Configure Kubernetes Ingress for Optimal Traffic Management

This skill configures Kubernetes Ingress for traffic routing, SSL/TLS termination, load balancing, and ingress controller optimization, with guidance on choosing between NGINX Ingress (general-purpose HTTP/HTTPS with extensive annotation support), Traefik (dynamic service discovery and automatic SSL certificate management), HAProxy (high-throughput performance), Istio Gateway (service mesh environments), and the AWS Load Balancer Controller (native AWS integration). Traffic-routing fundamentals cover host-based routing taking precedence over path-based, longest-path-match-wins semantics, always defining a default backend, and using regex path matching judiciously to avoid performance impact.

It provides working YAML for SSL/TLS termination with cert-manager and forced HTTPS redirect, wildcard certificate configuration, canary deployments with weighted and header-based traffic splitting, multi-service routing with regex path rewrites for microservices, rate limiting with CORS and security headers (X-Frame-Options, X-Content-Type-Options, HSTS), and health-check tuning (backend protocol, upstream keepalive settings). It covers five named troubleshooting scenarios with fixes - 502 Bad Gateway (check service endpoints and pod readiness), SSL certificate issues (verify the cert-manager ClusterIssuer and DNS validation), path-matching problems, CORS errors, and rate-limit-exceeded errors - alongside debugging commands for checking controller logs, ingress configuration, and service endpoints.

kubectl logs -n ingress-nginx deployment/ingress-nginx-controller
kubectl get ingress -o yaml
kubectl describe ingress <ingress-name>

Use this skill when configuring or troubleshooting Kubernetes Ingress - choosing a controller, setting up SSL/TLS, building canary or multi-service routing, adding rate limiting and security headers, or diagnosing a specific ingress failure mode.

It is not a fit for choosing or operating the underlying Kubernetes cluster itself, or for service mesh configuration beyond Istio's role as one of several ingress controller options - the guidance is scoped to the Ingress layer, not broader cluster or mesh architecture.

Inputs are your routing requirements (hosts, paths, backends), TLS/certificate needs, and traffic-splitting or rate-limiting requirements. Outputs are working Ingress YAML manifests for SSL/TLS, canary and multi-service routing, rate limiting and security headers, and health checks, plus kubectl debugging commands for each named failure mode.

Covers NGINX Ingress, Traefik, HAProxy, Istio Gateway, and the AWS Load Balancer Controller, plus cert-manager for automated certificate issuance.

Platform and DevOps engineers configuring Kubernetes Ingress who need concrete, working YAML for SSL/TLS, canary rollouts, rate limiting, and security headers, plus a troubleshooting guide mapping specific errors (502s, CORS failures, SSL issues) to their likely cause and the kubectl commands to confirm it. The best-practices summary also calls for configuring appropriate timeouts on long-running requests, monitoring ingress controller metrics and logs on an ongoing basis, and regularly updating the ingress controller version to pick up security patches.