CKA — Ingress Controllers

4 minute read

CKA Exam Domain

Services & Networking — 20%

The CKA exam expects you to understand the relationship between Ingress resources and Ingress Controllers. You may be asked to install a controller, verify it’s running, or troubleshoot why Ingress rules aren’t working.

Controller vs Resource

This is a fundamental distinction that trips up many candidates:

  Ingress Resource Ingress Controller
What YAML config that defines routing rules A running Pod/Deployment that implements the rules
API networking.k8s.io/v1 Vendor-specific (e.g., NGINX, Traefik)
Without the other Does nothing — just data in etcd Has nothing to configure
Analogy A routing table on paper The actual router hardware

Key insight: Creating an Ingress resource without an Ingress Controller is like writing traffic rules with no traffic lights. The rules exist, but nothing enforces them.

The controller watches the Kubernetes API for Ingress resources, reads the rules, and configures its underlying proxy (e.g., NGINX) to route traffic accordingly.

NGINX Ingress Controller

The NGINX Ingress Controller is the most widely used controller and the one you’re most likely to encounter on the CKA exam.

Installation

Install using the official manifest:

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.10.0/deploy/static/provider/cloud/deploy.yaml

This creates:

  • A namespace ingress-nginx
  • A Deployment running the NGINX controller Pods
  • A Service (LoadBalancer or NodePort) to receive external traffic
  • RBAC roles and bindings
  • An IngressClass named nginx

Verify Installation

# Check the controller Pods are running
kubectl get pods -n ingress-nginx

# Expected output:
# NAME                                        READY   STATUS    RESTARTS   AGE
# ingress-nginx-controller-7d4db76476-k2r9l   1/1     Running   0          2m

# Check the Service
kubectl get svc -n ingress-nginx

# Check the IngressClass was created
kubectl get ingressclass

How It Works

  1. The controller Pod watches the Kubernetes API for Ingress resources
  2. When an Ingress is created/updated/deleted, the controller reads the rules
  3. It generates an NGINX configuration and reloads NGINX
  4. Traffic flows: Client → Controller Service → Controller Pod (NGINX) → Backend Service → Pods

Annotations for Configuration

Annotations let you customize the NGINX controller’s behavior on a per-Ingress basis. These are added to the Ingress resource’s metadata.annotations.

Common Annotations

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    # Rewrite the URL path before forwarding
    nginx.ingress.kubernetes.io/rewrite-target: /

    # Disable automatic HTTPS redirect
    nginx.ingress.kubernetes.io/ssl-redirect: "false"

    # Set max request body size (default is 1m)
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"

    # Set connection timeout
    nginx.ingress.kubernetes.io/proxy-connect-timeout: "30"

    # Enable CORS
    nginx.ingress.kubernetes.io/enable-cors: "true"

    # Rate limiting
    nginx.ingress.kubernetes.io/limit-rps: "10"
spec:
  ingressClassName: nginx
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-svc
            port:
              number: 80

Rewrite Target Deep Dive

The rewrite-target annotation is especially important for the exam. Without it, the full path is forwarded to the backend:

Request Without rewrite With rewrite-target: /
/api/users Backend sees /api/users Backend sees /users
/app/dashboard Backend sees /app/dashboard Backend sees /dashboard

This is critical when your backend Services expect requests at / but Ingress routes them under a subpath.

Multiple Ingress Controllers

In production (and sometimes on the exam), you might have multiple controllers installed — for example, one for public traffic and one for internal traffic.

Use IngressClass to select which controller handles which Ingress:

# Public IngressClass
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx-public
spec:
  controller: k8s.io/ingress-nginx

---
# Internal IngressClass
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx-internal
spec:
  controller: k8s.io/ingress-nginx-internal

Then reference the appropriate class:

spec:
  ingressClassName: nginx-public   # or nginx-internal

Ingress Controller Comparison

Controller Provider Key Features
NGINX Community / F5 Most popular, well-documented, CKA exam default
Traefik Traefik Labs Auto-discovery, Let’s Encrypt integration, dashboard
HAProxy HAProxy Technologies High performance, TCP/HTTP load balancing
Contour VMware / Project Contour Envoy-based, HTTPProxy CRD, multi-team support

For the CKA exam, focus on NGINX. That’s what you’ll encounter in exam questions and lab environments.

kubectl Commands

# List Ingress Controller Pods
kubectl get pods -n ingress-nginx

# Check controller logs
kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx

# View the NGINX configuration inside the controller
kubectl exec -n ingress-nginx <controller-pod> -- cat /etc/nginx/nginx.conf

# Check IngressClass resources
kubectl get ingressclass

# Describe IngressClass for details
kubectl describe ingressclass nginx

Practice Questions

Q1. What happens when you create an Ingress resource but no Ingress Controller is installed in the cluster?

Show Answer

The Ingress resource is created and stored in etcd, but no routing occurs. The resource is just configuration data — without a controller watching for it and implementing the rules, traffic won’t be routed. The Ingress will show no ADDRESS in kubectl get ingress output.

Q2. Install the NGINX Ingress Controller and verify it’s running.

Show Answer 
# Install
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.10.0/deploy/static/provider/cloud/deploy.yaml

# Verify Pods
kubectl get pods -n ingress-nginx

# Verify IngressClass
kubectl get ingressclass

The controller Pod should be in Running state with 1/1 ready.

Q3. What does the nginx.ingress.kubernetes.io/rewrite-target: / annotation do?

Show Answer

It rewrites the URL path before forwarding the request to the backend Service. For example, if the Ingress matches path /api and a request comes in for /api/users, the rewrite-target annotation strips the matched prefix and sends /users to the backend instead of /api/users.

This is useful when backend Services expect requests at the root path but Ingress routes them under a subpath.

Q4. How do you select which Ingress Controller handles a specific Ingress resource when multiple controllers are installed?

Show Answer

Use the ingressClassName field in the Ingress spec:

spec:
  ingressClassName: nginx-public

This references an IngressClass resource that maps to a specific controller. Each controller is associated with an IngressClass through the spec.controller field.

Q5. How would you check the NGINX configuration generated by the Ingress Controller?

Show Answer 
# Get the controller Pod name
kubectl get pods -n ingress-nginx

# View the generated NGINX config
kubectl exec -n ingress-nginx <controller-pod-name> -- cat /etc/nginx/nginx.conf

This shows you how the controller translated your Ingress resources into actual NGINX configuration directives. Useful for debugging routing issues.

Updated:

You may also enjoy