # IMAPS with TLS passthrough
      - 1352  # HCL Notes/Domino (NRPC)
      # Override the container-side ports via apisix.streamPorts.* in the Domino
      # chart if these listener ports differ — see "Default routes" in the Domino
      # chart documentation.

apisix:
  ssl:
    enabled: true
    containerPort: 443
  admin:
    credentials:
      # Generate both as random alphanumeric strings (see Helm deployment
      # prerequisites). Reuse this admin value in the ingress-controller block
      # below, and as apisix.adminKey in the Domino chart.
      admin: <admin API key>
      viewer: <read-only API key>
  prometheus:
    enabled: true
  # Plugins used by the default routes shipped with the Domino chart
  # (charts/domino/files/apisix-routes.yaml). The dom-router plugin is
  # registered separately via its own installation, not through this list.
  plugins:
    - cors
    - ip-restriction
    - openid-connect
    - proxy-control
    - redirect

# Required for every component other than Domino: they route through
# ApisixRoute/Ingress resources, which need the ingress controller watching
# for them (Domino manages its routes directly via the Admin API instead).
ingress-controller:
  enabled: true
  gatewayProxy:
    createDefault: true
    provider:
      controlPlane:
        auth:
          adminKey:
            value: <admin API key>  # same as apisix.admin.credentials.admin above
  apisix:
    adminService:
      namespace: ingress-apisix

helm upgrade --install apisix apisix/apisix \
  --namespace ingress-apisix \
  --create-namespace \
  -f apisix-values.yaml

Domino can take this key inline (apisix.adminKey) or as a Secret reference (apisix.secretName) — see APISIX Admin API integration.

Public-facing certificate

APISIX terminates TLS for <domain> and *.<domain> on port 443. The certificate can come from a public CA or be supplied directly as a certificate/key pair — see cert-manager: public-facing certificate.

etcd

The chart above uses APISIX's bundled etcd by default, which is fine for a single-node evaluation. For a highly available etcd backend, see APISIX's own documentation on running with an external etcd cluster.

Verify

kubectl get pods -n ingress-apisix
kubectl get svc -n ingress-apisix apisix-gateway

EXTERNAL-IP of apisix-gateway should show the address allocated by the load balancer rather than <pending>.

Confirm the Admin API is reachable (from inside the cluster, or via a temporary port-forward):

kubectl port-forward -n ingress-apisix svc/apisix-admin 9180:9180
curl -H "X-API-KEY: <admin API key>" http://127.0.0.1:9180/apisix/admin/routes