Ingress Controller: Your Cluster's Smart Reverse Proxy

WHY IT EXISTS By default, Kubernetes Services are mainly for internal cluster communication. Exposing them externally with a unique LoadBalancer per service is expensive and complex. An Ingress Controller provides a single, intelligent, and cost-effective entry point for all external HTTP and HTTPS traffic into the cluster.

THE MENTAL MODEL Think of an Ingress Controller as the receptionist in a large office building. You create an Ingress resource, which is like giving the receptionist a directory: 'All requests for api.example.com go to the API-Service on the 3rd floor.' The Ingress Controller is the receptionist who reads this directory and directs incoming traffic to the correct service.

HOW IT WORKS An Ingress Controller is a deployment of pods running a proxy like NGINX or Traefik. It watches the Kubernetes API for Ingress resources. When you create an Ingress object defining routing rules (e.g., host 'foo.com' path '/bar' goes to 'service-a'), the controller detects this. It then automatically reconfigures its underlying proxy to enforce these rules. All external traffic hits the controller's single public endpoint and is routed internally based on the rules it has ingested.

WHEN TO USE IT Use an Ingress Controller whenever you need to expose one or more HTTP/S services to the outside world. It is the standard for managing host-based routing (directing api.myapp.com and www.myapp.com to different services) and path-based routing (sending /api and /app to different services from the same domain). It is also the canonical place to handle TLS termination for your services.

WHEN NOT TO USE IT For non-HTTP/S traffic, such as TCP streams for databases or message queues, an Ingress Controller is the wrong tool. For those protocols, you should use a Service of type LoadBalancer or NodePort directly. It might also be overkill for a very simple cluster exposing only a single service.

ONE CANONICAL EXAMPLE The most common mistake is creating an Ingress resource and expecting it to work. The Ingress resource itself does nothing; it is only a declaration of routing rules. You must have an Ingress Controller (like ingress-nginx, Traefik, or Contour) deployed and running in your cluster to actually read those rules and manage the traffic. Without the controller, the Ingress object is just an ignored piece of configuration.