X'inhu Ingress u kif jirrawtja t-traffiku estern lejn is-Services?

Question

IT Interview Practice · Accepted Answer

**Ingress** huwa object ta' Kubernetes li jiddefinixxi **regoli ta' routing HTTP/HTTPS** — jimmappja hostnames u URL paths lejn **Services** ta' backend. Jiġi mwettaq minn **Ingress Controller** (nginx, Traefik, cloud gateways) u jagħtik punt tad-dħul wieħed, TLS termination, u routing skont host/path minflok LoadBalancer għal kull service.

## Il-problema li Ingress isolvi

```text
Exposing many services with type: LoadBalancer means MANY cloud LBs (and public IPs)
— expensive, and no shared hostname/path routing or TLS.
Ingress gives ONE entry point that routes by host & path to internal ClusterIP Services.
```

## Kif jingħaqad kollox

```text
      Internet
         │
   ┌─────┴──────────────┐
   │ Ingress Controller │  (a Pod, e.g. nginx; usually behind ONE LoadBalancer)
   │  reads Ingress rules│
   └─────┬──────────────┘
         │ routes by host / path
   ┌─────┼───────────────┬───────────────┐
   ▼                     ▼               ▼
 Service: web        Service: api    Service: admin  (all ClusterIP)
   │                     │               │
 Pods                  Pods            Pods

Ingress (rules)  ≠  Ingress Controller (the running proxy that enforces them)
```

## Manifest ta' Ingress

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls        # cert/key tat-TLS maħżun f'Secret
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api
                port: { number: 80 }
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port: { number: 80 }
```

```text
shop.example.com/api/... → Service "api" → api Pods
shop.example.com/...     → Service "web" → web Pods
TLS is terminated at the controller using the cert in the "shop-tls" Secret.
```

## Punti ewlenin

```text
• You MUST run an Ingress Controller — the Ingress object alone does nothing.
• ingressClassName selects which controller handles the rules.
• Ingress is HTTP/HTTPS (L7) only. For raw TCP/UDP use a Service or Gateway API.
• The newer Gateway API is the evolving successor with richer, role-oriented routing.
```

```bash
kubectl get ingress                  # elenka r-regoli, hosts, indirizzi
kubectl describe ingress app-ingress # ara l-backends u l-events
```

## Għaliex huwa importanti

Ingress huwa l-mod standard biex tesponi applikazzjonijiet HTTP/HTTPS lid-dinja ta' barra fuq Kubernetes, għalhekk li tifhmu huwa għarfien essenzjali tan-networking għall-inġiniera tal-livell middle. Il-problema li jsolvi hija konkreta u komuni: li tesponi ħafna services permezz ta' `type: LoadBalancer` ifisser li tipprovdi load balancer fil-cloud separat u IP pubbliku għal kull service — għali u mingħajr routing kondiviż ta' hostname jew TLS — filwaqt li **Ingress** jagħtik punt tad-dħul wieħed li jirrawtja skont **host u path** lejn Services ClusterIP interni u jitterminaw it-**TLS** ċentralment. Id-distinzjoni li tħawwad lin-nies hija bejn l-**object Ingress** (regoli ta' routing dikjarattivi) u l-**Ingress Controller** (il-proxy attwali li jaħdem — nginx, Traefik, cloud gateway — li josserva dawk ir-regoli u jinfurzahom); ir-regoli ma jagħmlu xejn mingħajr controller installat, u `ingressClassName` jagħżel liema controller jieħu ħsiebhom. Li tifhem li Ingress jopera fil-**L7 (HTTP/HTTPS biss)** — għalhekk TCP/UDP mhux ipproċessat jeħtieġ Service jew il-Gateway API l-ġdid — u li l-**Gateway API** huwa s-suċċessur li qed jevolvi u aktar espressiv, jirrifletti għarfien attwali tad-dinja reali. Peress li kważi kull applikazzjoni li tħares lejn l-utent fuq Kubernetes teħtieġ routing ibbażat fuq host/path u TLS minn punt tad-dħul wieħed, u peress li d-distinzjoni object-vs-controller hija sors frekwenti ta' konfużjoni kemm fl-intervisti kif ukoll fil-prattika, fehim solidu ta' Ingress huwa fundamentali biex tesponi u tħaddem workloads tal-web fuq cluster.

Il-problema li Ingress isolvi

Kif jingħaqad kollox

Manifest ta' Ingress

Punti ewlenin

Għaliex huwa importanti

Mistoqsijiet relatati