IT 3300 : Virtualization

Kubernetes — Ingress

Why Ingress

  • NodePort exposes raw ports; LoadBalancer needs one IP per service
  • Real sites want: one entry point, many apps, by hostname/path, with TLS
  • Ingress is HTTP(S) routing into the cluster

Two pieces

Enable a controller

    # MicroK8s
    # check if enabled
    microk8s.status
    # if not
    microk8s enable ingress

An Ingress manifest (for our example)

    apiVersion: networking.k8s.io/v1
    kind: Ingress
    metadata:
      name: ingress-stuff
    spec:
      ingressClassName: nginx
      rules:
        - http:
            paths:
              - path: /
                pathType: Prefix
                backend:
                  service:
                    name: loadbalancer
                    port:
                      number: 80
              - path: /sentiment
                pathType: Prefix
                backend:
                  service:
                    name: loadbalancer
                    port:
                      number: 80

Routing options

TLS

  • Terminate HTTPS at the Ingress
  • Reference a TLS secret (cert + key) in the Ingress spec
  • cert-manager can issue/renew Let's Encrypt certs automatically

What's next: the Gateway API

  • The successor to Ingress: more expressive, role-oriented
  • Separates infra (Gateway) from routing (HTTPRoute)
  • Expect it to gradually replace Ingress — know the name