Skip to main content

Chapter 8.2 - Ingress Controller

Learning Objectives​

By the end of this chapter, you will be able to:

  • Understand what an Ingress Controller is
  • Install NGINX Ingress Controller
  • Configure an Ingress Controller
  • Understand the different types of controllers
  • Manage annotations and advanced configurations
  • Troubleshoot an Ingress Controller

Introduction​

An Ingress Controller is a Pod that watches Ingress resources and configures a load balancer to implement routing rules. Without an Ingress Controller, Ingress resources do not work.

What is an Ingress Controller?​

An Ingress Controller is a reverse proxy that:

  • Watches Ingress resources in the cluster
  • Configures a load balancer according to Ingress rules
  • Manages HTTP/HTTPS routing
  • Terminates TLS/SSL
  • Provides load balancing

Important: An Ingress Controller must be installed separately. Kubernetes does not provide a default controller.

Types of Ingress Controllers​

1. NGINX Ingress Controller​

The most popular

Advantages:

  • Very high performance
  • Feature-rich
  • Well documented
  • Active support

Installation:

# Official Kubernetes
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/cloud/deploy.yaml

# Verify the installation
kubectl get pods -n ingress-nginx

2. Traefik​

Simple and modern

Advantages:

  • Auto-configuration
  • Built-in dashboard
  • Simple configuration
  • Built-in Let's Encrypt support

Installation:

# Helm
helm repo add traefik https://traefik.github.io/charts
helm install traefik traefik/traefik

3. HAProxy Ingress​

Very high performance

Advantages:

  • Exceptional performance
  • Advanced configuration
  • TCP/UDP support

4. Istio Gateway​

For service mesh

Advantages:

  • Integration with Istio
  • Advanced features
  • Complete service mesh

Installing NGINX Ingress Controller​

Method 1: Kubernetes Manifest​

# Standard installation
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml

# Verify
kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx

Method 2: Helm​

# Add the repository
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

# Install
helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --create-namespace

Verification​

# View Pods
kubectl get pods -n ingress-nginx

# View the Service
kubectl get svc -n ingress-nginx

# View the external IP
kubectl get svc ingress-nginx-controller -n ingress-nginx

Basic Configuration​

IngressClass​

Define which Ingress class to use:

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx
spec:
  controller: k8s.io/ingress-nginx

Ingress Resource​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

NGINX Annotations​

Annotations allow advanced NGINX configuration:

Rewrite​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /api/(.*)
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

SSL Redirect​

metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"

Rate Limiting​

metadata:
  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "100"

CORS​

metadata:
  annotations:
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "*"

Authentication​

metadata:
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required"

Advanced Configuration​

ConfigMap for NGINX​

apiVersion: v1
kind: ConfigMap
metadata:
  name: nginx-config
  namespace: ingress-nginx
data:
  proxy-body-size: "50m"
  ssl-protocols: "TLSv1.2 TLSv1.3"
  client-max-body-size: "50m"

Apply the Configuration​

apiVersion: apps/v1
kind: Deployment
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  template:
    spec:
      containers:
      - name: controller
        args:
        - /nginx-ingress-controller
        - --configmap=$(POD_NAMESPACE)/nginx-config

Complete Example​

Step 1: Service​

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  selector:
    app: web
  ports:
  - port: 80
    targetPort: 8080

Step 2: Ingress​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
  tls:
  - hosts:
    - example.com
    secretName: example-tls

Useful Commands​

Verification​

# View Controller Pods
kubectl get pods -n ingress-nginx

# Controller Logs
kubectl logs -n ingress-nginx -l app.kubernetes.io/component=controller

# View Services
kubectl get svc -n ingress-nginx

# View Ingresses
kubectl get ingress
kubectl describe ingress web-ingress

Troubleshooting​

# Check the NGINX configuration
kubectl exec -n ingress-nginx <controller-pod> -- cat /etc/nginx/nginx.conf

# Test connectivity
curl -H "Host: example.com" http://<ingress-ip>/

# View events
kubectl get events -n ingress-nginx

Best Practices​

1. Dedicated Namespace​

Install the Ingress Controller in a dedicated namespace (ingress-nginx).

2. Resources​

Define resource limits for the Controller.

3. High Availability​

Deploy multiple replicas of the Controller for high availability.

4. Monitoring​

Monitor Controller metrics (requests, latency, errors).

5. Security​

  • Use TLS everywhere
  • Configure rate limits
  • Enable authentication if needed

Summary​

In this chapter, you learned:

Ingress Controller: Pod that implements Ingress rules
Types: NGINX (popular), Traefik (simple), HAProxy (performant), Istio (service mesh)
Installation: Kubernetes manifest or Helm
Configuration: IngressClass, annotations, ConfigMap
Annotations: Rewrite, SSL redirect, rate limiting, CORS, auth
Troubleshooting: Logs, NGINX configuration, events
Best practices: Dedicated namespace, HA, monitoring, security

Next Steps​

Chapter 8.3: Routing and TLS
Lab 8.1: Deploying an Ingress Controller

Chapter created: December 2024