Why Ingress manages external access in Kubernetes - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary role of an Ingress in Kubernetes?

In Kubernetes, what main function does an Ingress resource serve?

A It controls external access to services inside the cluster, often via HTTP/HTTPS routing.

B It schedules pods onto nodes based on resource availability.

C It stores persistent data for stateful applications.

D It manages internal pod-to-pod communication within the cluster.

💡 Hint

Think about how users outside the cluster reach applications running inside.

An Ingress manages external access by routing incoming traffic to services inside the cluster, typically handling HTTP and HTTPS requests.

💻 Command Output

intermediate

Output of kubectl get ingress command

What output do you expect from kubectl get ingress if an Ingress resource named web-ingress is correctly configured?

Kubernetes

kubectl get ingress

A

NAME          CLASS    HOSTS             ADDRESS        PORTS   AGE
web-ingress   <none>   example.com       192.168.1.10   80      5m

B

NAME          READY   STATUS    RESTARTS   AGE
web-ingress   1/1     Running   0          5m

C

NAME          TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)   AGE
web-ingress   LoadBalancer 10.0.0.1        <pending>     80        5m

D

NAME          READY   UP-TO-DATE   AVAILABLE   AGE
web-ingress   3/3     3            3           5m

💡 Hint

Look for the output format that shows hosts, addresses, and ports related to Ingress.

The kubectl get ingress command lists Ingress resources with columns like NAME, CLASS, HOSTS, ADDRESS, PORTS, and AGE.

❓ Configuration

advanced

Correct Ingress YAML for routing traffic

Which Ingress YAML snippet correctly routes HTTP traffic from myapp.example.com to a service named myapp-service on port 80?

A

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
spec:
  host: myapp.example.com
  backend:
    serviceName: myapp-service
    servicePort: 80

B

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
spec:
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        backend:
          serviceName: myapp-service
          servicePort: 80

C

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
spec:
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp-service
            port:
              number: 80

D

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
spec:
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: ImplementationSpecific
        backend:
          service:
            name: myapp-service
            port:
              number: 8080

💡 Hint

Check the correct indentation and field names for Ingress backend service and port.

Option C uses the correct API version and the proper nested structure for backend service name and port number with pathType 'Prefix'.

❓ Troubleshoot

advanced

Why is external traffic not reaching the service via Ingress?

You created an Ingress resource, but external HTTP requests to your domain are not reaching the service. Which is the most likely cause?

A The service has no selector labels matching any pods.

B The Ingress controller is not installed or running in the cluster.

C The pod containers are missing readiness probes.

D The cluster nodes do not have enough CPU resources.

💡 Hint

Ingress resources need a controller to act on them and route traffic.

Without an Ingress controller, the Ingress resource rules are not enforced, so external traffic won't be routed to services.

✅ Best Practice

expert

Best practice for securing Ingress external access

Which practice best secures external access managed by an Ingress in Kubernetes?

A Use only HTTP protocol to reduce overhead and improve speed.

B Expose all services directly with NodePort to avoid Ingress complexity.

C Disable authentication on Ingress to simplify user access.

D Use TLS encryption with certificates and enforce HTTPS traffic in the Ingress rules.

💡 Hint

Think about protecting data in transit and user privacy.

Using TLS with HTTPS ensures encrypted communication, protecting data and user privacy when accessing services externally.

Practice

1. What is the primary role of an Ingress in Kubernetes?

easy

A. To manage external access to services inside the cluster

B. To store configuration data for pods

C. To schedule pods on nodes

D. To monitor resource usage of containers

Solution

1. Step 1: Understand Ingress purpose

   Ingress is designed to control how external users access services running inside Kubernetes.

2. Step 2: Compare with other components

   Other components like ConfigMaps store data, schedulers place pods, and metrics monitor usage, but Ingress manages external access.

3. Final Answer:

   To manage external access to services inside the cluster -> Option A

4. Quick Check:

   Ingress controls external access = C [OK]

Hint: Ingress controls outside traffic to services [OK]

Common Mistakes:

• Confusing Ingress with ConfigMap or Scheduler
• Thinking Ingress manages internal pod scheduling
• Assuming Ingress monitors resource usage

2. Which of the following is the correct basic syntax to define an Ingress resource in YAML?

easy

A. apiVersion: v1\nkind: Service\nmetadata:\n name: example-ingress\nspec:\n selector:\n app: example\n ports:\n - protocol: TCP\n port: 80\n targetPort: 9376

B. apiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: example-ingress\nspec:\n rules:\n - host: example.com\n http:\n paths:\n - path: /\n pathType: Prefix\n backend:\n service:\n name: example-service\n port:\n number: 80

C. apiVersion: apps/v1\nkind: Deployment\nmetadata:\n name: example-ingress\nspec:\n replicas: 3\n selector:\n matchLabels:\n app: example

D. apiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: example-ingress\nspec:\n rules:\n - host: example.com\n tcp:\n ports:\n - port: 80\n backend:\n serviceName: example-service\n servicePort: 80

Solution

1. Step 1: Identify correct Ingress syntax

   Ingress uses apiVersion networking.k8s.io/v1, kind Ingress, and defines rules with host and http paths.

2. Step 2: Check options for correct fields

   apiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n name: example-ingress\nspec:\n rules:\n - host: example.com\n http:\n paths:\n - path: /\n pathType: Prefix\n backend:\n service:\n name: example-service\n port:\n number: 80 matches the correct structure with service name and port under backend. apiVersion: v1\nkind: Service\nmetadata:\n name: example-ingress\nspec:\n selector:\n app: example\n ports:\n - protocol: TCP\n port: 80\n targetPort: 9376 is a Service definition. The other options define a Deployment or incorrectly use a tcp field.

3. Final Answer:

   apiVersion: networking.k8s.io/v1 kind: Ingress spec: rules: - host: example.com http: paths: - path: / pathType: Prefix backend: service: name: example-service port: number: 80 -> Option B

4. Quick Check:

   Ingress YAML syntax = A [OK]

Hint: Ingress YAML uses rules with host and http paths [OK]

Common Mistakes:

• Confusing Service or Deployment YAML with Ingress
• Using tcp instead of http in rules
• Incorrect apiVersion or kind for Ingress

3. Given this Ingress rule snippet, what hostname will route traffic to my-service?

spec:
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /app
        pathType: Prefix
        backend:
          service:
            name: my-service
            port:
              number: 8080

medium

A. app.example.com

B. example.com

C. my-service

D. app

Solution

1. Step 1: Identify the host in the Ingress rule

   The host field is set to app.example.com, which defines the hostname for routing.

2. Step 2: Understand routing based on host

   Traffic to app.example.com with path prefix /app routes to my-service on port 8080.

3. Final Answer:

   app.example.com -> Option A

4. Quick Check:

   Host in rule = app.example.com [OK]

Hint: Look for host field in Ingress rules [OK]

Common Mistakes:

• Confusing service name with hostname
• Ignoring the host field and picking path or service name
• Choosing partial strings like 'app' instead of full hostname

4. You created an Ingress resource but external traffic is not reaching your service. Which of these is a likely cause?

medium

A. The pod image is missing a label

B. The cluster has no nodes

C. The service port is set to 0

D. The Ingress controller is not installed or running

Solution

1. Step 1: Check Ingress controller presence

   Ingress resources need an Ingress controller to process rules and route traffic. Without it, Ingress does nothing.

2. Step 2: Evaluate other options

   Pod labels or service ports affect internal routing but won't stop Ingress from receiving traffic. No nodes means cluster is down, but question focuses on Ingress.

3. Final Answer:

   The Ingress controller is not installed or running -> Option D

4. Quick Check:

   Ingress needs controller to route traffic = B [OK]

Hint: Ingress needs a controller running to work [OK]

Common Mistakes:

• Ignoring the need for an Ingress controller
• Blaming pod labels for external access issues
• Confusing service port 0 with Ingress failure

5. You want to expose two services, service-a and service-b, on the same domain but different paths using Ingress. Which configuration correctly achieves this?

hard

A. Use a LoadBalancer service type for each service instead of Ingress

B. Create two Ingress resources with the same host example.com, each with one path for service-a and service-b

C. Define one Ingress with rules for host example.com and paths /a routing to service-a, /b routing to service-b

D. Expose service-a and service-b on different ports without Ingress

Solution

1. Step 1: Understand Ingress path routing

   Ingress can route different URL paths on the same host to different services using rules with multiple paths.

2. Step 2: Compare options for best practice

   Define one Ingress with rules for host example.com and paths /a routing to service-a, /b routing to service-b uses one Ingress with multiple paths, which is efficient and standard. Create two Ingress resources with the same host example.com, each with one path for service-a and service-b may cause conflicts. Options C and D avoid Ingress and don't meet the requirement.

3. Final Answer:

   Define one Ingress with rules for host example.com and paths /a and /b routing to respective services -> Option C

4. Quick Check:

   One Ingress, multiple paths = A [OK]

Hint: Use one Ingress with multiple paths for same host [OK]

Common Mistakes:

• Creating multiple Ingresses with same host causing conflicts
• Using LoadBalancer instead of Ingress for path routing
• Exposing services on different ports without hostname routing