Write Ingress Rules Including TLS

Why this matters

Exposing every Service as its own LoadBalancer is expensive and unmanageable past a handful of apps. Ingress concentrates external HTTP entry in one place with name-based and path-based routing plus central TLS termination. The exam tests the declaration plus the controller relationship, because routing that silently goes nowhere is the signature Ingress failure.

Concepts

An Ingress object holds rules (host plus paths to backend Services) and optionally a tls section naming a Secret per host. It does nothing alone: an ingress controller (NGINX, Traefik, cloud-native) watches Ingress objects and configures the actual proxy. No controller means the ADDRESS field stays empty forever, which is the first thing to check.

Paths match by type: Exact, Prefix, or controller-specific regex. Backend Services are referenced by name plus port number or name. The TLS Secret must hold tls.crt plus tls.key in the same namespace as the Ingress, and the tls hosts list must cover the rule hosts or browsers complain. Termination happens at the controller; traffic behind it is plain HTTP to the Service unless re-encrypted deliberately.

Worked example

Two apps, one host each, TLS on both, self-signed for the lab:

# secret first, same namespace as the ingress
kubectl create secret tls demo-tls \
  --cert=tls.crt --key=tls.key -n demo
# one ingress, two hosts
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata: { name: demo, namespace: demo }
spec:
  tls:
  - { hosts: [shop.demo.test, api.demo.test], secretName: demo-tls }
  rules:
  - host: shop.demo.test
    http: { paths: [{ path: /, pathType: Prefix,
      backend: { service: { name: shop, port: { number: 80 } } } }] }
  - host: api.demo.test
    http: { paths: [{ path: /, pathType: Prefix,
      backend: { service: { name: api, port: { number: 80 } } } }] }
kubectl get ingress -n demo   # ADDRESS filled by the controller
curl -k https://shop.demo.test/  # with /etc/hosts pointing at ADDRESS

Empty ADDRESS means no controller (or a broken one): check the controller pods before rewriting rules. Certificate errors with a filled address mean the Secret or hosts list, not the routing.

Exam notes

The Secret and the Ingress must share a namespace: cross-namespace TLS references do not work. pathType is required in v1 and Prefix on / catches everything below it. And kubectl describe ingress shows the controller's view including default-backend and rule errors, which beats re-reading your YAML.