Kubernetes Ingress Concepts

External

• https://medium.com/google-cloud/understanding-kubernetes-networking-ingress-1bc341c84078

Internal

• Networking Concepts
• Service Concepts
• Amazon EKS Concepts - Load Balancing and Ingress

Overview

An Ingress is a mechanism that operates at the application layer of the network stack (HTTP) and brings layer 7 features such as host and path-based routing and cookie-based session affinity to services. Ingress cooperates with services to distribute load to pods. It exposes multiple services through a single IP address, and its implementation differs fundamentally from the implementation of ClusterIP, NodePort and LoadBalancer services. The reasons to use an Ingress include:

• One Ingress can serve multiple services, behind a single public IP address, while each LoadBalancer requires its own native load balancer, each of them requiring their own public IP address.
• Host, paths and cookies can be used to route the request.

The Ingress mechanism consists of an Ingress controller and an Ingress resource.

How Ingress Works

A client attempting to access http://a.example.com resolves the name to the public IP address of the ingress controller external load balancer and establishes a connection to it. The ingress controller load balancer forwards the request, via the ingress controller LoadBalancer/NodePort/ClientIP service, to the ingress controller pod. The ingress controller's state was updated when an ingress resource that defines the host "a.example.com" was deployed, and it knows that all requests for "a.example.com" must be forwarded to the "a" ClusterIP service, which in turn forwards the request to one of the pods.

Ingress Controller

The ingress controller is the process - most likely running as a pod or pods inside the Kubernetes cluster itself - that accepts the HTTP connections, distributes traffic, terminates SSL connections, etc. Some Kubernetes distributions provide an ingress controller as an "add-on". For example, minikube provides to "minikube addons enable ingress" command. If the ingress controller is not provided as add-on, it can be installed. There is a default "ingress-nginx" ingress controller that can be installed in any Kubernetes instance. More details:

ingress-nginx

The ingress controller deploys as part of its installation a layer 4 service of its own, most likely a LoadBalancer.

Once installed, the access to the ingress controller pod(s) is performed via its own LoadBalancer/NodePort/ClusterIP service.

To access a service through an its external name, the external service DNS name must resolve to the public IP address of the load balancer deployed by the ingress controller's LoadBalancer service.

Ingress API Resource

https://kubernetes.io/docs/concepts/services-networking/ingress/

An Ingress is the Kubernetes API resource that declares access to level 4 services and allows configuring this access based on host and path. The ingress controller is notified when new ingress objects are created or when the existing ingress objects are modified and updates its internal state accordingly.

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  annotations:
    kubernetes.io/ingress.class: nginx
  name: example
spec:
  rules:
  - host: a.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: a
          servicePort: 80
        
  - host: b.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: b
          servicePort: 80
  # This section is only required if TLS is to be enabled for the Ingress
  tls:
    - hosts:
        - a.local
      secretName: example-tls-a

Some cloud providers require that the ingress points to a NodePort service, but this is not a Kubernetes requirement.

The ingress must be deployed in the same namespace as the services it serves.

TLS Support

If TLS is enabled for the Ingress, a Secret containing the certificate and key must also be provided:

apiVersion: v1
kind: Secret
type: kubernetes.io/tls
metadata:
  name: example-tls
  namespace: test-namespace
data:
  tls.crt: <base64 encoded cert>
  tls.key: <base64 encoded key>