Route HTTP traffic with Ingress and the Gateway API

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Ingress and the Gateway API

Know the parts

The objects describe routes; a controller must be installed to make them work.

API	Objects
Ingress	`IngressClass` (which controller), `Ingress` (rules)
Gateway API	`GatewayClass` (controller), `Gateway` (listeners: ports, TLS), `HTTPRoute` (rules)

$kubectl get ingressclass
$kubectl get pods -n ingress-nginx
$kubectl get gatewayclass

9.2

Write an Ingress

Rules by host and path, to a Service and port.

$kubectl create ingress shop --class=nginx --rule="shop.example.com/=web:80" --rule="shop.example.com/api*=api:8080" -n shop

ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
  namespace: shop
spec:
  ingressClassName: nginx
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend: { service: { name: web, port: { number: 80 } } }
          - path: /api
            pathType: Prefix
            backend: { service: { name: api, port: { number: 8080 } } }

`pathType`	Matches
`Prefix`	`/api`, `/api/`, `/api/orders`
`Exact`	Only exactly `/api`

9.3

Add TLS

The certificate and key live in a kubernetes.io/tls Secret; the Ingress refers to it.

$kubectl create secret tls shop-tls --cert=shop.crt --key=shop.key -n shop
$curl -k --resolve shop.example.com:443:INGRESS_IP https://shop.example.com/

At work

cert-manager gets and renews Let's Encrypt certificates automatically for Ingress and Gateway objects.

9.4

Use the Gateway API

The Gateway API splits roles: the platform team owns the Gateway, app teams own their HTTPRoutes. It supports more features (header matching, traffic splitting) without controller-specific annotations.

gateway.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: { name: shop-gw, namespace: shop }
spec:
  gatewayClassName: nginx
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: shop.example.com
      tls:
        certificateRefs: [{ name: shop-tls }]
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: shop, namespace: shop }
spec:
  parentRefs: [{ name: shop-gw }]
  hostnames: [shop.example.com]
  rules:
    - matches: [{ path: { type: PathPrefix, value: /api } }]
      backendRefs: [{ name: api, port: 8080 }]
    - backendRefs:
        - { name: web, port: 80, weight: 90 }
        - { name: web-canary, port: 80, weight: 10 }

$kubectl get gateway,httproute -n shop
$kubectl describe httproute shop -n shop

Remember

weight splits traffic — here 10 % goes to the canary version.

9.5

Troubleshoot routing

Check from the outside in: controller → rule → Service → endpoints → pod.

$kubectl describe ingress shop -n shop
$kubectl logs -n ingress-nginx deploy/ingress-nginx-controller --tail=50
$kubectl get endpointslices -n shop
$curl -H "Host: shop.example.com" http://INGRESS_IP/

All commands in this chapter