Ingress Rules

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-gateway                  # Ingress object name
  namespace: production              # Must be in the same namespace as the target Services
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"   # Enable regex in path matching
spec:
  ingressClassName: nginx            # Which controller handles this — matches IngressClass name
  rules:
    - host: api.shop.com             # Only match requests with this Host header
      http:
        paths:
          - path: /orders(/|$)(.*)   # Match /orders, /orders/, /orders/123, etc.
            pathType: ImplementationSpecific   # Allows regex — controller-specific behaviour
            backend:
              service:
                name: order-svc      # Route to this ClusterIP Service
                port:
                  number: 80

          - path: /products(/|$)(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: product-svc
                port:
                  number: 80

          - path: /users(/|$)(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: user-svc
                port:
                  number: 80

          - path: /payments(/|$)(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: payment-svc
                port:
                  number: 80

          - path: /                  # Catch-all: anything not matched above
            pathType: Prefix         # Prefix: matches any path starting with /
            backend:
              service:
                name: frontend-svc   # Serve the frontend SPA for unmatched paths
                port:
                  number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: multi-host-ingress
  namespace: production
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"  # cert-manager: auto-provision TLS certs
    nginx.ingress.kubernetes.io/ssl-redirect: "true"    # Force HTTPS on all three hosts
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.shop.com                # Include this hostname in the TLS certificate
      secretName: api-shop-tls       # cert-manager will create/renew this Secret automatically
    - hosts:
        - admin.shop.com
      secretName: admin-shop-tls
    - hosts:
        - docs.shop.com
      secretName: docs-shop-tls
  rules:
    - host: api.shop.com             # Rule 1: API traffic
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-svc
                port:
                  number: 80

    - host: admin.shop.com           # Rule 2: Admin portal — separate host, separate service
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: admin-svc
                port:
                  number: 80

    - host: docs.shop.com            # Rule 3: Documentation site
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: docs-svc
                port:
                  number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  namespace: production
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    # rewrite-target: replaces the matched path with /$2 (capture group 2 from the path regex)
    # Combined with the path below:
    # Request:  /orders/v1/items → capture group 2 = v1/items → forwarded as /v1/items
    # Request:  /orders/         → capture group 2 = (empty)  → forwarded as /
    # Request:  /orders          → capture group 2 = (empty)  → forwarded as /
spec:
  ingressClassName: nginx
  rules:
    - host: api.shop.com
      http:
        paths:
          - path: /orders(/|$)(.*)   # Capture groups: group 1 = / or end, group 2 = remainder
            pathType: ImplementationSpecific
            backend:
              service:
                name: order-svc
                port:
                  number: 80

          - path: /products(/|$)(.*)  # Same pattern for products
            pathType: ImplementationSpecific
            backend:
              service:
                name: product-svc
                port:
                  number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: payment-api-ingress
  namespace: production
  annotations:
    # --- Rate Limiting ---
    nginx.ingress.kubernetes.io/limit-rps: "20"
    # limit-rps: max 20 requests per second per client IP
    # Clients exceeding this receive 503 Too Many Requests

    nginx.ingress.kubernetes.io/limit-connections: "10"
    # limit-connections: max 10 simultaneous connections per client IP

    nginx.ingress.kubernetes.io/limit-burst-multiplier: "5"
    # Burst up to 5× the rate limit before throttling kicks in
    # Allows short legitimate spikes without dropping legitimate requests

    # --- IP Allowlisting ---
    nginx.ingress.kubernetes.io/whitelist-source-range: "203.0.113.0/24,198.51.100.0/24"
    # Only allow traffic from these CIDRs — all other IPs get 403 Forbidden
    # Useful for partner APIs, admin portals, internal tooling

    # --- CORS (Cross-Origin Resource Sharing) ---
    nginx.ingress.kubernetes.io/enable-cors: "true"
    nginx.ingress.kubernetes.io/cors-allow-origin: "https://shop.com,https://admin.shop.com"
    nginx.ingress.kubernetes.io/cors-allow-methods: "GET, POST, PUT, DELETE, OPTIONS"
    nginx.ingress.kubernetes.io/cors-allow-headers: "Authorization, Content-Type, X-Request-ID"
    nginx.ingress.kubernetes.io/cors-max-age: "86400"
    # cors-max-age: browsers cache the preflight response for 24 hours (86400 seconds)
    # Reduces OPTIONS preflight requests significantly

    # --- Custom Response Headers ---
    nginx.ingress.kubernetes.io/configuration-snippet: |
      more_set_headers "X-Request-ID: $request_id";
      more_set_headers "Cache-Control: no-store";
    # configuration-snippet: inject arbitrary nginx config into the location block
    # Use for per-Ingress config that isn't covered by a dedicated annotation

    # --- Timeouts (per-Ingress override of controller defaults) ---
    nginx.ingress.kubernetes.io/proxy-read-timeout: "120"
    # Override the controller-wide read timeout for this specific service
    # Payment processing can take longer — give it 2 minutes

spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - api.shop.com
      secretName: api-shop-tls
  rules:
    - host: api.shop.com
      http:
        paths:
          - path: /payments
            pathType: Prefix
            backend:
              service:
                name: payment-svc
                port:
                  number: 80

kubectl describe ingress api-gateway -n production
# Full rule table: shows which paths map to which backends and their current endpoints
# If a backend shows "no endpoints" → the ClusterIP Service has no matching Pods
# If a path is missing entirely → check the YAML for typos

kubectl get ingress api-gateway -n production -o yaml
# Full YAML view: useful for checking that annotations were applied correctly

kubectl logs -l app.kubernetes.io/component=controller -n ingress-nginx --tail=100
# Controller logs: shows every request processed and any configuration errors
# Look for: "error obtaining endpoints" (service has no pods)
#           "could not get service" (service name typo or wrong namespace)
#           "configuration changed" (shows when a new Ingress rule was picked up)

kubectl exec -it -n ingress-nginx deploy/ingress-nginx-controller -- \
  nginx -T | grep -A10 "server_name api.shop.com"
# nginx -T: dump the full nginx configuration the controller is running
# Grep for your hostname to see the exact location blocks it generated
# This is the ground truth — if the nginx config looks wrong, the Ingress is broken