Ingress — Exposing HTTP and HTTPS Applications in Kubernetes¶

Ingress is a Kubernetes API resource that manages external HTTP and HTTPS access to applications running inside a Kubernetes cluster. Instead of exposing every application with its own LoadBalancer or NodePort Service, an Ingress provides a single entry point that intelligently routes requests to different backend Services based on hostnames, URL paths, headers, or other HTTP rules. Combined with an Ingress Controller, it enables SSL/TLS termination, virtual hosting, load balancing, authentication, and advanced traffic management. Every Kubernetes Administrator, DevOps Engineer, Platform Engineer, Site Reliability Engineer (SRE), Cloud Architect, and Network Engineer should understand Kubernetes Ingress.

Learning Path¶

Networking Mastery → Module 11: Kubernetes Networking → Lesson 4

Difficulty: Advanced

Reading Time: 220 Minutes

Course Progress

Course: Networking Mastery

Module: Kubernetes Networking

Lesson: 4 of 9

What You'll Learn¶

After completing this lesson, you'll be able to:

Understand Kubernetes Ingress
Learn the role of an Ingress Controller
Configure Host-Based Routing
Configure Path-Based Routing
Enable HTTPS using Transport Layer Security (TLS)
Compare Ingress with LoadBalancer Services
Design production-ready Kubernetes ingress architectures

Prerequisites¶

Complete:

Pod Networking
Service Networking
DNS Fundamentals
Load Balancers
Kubernetes Fundamentals

Why Do We Need Ingress?¶

Imagine a Kubernetes cluster hosting:

Frontend
Backend API
Authentication Service
Admin Portal

Without Ingress:

Frontend

↓

LoadBalancer

API

↓

LoadBalancer

Admin

↓

LoadBalancer

Problems:

Multiple Public IPs
Higher Cost
Complex Domain Name System (DNS) Management
Difficult SSL Management

Instead:

One

Ingress

↓

Multiple Applications

What is Ingress?¶

Ingress is:

A

Kubernetes

HTTP/HTTPS

Routing

Resource

It routes external traffic to Kubernetes Services.

Ingress works only with an Ingress Controller.

Ingress Architecture¶

Internet

↓

Load Balancer

↓

Ingress Controller

↓

Ingress Rules

↓

Services

↓

Pods

The Ingress resource defines the routing rules.

The Ingress Controller enforces those rules.

What is an Ingress Controller?¶

An Ingress resource contains only configuration.

The actual traffic handling is performed by an:

Ingress

Controller

Popular controllers include:

NGINX Ingress Controller
HAProxy Ingress
Traefik
AWS Load Balancer Controller
Kong
Istio Ingress Gateway

Without an Ingress Controller:

Ingress

Does

Nothing

Traffic Flow¶

User

↓

DNS

↓

Load Balancer

↓

Ingress Controller

↓

Service

↓

Pods

Every HTTP request follows this path.

Host-Based Routing¶

Example:

app.company.com

↓

Frontend Service

api.company.com

↓

API Service

The hostname determines which backend Service receives the request.

Path-Based Routing¶

Example:

company.com/

↓

Frontend

company.com/api

↓

API

company.com/admin

↓

Admin

The URL path determines the destination.

Example Ingress Rule¶

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
spec:
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: frontend
            port:
              number: 80

The Ingress routes requests for app.example.com to the frontend Service.

TLS Termination¶

Instead of every application managing certificates:

Client

↓

HTTPS

↓

Ingress Controller

↓

HTTP

↓

Application

Benefits:

Centralised Certificate Management
Easier HTTPS Deployment
Reduced Backend Complexity

TLS Secret¶

Certificates are stored as Kubernetes Secrets.

Example:

tls:
- hosts:
  - app.example.com
  secretName: tls-secret

The Ingress Controller uses the certificate during the TLS handshake.

Virtual Hosting¶

A single Ingress can host multiple domains.

Example:

shop.company.com

↓

Shopping Service

blog.company.com

↓

Blog Service

api.company.com

↓

API Service

Default Backend¶

If no rule matches:

Request

↓

Default Backend

This usually returns:

404 Not Found

or a custom error page.

Load Balancing¶

The Ingress Controller forwards traffic to the Service.

The Service then distributes requests across healthy Pods.

Ingress

↓

Service

↓

Pod A

↓

Pod B

↓

Pod C

Authentication¶

Ingress Controllers can integrate with:

OAuth
OpenID Connect (OIDC)
Lightweight Directory Access Protocol (LDAP)
Basic Authentication

This allows authentication before traffic reaches the application.

Rate Limiting¶

Ingress Controllers can limit requests.

Example:

100 Requests

Per Minute

Benefits:

API Protection
Distributed Denial of Service (DDoS) Mitigation
Fair Resource Usage

URL Rewriting¶

Example:

Client requests:

/api/users

Ingress rewrites to:

/users

before forwarding the request.

Useful when backend applications expect different URL structures.

Kubernetes Perspective¶

Ingress is designed for:

HTTP
HTTPS

Protocols such as:

Transmission Control Protocol (TCP)
User Datagram Protocol (UDP)

typically require alternative solutions or controller-specific configurations.

Cloud Provider Perspective¶

Amazon EKS¶

Common options:

AWS Load Balancer Controller
NGINX Ingress Controller

Creates AWS Application Load Balancers (ALBs) when configured.

Azure AKS¶

Common options:

NGINX Ingress Controller
Azure Application Gateway Ingress Controller (AGIC)

Integrates with Azure networking services.

Google GKE¶

Supports:

GKE Ingress
NGINX Ingress Controller

Can automatically provision Google Cloud HTTP(S) Load Balancers.

Enterprise Architecture¶

Internet

↓

DNS

↓

Cloud Load Balancer

↓

Ingress Controller

↓

Frontend Service

↓

Frontend Pods

↓

Backend Service

↓

Backend Pods

↓

Database

This architecture supports multiple applications through a single public endpoint.

Ingress vs LoadBalancer Service¶

Ingress	LoadBalancer Service
Layer 7	Layer 4
HTTP/HTTPS	TCP/UDP
Multiple Applications	One Service
Host Routing	No Host Routing
Path Routing	No Path Routing
TLS Termination	Limited

CLI Examples¶

List Ingress resources.

kubectl get ingress

Describe an Ingress.

kubectl describe ingress web-ingress

Display Ingress YAML.

kubectl get ingress web-ingress -o yaml

View Ingress Controller Pods.

kubectl get pods -n ingress-nginx

Common Ingress Components¶

Component	Purpose
Ingress	Routing Rules
Ingress Controller	Traffic Processing
Service	Backend Endpoint
Pod	Application
TLS Secret	SSL Certificate
DNS	Name Resolution

Hands-on Lab¶

Task 1¶

List Ingress resources.

kubectl get ingress

Task 2¶

Describe an Ingress.

kubectl describe ingress web-ingress

Task 3¶

Deploy:

Frontend Service
Backend Service
Ingress

Verify routing.

Task 4¶

Configure:

Host-Based Routing
Path-Based Routing

for multiple applications.

Task 5¶

Enable HTTPS using a TLS Secret.

Task 6¶

Deploy the NGINX Ingress Controller and expose multiple applications through a single public IP.

Task 7¶

Implement rate limiting and basic authentication for an API exposed through Ingress.

Task 8¶

Draw a production Kubernetes ingress architecture showing:

Internet
DNS
Cloud Load Balancer
Ingress Controller
Ingress
Services
Pods

Explain how a request for:

https://api.company.com/users

travels through the Kubernetes cluster.

Production Troubleshooting¶

Problem:

User

Receives

404

From

Ingress

Check:

DNS Resolution
Ingress Rules
Hostname
Path Configuration
Service Availability
Endpoints
Ingress Controller Logs
TLS Configuration

Workflow:

Client

↓

DNS

↓

Load Balancer

↓

Ingress Controller

↓

Service

↓

Pod

Common Mistakes¶

❌ Creating an Ingress without an Ingress Controller.

✅ Install and verify an Ingress Controller.

❌ Incorrect host or path rules.

✅ Validate routing configuration carefully.

❌ Missing TLS Secret.

✅ Create and reference the correct certificate Secret.

❌ Exposing every Service with a LoadBalancer.

✅ Use a shared Ingress for HTTP/HTTPS applications.

❌ Ignoring controller logs.

✅ Review Ingress Controller logs during troubleshooting.

Best Practices¶

Use one Ingress to expose multiple web applications.
Enable HTTPS for all external endpoints.
Store certificates in Kubernetes Secrets.
Use Host-Based Routing for multiple domains.
Use Path-Based Routing for microservices.
Enable authentication and rate limiting where appropriate.
Monitor Ingress latency, errors, and controller health.
Deploy multiple Ingress Controller replicas for high availability.

Interview Questions¶

Beginner¶

What is Kubernetes Ingress?
Why do we need an Ingress Controller?
What is Host-Based Routing?
What is Path-Based Routing?

Intermediate¶

Compare Ingress and LoadBalancer Services.
Explain TLS termination in Kubernetes.
What is the role of the Ingress Controller?
How does an Ingress route requests to backend Services?

Architect Level¶

Design a production Ingress architecture for a microservices platform.
Explain how to expose multiple applications through a single public IP.
How would you troubleshoot intermittent 404 or 502 errors from an Ingress Controller?

Summary¶

In this lesson, you learned:

Kubernetes Ingress
Ingress Controllers
Host-Based Routing
Path-Based Routing
TLS Termination
Virtual Hosting
Authentication
Rate Limiting
Cloud Ingress Integrations

Ingress provides a centralised Layer 7 entry point for Kubernetes applications. By combining routing rules, TLS termination, authentication, and cloud load balancers, Ingress simplifies application exposure while improving scalability, security, and operational efficiency.

Key Takeaways¶

Ingress provides Layer 7 HTTP/HTTPS routing in Kubernetes.
An Ingress Controller is required to process Ingress resources.
Host-Based and Path-Based Routing allow multiple applications to share one public endpoint.
TLS termination centralises HTTPS certificate management.
Ingress integrates with cloud load balancers and Kubernetes Services.
Production deployments should include authentication, rate limiting, monitoring, and high availability.

What's Next?¶

Network Policies

In the next lesson, you'll learn about Network Policies.

You'll explore:

What Network Policies are
Ingress and Egress Rules
Pod Isolation
Label-Based Security
Default Deny Policies
CNI Support
Zero Trust Networking

By the end of the lesson, you'll understand how to secure communication between Kubernetes workloads using fine-grained network access controls.