Stop 08 · Kubernetes & OrchestrationTopics · 5/12

Ingress Controllers

In short

You have a frontend and an API, and you want shop.example.com and shop.example.com/api to land on the right one through a single entry point with HTTPS. That's the job of Ingress.

Managing external HTTP/HTTPS access into the cluster — routing traffic to different Services based on hostname or path, similar in spirit to a reverse proxy but Kubernetes-native.

The mascot stands behind a station enquiry counter pointing travellers with suitcases to different platforms.

Think of it like this

The station enquiry counter

At a busy junction, everyone enters through one main hall. The enquiry counter looks at your ticket and points you: Platform 3 for Howrah, Platform 5 for Chennai. An Ingress controller is that counter, reading the host and path of each request and sending it to the right Service.

Watch it happen

One entry, two Services

Browser

Ingress ctrl

web Service

api Service

GET shop.local/

1/5Every request enters through the Ingress controller, usually behind one cloud load balancer.

The big ideas

What you need to know

Ingress is just rules

The Ingress object only describes routes. Nothing happens until an Ingress controller is installed to read and apply them.

Pick a controller

Traefik, HAProxy, Contour and cloud controllers all implement Ingress. ingressClassName chooses which one handles your rules.

TLS at the edge

Add a tls section with a certificate Secret. cert-manager can fetch and renew free Let's Encrypt certificates for you.

Gateway API is next

The newer Gateway API is the official successor with richer routing. Ingress still works and you'll see it everywhere.

See it in code

Walk through the code

yaml

1apiVersion: networking.k8s.io/v12kind: Ingress3metadata: { name: shop }4spec:5  ingressClassName: traefik6  rules:7    - host: shop.local8      http:9        paths:10          - path: /api11            pathType: Prefix12            backend: { service: { name: api, port: { number: 3000 } } }13          - path: /14            pathType: Prefix15            backend: { service: { name: web, port: { number: 80 } } }

1/4An Ingress handled by the controller whose class is traefik.

k3s and k3d ship with Traefik already installed. On other clusters, install a controller first and set ingressClassName to match it.

Save yourself the pain

Common mistakes

Oops

Creating an Ingress and wondering why nothing happens.

Do this instead

Check a controller is running and its class matches ingressClassName. Without one, an Ingress is just an ignored document.

Oops

Making every Service a LoadBalancer type to expose it.

Do this instead

Each one can create a separate paid cloud load balancer. Put one Ingress or Gateway in front and route by host and path.

Your mission

Route two apps by path

~35 min

Quick check

You applied an Ingress, but kubectl get ingress shows no address and nothing routes. What's the first thing to check?

Go deeper

1Set up a basic Ingress resource routing traffic to a Service in your local cluster.
2Learn the difference between a Service of type LoadBalancer and an Ingress.
3Explore a common Ingress controller (like NGINX Ingress) at a conceptual level.