Ingress Controller: Your Cluster's Smart Reverse Proxy
An Ingress Controller is the traffic cop for your Kubernetes cluster, directing external HTTP/S requests to the correct internal services. It exposes multiple services under a single IP, handling host and path routing.
Why it exists
By default, Kubernetes Services are mainly for internal cluster communication. Exposing them externally with a unique LoadBalancer per service is expensive and complex. An Ingress Controller provides a single, intelligent, and cost-effective entry point for all external HTTP and HTTPS traffic into the cluster.
The mental model
Think of an Ingress Controller as the receptionist in a large office building. You create an Ingress resource, which is like giving the receptionist a directory: 'All requests for api.example.com go to the API-Service on the 3rd floor.' The Ingress Controller is the receptionist who reads this directory and directs incoming traffic to the correct service.
How it works
An Ingress Controller is a deployment of pods running a proxy like NGINX or Traefik. It watches the Kubernetes API for Ingress resources. When you create an Ingress object defining routing rules (e.g., host 'foo.com' path '/bar' goes to 'service-a'), the controller detects this. It then automatically reconfigures its underlying proxy to enforce these rules. All external traffic hits the controller's single public endpoint and is routed internally based on the rules it has ingested.
When to use it
Use an Ingress Controller whenever you need to expose one or more HTTP/S services to the outside world. It is the standard for managing host-based routing (directing api.myapp.com and www.myapp.com to different services) and path-based routing (sending /api and /app to different services from the same domain). It is also the canonical place to handle TLS termination for your services.
When not to use it
For non-HTTP/S traffic, such as TCP streams for databases or message queues, an Ingress Controller is the wrong tool. For those protocols, you should use a Service of type LoadBalancer or NodePort directly. It might also be overkill for a very simple cluster exposing only a single service.
One canonical example
The most common mistake is creating an Ingress resource and expecting it to work. The Ingress resource itself does nothing; it is only a declaration of routing rules. You must have an Ingress Controller (like ingress-nginx, Traefik, or Contour) deployed and running in your cluster to actually read those rules and manage the traffic. Without the controller, the Ingress object is just an ignored piece of configuration.
Interview question
Which of the following is the primary advantage of using an Ingress Controller for exposing applications in a Kubernetes cluster?
- a.It encrypts all internal network traffic between pods, enhancing cluster security.
- b.It automatically scales backend services based on traffic load and resource utilization.
- c.It enables advanced HTTP/S routing from a single public endpoint, reducing cost and complexity.Correct
- d.It provides a dedicated external IP address for each individual service, simplifying access.
Why? this is the answer
The card states an Ingress Controller provides "a single, intelligent, and cost-effective entry point for all external HTTP and HTTPS traffic" and is used for "host-based routing... and path-based routing." Option D is incorrect because the card explicitly mentions that exposing services with "a unique LoadBalancer per service is expensive and complex," which an Ingress Controller aims to avoid by providing a single entry point.
Just read this? Test yourself on what you have been reading.
Read the original → kubernetes.io
- #kubernetes
- #networking
- #ingress
- #devops
Put your scrolling time to good use
Learn one idea, try a quiz and save useful cards for revision. Tezvyn makes it easy to learn and stay current in your tech field, a few minutes at a time.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on kubernetes — each one lists the topics its interview covers.
See open roles