Set up external access

An Ingress controller routes external HTTP requests according to your Ingress rules. The local course cluster uses Traefik.

Traefik is an open-source edge router. It watches Ingress rules and routes HTTP requests to Services. The interactive diagram at the end follows that request path.

k3d includes Traefik in a cluster by default when it's created. However because k3d is a containerized cluster we need to specifically tell it to open a port and match to the host. Optional local setup only: the commands below recreate the disposable course cluster and remove its workloads. Browser learners can skip this setup because the simulated cluster is already prepared. If following locally, reapply your manifests afterward.

k3d cluster delete localk8s
k3d cluster create localk8s -p "8080:80@loadbalancer" --registry-use k3d-localk8s:12345

We now have mapped port 8080 on the Docker host to TCP port 80 in the container. You might be asking yourself, why did we choose port 80?

Like I mentioned before Traefik is included with k3d. Traefik has a LoadBalancer service which is set to accept web traffic through port 80 via the TCP protocol. You can verify this by running:

kubectl get services -n kube-system
NAME             TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)                      AGE
kube-dns         ClusterIP      10.43.0.10     <none>        53/UDP,53/TCP,9153/TCP       14m
metrics-server   ClusterIP      10.43.200.52   <none>        443/TCP                      14m
traefik          LoadBalancer   10.43.29.68    172.21.0.3    80:30455/TCP,443:31917/TCP   13m

Now that we have the port opened up on our docker host we can add an ingress resource. But first let's add everything we added previously. The sandbox has our manifests from the previous lessons ready to go:

kubectl apply -f ./nginx-deployment.yaml -f ./nginx-service.yaml

Here we have an ingress resource:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    ingress.kubernetes.io/ssl-redirect: "false"
spec:
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: nginx-service
            port:
              number: 80

Let's go over what this resource is doing. We are telling the ingress controller (traefik) that we would like to define an ingress resource by specifying rules. The rule says that for http traffic going to the root path / we want to internally route traffic to the backend service named nginx-service we are also saying that the http traffic will be routed to port 80 on that service.

Note: The Kubernetes Ingress resource is feature-frozen. The newer Gateway API is the future direction for Kubernetes networking. The concepts here still apply -- Gateway API just offers a more expressive model.

Apply the ingress: kubectl apply -f ./web-ingress.yaml

Verify everything is in place with kubectl get ingress and kubectl get services. On a real cluster, you could now access your application at http://localhost:8080.

You have now connected the application's external route to its Service. Next, give the application its configuration using ConfigMaps and Secrets.