The Problem

Your webhook-receiving service runs in Kubernetes. Your Ingress is internal-only (no public LoadBalancer). How do external webhooks reach it?

Solution

Skooh Proxy runs as a Kubernetes Deployment, maintains an outbound connection to Skooh Cloud, and forwards to your internal Ingress.

Note: For non-Kubernetes environments, you can also use the Skooh Desktop App on any workstation, or run Docker on any Linux server.

Architecture

Internet → Skooh Cloud → (outbound connection) → Skooh Proxy Pod
                                                        ↓
                                             Internal Ingress
                                                        ↓
                                              Your Service Pods

Kubernetes Manifests

Skooh Proxy Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: skooh-proxy
  namespace: webhooks
spec:
  replicas: 2  # HA
  selector:
    matchLabels:
      app: skooh-proxy
  template:
    metadata:
      labels:
        app: skooh-proxy
    spec:
      containers:
      - name: skooh-proxy
        image: skooh/proxy:latest
        env:
        - name: SKOOH_TOKEN
          valueFrom:
            secretKeyRef:
              name: skooh-credentials
              key: token
        - name: SKOOH_API_KEY
          valueFrom:
            secretKeyRef:
              name: skooh-credentials
              key: api-key
        - name: FORWARD_URL
          value: "http://webhook-service.webhooks.svc.cluster.local/hooks"
        resources:
          requests:
            memory: "64Mi"
            cpu: "50m"
          limits:
            memory: "128Mi"
            cpu: "100m"

Secret

apiVersion: v1
kind: Secret
metadata:
  name: skooh-credentials
  namespace: webhooks
type: Opaque
stringData:
  token: "your-hook-token"
  api-key: "your-api-key"

Your Webhook Service

apiVersion: v1
kind: Service
metadata:
  name: webhook-service
  namespace: webhooks
spec:
  selector:
    app: webhook-handler
  ports:
  - port: 80
    targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: webhook-handler
  namespace: webhooks
spec:
  replicas: 3
  selector:
    matchLabels:
      app: webhook-handler
  template:
    metadata:
      labels:
        app: webhook-handler
    spec:
      containers:
      - name: handler
        image: your-org/webhook-handler:latest
        ports:
        - containerPort: 8080

With Internal Ingress

If you use an internal Ingress controller:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webhook-ingress
  namespace: webhooks
  annotations:
    kubernetes.io/ingress.class: nginx-internal  # Internal ingress class
spec:
  rules:
  - host: webhooks.internal.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: webhook-service
            port:
              number: 80

Update FORWARD_URL to use the Ingress:

- name: FORWARD_URL
  value: "http://webhooks.internal.example.com/hooks"

TLS to Internal Services

If your internal Ingress uses TLS:

- name: FORWARD_URL
  value: "https://webhooks.internal.example.com/hooks"

For self-signed certs, you may need to add CA certificates to the proxy container.

Health Checks

Add liveness/readiness probes:

livenessProbe:
  httpGet:
    path: /health
    port: 8081
  initialDelaySeconds: 10
  periodSeconds: 30
readinessProbe:
  httpGet:
    path: /ready
    port: 8081
  initialDelaySeconds: 5
  periodSeconds: 10

Multiple Endpoints

For different webhook sources, run multiple proxies:

# Stripe webhooks
- name: skooh-stripe
  env:
  - name: SKOOH_TOKEN
    value: "stripe-token"
  - name: FORWARD_URL
    value: "http://payments-service/webhooks/stripe"

# GitHub webhooks  
- name: skooh-github
  env:
  - name: SKOOH_TOKEN
    value: "github-token"
  - name: FORWARD_URL
    value: "http://ci-service/webhooks/github"

Monitoring

Add Prometheus metrics:

annotations:
  prometheus.io/scrape: "true"
  prometheus.io/port: "9090"

Deploy to Kubernetes →