Help Center/ Cloud Container Engine/ Kubernetes Basics/ Kubernetes Networks/ Ingresses
Updated on 2026-07-07 GMT+08:00
View PDF
Share

Ingresses

Video Tutorial

Why Are Ingresses Required?

Services forward requests using TCP and UDP at Layer 4. Ingresses forward requests using HTTP and HTTPS at Layer 7, and can achieve finer-grained traffic routing through domain names and paths.

Figure 1 An ingress and its associated Services

How Ingresses Work

To use ingresses, you must install an Ingress Controller in your Kubernetes cluster. There are many implementations of Ingress Controllers. The most common one is ingress-nginx maintained by Kubernetes. Different cloud providers usually have their own implementations. For example, CCE works with ELB for load balancing through ingresses at Layer 7.

When external requests arrive at an Ingress Controller, it first locates the target Service based on the ingress routing rule, retrieves the pod's IP address from the endpoint, and then forwards the requests to the pod.

Figure 2 How an ingress works

Creating an Ingress

In this example, the ingress, associated with Service nginx:8080, uses HTTP for communications and ELB as the Ingress Controller (metadata.annotations specifies the load balancer). When a request is sent to http://192.168.10.155:8080/, it is first routed to Service nginx:8080, which then forwards the request to the target pod.

The following is an example ingress (only for clusters v1.23 or later): 
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
  annotations:
    kubernetes.io/elb.class: union
    kubernetes.io/elb.port: '8080'
    kubernetes.io/elb.id: aa7cf5ec-7218-4c43-98d4-c36c0744667a
spec:
  rules:
    - host: ''
      http:
        paths:
          - path: /
            backend:
              service:
                name: nginx
                port:
                  number: 8080
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

You can also set an external domain name in an ingress so that you can access the load balancer through the domain name and then access the associated Service.

To use a domain name for access, you need to point the domain name to the IP address of the load balancer. To this end, you can use a DNS service. For example, you can use Huawei Cloud Domain Name Service (DNS).

...
spec:
  rules:
    - host: www.example.com       # Domain name
      http:
        paths:
          - path: /
            backend:
              service:
                name: nginx
                port:
                  number: 8080
...

Routing an Ingress to Multiple Services

An ingress can be routed to multiple Services at the same time. The following is an example configuration:

  • When you access http://foo.bar.com/foo, the Ingress is routed to backend Service s1:80.
  • When you access http://foo.bar.com/bar, the ingress is routed to backend Service s2:80.

The paths specified in the ingress forwarding policy must exist in the backend application. If the paths do not exist, the forwarding fails.

For example, the default web access path of the Nginx application is /usr/share/nginx/html. If you add /test in the ingress forwarding policy, make sure that the Nginx application has the /usr/share/nginx/html/test path. If this path does not exist, 404 will return.

...
spec:
  rules:
    - host: foo.bar.com          # Host address
      http:
        paths:
          - path: "/foo"
            backend:
              service:
                name: s1
                port:
                  number: 80
          - path: "/bar"
            backend:
              service:
                name: s2
                port:
                  number: 80
...
Parent Topic: Kubernetes Networks