# Kubernetes Ingress

> Expose a service running inside a Kubernetes cluster to traffic from outside the cluster.

- Skill: `jaycheng113/kubernetes-ingress` (Agent Skill)
- Install (CLI): `npx skillmds@latest add jaycheng113/kubernetes-ingress`
- Raw SKILL.md: https://api.skillmd.com/api/skills/jaycheng113/kubernetes-ingress/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: JayCheng113 (https://skillmd.com/u/jaycheng113)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/jaycheng113/kubernetes-ingress

---


# Getting external traffic into a cluster

A `Service` of type `ClusterIP` is only reachable from inside the cluster. Three
ways out, in increasing order of control:

`NodePort` opens the same high port on every node. Cheap, but the port range is
constrained and you still need something in front to load balance across nodes.

`LoadBalancer` asks the cloud provider for one address per service. Simple, and
expensive once you have more than a handful of services.

`Ingress` puts one HTTP router in front of many services and routes by host and
path. It needs an ingress controller actually running in the cluster — the
`Ingress` object on its own does nothing, which is the most common reason a
freshly applied manifest silently never receives traffic.

Terminate TLS at the ingress and keep the certificate in a `Secret` the controller
can read; a certificate mounted into the workload pod instead will not be used.