/api vs /app), hostname routing (api.example.com), SSL/TLS termination, and header rewriting. This is handled by Ingress.TL;DR (Quick Summary)#
- Ingress Resource vs Ingress Controller:
- Ingress Resource: The declarative YAML configuration defining L7 routing rules.
- Ingress Controller: The active reverse-proxy software (NGINX, Traefik, HAProxy, Envoy) that evaluates Ingress resources and proxies external traffic to internal
ClusterIPservices.
- Benefits: Single entrypoint IP for hundreds of microservices, central TLS certificate termination, and rate-limiting.
1. How Ingress Works#
graph TD
Client["Client Browser"] -->|HTTPS request to api.example.com/v1| ExtLB["Cloud LoadBalancer
(Single Public IP)"]
ExtLB -->|Port 80/443| IC["NGINX Ingress Controller Pod
(IngressClass: nginx)"]
subgraph K8sCluster["Kubernetes Cluster Internal"]
IC -->|Path: /api/*| SvcAPI["api-service
(ClusterIP: 10.96.50.10:8080)"]
IC -->|Host: app.example.com| SvcApp["web-app-service
(ClusterIP: 10.96.80.20:80)"]
SvcAPI --> PodAPI["API Pods"]
SvcApp --> PodApp["Web App Pods"]
end
2. Installing NGINX Ingress Controller#
Enable NGINX Ingress Controller on Minikube or helm:
# Minikube addon
minikube addons enable ingress
# Or via Helm
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm install ingress-nginx ingress-nginx/ingress-nginxVerify Ingress Controller Pod is running:
kubectl get pods -n ingress-nginx3. Path-Based & Host-Based Ingress Manifest#
Create ingress.yaml:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: main-application-ingress
namespace: default
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
ingressClassName: nginx
rules:
# Host 1: Subdomain Host-Based Routing
- host: app.mycompany.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: frontend-service
port:
number: 80
# Host 2: API Path-Based Routing
- host: api.mycompany.com
http:
paths:
- path: /v1/users
pathType: Prefix
backend:
service:
name: user-service
port:
number: 8080
- path: /v1/orders
pathType: Prefix
backend:
service:
name: order-service
port:
number: 9000Apply the Ingress resource:
kubectl apply -f ingress.yamlInspect Ingress status:
kubectl get ingress main-application-ingressExpected Terminal Output:
NAME CLASS HOSTS ADDRESS PORTS AGE
main-application-ingress nginx app.mycompany.com,api.mycompany.com 192.168.49.2 80, 443 30s4. Enabling TLS/SSL Encryption#
To terminate HTTPS traffic at the Ingress Controller, store your SSL certificate and private key in a Kubernetes TLS Secret.
1. Create TLS Secret#
kubectl create secret tls tls-mycompany-secret \
--cert=path/to/tls.crt \
--key=path/to/tls.key2. Attach Secret to Ingress Manifest#
Update ingress.yaml with the tls section:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: secure-ingress
annotations:
nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
ingressClassName: nginx
tls:
- hosts:
- app.mycompany.com
- api.mycompany.com
secretName: tls-mycompany-secret
rules:
- host: app.mycompany.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: frontend-service
port:
number: 80In production, automate SSL certificate generation and renewal using cert-manager combined with Let’s Encrypt!
5. Summary & Next Steps#
Ingress Controllers provide scalable, secure L7 HTTP routing across microservices with a single entry point.
In Episode 07: ConfigMaps, Secrets & Environment Variables, we will learn how to decouple application configuration, environment settings, and sensitive database credentials from container images using ConfigMaps and Secrets!