Search across all documentation pages
Expose HTTP routes and control pod network policy. Results appear in the same fence: same-line # comments when short, multiline # blocks below the sample when not. Fences are bash, dockerfile, or yaml as appropriate.
HTTP path routing to a Service.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: web
spec:
rules:
- host: app.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: web
port: { number: 80 }
# routes host to Service webTLS termination with a Secret.
spec:
tls:
- hosts: [app.example.com]
secretName: app-tls
# cert/key in Secret type kubernetes.io/tlsDefault-deny ingress example allow from app.
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: db-allow-api
spec:
podSelector:
matchLabels: { app: db }
ingress:
- from:
- podSelector: { matchLabels: { app: api } }
ports:
- port: 5432
# only api pods reach db:5432Service DNS forms.
# bash
# api.default.svc.cluster.local
# short: api / api.defaultModern route resources (GA).
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: api
spec:
parentRefs:
- name: main-gateway
rules:
- backendRefs:
- name: api
port: 80
# attaches to Gateway main-gatewayExact vs Prefix vs ImplementationSpecific.
path: /v1
pathType: Prefix
# matches /v1 and /v1/...Select controller implementation.
spec:
ingressClassName: nginx
# used by ingress-nginx classLimit egress destinations.
egress:
- to:
- namespaceSelector: {}
ports:
- port: 53
protocol: UDP
# allow DNS exampleEmpty podSelector selects all pods in namespace.
podSelector: {}
# applies to entire namespaceService CNAME off-cluster.
# see Deployments and Services ExternalNameController-specific annotations common for CORS.
metadata:
annotations:
nginx.ingress.kubernetes.io/enable-cors: "true"
# implementation specificgRPC backend annotations (controller-specific).
# nginx.ingress.kubernetes.io/backend-protocol: "GRPC"Policies require a supporting CNI.
# Calico/Cilium/etc must enforce NetworkPolicyMesh sidecars add mTLS beyond NetworkPolicy.
# Istio/Linkerd VirtualService examples live in mesh docsProbes often match health routes behind Ingress carefully.
# probe cluster-internal Service, not public Ingress, when possibleStack versions: Kubernetes 1.36.2 · Docker Engine 29.6.1 · Helm 3 · Compose v2 · containerd via CRI
Reviewed by Chris St. John·Last updated Jul 18, 2026