Kubernetes Ingress: Advanced Traffic Routing

📋 Overview

Kubernetes Ingress is an API object that manages external access to services within a cluster, typically handling HTTP and HTTPS traffic. It provides a more sophisticated, cost-effective alternative to Service Type: LoadBalancer by allowing a single IP/Load Balancer to route traffic to dozens of internal services based on hostnames or URL paths.

---

🏗️ Core Principles & Characteristics

• L7 Load Balancing: Operates at the Application Layer (HTTP/HTTPS).
• Ingress Resource: The YAML definition of routing rules (e.g., /api goes to service-a).
• Ingress Controller: The actual software (Nginx, Traefik, HAProxy, AWS ALB) that implements the rules.
• Features:
  • Path-based Routing: myapp.com/api vs myapp.com/static.
  • Host-based Routing: api.myapp.com vs web.myapp.com.
  • TLS Termination: Handling SSL/TLS certificates at the edge.

---

⚖️ Trade-offs: Pros & Cons

• Pros:
  • Cost Efficiency: One Cloud Load Balancer can serve multiple services.
  • Centralized Security: SSL certificates and WAF rules are managed in one place.
  • Flexibility: Supports advanced traffic patterns like Canary deployments and Blue/Green.
• Cons:
  • Complexity: Requires installing and managing an Ingress Controller.
  • HTTP Only: Standard Ingress does not handle TCP/UDP (L4) traffic (requires specialized controllers).
  • Performance: Adds an extra "hop" compared to a direct NodePort or LoadBalancer service.

---

🌍 Real-World Implementation

• Microservices: Routing shop.com/orders to the Order service and shop.com/cart to the Cart service.
• Cert-Manager Integration: Automatically issuing and renewing Let's Encrypt certificates for the Ingress.
• External-DNS: Automatically creating DNS records in Route53 or Cloudflare based on the Ingress host rules.

---

💡 Interview "Gotchas" & Tips

• Resource vs. Controller: An Ingress Resource is just a "wishlist" of rules. Without an Ingress Controller installed, those rules do nothing.
• Default Backend: What happens if a request doesn't match any rule? The Ingress Controller sends it to a "Default Backend" (usually a 404 page).
• Ingress vs. Gateway API: Mention the new Kubernetes Gateway API, which is the successor to Ingress, providing even more granular control for multi-team environments.

---

📐 Suggested Architecture Primitives

• Ingress Controller (Nginx/Envoy): The traffic manager.
• TLS Secret: Storing the SSL certificate.
• Service (ClusterIP): The internal target for the Ingress.
• Annotations: Controller-specific "magic" strings to enable features like Rate Limiting or CORS.