Ingress and External Access¶

Overview¶

ClusterIP Services reach only internal workloads. NodePort and LoadBalancer expose individual Services — but each public Service needs its own IP or port, and L7 routing (hostname, path, TLS) belongs at the edge, not in every Service definition. Ingress defines HTTP/HTTPS routing rules; an Ingress controller (nginx, Traefik, HAProxy, AWS ALB) implements those rules and terminates TLS at the cluster boundary.

When a user visits https://api.example.com/v1/users, the Ingress controller matches the host and path, forwards to the correct backend Service, and returns the response — hiding internal Pod topology. This is the Kubernetes equivalent of the reverse proxy patterns from Reverse Proxy and Ingress Basics.

This is Tutorial 10 in Module 4: Networking & Operations of the REBASH Academy Kubernetes series. Complete Persistent Volumes and Storage and Services and Cluster Networking first.

Prerequisites¶

• Completed Services and Cluster Networking — ClusterIP, NodePort, DNS
• Completed Deployments — Managing Replicated Pods
• Completed Persistent Volumes and Storage
• Completed ConfigMaps and Secrets — TLS Secrets
• Familiarity with HTTP, HTTPS, and the Application Layer
• A cluster with an Ingress controller (minikube: minikube addons enable ingress)

Learning Objectives¶

By the end of this tutorial, you will be able to:

• Explain the difference between Ingress, Ingress controller, and Service
• Install and verify an Ingress controller (nginx)
• Create Ingress rules for hostname and path-based routing
• Terminate TLS with Kubernetes TLS Secrets
• Compare Ingress vs LoadBalancer vs Gateway API
• Debug common Ingress failures (404, 502, certificate errors)
• Apply production patterns: annotations, rate limiting, and multiple backends

Architecture Diagram¶

External clients hit the Ingress controller LoadBalancer. The controller reads Ingress rules and proxies to internal ClusterIP Services.

flowchart TB
    subgraph Internet
        USER["Client<br/>https://shop.example.com"]
    end

    subgraph Edge["Ingress Controller — nginx / Traefik"]
        IC["LoadBalancer IP<br/>TLS termination"]
        RULES["Ingress rules<br/>host + path routing"]
    end

    subgraph Cluster["Cluster Internal"]
        SVC1["Service web<br/>ClusterIP :80"]
        SVC2["Service api<br/>ClusterIP :8080"]
        P1["Pods web"]
        P2["Pods api"]
    end

    USER --> IC
    IC --> RULES
    RULES -->|"/"| SVC1
    RULES -->|"/api"| SVC2
    SVC1 --> P1
    SVC2 --> P2```

## Theory

### Ingress vs Service vs Ingress Controller

| Component | Role |
|-----------|------|
| **Service (ClusterIP)** | Stable internal IP for Pod load balancing |
| **Ingress** | Declarative HTTP routing rules (API object) |
| **Ingress controller** | Pod(s) that watch Ingress resources and configure a reverse proxy |

Ingress is useless without a controller. Unlike Services (built into Kubernetes), Ingress requires installing nginx-ingress, Traefik, or a cloud-specific controller.

### Ingress Resource Structure

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - shop.example.com
      secretName: shop-tls
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 8080

Path Types¶

TLS Termination¶

TLS Secrets store certificate and key:

apiVersion: v1
kind: Secret
metadata:
  name: shop-tls
type: kubernetes.io/tls
data:
  tls.crt: <base64-cert>
  tls.key: <base64-key>

Production clusters use cert-manager to automate Let's Encrypt certificates — covered in advanced tutorials.

The Ingress controller terminates HTTPS and typically forwards plain HTTP to backend Services on the cluster network (trusted internal path).

External Access Patterns¶

Common Ingress Controller Annotations (nginx)¶

annotations:
  nginx.ingress.kubernetes.io/ssl-redirect: "true"
  nginx.ingress.kubernetes.io/proxy-body-size: "10m"
  nginx.ingress.kubernetes.io/rate-limit: "100"
  cert-manager.io/cluster-issuer: "letsencrypt-prod"

Annotations are controller-specific — nginx annotations do not work on Traefik without equivalents.

Default Backend¶

Ingress can define a defaultBackend for requests matching no rules — typically a custom 404 page Service.

Hands-on Lab¶

Step 1 – Enable Ingress controller (minikube)¶

Command:

minikube addons enable ingress
kubectl wait --namespace ingress-nginx \
  --for=condition=ready pod \
  --selector=app.kubernetes.io/component=controller \
  --timeout=120s
kubectl get pods -n ingress-nginx

Explanation: kind and k3s have different install paths. minikube bundles the nginx Ingress controller as an addon.

For kind, install via official manifest:

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/kind/deploy.yaml

Step 2 – Deploy two backend Services¶

Command:

kubectl create namespace lab-ingress
kubectl create deployment web --image=nginx:1.25-alpine -n lab-ingress
kubectl create deployment api --image=hashicorp/http-echo -n lab-ingress \
  -- --text="API response" --listen=:8080
kubectl expose deployment web --port=80 --target-port=80 -n lab-ingress
kubectl expose deployment api --port=8080 --target-port=8080 -n lab-ingress

Explanation: Two Deployments with ClusterIP Services simulate a frontend and API backend.

Step 3 – Create a basic Ingress¶

Command:

Save as web-ingress.yaml:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: demo-ingress
  namespace: lab-ingress
spec:
  ingressClassName: nginx
  rules:
    - host: demo.local
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 8080

kubectl apply -f web-ingress.yaml
kubectl get ingress -n lab-ingress
kubectl describe ingress demo-ingress -n lab-ingress

Expected output:

NAME           CLASS   HOSTS        ADDRESS        PORTS   AGE
demo-ingress   nginx   demo.local   192.168.49.2   80      30s

Step 4 – Test routing¶

Command:

# minikube — get controller IP
MINIKUBE_IP=$(minikube ip)
curl -s -H "Host: demo.local" http://$MINIKUBE_IP/ | head -5
curl -s -H "Host: demo.local" http://$MINIKUBE_IP/api

Explanation: The Host header selects the Ingress rule. Path / routes to nginx; /api routes to http-echo.

Expected output:

<!DOCTYPE html>
<html>
...
API response

Step 5 – Add TLS termination¶

Command:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout tls.key -out tls.crt -subj "/CN=demo.local"
kubectl create secret tls demo-tls -n lab-ingress --cert=tls.crt --key=tls.key

Update Ingress:

spec:
  tls:
    - hosts:
        - demo.local
      secretName: demo-tls
  rules:
    - host: demo.local
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

kubectl apply -f web-ingress.yaml
curl -sk -H "Host: demo.local" https://$MINIKUBE_IP/ | head -3
rm -f tls.key tls.crt

Explanation: The Ingress controller presents the TLS certificate for HTTPS connections.

Step 6 – Debug a misconfigured backend¶

Command:

kubectl patch ingress demo-ingress -n lab-ingress --type=json \
  -p='[{"op":"replace","path":"/spec/rules/0/http/paths/1/backend/service/name","value":"nonexistent"}]'
curl -s -o /dev/null -w "%{http_code}\n" -H "Host: demo.local" http://$MINIKUBE_IP/api
kubectl logs -n ingress-nginx -l app.kubernetes.io/component=controller --tail=10
kubectl patch ingress demo-ingress -n lab-ingress --type=json \
  -p='[{"op":"replace","path":"/spec/rules/0/http/paths/1/backend/service/name","value":"api"}]'

Explanation: Wrong Service names produce 502/503 errors. Controller logs reveal upstream resolution failures.

Step 7 – Clean up¶

Command:

kubectl delete namespace lab-ingress

Commands & Code¶

Multi-host Ingress with TLS¶

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: production-ingress
  namespace: production
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    nginx.ingress.kubernetes.io/proxy-body-size: "25m"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - app.example.com
        - api.example.com
      secretName: example-com-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend
                port:
                  number: 80
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 8080

Common Mistakes¶

Best Practices¶

Troubleshooting¶

Summary¶

• Ingress defines L7 HTTP routing rules; Ingress controllers implement them
• Route by hostname and path to different backend Services on one external IP
• TLS Secrets enable HTTPS termination at the cluster edge
• Ingress is preferred over per-Service LoadBalancers for HTTP applications
• Gateway API is the evolving successor for advanced traffic management
• Next: isolate environments with Namespaces and Resource Management

Interview Questions¶

1. What is the difference between an Ingress and an Ingress controller?
2. Why is Ingress preferred over LoadBalancer for multiple HTTP services?
3. Explain pathType Prefix vs Exact.
4. How does TLS termination work with Ingress?
5. What happens if an Ingress references a Service with no endpoints?
6. What is ingressClassName used for?
7. Compare Ingress with the Gateway API.
8. How do you test Ingress locally without DNS?
9. What annotations are common on nginx Ingress controllers?
10. How does Ingress relate to a reverse proxy like nginx on a VM?

Related Tutorials¶

• Kubernetes – Category Overview
• Persistent Volumes and Storage (previous in Module 3)
• Services and Cluster Networking
• Deployments — Managing Replicated Pods
• Pods — The Atomic Unit
• Namespaces and Resource Management (next in Module 4)
• Reverse Proxy and Ingress Basics
• Load Balancing Fundamentals

References¶

• Ingress documentation
• nginx Ingress Controller
• cert-manager documentation
• Gateway API
• REBASH Academy – Networking Overview