07 - Ingress & Ingress Controllers

Why this matters

Services alone don't give you host/path-based routing, TLS termination, or a single external entry point. Ingress does — and almost every real-world cluster runs one.

Read this first — Definitions & Explanations

Ingress

An API object that describes HTTP/HTTPS routing into the cluster (host/path rules → backend Services). It is not a server by itself.

Ingress Controller

The software that implements Ingress rules (NGINX, Traefik, HAProxy, cloud controllers). Without a controller, Ingress objects do nothing useful.

Typical flow

Internet → LoadBalancer/NodePort of controller → Ingress rules → Service → Pods

TLS on Ingress

Usually referenced via a Secret (tls.crt / tls.key). Termination often happens at the Ingress controller.

Path and host rules

• Host-based: api.example.com vs www.example.com
• Path-based: /api vs /

IngressClass

Selects which controller should handle an Ingress when multiple controllers exist.

Official docs (read for detail)

• Ingress
• Ingress Controllers
• Gateway API (newer L7 routing model)

Key Concepts

• Ingress resource (the routing rules) vs Ingress controller (the thing that actually implements them — nginx-ingress, Traefik, ALB controller, etc.) — Ingress resources do nothing without a controller running
• Host-based vs path-based routing
• TLS termination at the ingress
• IngressClass — which controller handles which Ingress
• Gateway API — the newer, more expressive successor to Ingress (know it exists)

YouTube search terms

• "Kubernetes Ingress explained nginx ingress controller"
• "Kubernetes Ingress vs Gateway API"
• "Kubernetes TLS termination ingress"

Hands-on lab (on prod-sim)

minikube addons enable ingress -p prod-sim
kubectl get pods -n ingress-nginx

kubectl create deployment app1 --image=hashicorp/http-echo -- -text="app1"
kubectl create deployment app2 --image=hashicorp/http-echo -- -text="app2"
kubectl expose deployment app1 --port=5678
kubectl expose deployment app2 --port=5678

cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: app1.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app1
            port:
              number: 5678
  - host: app2.local
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app2
            port:
              number: 5678
EOF

# Route via /etc/hosts + minikube ip, or minikube tunnel for LoadBalancer-style access
minikube ip -p prod-sim
curl --resolve app1.local:80:$(minikube ip -p prod-sim) http://app1.local
curl --resolve app2.local:80:$(minikube ip -p prod-sim) http://app2.local

Notes

(fill in your own words after watching + labbing)