Comparison
EgressvsIngress
Egress
your workload calling a payment provider goes out through something with a fixed address, because the provider allow-lists it.
Traffic leaving a cluster or network for the outside world. It is the direction teams forget until two things happen: a third party requires a stable source address to allow-list, and the bill arrives with data-transfer charges on it. Controlling it also matters for security, because unrestricted egress is how a compromised workload reaches a command-and-control host or exfiltrates data.
Full entry →Ingress
traffic from outside arrives at one front door with the certificate on it, and is routed inwards by hostname and path.
Traffic entering a cluster or network boundary from outside, and the configuration describing how it is routed once it arrives. It is where TLS termination, external DNS, WAF rules and public routing all live, so it is a shared, contended object across teams. It is also the natural chokepoint for rate limiting and authentication, which is why it accretes responsibilities until somebody calls it an API gateway.
Full entry →