What is an Ingress in Kubernetes and how does it differ from a Service?
Learn what a Kubernetes Ingress is, how Layer 7 routing and TLS termination work, and how it differs from a Service — with YAML examples and interview tips.
Expected Interview Answer
An Ingress is a Kubernetes API object that manages external HTTP and HTTPS access to Services in a cluster, providing host- and path-based routing, TLS termination, and a single entry point. A Service exposes a set of pods internally (or externally) at Layer 4, while an Ingress operates at Layer 7 and routes requests to Services.
A Service gives a stable virtual IP and DNS name that load-balances traffic across matching pods, but it has no awareness of URLs, hostnames, or paths. An Ingress sits in front of one or more Services and uses rules to route requests like example.com/api to one Service and example.com/web to another. An Ingress only works if an Ingress Controller (such as NGINX or Traefik) is running to actually fulfil the rules; the Ingress object itself is just configuration.
- Consolidates many Services behind one external IP or load balancer
- Host- and path-based Layer 7 routing
- Centralised TLS/HTTPS termination
- Reduces cost versus one LoadBalancer per Service
- Supports name-based virtual hosting and rewrites
AI Mentor Explanation
A Service is like each individual net where a specific bowler practises — you go straight to that net to face that bowler. An Ingress is the ground's main gate steward who reads your ticket and directs you: batters to net one, spinners to net two, media to the pavilion, all through a single controlled entrance rather than a dozen separate gates.
Step-by-Step Explanation
Step 1
Deploy an Ingress Controller
Install a controller like ingress-nginx; without it, Ingress objects have no effect.
Step 2
Expose backends as Services
Create ClusterIP Services for each app so the Ingress has stable targets to route to.
Step 3
Define routing rules
Write an Ingress manifest mapping hosts and paths to specific Service names and ports.
Step 4
Configure TLS
Reference a TLS secret in the Ingress to terminate HTTPS at the edge for the listed hosts.
Step 5
Verify routing
Apply the manifest and curl each host/path to confirm requests reach the correct Service.
What Interviewer Expects
- Clear Layer 4 vs Layer 7 distinction
- Knowing an Ingress Controller is required
- Host- and path-based routing understanding
- TLS termination awareness
- Cost/consolidation reasoning vs many LoadBalancers
Common Mistakes
- Thinking an Ingress works without a controller
- Confusing Ingress with a LoadBalancer Service
- Believing Ingress replaces Services entirely
- Assuming Ingress handles TCP/UDP by default
Best Answer (HR Friendly)
“A Service gives an app a stable internal address inside the cluster, while an Ingress is the single front door for the whole cluster that sends web traffic to the right app based on the URL. The Ingress also handles HTTPS, so you do not need a separate load balancer for every app.”
Code Example
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: app-ingress
annotations:
nginx.ingress.kubernetes.io/rewrite-target: /
spec:
ingressClassName: nginx
tls:
- hosts:
- example.com
secretName: example-tls
rules:
- host: example.com
http:
paths:
- path: /api
pathType: Prefix
backend:
service:
name: api-service
port:
number: 80
- path: /web
pathType: Prefix
backend:
service:
name: web-service
port:
number: 80Follow-up Questions
- What is the difference between an Ingress and a LoadBalancer Service?
- How does TLS termination work in an Ingress?
- What is an IngressClass and why was it introduced?
- How would you route based on hostname versus path?
- How does the Gateway API improve on Ingress?
MCQ Practice
1. At which OSI layer does an Ingress primarily operate?
Ingress performs HTTP/HTTPS routing based on hosts and paths, which is Layer 7 (application layer).
2. What is required for an Ingress resource to actually route traffic?
The Ingress object is only configuration; an Ingress Controller must be running to fulfil the rules.
3. Which is a key advantage of Ingress over one LoadBalancer per Service?
Ingress consolidates many Services behind a single entry point, avoiding a paid load balancer per Service.
Flash Cards
What layer does an Ingress work at? — Layer 7 — it routes HTTP/HTTPS based on host and path.
Does an Ingress work on its own? — No — you need a running Ingress Controller like NGINX or Traefik.
What does a Service provide? — A stable virtual IP/DNS name load-balancing across matching pods (Layer 4).
Where is TLS terminated with Ingress? — At the edge, using a referenced TLS secret for the listed hosts.