We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design and AI Engineering, by Roni Das. 984 interactive lessons.
Start LearningIntermediate · Kubernetes & Containers
A K8s resource that manages external HTTP/HTTPS access to services inside the cluster. Routes traffic by hostname or URL path to different backend services.
In short
Kubernetes Ingress is a cluster resource that defines rules for routing external HTTP and HTTPS traffic to Services inside the cluster, matching requests by hostname and URL path so a single external IP and load balancer can serve many applications. The rules only take effect when an Ingress controller, such as ingress-nginx or Traefik, is running to read them and configure an actual proxy.
In short
Kubernetes Ingress is a cluster resource that defines rules for routing external HTTP and HTTPS traffic to Services inside the cluster, matching requests by hostname and URL path so a single external IP and load balancer can serve many applications. The rules only take effect when an Ingress controller, such as ingress-nginx or Traefik, is running to read them and configure an actual proxy.
Learn it in the course
This page is the free part.
₹1,111 in India$25 everywhere elseonce, for the whole course
The System Design course covers Kubernetes Ingress across a run of lessons, not one page. These 4 alone are about 125 minutes of step-by-step reading, every one with a quiz.
Routing external HTTP traffic to the right Kubernetes service, the cluster's front door.
Path-based routing for microservices request routing, tested on real nginx, Envoy and HAProxy: nginx location order, ALB path rules, Ingress, path vs host.
How load balancers decide which server gets the next request. Round Robin, Weighted, Least Connections, IP Hash, and more.
How load balancer failover works with a shared virtual IP, VRRP and keepalived. Also covers ALB health checks and failover across zones.
all part of
System Design Masterclass
770 lessons · about 287 hours · 18 free to read
₹1,111in India, by UPI
$25everywhere else, by PayPal
It is really nice and good Please join the course
You own this course
Continue with Ingress Controllerspay once,
yours for life
An Ingress is a Kubernetes API object that holds routing rules. A typical rule says something like: send requests for host shop.example.com with path /api to the orders Service on port 8080, and everything else to the web Service. It is plain configuration, not a running program.
Ingress exists because exposing every Service with its own external LoadBalancer is expensive and wasteful. On AWS or GCP, each LoadBalancer Service provisions a separate cloud load balancer that costs money and burns through public IPs. Ingress lets you put one entry point in front of dozens of Services and route between them at layer 7, the HTTP layer.
The Ingress object alone does nothing. You need an Ingress controller, a pod running inside the cluster that watches the Kubernetes API for Ingress objects and translates them into a real reverse proxy configuration. Without a controller, your Ingress rules are just rows in etcd that no traffic ever reads.
The controller runs as a deployment in the cluster, usually exposed by a single LoadBalancer or NodePort Service so it has one public IP. ingress-nginx, the most common controller, runs an NGINX process. When you create or change an Ingress object, the controller's control loop notices the change through a watch on the Kubernetes API and regenerates the NGINX config, then reloads it.
When a request arrives, the controller terminates TLS if a certificate is configured, reads the Host header and the request path, and matches them against the compiled rules. It then forwards the request to the backend Service. In practice most controllers skip the Service's cluster IP and proxy straight to the pod IPs they learn from the Service's Endpoints, which gives them better load balancing and faster failover when a pod dies.
TLS is handled by referencing a Kubernetes Secret that holds the certificate and key. Pairing the controller with cert-manager automates issuing and renewing free Let's Encrypt certificates, so HTTPS for a new hostname becomes a few lines of YAML instead of a manual certificate dance.
IngressClass tells the cluster which controller owns a given Ingress, so you can run more than one controller, for example a public-facing ingress-nginx and a separate internal one, without them fighting over the same rules.
Reach for Ingress when you are serving HTTP or HTTPS and want host and path routing, shared TLS, and one front door for many Services. It is the standard answer for web apps and REST APIs running on Kubernetes.
It is layer 7 only. If you need to expose raw TCP or UDP, such as a Postgres port or a game server, Ingress does not help and you want a LoadBalancer Service or the controller's TCP passthrough feature instead. Ingress also has a thin core spec, so anything beyond basic routing, like rate limiting, rewrites, sticky sessions, or auth, gets bolted on through controller-specific annotations. Those annotations are not portable, so an Ingress tuned for ingress-nginx will not behave the same on Traefik or HAProxy.
Because of those limits, newer clusters increasingly use the Gateway API, a more expressive successor designed to replace Ingress for advanced traffic management. For straightforward routing, Ingress is still simpler and remains very widely deployed.
Say you run a storefront with three Services: web, api, and admin. You create one Ingress that routes shop.example.com to the web Service, shop.example.com/api to the api Service, and admin.example.com to the admin Service, with a TLS Secret covering both hostnames.
You install ingress-nginx, which provisions a single cloud load balancer with one public IP. You point all your DNS records at that IP. Now a request to shop.example.com/api/orders lands on the load balancer, hits NGINX, gets matched to the api Service, and is proxied to a healthy api pod. Three Services, one IP, one certificate, one load balancer bill.
Add a fourth Service later and you just append a rule to the same Ingress. No new load balancer, no new IP, no new DNS work beyond a CNAME if the hostname is new.
ingress-nginx
The reference NGINX-based controller maintained by the Kubernetes project, the most widely deployed Ingress controller in production clusters.
Traefik
A popular Ingress controller from Traefik Labs with native Let's Encrypt support and dynamic config, common in smaller and self-managed clusters.
Google Kubernetes Engine
GKE ships a built-in controller that turns Ingress objects into Google Cloud HTTP(S) Load Balancers automatically.
AWS Load Balancer Controller
Provisions an AWS Application Load Balancer from Ingress objects on EKS clusters, mapping path and host rules to ALB listener rules.
A LoadBalancer Service exposes one Service through one cloud load balancer at layer 4, doing simple port forwarding. An Ingress works at layer 7 and lets one load balancer route HTTP traffic to many Services by hostname and path, plus handle TLS, which is cheaper and more flexible for web traffic.
You need a controller. The Ingress object is only configuration. Nothing reads or acts on those rules until a controller like ingress-nginx or Traefik is running and watching for them, so a fresh cluster with no controller will route no traffic.
Not through the standard spec, which is HTTP and HTTPS only. For raw TCP or UDP you use a LoadBalancer Service, a NodePort, or a controller-specific TCP feature such as the ingress-nginx tcp-services ConfigMap.
You store a certificate and key in a Kubernetes Secret and reference it in the Ingress tls section. The controller terminates TLS using that Secret. Adding cert-manager automates issuing and renewing free Let's Encrypt certificates so you do not manage them by hand.
The Gateway API is a more expressive successor for advanced traffic management, and clusters with complex needs are adopting it. Ingress is not removed and remains the simpler choice for basic host and path routing, so both coexist today.
Kubernetes Service
A stable network endpoint that load-balances traffic across a set of pods. Pods come and go, but the Service's IP and DNS name stay constant.
Reverse Proxy
A server in front of your web servers that receives every request first, passes it to one of them and returns the answer. It handles TLS, load balancing, caching and routing, and hides the servers behind it.
Layer 7 Load Balancing
Load balancing at the application layer (HTTP) that can route based on URL paths, headers, cookies, or request content. More flexible but more CPU-intensive.
Docker
A platform for packaging applications into lightweight, portable containers. 'Works on my machine' becomes 'works everywhere.'
Kubernetes
An orchestration platform that automates deploying, scaling, and managing containerized applications. K8s is the operating system for your cloud.
Container
A lightweight, isolated environment that packages an application with its dependencies. Shares the host OS kernel, unlike VMs. Starts in milliseconds.
This page explains the idea. The "Ingress Controllers" lesson builds it up step by step, with diagrams. It is part of the System Design Masterclass course, which has 770 lessons. 18 of them are free to read. You pay once and keep it for life, with no subscription.
Open the Ingress Controllers lessoncourse 1
From absolute beginner to principal engineer, drawn step by step.
Asked about Kubernetes Ingress in an interview?
Each question has why it is asked, a full answer, what the interviewer listens for, the follow-ups, the common mistakes and a diagram (268 diagrams in all). A PDF you keep, junior to staff level.
India: UPI, cards or netbanking through Razorpay. Elsewhere: card or PayPal. Download at once from My packs.
