IT 3300 : Virtualization

Kubernetes — Ingress

Why Ingress

  • NodePort exposes raw ports; LoadBalancer needs one IP per service
  • Real sites want: one entry point, many apps, by hostname/path, with TLS
  • Ingress is HTTP(S) routing into the cluster

Two pieces

  • Ingress resource — the rules (host/path -> service)
  • Ingress controller — the thing that enforces them
    • e.g. Ingress-NGINX, Traefik (default in k3s)
  • No controller = your Ingress rules do nothing

Enable a controller

    # MicroK8s
    microk8s enable ingress

    # or apply Ingress-NGINX manifests
    kubectl apply -f ingress-nginx.yaml

An Ingress manifest

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
spec:
  rules:
    - host: web.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

Routing options

  • By host — app1.example.com vs app2.example.com
  • By path — /api vs / to different services
  • One external entry point fans out to many services

TLS

  • Terminate HTTPS at the Ingress
  • Reference a TLS secret (cert + key) in the Ingress spec
  • cert-manager can issue/renew Let's Encrypt certs automatically

What's next: the Gateway API

  • The successor to Ingress: more expressive, role-oriented
  • Separates infra (Gateway) from routing (HTTPRoute)
  • Expect it to gradually replace Ingress — know the name

Lab goals

  • Enable an ingress controller
  • Route two services by host and/or path through one Ingress
  • (Stretch) Add TLS with a self-signed or cert-manager cert