Working with Ingress
1. Creating Ingress Resource
Example: Host + path-based routing with TLS
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web
annotations:
nginx.ingress.kubernetes.io/proxy-body-size: 50m
spec:
ingressClassName: nginx
tls:
- hosts: [www.example.com]
secretName: www-tls
rules:
- host: www.example.com
http:
paths:
- { path: /api, pathType: Prefix, backend: { service: { name: api, port: { number: 80 } } } }
- { path: /, pathType: Prefix, backend: { service: { name: web, port: { number: 80 } } } }2. Listing Ingress Resources
kubectl get ing -A
kubectl get ing -o wide # shows hosts, address, ports| Column | Meaning |
|---|---|
| CLASS | ingressClassName |
| HOSTS | FQDNs in rules |
| ADDRESS | Controller external IP/host |
3. Describing Ingress Details
| Section | Info |
|---|---|
| Rules | Hosts & path mappings |
| TLS | Hostnames & secrets |
| Default backend | Fallback service |
| Events | Controller sync/errors |
4. Configuring Ingress Rules
| Match | Source |
|---|---|
| Host | HTTP Host header (with SNI for TLS) |
| Path | pathType determines match semantics |
| Wildcard host | *.example.com (single-label only) |
5. Setting Default Backend
spec:
defaultBackend:
service: { name: notfound, port: { number: 80 } }| Behavior | Detail |
|---|---|
| No rule match | Routed to defaultBackend |
| Controller-wide | NGINX has its own default-backend service |
6. Using Path Types
| pathType | Semantics |
|---|---|
| Exact | Match URL path exactly |
| Prefix | Match element-wise prefix (/foo matches /foo/bar) |
| ImplementationSpecific | Controller-defined (e.g., NGINX regex) |
7. Configuring TLS Termination
spec:
tls:
- hosts: [www.example.com, api.example.com]
secretName: example-tls| Secret Type | Keys |
|---|---|
| kubernetes.io/tls | tls.crt, tls.key |
| Auto-issued | cert-manager + Issuer / ClusterIssuer |
8. Using Ingress Annotations
| NGINX Annotation | Effect |
|---|---|
rewrite-target | Rewrite path for backend |
ssl-redirect: "true" | Force HTTPS |
proxy-read-timeout | Backend read timeout (s) |
limit-rps | Rate limit per client |
auth-url / auth-signin | External auth |
configuration-snippet | Inline NGINX directives |
9. Setting Ingress Class
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata: { name: nginx }
spec:
controller: k8s.io/ingress-nginx| Field | Detail |
|---|---|
| spec.ingressClassName | Per-Ingress reference |
| Default | ingressclass.kubernetes.io/is-default-class: "true" |
10. Installing Ingress Controllers
| Controller | Install |
|---|---|
| ingress-nginx | helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx |
| Traefik | helm install traefik traefik/traefik |
| HAProxy | helm install haproxy haproxytech/kubernetes-ingress |
| AWS ALB Controller | Provision ALBs from Ingress objects |
| Cloud-native (GKE/EKS) | Managed Ingress controllers |
11. Troubleshooting Ingress
| Symptom | Check |
|---|---|
| 404 default backend | Host header / path mismatch |
| No ADDRESS | Controller not running / no IngressClass |
| 502/504 | Backend pod down or readiness failing |
| TLS errors | Wrong secretName / mismatched SNI |
| Connection refused | targetPort mismatch |