Suppose an application has two internal services, but users should reach both through one public address. An Ingress is a Kubernetes API object that creates an HTTP load balancer in front of Services. Its rules inspect each request and choose a backend by URL path, hostname, or both. Unlike separate LoadBalancer Services, the backends can share one external IP. section 7.2
A practical setup has three parts:
- Deploy the applications and expose each through a Service. The demonstrated configuration uses NodePort Services as Ingress backends. section 7.2
- Create an Ingress with rules mapping paths such as / and /robohash, or distinct hostnames, to Service names and ports. section 7.2
- Apply the configuration, then use kubectl get ing -w to wait for an external address; kubectl describe ingress shows the resulting routes and backends. section 7.2
Listing 7.6 Chapter07/7.2_Ingress/ingress_path.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: timeserver-ingress
spec:
rules:
- http:
paths:
- path: / #1
pathType: Prefix
backend:
service:
name: timeserver-internal
port:
number: 80
- path: /robohash #2
pathType: Prefix
backend:
service:
name: robohash-internal
port:
number: 80
#1 First path, handled by the timeserver-internal Service
#2 Second path, handled by the robohash-internal Service
This Ingress sends requests for / and /robohash to different Services on port 80. section 7.2
Ingress can also handle HTTPS at the load balancer. Create a TLS Secret from a certificate and private key, then name that Secret in the Ingress tls configuration. After terminating TLS, it can contact a backend over HTTP or re-encrypt the connection over HTTPS; it cannot pass the client's unchanged encrypted connection through. Use a LoadBalancer Service when that passthrough is required. A self-signed certificate is useful for a demonstration but does not verify the server's identity. section 7.2.1
Because Ingress sees HTTP requests, it can also expose a requests-per-second metric for a HorizontalPodAutoscaler. A layer-4 load balancer handles TCP/IP traffic instead and does not provide this HTTP request view. section 6.2.1
