A type: LoadBalancer Service gives you one external IP per Service — expensive and unmanageable at scale. Ingress solves this: a single entry point (one IP/LB) that routes HTTP/HTTPS traffic to multiple backend Services based on hostname and path — like a virtual host configuration.

1. How Ingress Works

Ingress has two components:

1. Ingress resource — a declarative YAML describing routing rules (host, path → backend Service)
2. Ingress Controller — the actual software (nginx, envoy, traefik) that reads the rules and routes traffic

The Ingress resource is useless without a controller. Creating an Ingress object does nothing unless a controller is watching for it.

2. Ingress Resource

Simple Fanout (Path-Based Routing)

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /    # controller-specific
spec:
  ingressClassName: nginx                             # which controller handles this
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-svc
                port:
                  number: 80
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-svc
                port:
                  number: 80

Name-Based Virtual Hosting

spec:
  rules:
    - host: api.example.com           # Route by hostname
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-svc
                port:
                  number: 80
    - host: blog.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: blog-svc
                port:
                  number: 80

Path Types

Default Backend

spec:
  defaultBackend:                   # Handles requests that match no rule
    service:
      name: default-svc
      port:
        number: 80
  rules:
    - ...                          # Specific rules

3. TLS Termination

Ingress handles HTTPS by terminating TLS at the controller. Traffic between controller → backend Pods is typically unencrypted (within the cluster).

Setup

# 1. Create a TLS Secret:
kubectl create secret tls app-tls \
  --cert=./tls.crt \
  --key=./tls.key

# 2. Reference it in the Ingress:
spec:
  tls:
    - hosts:
        - app.example.com         # Must match a rule host
        - api.example.com
      secretName: app-tls         # TLS Secret in same namespace
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-svc
                port:
                  number: 80

TLS Modes

HTTP → HTTPS Redirect

# Most controllers support forced redirect:
metadata:
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"     # NGINX
    # or for other controllers:
    # traefik.ingress.kubernetes.io/redirect-scheme: https

4. Ingress Controllers

The Ingress resource is just a spec. The controller is the implementation. You must install one — nothing happens without it.

IngressClass

When multiple controllers exist in a cluster, ingressClassName determines which one handles a given Ingress:

# IngressClass resource (installed by the controller):
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"  # default if none specified
spec:
  controller: k8s.io/ingress-nginx

# Reference in Ingress:
spec:
  ingressClassName: nginx

NGINX vs Envoy-Based Controllers

5. Common NGINX Ingress Annotations

Rewrite Example

# Route /api/v1/users → backend receives /users
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /api(/|$)(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: api-svc
                port:
                  number: 80

Summary