Host-based routing in Kubernetes - Deep Dive

Overview - Host-based routing

What is it?

Host-based routing is a way to send internet traffic to different places based on the website address (host) a user types. In Kubernetes, it means directing requests to different services depending on the host name in the request. This helps run many websites or apps on the same cluster without mixing their traffic. It works by checking the host part of the URL and sending the request to the right backend service.

Why it matters

Without host-based routing, all traffic would go to one place, making it hard to run multiple websites or apps on the same system. This would waste resources and complicate management. Host-based routing solves this by letting one Kubernetes cluster handle many hosts efficiently, saving money and making updates easier. It also improves user experience by ensuring requests reach the correct app quickly.

Where it fits

Before learning host-based routing, you should understand basic Kubernetes concepts like pods, services, and ingress controllers. After mastering host-based routing, you can explore more advanced traffic management like path-based routing, TLS termination, and canary deployments. It fits into the bigger picture of Kubernetes networking and application delivery.

Mental Model

Core Idea

Host-based routing directs incoming requests to different services based on the website address in the request's host header.

Think of it like...

Imagine a receptionist in a large office building who looks at the company name on a visitor's invitation and then directs them to the correct office inside the building.

┌───────────────┐
│ Incoming HTTP │
│   Request     │
└──────┬────────┘
       │ Host header: www.siteA.com
       ▼
┌───────────────┐       ┌───────────────┐
│ Host-based    │──────▶│ Service A     │
│ Router        │       └───────────────┘
│ (Ingress)     │
└──────┬────────┘       ┌───────────────┐
       │ Host header: www.siteB.com
       ▼
       └────────────────▶ Service B     │
                       └───────────────┘

Build-Up - 7 Steps

1

Foundation

Understanding Kubernetes Ingress Basics

Concept: Learn what an Ingress is and how it controls external access to services in Kubernetes.

An Ingress is a Kubernetes resource that manages external HTTP and HTTPS traffic to services inside the cluster. It acts like a traffic controller, deciding where requests go based on rules. Ingress requires an Ingress Controller, which is a piece of software that implements these rules and routes traffic accordingly.

Result

You know that Ingress is the entry point for HTTP traffic and that it uses rules to send requests to services.

Understanding Ingress is essential because host-based routing is implemented through Ingress rules, making it the foundation for controlling web traffic in Kubernetes.

2

Foundation

Basics of HTTP Host Headers

Concept: Learn what the host header in an HTTP request is and why it matters for routing.

When a browser sends a request to a website, it includes a 'Host' header that tells the server which website it wants. For example, if you visit www.example.com, the Host header is 'www.example.com'. Servers use this header to decide which website content to send back, especially when multiple sites share the same IP address.

Result

You understand that the Host header identifies the target website in a request.

Knowing about the Host header is key because host-based routing depends on reading this header to send traffic to the right service.

3

Intermediate

Creating Host-based Routing Rules in Ingress

🤔Before reading on: do you think host-based routing rules can direct traffic to multiple services in one Ingress resource? Commit to your answer.

Concept: Learn how to write Ingress rules that route traffic based on the host name to different services.

In an Ingress resource, you define rules under 'spec.rules'. Each rule has a 'host' field and a list of paths. For host-based routing, you specify different hosts and the backend services they should reach. For example: apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: example-ingress spec: rules: - host: www.siteA.com http: paths: - path: / pathType: Prefix backend: service: name: service-a port: number: 80 - host: www.siteB.com http: paths: - path: / pathType: Prefix backend: service: name: service-b port: number: 80

Result

Traffic to www.siteA.com goes to service-a, and traffic to www.siteB.com goes to service-b.

Knowing how to write host-based rules lets you run multiple websites on one cluster, each isolated by hostname.

4

Intermediate

Configuring Ingress Controller for Host Routing

🤔Before reading on: do you think any Ingress resource works without an Ingress Controller? Commit to your answer.

Concept: Understand the role of the Ingress Controller and how to deploy it to enable host-based routing.

An Ingress resource is just a set of rules. To make them work, you need an Ingress Controller like NGINX, Traefik, or HAProxy running in your cluster. This controller watches Ingress resources and configures the actual proxy to route traffic. Without it, host-based routing rules won't have any effect. Installing an Ingress Controller usually involves applying a YAML manifest or using Helm charts.

Result

Ingress Controller runs and enforces host-based routing rules defined in Ingress resources.

Recognizing the Ingress Controller's role prevents confusion when Ingress rules don't work as expected.

5

Intermediate

Testing Host-based Routing with Curl

🤔Before reading on: do you think curl can simulate requests with different host headers? Commit to your answer.

Concept: Learn how to test host-based routing by sending HTTP requests with specific Host headers.

You can use curl to test routing by specifying the Host header manually. For example: curl -H "Host: www.siteA.com" http:/// curl -H "Host: www.siteB.com" http:/// Replace with your Ingress Controller's external IP. This lets you check if traffic goes to the correct service based on the host.

Result

Curl returns responses from the correct backend service depending on the Host header sent.

Testing with curl helps verify that host-based routing is set up correctly before going live.

6

Advanced

Handling TLS with Host-based Routing

🤔Before reading on: do you think one TLS certificate can cover multiple hosts in host-based routing? Commit to your answer.

Concept: Learn how TLS (HTTPS) works with host-based routing and how to configure certificates for multiple hosts.

When using HTTPS, each host needs a TLS certificate. You can configure multiple certificates in the Ingress resource using 'tls' section, specifying hosts and secret names holding certificates. Alternatively, use a wildcard or SAN (Subject Alternative Name) certificate covering multiple hosts. The Ingress Controller uses SNI (Server Name Indication) to select the right certificate based on the host requested.

Result

Secure HTTPS connections work correctly for each host, with the right certificate served.

Understanding TLS with host routing is crucial for secure multi-host deployments and avoiding browser warnings.

7

Expert

Limitations and Performance of Host-based Routing

🤔Before reading on: do you think host-based routing adds significant latency or resource overhead? Commit to your answer.

Concept: Explore the internal workings, limitations, and performance considerations of host-based routing in Kubernetes Ingress.

Host-based routing relies on the Ingress Controller parsing the Host header and matching rules. While efficient, complex rules or many hosts can increase CPU and memory usage. Some Ingress Controllers cache rules for speed. Also, host-based routing depends on correct DNS and client behavior; misconfigured DNS or clients ignoring Host headers can break routing. Additionally, some legacy clients or protocols may not support Host headers properly, limiting routing effectiveness.

Result

You understand when host-based routing might cause performance issues or fail due to external factors.

Knowing these limits helps design scalable, reliable systems and choose the right routing strategy for your needs.

Under the Hood

When a request reaches the Ingress Controller, it reads the Host header from the HTTP request. It then compares this host value against the rules defined in the Ingress resource. The controller uses a routing table built from these rules to forward the request to the matching backend service. This routing happens at the proxy level inside the controller, often using software like NGINX or Envoy. TLS termination, if configured, happens before routing, using SNI to select the correct certificate.

Why designed this way?

Host-based routing was designed to allow multiple websites to share the same IP address and port, saving resources and simplifying infrastructure. Before this, each site needed a separate IP or port, which was costly and complex. Using the Host header leverages existing HTTP standards and client behavior, making routing flexible and scalable without changing client software.

┌───────────────┐
│ Client Request│
│ Host: siteA  │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Ingress       │
│ Controller    │
│ (Proxy Layer) │
└──────┬────────┘
       │ Matches Host header
       ▼
┌───────────────┐
│ Routing Table │
│ (Host -> Svc) │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ Backend       │
│ Service A     │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Does host-based routing require a unique IP address per host? Commit to yes or no.

Common Belief: Each host in host-based routing needs its own IP address.

Reality: Multiple hosts can share the same IP address and port because routing is done based on the Host header in the HTTP request.

Why it matters: Believing this leads to unnecessary IP address allocation and infrastructure complexity.

Quick: Can host-based routing work without an Ingress Controller? Commit to yes or no.

Common Belief: Defining Ingress rules alone is enough to route traffic by host.

Reality: Ingress rules need an Ingress Controller to enforce them; without it, routing does not happen.

Why it matters: This misconception causes confusion when traffic does not route as expected, delaying troubleshooting.

Quick: Does host-based routing automatically secure traffic with HTTPS? Commit to yes or no.

Common Belief: Host-based routing includes automatic HTTPS encryption for all hosts.

Reality: TLS must be explicitly configured with certificates; host-based routing itself does not provide encryption.

Why it matters: Assuming automatic security can lead to unencrypted traffic and security risks.

Quick: Is host-based routing always the best choice for traffic routing? Commit to yes or no.

Common Belief: Host-based routing is always the best way to route traffic in Kubernetes.

Reality: Sometimes path-based routing or other methods are better depending on the application structure and traffic patterns.

Why it matters: Choosing host-based routing blindly can cause complexity or inefficiency in some scenarios.

Expert Zone

1

Some Ingress Controllers support advanced host matching like wildcard hosts or regular expressions, which can simplify rule management but add complexity.

2

Host-based routing depends heavily on DNS configuration; misconfigured DNS can cause traffic to never reach the cluster or go to the wrong host.

3

In multi-tenant clusters, host-based routing can be combined with namespaces and network policies to isolate traffic securely.

When NOT to use

Avoid host-based routing when your application serves many paths under a single host or when you need fine-grained routing by URL path. In such cases, path-based routing or service mesh solutions like Istio provide better control.

Production Patterns

In production, teams often combine host-based routing with TLS termination, authentication, and rate limiting at the Ingress Controller. They use DNS automation tools to manage host records and integrate monitoring to track routing performance and errors.

Connections

DNS (Domain Name System)

Host-based routing relies on DNS to resolve hostnames to the Ingress Controller's IP address.

Understanding DNS helps grasp how users' browsers find the Ingress Controller before host-based routing directs traffic inside the cluster.

Load Balancing

Host-based routing is a form of load balancing that directs traffic based on host headers rather than just IP or port.

Knowing load balancing principles clarifies how traffic distribution and failover work alongside host-based routing.

Postal Mail Sorting

Host-based routing is like sorting mail by recipient address to send letters to the correct department.

This connection shows how routing decisions based on addresses optimize delivery efficiency in both networks and mail systems.

Common Pitfalls

#1 Not deploying an Ingress Controller after creating Ingress rules.

Wrong approach:

kubectl apply -f ingress-rules.yaml
# No Ingress Controller installed

Correct approach:

kubectl apply -f ingress-rules.yaml
kubectl apply -f ingress-controller.yaml

Root cause:

Misunderstanding that Ingress resources alone do not route traffic without a controller.

#2 Using the wrong host name in Ingress rules that does not match DNS or client requests.

Wrong approach:

spec:
rules:
- host: wrongsite.com
http:
paths:
- path: /
backend: ...

Correct approach:

spec:
rules:
- host: www.correctsite.com
http:
paths:
- path: /
backend: ...

Root cause:

Confusing host names or typos cause traffic to not match any rule and fail routing.

#3 Forgetting to specify the Host header when testing with curl.

Wrong approach:

curl http:///

Correct approach:

curl -H "Host: www.siteA.com" http:///

Root cause:

Not realizing that host-based routing depends on the Host header, so tests without it do not simulate real traffic.

Key Takeaways

Host-based routing sends web traffic to different services based on the website address in the request.

It uses the Host header in HTTP requests and is implemented in Kubernetes via Ingress resources and an Ingress Controller.

Multiple hosts can share the same IP address, making resource use efficient and management simpler.

Proper DNS setup and TLS configuration are essential for host-based routing to work securely and reliably.

Understanding the role of the Ingress Controller and testing with correct Host headers prevents common setup mistakes.