Octet

Say this first

An Ingress is a set of HTTP and HTTPS rules (host and path to Service) that an ingress controller turns into real proxy configuration. One load balancer and controller can serve many Services, with TLS termination in one place. A LoadBalancer Service is one external load balancer per Service at layer 4. The Gateway API is the newer, role-oriented replacement for Ingress, with Gateways and routes for HTTP, gRPC, TCP and more. The Ingress API itself is frozen.

Go deeper

Ingress needs a controller

The Ingress object does nothing on its own. The controller watches it and configures a proxy:

Self-hosted proxies (NGINX-based, Traefik, HAProxy, Envoy-based) running as pods behind one LoadBalancer Service.
Cloud-managed: the AWS Load Balancer Controller builds an ALB from an Ingress; GKE builds a Google Application Load Balancer.

YAML

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
  namespace: shop
spec:
  ingressClassName: alb
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api
                port:
                  number: 80

With the AWS controller, TLS is normally done with an ACM certificate annotation rather than a secret.

Gateway API

Split by role: the platform team owns GatewayClass and Gateway (listeners, certificates), app teams own HTTPRoute objects that attach to it. It supports header matching, traffic splitting and more protocols without controller-specific annotations.

They will ask next

Where does TLS terminate with an ALB ingress, and does the pod see HTTPS?
At the ALB, using an ACM certificate. The ALB talks HTTP to the pods unless you configure HTTPS to the backend. The original scheme is passed in X-Forwarded-Proto.
Why not just use a LoadBalancer Service for every app?
Each one creates and bills a separate cloud load balancer and public address, and you lose central TLS, routing and WAF. Ingress or Gateway consolidates them.

Traps

Creating an Ingress with no controller installed and wondering why nothing happens.
Mixing annotations from one controller into another controller's ingress class.

How did you do?