Kubernetes Cheatsheet

Ingress

Use this Kubernetes reference while you build software engineering projects, review code for technical interview prep, or polish examples for a software engineer resume.

Ingress vs. Service

	Service (LoadBalancer)	Ingress
Layer	L4 (TCP/UDP)	L7 (HTTP/HTTPS)
Cost	One LB per Service	One LB for all routes
TLS termination	No (pass-through)	Yes
Path/host routing	No	Yes
Auth, rate-limiting	No	Via annotations / middleware

Ingress requires an Ingress Controller (nginx, Traefik, AWS ALB, etc.) installed in the cluster.

Minimal Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  namespace: production
spec:
  ingressClassName: nginx       # name of IngressClass resource
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api
            port:
              number: 80

Path Types

`pathType`	Behavior
`Exact`	Matches exactly the given path, case-sensitive
`Prefix`	Matches path prefix split by `/`
`ImplementationSpecific`	Controller-defined (nginx uses regex)

Multi-Host Ingress

spec:
  ingressClassName: nginx
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api
            port:
              number: 80
  - host: www.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web
            port:
              number: 80

TLS / HTTPS

spec:
  tls:
  - hosts:
    - api.example.com
    secretName: api-tls          # kubernetes.io/tls Secret with tls.crt + tls.key
  rules:
  - host: api.example.com
    ...

cert-manager (auto TLS from Let's Encrypt)

metadata:
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
spec:
  tls:
  - hosts:
    - api.example.com
    secretName: api-tls          # cert-manager creates and renews this

Nginx Ingress Annotations

metadata:
  annotations:
    # redirect HTTP to HTTPS
    nginx.ingress.kubernetes.io/ssl-redirect: "true"

    # size limit
    nginx.ingress.kubernetes.io/proxy-body-size: "10m"

    # timeouts (seconds)
    nginx.ingress.kubernetes.io/proxy-read-timeout: "60"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "60"

    # rewrite path: /api/v1/foo → /foo
    nginx.ingress.kubernetes.io/rewrite-target: /$2
  name: api-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api/v1(/|$)(.*)
        pathType: ImplementationSpecific
        backend:
          service:
            name: api
            port:
              number: 80

Rate limiting

  annotations:
    nginx.ingress.kubernetes.io/limit-rps: "20"
    nginx.ingress.kubernetes.io/limit-connections: "5"

Basic auth

htpasswd -c auth admin              # create credentials file
kubectl create secret generic basic-auth --from-file=auth

  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: "Protected"

AWS ALB Ingress (aws-load-balancer-controller)

metadata:
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:...
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80,"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: "443"

IngressClass

Allows multiple controllers in the same cluster:

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: nginx
  annotations:
    ingressclass.kubernetes.io/is-default-class: "true"
spec:
  controller: k8s.io/ingress-nginx

kubectl Ingress Commands

Command	What it does
`kubectl get ingress`	List ingresses
`kubectl get ingress -A`	All namespaces
`kubectl describe ingress my-ingress`	Rules, backends, TLS, events
`kubectl get ingress my-ingress -o yaml`	Full manifest
`kubectl delete ingress my-ingress`	Delete