How Ingress Controllers Route Kubernetes Traffic

Introduction

In Kubernetes, a Service of type LoadBalancer exposes a single application with its own cloud load balancer — expensive and inefficient when you have dozens of microservices. An Ingress Controller is a reverse proxy (typically Nginx, Traefik, or HAProxy) deployed inside the cluster that acts as a single entry point, routing incoming HTTP/HTTPS traffic to different Services based on hostname and URL path rules defined in Ingress objects. One cloud load balancer serves all services.

Step-by-Step: How Ingress Routing Works

flowchart TD
    A["1. Ingress Controller Deployment"]
    B["2. Define an Ingress Object"]
    C["3. Controller Watch Loop"]
    D["4. TLS Termination with cert-manager"]
    E["5. Path-Based Routing Under the Hood"]
    A --> B
    B --> C
    C --> D
    D --> E

Step 1: Ingress Controller Deployment

# Deploy Nginx Ingress Controller via Helm
helm upgrade --install ingress-nginx ingress-nginx   --repo https://kubernetes.github.io/ingress-nginx   --namespace ingress-nginx --create-namespace   --set controller.service.type=LoadBalancer

# Verify controller pod
kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx  # Get external LoadBalancer IP

Step 2: Define an Ingress Object

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: production
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/rate-limit: "100"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - api.example.com
    - admin.example.com
    secretName: example-tls
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /v1
        pathType: Prefix
        backend:
          service:
            name: api-v1-service
            port:
              number: 80
      - path: /v2
        pathType: Prefix
        backend:
          service:
            name: api-v2-service
            port:
              number: 80
  - host: admin.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: admin-service
            port:
              number: 3000

Step 3: Controller Watch Loop

The Ingress Controller runs a controller loop that watches the Kubernetes API for Ingress object changes using the informer pattern:

Ingress object created/updated
  → Controller receives watch event via API server
  → Translates Ingress rules to Nginx upstream/server blocks
  → Hot-reloads Nginx config (or applies via Nginx Plus API)
  → New routing takes effect within seconds (no downtime)

Step 4: TLS Termination with cert-manager

# cert-manager ClusterIssuer using Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          ingressClassName: nginx

cert-manager watches Ingress TLS stanzas, issues ACME challenges, and stores certificates in Secrets — automatically renewing 30 days before expiry.

Step 5: Path-Based Routing Under the Hood

The controller translates Ingress rules into Nginx location blocks:

# Auto-generated by Nginx Ingress Controller
upstream api-v1-service {
    server 10.244.1.5:80;
    server 10.244.2.3:80;
    keepalive 32;
}
server {
    listen 443 ssl;
    server_name api.example.com;
    ssl_certificate /etc/tls/tls.crt;
    ssl_certificate_key /etc/tls/tls.key;

    location /v1 {
        proxy_pass http://api-v1-service;
        limit_req zone=api burst=100 nodelay;
    }
}

Key Takeaways

• An Ingress Controller provides one cloud load balancer for all services, drastically reducing cost vs. per-Service LoadBalancer type.
• Ingress objects are Kubernetes-native configuration that the controller translates into reverse proxy rules — changes apply in seconds without restarts.
• cert-manager automates TLS certificate issuance and renewal using Let’s Encrypt ACME challenges, eliminating manual cert management.
• The controller’s watch loop uses Kubernetes informers — efficient long-polling against the API server that scales to thousands of Ingress objects.
• Use annotations (e.g., nginx.ingress.kubernetes.io/rate-limit) to configure per-route behaviors without modifying the Ingress Controller itself.