Ingress with ALB

An Ingress annotated for ALB routes external HTTP traffic to your services and pods.

An Ingress is Kubernetes' way to expose HTTP routes to the outside world. With the AWS Load Balancer Controller, an Ingress becomes a real Application Load Balancer that routes by host and path.

ALB routing an Ingress to backend services and podsInternetALB(from Ingress)Service: web/ pathService: api/api pathweb podsapi pods
The ALB terminates external traffic and routes each path to the matching service, which forwards to its pods.

You configure the ALB entirely through annotations on the Ingress — scheme, target type, TLS certificate, and health checks.

Example

Example · yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
spec:
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

When to use it

  • An API team routes /api/* traffic to a backend service and /static/* to a separate frontend pod using a single ALB Ingress with path-based rules.
  • A platform team configures an ALB with HTTPS termination and an ACM certificate so all external traffic is encrypted without changing application code.
  • A multi-tenant SaaS app uses host-based routing on an ALB Ingress to direct tenant1.app.com and tenant2.app.com to separate Kubernetes services.

More examples

Basic ALB Ingress

An Ingress that creates a public ALB and routes all HTTP traffic to the api-svc Service, targeting pod IPs directly.

Example · yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
spec:
  rules:
  - http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 80

ALB Ingress with HTTPS and ACM

Provisions an HTTPS ALB using an ACM certificate, with the LBC handling certificate attachment and listener configuration automatically.

Example · yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: secure-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:123456789012:certificate/abc-123
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 443

Path-based routing Ingress

Routes /api requests to the API service and /static to the static asset service using a single ALB with two path-based rules.

Example · yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-path-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
spec:
  rules:
  - http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service: {name: api-svc, port: {number: 80}}
      - path: /static
        pathType: Prefix
        backend:
          service: {name: static-svc, port: {number: 80}}

Related

eks load balancer controllereks deployment service ingress

Discussion

  • Be the first to comment on this lesson.