Help Center/ Cloud Container Engine/ Kubernetes Basics/ Kubernetes Networks/ Ingresses
Updated on 2025-07-29 GMT+08:00
View PDF

Ingresses

Video Tutorial

Why Are Ingresses Required?

Services forward requests using TCP and UDP at Layer 4. Ingresses forward requests using HTTP and HTTPS at Layer 7. Domain names and paths can be used for access of finer granularities.

Figure 1 An ingress and associated Services

How Ingresses Work

To use Ingresses, you must install an Ingress Controller on your Kubernetes cluster. Cloud providers have different implementations for an Ingress Controller. The most common one is ingress-nginx, which is maintained by Kubernetes. CCE works with ELB for load balancing at Layer 7.

The Ingress Controller receives external requests, then finds the corresponding Service based on the routing rule of the Ingress, queries the IP address of the pod through the endpoint, and forwards the requests to the pod.

Figure 2 How an Ingress works

Creating an Ingress

In this example, the Ingress uses HTTP for communications and ELB as the Ingress Controller (metadata.annotations specifies the load balancer), and associates with a Service (nginx:8080). After a request for accessing http://192.168.10.155:8080/ is initiated, the request is forwarded to the Service (nginx:8080) and then to the corresponding pod through the Service.

The following is an example Ingress (only for clusters of v1.23 or later): 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    kubernetes.io/elb.class: union
    kubernetes.io/elb.port: '8080'
    kubernetes.io/elb.id: aa7cf5ec-7218-4c43-98d4-c36c0744667a
spec:
  rules:
    - host: ''
      http:
        paths:
          - path: /
            backend:
              service:
                name: nginx
                port:
                  number: 8080
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

You can also set an external domain name in an Ingress so that you can access the load balancer through the domain name and then access the associated Service.

To use a domain name for access, you need to point the domain name to the IP address of the load balancer. To this end, you can use a DNS service. For example, you can use .

...
spec:
  rules:
    - host: www.example.com       # Domain name
      http:
        paths:
          - path: /
            backend:
              service:
                name: nginx
                port:
                  number: 8080
...

Routing an Ingress to Multiple Services

An Ingress can be routed to multiple Services at the same time. The following is an example configuration:

  • When you access http://foo.bar.com/foo, the Ingress is routed to backend Service s1:80.
  • When you access http://foo.bar.com/bar, the Ingress is routed to backend Service s2:80.

The paths specified in the Ingress forwarding policy must exist in the backend application. If the paths do not exist, the forwarding fails.

For example, the default path of the Nginx application is /usr/share/nginx/html. If you add /test in the Ingress forwarding policy, make sure that the Nginx application has the /usr/share/nginx/html/test path. If this path does not exist, 404 will return.

...
spec:
  rules:
    - host: foo.bar.com          # Host address
      http:
        paths:
          - path: "/foo"
            backend:
              service:
                name: s1
                port:
                  number: 80
          - path: "/bar"
            backend:
              service:
                name: s2
                port:
                  number: 80
...
Parent topic: Kubernetes Networks