Ingress Controllers

Why Ingress Exists

A LoadBalancer Service gives one external IP per application — costly and inflexible when a dozen microservices share one domain. Ingress moves HTTP routing into the cluster: one controller terminates TLS and fans traffic out by host and path.

An Ingress object is only a rule set; a controller (nginx-ingress, Traefik, HAProxy, cloud implementations) must be installed and watch the API:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata: { name: web }
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend: { service: { name: api, port: { number: 8080 } } }

Traffic flows: internet → controller load balancer → controller pod → target Service → pods.

Hosts, Paths, and TLS

spec:
  tls:
  - hosts: [app.example.com]
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - { path: /api, pathType: Prefix, backend: { service: { name: api, port: { number: 8080 } } } }
      - { path: /,    pathType: Prefix, backend: { service: { name: web,  port: { number: 80 } } } }

pathType is explicit: Prefix matches segment boundaries (/api matches /api/x, not /apix), Exact matches the literal string, and ImplementationSpecific leaves it to the controller. The TLS secret (type kubernetes.io/tls with tls.crt and tls.key) is mounted by the controller, which also solves HTTP-01 or DNS-01 challenges for cert-manager-managed certificates.

Pitfalls and Interview Angles

Pitfall 1 — forgetting ingressClassName. With multiple controllers, an Ingress without ingressClassName may be picked up by none (or by a legacy default annotation), leaving rules unapplied with healthy pods everywhere.

Pitfall 2 — path ordering and redirects. Longest-prefix matching is controller-specific in edge cases; a catch-all / rule can shadow a sibling if the controller sorts unexpectedly. Also remember Ingress is HTTP(S)-level: gRPC, TCP, and UDP need other mechanisms (or the Gateway API).

Interview-ready: draw internet → LB → controller → Service → pod, contrast one-LB-per-app with host/path multiplexing, describe cert-manager obtaining certificates through the controller, and note Ingress's successor direction: the Gateway API for richer, portable routing.