Comparison
IngressvsIngress controller
Ingress
traffic from outside arrives at one front door with the certificate on it, and is routed inwards by hostname and path.
Traffic entering a cluster or network boundary from outside, and the configuration describing how it is routed once it arrives. It is where TLS termination, external DNS, WAF rules and public routing all live, so it is a shared, contended object across teams. It is also the natural chokepoint for rate limiting and authentication, which is why it accretes responsibilities until somebody calls it an API gateway.
Full entry →Ingress controller
the routing rules you wrote in a manifest become a running proxy's configuration, reloaded a second or two after you apply them.
The workload that watches routing objects and reconfigures a real proxy to match, plus the external load balancer in front of it. It is the piece that turns declarative routing into packets moving, and it is a shared single point of failure for every public path in the cluster. Its reload behaviour, its certificate handling and its default timeouts are three of the most-argued-about settings on any platform.
Full entry →