CKA Ingress — the path that is not a Service

Expose the Service. Write the rule. The path is not a second Service.

<!-- hal:authoritative:yaml -->

Expose the Service. Write the rule. The path is not a second Service.

§I — Frame

k8s_day_counter reads 14. Even is CKA. 08-28 closed Workloads and Scheduling 15% on the App Lifecycle half: rollingUpdate, maxUnavailable, Q18. 08-16 closed the scheduler half. CKS first pass closed on 08-31 System Hardening. Do not spend this clock on AppArmor. Do not spend it on maxSurge.

07-29 already spent Services and Networking 20% on ClusterIP, NodePort, LoadBalancer, ExternalName, DNS, and kube-proxy modes. The same file surveyed Ingress as one section: object plus controller, ingressClassName, pathType. Isolation is the leftover. Q12 is the stem. The unopened neighbor is Q11 Gateway API. Leave it named. Do not migrate.

The day's Ops lesson is AKS: Application Gateway as the L7 listener, not a LoadBalancer Service per app. Poulton already told you Ingress is how multiple web applications share a single LoadBalancer Service (Ch. 8, printed p. 93). The exam is not hosted. The exam is kubeadm. This file exposes a Deployment and writes an Ingress. The fleet cannot grade you on azurerm_application_gateway. The exam will not give you a second API. Learn both. Grade this file on the rule.

Coin it: the path that is not a Service.

§II — Domain foundations

Services and Networking is 20%. 07-29 spent the Service-type half. Four Ingress moves remain.

1. There is already a workload. Q12 LabSetUp created namespace echo-sound and Deployment echo on gcr.io/google_containers/echoserver:1.10 listening 8080. You do not recreate it unless it is missing.
2. Expose it as a Service. Q12 wants name echo-service, type NodePort, port 8080. That is still 07-29's object. It is not the Ingress.
3. Write an Ingress named echo in the same namespace. Host example.org. Path /echo. pathType Prefix. Backend echo-service port 8080.
4. Know that the object does nothing without a controller (K8sUR3 Ch. 7, PDF p. 112; Poulton printed p. 93). ADDRESS empty is not a missing YAML if spec is right. The exam still grades spec. Some stems then curl http://example.org/echo and want /etc/hosts (K8sUR3 PDF p. 115; Q12 Questions). Some validators never curl the host. Q12 validate.bash never does. Read the stem.

Q12 spends moves 2 and 3 in one item. The candidate who only exposes fails four Ingress checks. The candidate who only applies Ingress and leaves type ClusterIP fails the NodePort check. Both objects.

Q16 spends move 2 alone: NodePort 30080, no Ingress. That was 07-29. If today's stem names example.org, Q16's answer is a fail.

Q11 spends a later API. Gateway named web-gateway. HTTPRoute named web-route. GatewayClass nginx-class already installed. TLS copied from Ingress web. If you create those under a Q12 stem you invented a leftover. If a later item says migrate, come back to Q11. Not this file's apply.

Poulton's request of Ingress is one listener in front of many ClusterIP Services (printed pp. 93-94). Host-based routing needs name resolution pointed at that listener. Path-based routing needs the app ready to serve the subpath, because the path is not rewritten unless you asked. K8sUR3: longest prefix matches; the path remains unmodified (PDF p. 120). echoserver answers on /echo. A real app that only serves / will 404 on /echo even when the Ingress is perfect. The exam used echoserver so the path is both the rule and the app path. Do not generalize that as "Prefix rewrites."

Hold three strings in your head before you touch YAML. Namespace echo-sound. Service echo-service. Host example.org. Path /echo. Port 8080. A legal object uses all five. A CURRENT of a second LoadBalancer Service named echo is 07-29 muscle applied to the wrong kind. Count kinds before you count IPs.

pathType is required on networking.k8s.io/v1. Prefix, Exact, ImplementationSpecific. SolutionNotes uses Prefix. If the stem is silent, Prefix is the type you type. If the stem says exact match /echo and not /echo/foo, Exact. Do not pick ImplementationSpecific to "let the controller decide." The controller is not the grade. The field is.

§III — Mechanism: the walk the exam can see

Create the Service the way SolutionNotes does. Then create the Ingress. Do not invert the order if the backend must exist for your own curl. validate.bash does not care about order. Your nerves will.

kubectl expose deployment echo -n echo-sound --name echo-service --type NodePort --port 8080 --target-port 8080
kubectl get svc -n echo-sound echo-service

--port 8080 is the Service port. --target-port 8080 is the container. They match LabSetUp. If you type --port 80 because HTTP is 80, check 3 fails and the Ingress backend port 8080 points at a Service port that does not exist. Endpoints can still be green. Spec is not.

Then the object.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: echo
  namespace: echo-sound
spec:
  rules:
  - host: example.org
    http:
      paths:
      - path: /echo
        pathType: Prefix
        backend:
          service:
            name: echo-service
            port:
              number: 8080

kubectl apply -f ingress.yaml. kubectl get ingress -n echo-sound. validate.bash then greps host, path, backend name, backend port. Eight checks total. Service exists. Type NodePort. Port 8080. Ingress exists. Host example.org. Path /echo. Backend echo-service:8080. Endpoints nonempty.

Optional test from Questions: curl NODEIP:NODEPORT/echo. That proves the Service and the app path. It does not prove the Ingress. The exam-style curl is http://example.org/echo after /etc/hosts maps example.org to a node IP. Two curls. Two objects. If the stem gives you the curl -o /dev/null -s -w "%{http_code}" form, you need the controller. If the stem is silent and validate is jsonpath, spec is enough.

ingressClassName is absent in SolutionNotes. Add it only if the stem names a class. K8sUR3 Advanced Ingress Topics is multiple controllers (PDF p. 120). Poulton's GKE walk installs nginx beside the built-in controller (printed p. 95). The CKA cluster in front of you may have one. Adding nginx on a cluster whose only class is something else parks the object where no controller watches. Omitting a class the stem named does the same. Read the stem.

Recreate is not a field on Ingress. If you delete the Ingress to "make it pick up," you spend time. Apply is enough. If ADDRESS stays empty, inspect the controller Pod, not the Deployment (K8sUR3 p. 112: no code acting on the object). Do not scale the echo Deployment to 10. That is 08-28 muscle. Endpoints nonempty is check 8. One Ready Pod is enough.

§IV — Worked example: the eight checks as a drill

Run them in validate order so a fail tells you which object is wrong.

1. kubectl get svc echo-service -n echo-sound must work. If NotFound, you skipped expose or you used the wrong namespace.
2. .spec.type must be NodePort. ClusterIP is the production default and a Q12 fail. LoadBalancer is 07-29's internet door and a Q12 fail.
3. .spec.ports[0].port must be 8080. Not 80. Not the NodePort in 30000-32767. The NodePort is allocated. You do not set it unless the stem names one (Q16 named 30080; Q12 did not).
4. kubectl get ingress echo -n echo-sound must work. If NotFound, you applied in default or you created a Service named echo and thought kind was enough.
5. .spec.rules[0].host must be example.org. example.com is a different string. Empty host is a catch-all. Q12 wanted the host.
6. .spec.rules[0].http.paths[0].path must be /echo. / is Prefix for everything and still fails the grep. /echo/ may fail depending on how the jsonpath returns. Type /echo.
7. backend service name echo-service and port number 8080. Name echo is the Deployment. Port 80 is the blog.
8. endpoints nonempty. If empty, the Service selector does not match, or the Pod is not Ready. 08-16 owns placement. kubectl describe pod in echo-sound. Ingress cannot fix a Pending Pod.

Wrong writes, named:

• Gateway + HTTPRoute copying these hosts. Q11. Fail.
• kubectl create ingress with a rule that uses * and port 80 because the help text showed that shape. Check the generated yaml. If path or port is wrong, edit. Imperative is allowed. The jsonpaths are the grade.
• TLS Secret because az-900 named offload. Q12 did not. 08-01 / CKS Q25 did. Fail.
• NetworkPolicy allowing ingress to echo. 08-13 / 08-01. Fail.

07-29's Ingress section already typed a shop example: host shop.hedronite.example, path /api to Service api, path / to Service web, ingressClassName: nginx, and the imperative kubectl create ingress --rule=.... That survey closed the domain as a first pass. It did not file Q12. It did not force NodePort. It did not plant echoserver in echo-sound. Today's isolation is those five strings and the eight checks. If you reopen 07-29 and copy the shop YAML into echo-sound, host is wrong, paths are wrong, class may be wrong, backend names are wrong. Use SolutionNotes. Use the stem.

Imperative is legal when it emits the same jsonpaths. A candidate who can type --rule="example.org/echo*=echo-service:8080" faster than YAML should still kubectl get ingress echo -o yaml before they walk away. The * in some help text is pathType Prefix. Confirm. If the generated object landed in default, you used the wrong context namespace. -n echo-sound on expose and on apply. Always.

Why NodePort on an Ingress item. Two reasons, both in Q12's own files. Questions wants a curl to NODEIP:NODEPORT/echo as a Service-level check. validate wants .spec.type == NodePort. On a hosted cluster the same workload behind Application Gateway would be ClusterIP. That is Ops. On the exam the controller may be missing and the grader may still want the node curl. Type what the stem named. Do not "fix" it to ClusterIP because a blog said Ingress plus NodePort is redundant. Redundant on the fleet. Required in validate check 2.

The controller question, sharpened. K8sUR3 p. 112: you can create the object with no code acting on it. Poulton printed p. 104: most clusters require you to install a controller; some hosted services ship one. If the exam cluster has ingress-nginx in ingress-nginx and the controller Pod is Running, example.org curl can work after hosts. If that Pod is CrashLoop, spec can still be green and the curl is 000. Debug the controller the way 08-10 debugged a static Pod: describe, logs, --previous. Do not edit echo. Do not edit the Ingress host to the node IP. Host must stay example.org.

Gateway API as leftover, one paragraph. Q11 LabSetUp already has Ingress web and Secret web-tls. The job is copy, not invent. Gateway listener HTTPS 443 hostname gateway.web.k8s.local, tls.mode: Terminate, certificateRefs to web-tls. HTTPRoute parentRef web-gateway, same hostname, PathPrefix /, backendRef web-service port 80. If you have not kubectl describe ingress web first you will guess the Secret name. SolutionNotes step 1 is inspect. Today's Q12 LabSetUp has no TLS and no GatewayClass. Mixing the two items is how twenty minutes vanish.

§V — Connection to today's Ops and Dev

Ops named Application Gateway as the listener on AKS. azurecheatsheet named AKS and stopped at Load Balancer. Same class as 08-28: the cheatsheet named the service and stopped before the field. You learn both. You grade this file on kubeadm yaml.

Dev named NetworkingV1Api.list_ingress_for_all_namespaces and refused to patch. The jsonpaths in validate.bash are the attributes that census prints. A loop that patches host to example.org across the fleet is this stem applied to every namespace. Do not ship that loop. The exam apply is one object in echo-sound.

§VI — Practice questions

§VII — Close

Four moves. Workload exists. Expose the Service the stem named. Write the Ingress. Know the controller is separate. Q12 is expose plus a rule that must keep host example.org and path /echo. Q16 is NodePort only. Q11 is a later API. A second LoadBalancer Service is 07-29. Empty ADDRESS is not empty spec.

Examine well. The path is not a Service.

Related

• Prior arc: CKA App Lifecycle (2026-08-28)
• Domain hub: Cross-References/Certifications-Roadmap
• Grounding tome: Poulton Ch.8, Ingress, pp. 93-104