CKAD — Ingress TLS & Management

TLS Termination

Serve HTTPS by attaching a TLS certificate:

# Create a TLS Secret
kubectl create secret tls app-tls \
  --cert=tls.crt \
  --key=tls.key

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: tls-ingress
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-svc
            port:
              number: 80

The TLS Secret must contain tls.crt and tls.key. The Ingress controller terminates TLS and forwards plain HTTP to the backend Service.

Common Annotations

Annotation	Description
nginx.ingress.kubernetes.io/rewrite-target: /	Rewrite the URL path
nginx.ingress.kubernetes.io/ssl-redirect: "true"	Redirect HTTP to HTTPS
nginx.ingress.kubernetes.io/proxy-body-size: "10m"	Max request body size
nginx.ingress.kubernetes.io/use-regex: "true"	Enable regex in paths

Managing Ingress

# Create imperatively
kubectl create ingress my-ingress \
  --class=nginx \
  --rule="app.example.com/api*=api-svc:8080" \
  --rule="app.example.com/*=web-svc:80"

# List
kubectl get ingress

# Describe (see events for debugging)
kubectl describe ingress my-ingress

# Edit
kubectl edit ingress my-ingress

# Delete
kubectl delete ingress my-ingress

Exam tip: Use kubectl create ingress to quickly scaffold Ingress resources. It saves time compared to writing YAML from scratch.

---

Next: Network Policies →