Ingress controllers — choosing the right one for the workload

The major Ingress controllers are ingress-nginx, Traefik, HAProxy, Contour, and cloud-managed controllers. The choice is driven by the workload, the operational maturity, and the team’s experience. This lesson walks the comparison, the choice matrix, and the operational discipline.

The major controllers

The five Ingress controllers most commonly deployed:

The choice is driven by the workload, the operational maturity, and the team’s experience.

ingress-nginx

ingress-nginx is the de-facto standard. The controller runs in the cluster and uses nginx as the data plane.

flowchart LR
    A[Ingress] --> B[ingress-nginx controller]
    B --> C[nginx config]
    C --> D[nginx reload]
    D --> E[LoadBalancer]
    E --> F[Backend Service]

The controller watches the Ingress objects and generates the nginx configuration. The nginx configuration is reloaded on changes.

The trade-offs:

• Mature: the controller is the most widely deployed; the documentation is comprehensive.
• Performance: nginx is a high-performance data plane.
• Configuration: the nginx configuration is complex; the controller’s annotations are many.
• Reload: the nginx reload is a brief interruption.

Traefik

Traefik is the cloud-native controller. The controller runs in the cluster and uses the Traefik proxy as the data plane.

flowchart LR
    A[Ingress] --> B[Traefik controller]
    B --> C[Traefik config]
    C --> D[Traefik dynamic config]
    D --> E[LoadBalancer]
    E --> F[Backend Service]

The controller watches the Ingress objects and generates the Traefik configuration. The Traefik configuration is dynamic (no reload).

The trade-offs:

• Cloud-native: the controller is designed for Kubernetes-native workflows.
• Service discovery: the controller has automatic service discovery for several backends.
• Performance: the Traefik proxy is a high- performance data plane.
• Operational maturity: the controller is mature but newer than ingress-nginx.

HAProxy

HAProxy is the high-performance controller. The controller runs in the cluster and uses HAProxy as the data plane.

flowchart LR
    A[Ingress] --> B[HAProxy controller]
    B --> C[HAProxy config]
    C --> D[HAProxy reload]
    D --> E[LoadBalancer]
    E --> F[Backend Service]

The controller watches the Ingress objects and generates the HAProxy configuration. The HAProxy configuration is reloaded on changes.

The trade-offs:

• Performance: HAProxy is a high-performance data plane.
• Maturity: HAProxy is mature; the controller’s maturity is improving.
• Operational complexity: HAProxy’s configuration is complex.

Contour

Contour is the Envoy-based controller. The controller runs in the cluster and uses Envoy as the data plane.

flowchart LR
    A[Ingress] --> B[Contour controller]
    B --> C[Envoy xDS]
    C --> D[Envoy config]
    D --> E[LoadBalancer]
    E --> F[Backend Service]

The controller watches the Ingress objects and pushes the configuration to Envoy via xDS. The Envoy configuration is dynamic (no reload).

The trade-offs:

• Modern: the controller is designed for the modern Envoy data plane.
• Performance: Envoy is a high-performance data plane.
• Complexity: the controller is more complex than the alternatives.
• Gateway API: the controller is the canonical Gateway API implementation.

Cloud-managed controllers

The cloud-managed controllers are tightly integrated with the cloud provider:

• GKE Ingress: GKE-managed; integrated with GCLB.
• AWS Load Balancer Controller: AWS-managed; integrated with ALB/NLB.
• Azure Application Routing: Azure-managed; integrated with Azure Application Gateway.

The trade-offs:

• Integration: the controller is tightly integrated with the cloud provider.
• Cost: the controller uses the cloud provider’s load balancers, which may be expensive.
• Vendor lock-in: the controller is tied to the cloud provider.

The comparison matrix

The comparison matrix:

The choice is driven by the workload, the operational maturity, and the team’s experience.

The operational discipline

The controller’s operational discipline:

• Document the controller. The controller is the cluster’s HTTP gateway.
• Monitor the controller’s metrics. The metrics are the leading indicator.
• Test the controller in staging. The controller must work for the workload.
• Plan the controller’s evolution. The controller can be replaced with Gateway API.
• Document the troubleshooting. The troubleshooting is the cluster’s operational reference.

Quiz

Production discipline

• The Ingress controller is the cluster’s HTTP gateway. The cluster operator must treat it as critical infrastructure.
• Document the controller. The controller is the cluster’s HTTP gateway.
• Monitor the controller’s metrics. The metrics are the leading indicator.
• Test the controller in staging. The controller must work for the workload.
• Plan the controller’s evolution. The controller can be replaced with Gateway API.
• Document the troubleshooting. The troubleshooting is the cluster’s operational reference.
• Train the operations team on the controller’s diagnostics. The diagnostics are the team’s tools.
• Plan the controller’s evolution. The controller is the cluster’s HTTP gateway; the operator must plan for the future.