Ingress Controllers

An Ingress on its own does nothing. It’s a config object that needs an Ingress Controller — a real reverse proxy running as pods — to interpret it and terminate traffic.

The moving parts

Layered view

1. Cloud LB / MetalLB binds a public IP and forwards to a NodePort or a pod (with hostNetwork).
2. That LB targets the controller pods (nginx / Traefik / Envoy).
3. The controller watches Ingress (or HTTPRoute) objects and rewrites its own config.
4. Requests then hit Services → Pods.

Minimal Ingress

ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  ingressClassName: nginx
  tls:
    - hosts: [api.example.com]
      secretName: api-tls
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 80

nginx vs Traefik — the honest comparison

Concern	nginx-ingress	Traefik
Config source	Ingress + ConfigMap + annotations	Ingress or IngressRoute CRD
Reload behavior	Config regen + graceful reload	Hot reload (dynamic)
Metrics	Prometheus (needs enabling)	Prometheus (built-in)
Cert-manager integration	Excellent	Native ACME + cert-manager both fine
Rate limiting	Annotations	Middleware CRDs

My rule

Small team, standard HTTP — Traefik. Bigger team, hardened SRE org, want a well-known config surface — nginx. Multi-tenant / mesh-y — Envoy Gateway.

The Gateway API — the future

The Gateway API is the standards-based replacement for Ingress. Same problem, better model:

httproute.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api
spec:
  parentRefs:
    - name: shared-gateway
      namespace: gateway-system
  hostnames: ["api.example.com"]
  rules:
    - matches:
        - path: { type: PathPrefix, value: /v1 }
      backendRefs:
        - name: api-v1
          port: 80
    - matches:
        - path: { type: PathPrefix, value: /v2 }
      backendRefs:
        - name: api-v2
          port: 80

Why it's better

• Separation of roles. Platform team owns GatewayClass and Gateway; app teams own HTTPRoute.
• Portable. Same HTTPRoute works on Envoy, Cilium, nginx, Traefik, Contour.
• Rich matching (headers, methods, weights) without vendor-specific annotations.

Debug like an SRE

Is the packet reaching the controller?

kubectl -n ingress-nginx logs -l app.kubernetes.io/name=ingress-nginx --tail=100 -f

Is the Ingress even valid?

kubectl describe ingress api
# Look for `Warning` events — TLS secret missing? Backend service resolution failed?

What did nginx render?

kubectl -n ingress-nginx exec deploy/ingress-nginx-controller -- \
  cat /etc/nginx/nginx.conf | grep -A5 api.example.com