Getting requests into the cluster.
WHAT AN INGRESS CONTROLLER DOES
Receives external traffic and routes it to services.
WHAT IT ROUTES ON
Hostname and path.
WHAT IT HANDLES
Encryption termination Certificates Redirects and rewrites Sometimes rate limiting and authentication
WHAT TO AUTOMATE
Certificate issuance and renewal.
WHY
Manual renewal is forgotten, and expiry takes everything down at once.
HOW IT USUALLY WORKS
A controller requests certificates and stores them as secrets.
WHAT TO MONITOR
Certificate expiry, independently.
WHY INDEPENDENTLY
The automation itself fails silently.
WHAT TO CHECK WHEN ROUTING DOES NOT WORK
Whether the ingress object exists Whether a controller is installed Whether the service has endpoints Whether the hostname resolves to the right address
WHAT THE COMMONEST FAULT IS
An ingress object with no controller, which does nothing at all.
WHAT TO CONSIDER
Placing a content delivery network or provider firewall in front.
WHY
It absorbs attacks and caches, before traffic reaches you.
WHAT TO SET
Sensible request size and timeout limits at the edge.
WHAT TO TEST
That unencrypted requests are refused or redirected as intended.
