8 expert Kubernetes Ingress NGINX answers researched from official documentation. Every answer cites authoritative sources you can verify.
API object managing external HTTP/HTTPS access to services in a cluster. Provides: load balancing, SSL/TLS termination, name-based virtual hosting. Ingress resource defines rules (host/path → service), Ingress Controller implements rules (NGINX, Traefik, HAProxy, etc.). Alternative to Service type LoadBalancer (1 LB per Ingress vs 1 LB per Service).
Most popular Ingress Controller for Kubernetes (maintained by Kubernetes community). Uses NGINX as reverse proxy, load balancer, and HTTP router. Implements Ingress resources as NGINX configuration. Features: SSL/TLS, rewrites, redirects, rate limiting, auth. Two versions: kubernetes/ingress-nginx (community) and nginxinc/kubernetes-ingress (NGINX Inc). Use community version for most cases.
Helm installation (recommended): helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx && helm install ingress-nginx ingress-nginx/ingress-nginx. Or kubectl: kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/cloud/deploy.yaml. Creates: namespace ingress-nginx, Deployment, LoadBalancer Service. Verify: kubectl get pods -n ingress-nginx.
YAML example: apiVersion: networking.k8s.io/v1, kind: Ingress, metadata: {name: example, annotations: {kubernetes.io/ingress.class: nginx}}, spec: {rules: [{host: 'example.com', http: {paths: [{path: '/', pathType: Prefix, backend: {service: {name: app-service, port: {number: 80}}}}]}}]}. Apply: kubectl apply -f ingress.yaml. Access: curl example.com (requires DNS).
Create Secret with TLS cert: kubectl create secret tls example-tls --cert=tls.crt --key=tls.key. Add to Ingress: spec: {tls: [{hosts: ['example.com'], secretName: 'example-tls'}], rules: [...]}. NGINX auto-redirects HTTP→HTTPS. Certificate renewal: use cert-manager for automatic Let's Encrypt. Multiple domains: multiple tls entries with different secrets.
Common annotations: nginx.ingress.kubernetes.io/rewrite-target (URL rewriting), /ssl-redirect: 'false' (disable HTTP→HTTPS), /rate-limit (requests per second), /auth-type: basic (authentication), /backend-protocol: HTTPS (upstream HTTPS), /cors-enable: 'true' (CORS), /proxy-body-size: 10m (upload limit). Full list in docs. Example: annotations: {nginx.ingress.kubernetes.io/rewrite-target: /}.
Debug steps: (1) Check Ingress status: kubectl describe ingress name (Address should be set), (2) Verify controller running: kubectl get pods -n ingress-nginx, (3) Check logs: kubectl logs -n ingress-nginx deployment/ingress-nginx-controller, (4) Test backend Service: kubectl port-forward svc/app-service 8080:80, (5) Verify DNS points to LoadBalancer IP, (6) Check annotations syntax. Common issue: missing ingress.class annotation.
NGINX Ingress: mature (2017+), annotation-based config, single Ingress resource, simple use cases. Gateway API: next-gen (GA 2023), role-oriented (GatewayClass/Gateway/HTTPRoute), vendor-neutral, advanced routing (headers, query params, traffic splitting). NGINX supports both. Migrate to Gateway API for: multi-tenant, complex routing, vendor portability. Ingress sufficient for: basic host/path routing.