Skip to main content

Chapter 8.3 - Routing and TLS

Learning Objectives​

By the end of this chapter, you will be able to:

  • Configure hostname-based routing
  • Implement path-based routing
  • Configure TLS/SSL with certificates
  • Use cert-manager for automatic certificate management
  • Understand path types
  • Manage rewrites and redirects

Introduction​

Ingress routing allows directing traffic to different services based on the hostname or path. TLS configuration secures communications with HTTPS.

Hostname-Based Routing​

Routing based on the domain name:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-host-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: app1.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app1-service
            port:
              number: 80
  - host: app2.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app2-service
            port:
              number: 80
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

Result:

  • app1.example.com → app1-service
  • app2.example.com → app2-service
  • api.example.com → api-service

Path-Based Routing​

Routing based on the URL path:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: path-based-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
      - path: /web
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
      - path: /admin
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 80
      - path: /
        pathType: Prefix
        backend:
          service:
            name: default-service
            port:
              number: 80

Result:

  • example.com/api → api-service
  • example.com/web → web-service
  • example.com/admin → admin-service
  • example.com/ → default-service

Path Types​

Prefix​

The path must start with the specified prefix:

- path: /api
  pathType: Prefix

Matches:

  • /api
  • /api/v1
  • /api/users
  • /api/v1/users

Exact​

The path must match exactly:

- path: /api
  pathType: Exact

Matches:

  • /api only

Does not match:

  • /api/v1
  • /api/users

ImplementationSpecific​

Depends on the Ingress Controller implementation:

- path: /api
  pathType: ImplementationSpecific

TLS Configuration​

Create a TLS Secret​

# Generate a certificate (example with openssl)
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout tls.key -out tls.crt \
  -subj "/CN=example.com/O=example.com"

# Create the Secret
kubectl create secret tls example-tls \
  --cert=tls.crt \
  --key=tls.key

Use in Ingress​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.com
    - www.example.com
    secretName: example-tls
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
  - host: www.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

Result: HTTPS enabled for example.com and www.example.com.

Cert-Manager for Automatic Certificates​

cert-manager automatically manages TLS certificates with Let's Encrypt.

Installation​

# Helm
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager \
  --namespace cert-manager \
  --create-namespace \
  --set installCRDs=true

ClusterIssuer (Let's Encrypt)​

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

Usage in Ingress​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cert-ingress
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.com
    secretName: example-tls  # Automatically created by cert-manager
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

Result: TLS certificate automatically obtained and renewed by cert-manager.

Rewrites and Redirects​

Rewrite (NGINX)​

Rewrite the URL before forwarding it to the backend:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /api(/|$)(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: api-service
            port:
              number: 80

Result: example.com/api/users → api-service/users

Redirect​

Redirect to another URL:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: redirect-ingress
  annotations:
    nginx.ingress.kubernetes.io/permanent-redirect: "https://www.example.com"
spec:
  ingressClassName: nginx
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80

Complete Example: Multi-Tier Application​

Architecture​

Configuration​

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - example.com
    secretName: example-tls
  rules:
  - host: example.com
    http:
      paths:
      # Web frontend
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-service
            port:
              number: 80
      # API backend
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 8080
      # Admin panel
      - path: /admin
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 8080

Useful Commands​

Verification​

# View Ingresses
kubectl get ingress

# Details
kubectl describe ingress app-ingress

# View certificates
kubectl get certificates
kubectl describe certificate example-tls

# View TLS secrets
kubectl get secrets | grep tls

Testing​

# Test HTTP
curl -H "Host: example.com" http://<ingress-ip>/

# Test HTTPS
curl -k https://example.com/

# Test with path
curl -H "Host: example.com" http://<ingress-ip>/api/health

Best Practices​

1. TLS Everywhere​

Use HTTPS for all external communications.

2. Cert-Manager​

Use cert-manager for automatic certificate management.

3. Path Types​

Choose the right path type (Prefix for most cases).

4. Annotations​

Use annotations for advanced features (rewrites, redirects).

5. Monitoring​

Monitor certificates and their expiration.

Summary​

In this chapter, you learned:

Hostname routing: Multiple domains with a single Ingress
Path routing: Path-based routing to different services
Path types: Prefix, Exact, ImplementationSpecific
TLS: Configuration with Kubernetes secrets
cert-manager: Automatic management of Let's Encrypt certificates
Rewrites: URL rewriting with annotations
Redirects: Permanent or temporary redirections
Best practices: TLS everywhere, cert-manager, monitoring

Next Steps​

Module 9: Security and RBAC
Lab 8.2: Configuring Ingress for an Application
Lab 8.3: TLS Certificates with Cert-Manager

Chapter created: December 2024