Ingress Controllers in AKS

How Ingress works

An Ingress controller is a reverse proxy running as a pod in your cluster. It watches the Kubernetes API for Ingress resources — routing rule objects — and reconfigures itself whenever rules change.

The flow for an incoming request:

1. Client sends a request to the ingress controller’s public IP
2. The controller reads the Host header and the URL path
3. It matches against ingress rules and finds the correct backend Service
4. It proxies the request to a pod behind that Service

The ingress controller itself is exposed via one LoadBalancer Service. All routing happens inside the cluster.

Ingress controller options in AKS

NGINX Ingress Controller is the most commonly used option. This page focuses on it.

Installing NGINX Ingress Controller with Helm

The standard way to install NGINX Ingress in AKS is via Helm:

# Add the NGINX Helm repository
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

# Create a dedicated namespace for the ingress controller
kubectl create namespace ingress-nginx

# Install NGINX Ingress Controller
helm install ingress-nginx ingress-nginx/ingress-nginx \
  --namespace ingress-nginx \
  --set controller.replicaCount=2 \
  --set controller.nodeSelector."kubernetes\.io/os"=linux \
  --set defaultBackend.nodeSelector."kubernetes\.io/os"=linux

# Wait for the load balancer IP to be assigned
kubectl get service ingress-nginx-controller \
  --namespace ingress-nginx \
  --watch

Once the EXTERNAL-IP is assigned, that is your single entry point for all Ingress-routed traffic.

# Save the IP for use in DNS or testing
INGRESS_IP=$(kubectl get service ingress-nginx-controller \
  --namespace ingress-nginx \
  -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
echo $INGRESS_IP

Creating an Ingress resource

With the controller running, define routing rules with Ingress resources. Suppose you have two services: web-frontend and api-service.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: production
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-frontend
            port:
              number: 80
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

kubectl apply -f app-ingress.yaml

# Verify the ingress was configured
kubectl get ingress app-ingress -n production
# NAME          CLASS   HOSTS                ADDRESS         PORTS   AGE
# app-ingress   nginx   myapp.example.com    20.50.200.11    80      1m

Requests to myapp.example.com/ go to web-frontend. Requests to myapp.example.com/api go to api-service. One IP, one load balancer, multiple services.

Path types explained

Ingress path matching has three modes:

• Exact — only the exact path matches. /api matches /api but not /api/users.
• Prefix — matches the path and any sub-paths. /api matches /api, /api/users, /api/users/123.
• ImplementationSpecific — controller decides. For NGINX, this allows regex patterns in the path.

Use Prefix for most API routing. Use Exact for specific endpoints that should not accidentally match sub-paths.

TLS termination

To serve HTTPS, create a Kubernetes Secret with your TLS certificate and key, then reference it in the Ingress resource:

# Create a TLS secret from certificate files
kubectl create secret tls myapp-tls \
  --cert=myapp.crt \
  --key=myapp.key \
  --namespace production

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress-tls
  namespace: production
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-frontend
            port:
              number: 80

With ssl-redirect: “true”, HTTP requests are automatically redirected to HTTPS. The ingress controller terminates TLS and forwards plain HTTP to the backend services.

Automating certificates with cert-manager

Manually managing certificates is tedious. cert-manager automates certificate issuance and renewal from Let’s Encrypt or other certificate authorities.

# Install cert-manager
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml

# Create a Let's Encrypt ClusterIssuer
cat <<EOF | kubectl apply -f -
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx
EOF

Add an annotation to your Ingress resource to trigger automatic certificate issuance:

metadata:
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls-auto  # cert-manager creates this

cert-manager watches for this annotation, requests a certificate from Let’s Encrypt, stores it in the Secret, and renews it before it expires. You never touch TLS certificates manually again.

Useful NGINX Ingress annotations

NGINX Ingress Controller behavior is customized via annotations on Ingress resources:

metadata:
  annotations:
    # Require HTTPS (redirect HTTP to HTTPS)
    nginx.ingress.kubernetes.io/ssl-redirect: "true"

    # Increase upload size limit
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"

    # Rate limiting: 100 requests per minute per IP
    nginx.ingress.kubernetes.io/limit-rpm: "100"

    # Enable CORS
    nginx.ingress.kubernetes.io/enable-cors: "true"

    # Sticky sessions (route same client to same pod)
    nginx.ingress.kubernetes.io/affinity: "cookie"

    # Custom timeout
    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"