Ingress controllers (Nginx, Traefik) in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Nginx Ingress Controller Pod Status

You deployed an Nginx Ingress Controller in your Kubernetes cluster. What is the output of the command kubectl get pods -n ingress-nginx immediately after deployment?

Kubernetes

kubectl get pods -n ingress-nginx

A

NAME                                        READY   STATUS    RESTARTS   AGE
nginx-ingress-controller-abc123               1/1     CrashLoopBackOff   3          1m

B

NAME                                        READY   STATUS    RESTARTS   AGE
nginx-ingress-controller-abc123               0/1     Pending   0          1m

C

NAME                                        READY   STATUS    RESTARTS   AGE
nginx-ingress-controller-abc123               1/1     Running   0          1m

D Error from server (NotFound): namespaces "ingress-nginx" not found

💡 Hint

Think about the normal state of a pod right after a successful deployment.

After a successful deployment, the Nginx Ingress Controller pod should be in Running state with all containers ready (1/1). Pending means it hasn't started, CrashLoopBackOff means it is failing repeatedly, and NotFound means the namespace doesn't exist.

🧠 Conceptual

intermediate

Traefik Ingress Controller Feature

Which feature is unique to Traefik compared to Nginx Ingress Controller in Kubernetes?

A Does not support Let's Encrypt integration

B Supports only HTTP and HTTPS protocols

C Requires manual configuration reload after changes

D Automatic service discovery and dynamic configuration without reload

💡 Hint

Think about how Traefik handles configuration updates.

Traefik automatically discovers services and updates its routing configuration dynamically without needing to reload, unlike Nginx which often requires reloads.

❓ Troubleshoot

advanced

Nginx Ingress Controller TLS Issue

You configured TLS for your Nginx Ingress Controller, but HTTPS requests fail with a certificate error. Which of the following is the most likely cause?

A The TLS secret referenced in the Ingress resource does not exist or is in the wrong namespace

B The Ingress controller does not support TLS

C The Ingress resource is missing the host field

D The service port is not exposed as NodePort

💡 Hint

Check the TLS secret and its namespace carefully.

TLS requires a valid secret with the certificate and key in the same namespace as the Ingress resource. If the secret is missing or in another namespace, the certificate error occurs.

🔀 Workflow

advanced

Deploying Traefik with Helm

Which Helm command correctly installs Traefik Ingress Controller in the namespace 'traefik-system' with default settings?

A helm deploy traefik traefik/traefik --namespace traefik-system

B helm install traefik traefik/traefik --namespace traefik-system --create-namespace

C helm install traefik traefik/traefik --namespace default

D helm apply traefik traefik/traefik --namespace traefik-system

💡 Hint

Remember the correct Helm command to install a chart and create namespace if missing.

The correct Helm command to install a chart is 'helm install'. The '--create-namespace' flag creates the namespace if it doesn't exist. 'helm deploy' and 'helm apply' are invalid Helm commands.

✅ Best Practice

expert

Securing Ingress Controllers

What is the best practice to secure your Kubernetes cluster's Ingress Controller against unauthorized external access?

A Use Network Policies to restrict traffic to the Ingress Controller pods

B Expose the Ingress Controller service as LoadBalancer without firewall rules

C Disable TLS to simplify configuration

D Allow all incoming traffic to the Ingress Controller

💡 Hint

Think about controlling network traffic at the pod level.

Network Policies allow you to restrict which pods or IPs can communicate with the Ingress Controller, enhancing security. Exposing without restrictions or disabling TLS weakens security.

Practice

1. What is the main role of an Ingress controller like Nginx or Traefik in Kubernetes?

easy

A. To monitor pod resource usage

B. To manage Kubernetes cluster nodes

C. To store container images

D. To route external traffic to internal Kubernetes services

Solution

1. Step 1: Understand Ingress controller purpose

   Ingress controllers manage how external users access services inside the Kubernetes cluster.

2. Step 2: Identify correct function

   Nginx and Traefik route incoming traffic to the right service based on rules.

3. Final Answer:

   To route external traffic to internal Kubernetes services -> Option D

4. Quick Check:

   Ingress controller = traffic router [OK]

Hint: Ingress controllers route external traffic inside Kubernetes [OK]

Common Mistakes:

• Confusing ingress controller with node management
• Thinking ingress stores images
• Mixing ingress with monitoring tools

2. Which annotation correctly specifies the use of the Nginx ingress controller in a Kubernetes Ingress resource?

easy

A. kubernetes.io/ingress.class: "nginx"

B. ingress.kubernetes.io/controller: "traefik"

C. kubernetes.io/controller: "nginx"

D. ingress.class: "nginx-controller"

Solution

1. Step 1: Recall correct annotation key for ingress class

   The standard annotation to specify ingress controller is kubernetes.io/ingress.class.

2. Step 2: Match correct value for Nginx

   The value for Nginx ingress controller is "nginx".

3. Final Answer:

   kubernetes.io/ingress.class: "nginx" -> Option A

4. Quick Check:

   Annotation key = kubernetes.io/ingress.class [OK]

Hint: Use kubernetes.io/ingress.class: "nginx" for Nginx [OK]

Common Mistakes:

• Using wrong annotation keys
• Mixing Traefik and Nginx values
• Omitting quotes around values

3. Given this Ingress YAML snippet using Traefik:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  annotations:
    kubernetes.io/ingress.class: "traefik"
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /app
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 80

What happens when a user visits http://example.com/app/page?

medium

A. Traffic goes to default backend ignoring /app path

B. Traffic is blocked because pathType is incorrect

C. Traffic is routed to the app-service on port 80

D. Ingress controller returns 404 error

Solution

1. Step 1: Analyze ingress rule for host and path

   The rule matches host example.com and path prefix /app, so /app/page matches.

2. Step 2: Check backend service and port

   Requests matching the path are sent to app-service on port 80.

3. Final Answer:

   Traffic is routed to the app-service on port 80 -> Option C

4. Quick Check:

   Path prefix match routes traffic correctly [OK]

Hint: Path prefix routes all subpaths to backend service [OK]

Common Mistakes:

• Assuming pathType Prefix is invalid
• Ignoring host match requirement
• Thinking default backend handles matched paths

4. You deployed an Nginx ingress controller but your Ingress resource is not routing traffic. Which fix is most likely correct?

medium

A. Add annotation kubernetes.io/ingress.class: "nginx" to the Ingress resource

B. Change service port to 8080 in the Ingress backend

C. Remove all annotations from the Ingress resource

D. Restart the Kubernetes API server

Solution

1. Step 1: Identify cause of routing failure

   Ingress controller routes traffic only to Ingress resources with matching ingress.class annotation.

2. Step 2: Apply correct annotation for Nginx

   Adding kubernetes.io/ingress.class: "nginx" tells Nginx controller to manage this Ingress.

3. Final Answer:

   Add annotation kubernetes.io/ingress.class: "nginx" to the Ingress resource -> Option A

4. Quick Check:

   Ingress class annotation enables controller routing [OK]

Hint: Add ingress.class annotation matching controller [OK]

Common Mistakes:

• Changing service port without checking actual port
• Removing annotations disables routing
• Restarting API server does not fix ingress routing

5. You want to expose two services, webapp and api, on the same domain using Traefik ingress. The webapp should respond on / and api on /api. Which Ingress configuration correctly achieves this?

hard

A. Create two Ingresses with same host but no annotations

B. Use one Ingress with two paths: / to webapp and /api to api service, with annotation kubernetes.io/ingress.class: "traefik"

C. Use one Ingress with only /api path to api service, and no path for webapp

D. Create one Ingress with annotation kubernetes.io/ingress.class: "nginx" for Traefik

Solution

1. Step 1: Understand routing requirements

   Both services share the same domain; webapp on root path /, api on /api path.

2. Step 2: Configure single Ingress with multiple paths and correct annotation

   One Ingress resource with two paths and annotation kubernetes.io/ingress.class: "traefik" directs traffic properly.

3. Final Answer:

   Use one Ingress with two paths: / to webapp and /api to api service, with annotation kubernetes.io/ingress.class: "traefik" -> Option B

4. Quick Check:

   Multiple paths in one Ingress with correct class [OK]

Hint: One Ingress, multiple paths, correct ingress.class annotation [OK]

Common Mistakes:

• Using wrong ingress.class annotation for Traefik
• Creating multiple Ingresses without annotations
• Missing path for root service