4. Ingress and the Gateway API

An Ingress routes external HTTP(S) traffic to Services by host and path, with TLS termination — one load balancer for many services. It needs an ingress controller (ingress-nginx, Azure Application Gateway Ingress Controller / Application Gateway for Containers, Traefik, HAProxy).

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt
spec:
  ingressClassName: nginx
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend: { service: { name: shop-api, port: { number: 80 } } }
          - path: /
            pathType: Prefix
            backend: { service: { name: shop-web, port: { number: 80 } } }

The Gateway API (GatewayClass, Gateway, HTTPRoute) is the more expressive successor to Ingress (traffic splitting, header matching, role separation). Note: the community ingress-nginx project announced retirement (maintenance ends March 2026) — new clusters should evaluate Gateway API implementations or other controllers.