Skip to main content

Chapter 8.1 - Introduction to Ingress

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand what Ingress is and why to use it
  • Distinguish Ingress from other exposure methods
  • Understand the Ingress architecture
  • Identify appropriate use cases
  • Understand advantages and limitations

Introduction​

Exposing applications in Kubernetes can be done in several ways. Ingress is the recommended method for exposing HTTP/HTTPS services from outside the cluster.

What is Ingress?​

Ingress exposes HTTP and HTTPS Services from outside the cluster to services inside the cluster. It provides:

  • Routing based on hostname or path
  • TLS/SSL termination
  • Load balancing
  • A single entry point for multiple services

Ingress Architecture​

Components​

  1. Ingress Resource: Defines routing rules
  2. Ingress Controller: Pod that implements the rules (NGINX, Traefik, etc.)

Comparison of Methods​

NodePort​

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  type: NodePort
  ports:
  - port: 80
    nodePort: 30080

Advantages:

  • Simple
  • No external dependency

Disadvantages:

  • High ports (30000-32767)
  • No hostname-based routing
  • No built-in TLS
  • One port per service

LoadBalancer​

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  type: LoadBalancer
  ports:
  - port: 80

Advantages:

  • Dedicated external IP
  • Native cloud integration

Disadvantages:

  • Cost (one LB per service)
  • No hostname-based routing
  • No built-in TLS

Ingress​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        backend:
          service:
            name: web-service
            port:
              number: 80

Advantages:

  • Hostname/path-based routing
  • Built-in TLS
  • Single entry point
  • Cost-effective (one LB for multiple services)

Disadvantages:

  • Requires an Ingress Controller
  • HTTP/HTTPS only

Use Cases​

1. Multi-Domains​

Expose multiple domains with a single LoadBalancer:

2. Path-Based Routing​

Routing based on the path:

example.com/api     → API Service
example.com/web     → Web Service
example.com/admin   → Admin Service

3. TLS/SSL Termination​

Centralized management of SSL/TLS certificates.

4. Load Balancing​

Traffic distribution among multiple instances.

Basic Example​

Step 1: Service​

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 8080

Step 2: Ingress​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

Result: example.com routes to web-service.

Ingress Controllers​

An Ingress Controller is a Pod that watches Ingress resources and configures a load balancer.

  1. NGINX Ingress Controller

    • Most popular
    • High performance
    • Feature-rich

  2. Traefik

    • Simple and modern
    • Auto-configuration
    • Built-in dashboard

  3. HAProxy Ingress

    • Very high performance
    • Advanced configuration

  4. Istio Gateway

    • For service mesh
    • Advanced features

Advantages of Ingress​

1. Cost-Effective​

A single LoadBalancer for multiple services:

2. Advanced Routing​

  • By hostname
  • By path
  • By headers
  • Rewrites and redirects

3. Centralized TLS​

Certificate management at the Ingress level.

4. Flexibility​

Declarative configuration with YAML.

Limitations​

1. HTTP/HTTPS Only​

Ingress supports only HTTP and HTTPS. For TCP/UDP, use NodePort or LoadBalancer.

2. Requires a Controller​

An Ingress Controller must be installed in the cluster.

3. External Dependency​

For external access, a LoadBalancer or NodePort is still required.

Summary​

In this chapter, you learned:

Ingress: HTTP/HTTPS exposure with advanced routing
Architecture: Ingress Resource + Ingress Controller
Advantages: Hostname/path routing, TLS, cost-effective
Comparison: Better than NodePort/LoadBalancer for HTTP
Use cases: Multi-domains, path-based routing, TLS
Limitations: HTTP/HTTPS only, requires a controller
Ingress Controllers: NGINX, Traefik, HAProxy, Istio

Next Steps​

Chapter 8.2: Ingress Controller (Installation and Configuration)
Chapter 8.3: Routing and TLS

Chapter created: December 2024