Ingress
The address a Service puts up only answers inside the cluster. Taking traffic from outside means a door per Service, and every door drags along an IP and a certificate. An Ingress collects those doors into one and decides the destination by which rule the request's host and path match. However many domains you serve, there is one way in.
01Ingress
Concept at a GlanceThe address a Service puts up only answers inside the cluster. Letting traffic in from outside means a door per Service — and an IP and a certificate with every door.
An Ingress collects those doors into one. The client only needs the load balancer's address, and the rules decide where each request goes.
Rules split on the host first. This request didn't come for that name, so the admin row drops out of the running here.
The two remaining rows split on path. /api/orders starts with /api, so it matches the first row and rides that edge to api-svc.
An Ingress never reaches a Pod directly. It hands off to a Service, and which Pod answers behind it is the Service's call.
Same door, different path, different destination. /login doesn't start with /api, so it falls to the row below.
Change the host and you land in another part of the table — without renting a separate IP for each domain.
The certificate is handled once, at the door. Traffic is decrypted here and passed on in the clear, so no Service needs one of its own.
A request that matches no row simply drops. Without a default backend, the controller answers 404.
The Ingress itself is only a declaration, though. What raises the load balancer in this picture is the Ingress controller — with none running, the rules just pile up.
02 Understand It Simply
For EveryoneRather than exposing every service separately, one entry point takes all traffic and host and path rules decide which service receives it. Certificates are terminated once, at that entry point.
An Ingress is an L7 rule that picks a backing Service from an HTTP request's Host header and path.
Several path rules can match at once, and the longest match wins.
TLS is terminated at the door, so traffic moves on in the clear behind it.
The Ingress object itself is only a declaration, though — an Ingress controller (nginx, traefik, and friends) has to be running to actually accept traffic and forward it.
Controllers differ in what they support, which pushes the finer settings into annotations; the Gateway API is the effort to clear away that fragmentation.
- –Splitting traffic by domain and path
- –managing certificates in one place
- –avoiding a LoadBalancer per Service to cut cost
- –and choosing a controller while knowing where its annotations differ
03 Frequently Asked Questions
FAQWhat is Ingress?+
The address a Service puts up only answers inside the cluster. Taking traffic from outside means a door per Service, and every door drags along an IP and a certificate. An Ingress collects those doors into one and decides the destination by which rule the request's host and path match. However many domains you serve, there is one way in.
Where is Ingress used?+
Splitting traffic by domain and path, managing certificates in one place, avoiding a LoadBalancer per Service to cut cost, and choosing a controller while knowing where its annotations differ.
What's a simple analogy for Ingress?+
Rather than exposing every service separately, one entry point takes all traffic and host and path rules decide which service receives it. Certificates are terminated once, at that entry point.