networking • Intermediate

Ingress Controllers & Layer-7 HTTP Routing

Ingress acts as a smart HTTP/HTTPS reverse proxy and API Gateway at the edge of the cluster, providing path-based routing (/api -> api-svc, / -> web-svc) and TLS termination with a single public Load Balancer.

Intuitive Mental Model

The Airport Terminal Directory: The public entrance (Ingress) inspects your boarding pass URL path. If it says "/flights", you are routed to Gate A; if "/baggage", to Gate B.

Dockerfile / YAML Manifest / CLIProduction Standard

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: main-ingress
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.example.com
    secretName: api-tls-cert
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /v1/users
        pathType: Prefix
        backend:
          service:
            name: user-service
            port:
              number: 80
      - path: /v1/orders
        pathType: Prefix
        backend:
          service:
            name: order-service
            port:
              number: 80

Key Architectural Takeaways

•Ingress is only an API resource specification; an Ingress Controller (Nginx, Traefik, Envoy, Istio) must be running to execute the routing.
•Path-based and host-based routing consolidates dozens of microservices behind a single external cloud IP.
•Automates SSL/TLS certificates via cert-manager and ACME Let's Encrypt.

Common Production Mistake

Creating a separate cloud LoadBalancer Service for every microservice, multiplying cloud infrastructure costs by 10x.