Kubernetes Ingress

Routing external traffic into the cluster — Ingress, Gateway API, and the controllers.

The Ingress object is increasingly being replaced by Gateway API, which is the successor and is GA. Most production clusters in 2026 run a controller that supports both.

Ingress / Gateway controllers

★ ingress-nginx — Kubernetes-maintained; the default for years; stable. Gateway API support added.
★ Cilium Gateway / Cilium Ingress — eBPF-native; replaces ingress + service mesh in one. Increasingly the default in 2026 if you're already on Cilium.
★ Traefik — Gateway API + Ingress; great DX; built-in Let's Encrypt; CRD-driven configuration.
Contour (CNCF / VMware) — Envoy-based; Gateway API first-class.
Gloo (Solo.io) — Envoy-based; commercial Enterprise tier for advanced features.
Emissary-ingress (formerly Ambassador) — Envoy-based; CRD-heavy.
HAProxy Ingress — for HAProxy fans.
Istio Gateway — if you're running Istio anyway.
Linkerd doesn't ship its own — pair with one of the above.

Cloud / managed

AWS Load Balancer Controller — provisions ALB / NLB for Ingress / Gateway resources.
GCP GKE Ingress / Gateway — provisions Google Cloud Load Balancer.
Azure Application Gateway Ingress Controller — Azure-native.
DigitalOcean / Linode / Vultr — provision their LB primitives.

Gateway API (the successor)

★ Gateway API is GA and recommended for new setups. CRDs: GatewayClass, Gateway, HTTPRoute, TLSRoute, GRPCRoute.
Differences from Ingress: split between cluster operator (Gateway) and app team (HTTPRoute), supports L4 and L7, much richer routing.
Most controllers above support both; new clusters should default to Gateway API.

TLS / certs

★ cert-manager + Let's Encrypt — automatic TLS.
Automatic HTTPS by Caddy — if your "ingress" is Caddy outside the cluster.
Cloudflare Origin Certs — when CF is in front; 15-year origin-only certs.

Service-level features

MetalLB — L2 / BGP load balancer for bare-metal clusters where there's no cloud LB.
kube-vip — alternative; can also do control-plane HA.
Cilium L2 Announcements / BGP — same niche, eBPF-flavored.

Patterns to adopt

★ Default to Gateway API. Ingress is fine for legacy; new is Gateway.
One ingress / Gateway per environment. Separate prod from staging at the network edge.
Run two replicas of the controller for HA.
TLS termination at the ingress controller, not at each pod.
Use canonical hostnames with cert-manager Cluster issuers; share certs across namespaces with Reflector or shared issuers.
Don't forget rate limiting at the ingress; see Rate Limiting.

Pick this if…

Default new cluster: ingress-nginx (most documentation) or Cilium Gateway (if on Cilium).
Ergonomics + automatic TLS: Traefik.
Already on a service mesh: that mesh's gateway (Istio, Linkerd's per-service ingress).
Bare metal: MetalLB / kube-vip + ingress-nginx.
Cloud-managed LB: the cloud's controller (AWS LBC, etc.).
Want enterprise features without a paid mesh: Gloo or Contour.