Context: You must expose a web application using HTTPS routes. Task: Create an Ingress resource named web in the prod namespace and configure it as follows: . Route traffic for host web.k8s.local and

Question

Exhibits

Explanation

The task requires creating a Kubernetes Ingress resource to expose a web application via HTTPS with HTTP-to-HTTPS redirection, utilizing a specific host, service, and TLS secret.

Approach. The user must create an Ingress resource manifest (e.g., ingress-web.yaml) in the exam environment (likely a terminal with vi, nano, or similar text editor) and then apply it using kubectl apply -f ingress-web.yaml. The YAML manifest should correctly define the Ingress resource as follows:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
  namespace: prod
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: "true" # Redirects HTTP to HTTPS
    # Note: This annotation is specific to the NGINX Ingress Controller. 
    # Other controllers may use different annotations.
spec:
  ingressClassName: nginx # Explicitly specifies the Ingress Controller (common for CKA/CKAD)
  tls:
    - hosts:
        - web.k8s.local
      secretName: web-cert # Enables TLS termination using the specified secret
  rules:
    - host: web.k8s.local # Matches the specified host
      http:
        paths:
          - path: / # Matches all paths
            pathType: Prefix # Ensures all sub-paths are also matched
            backend:
              service:
                name: web # Routes to the existing 'web' Service
                port:
                  number: 80 # Assumes the 'web' Service listens on port 80

Reasoning:

1. apiVersion: networking.k8s.io/v1, kind: Ingress: Correctly identifies the resource as an Ingress for modern Kubernetes versions.
2. metadata.name: web, metadata.namespace: prod: Fulfills the naming and namespace requirements.
3. annotations.nginx.ingress.kubernetes.io/ssl-redirect: "true": This annotation, specific to the NGINX Ingress Controller (commonly used in certification exams), enables the automatic redirection of HTTP requests to HTTPS for the host with TLS configured, fulfilling the 'Redirect HTTP requests to HTTPS' requirement.
4. spec.ingressClassName: nginx: Explicitly associates the Ingress with the NGINX Ingress Controller, which is good practice in environments with multiple controllers.
5. spec.tls: Configures TLS termination. It specifies web.k8s.local as the host for which TLS is enabled and uses the existing web-cert Secret for the certificate.
6. spec.rules: Defines the routing logic.
   • host: web.k8s.local: Ensures traffic for this specific hostname is handled.
   • path: / and pathType: Prefix: Configures the Ingress to route all paths under web.k8s.local.
   • backend.service.name: web and backend.service.port.number: 80: Directs the matched traffic to the existing web Service, assuming it listens on port 80 (a common default for web services).

Common mistakes.

• common_mistake. 1. Using the provided skeleton file for NetworkPolicy: The exhibit image misleadingly suggests a network-policy.yaml file. Creating a NetworkPolicy instead of an Ingress would be completely incorrect, as NetworkPolicy controls internal pod-to-pod communication, not external service exposure.

1. Incorrect apiVersion or kind: Using outdated API versions like extensions/v1beta1 or networking.k8s.io/v1beta1 for Ingress, or a wrong kind (e.g., Service or Deployment), would result in a manifest that cannot be applied or does not function as an Ingress.
2. Missing or incorrect tls configuration: Omitting the spec.tls section, failing to specify hosts under tls, or providing an incorrect secretName would prevent HTTPS from working or TLS termination from occurring.
3. Incorrect routing rules: Mistakes in defining spec.rules, such as an incorrect host name, missing pathType: Prefix (which is crucial for 'all paths'), or providing a wrong service.name or service.port.number, would cause traffic to be misrouted or not routed at all.
4. Forgetting the HTTP to HTTPS redirect annotation: Not including the nginx.ingress.kubernetes.io/ssl-redirect: "true" (or similar for other controllers) annotation would mean HTTP requests are not automatically redirected to HTTPS, failing a core requirement of the task.
5. Missing ingressClassName: While not always strictly required if there's only one Ingress controller, omitting ingressClassName: nginx can lead to the Ingress not being picked up by the intended controller in environments with multiple Ingress controllers or explicit class requirements.

Concept tested. Kubernetes Ingress resource configuration, including: defining routing rules based on host and path, enabling TLS termination using Secrets, and implementing HTTP to HTTPS redirection via Ingress Controller-specific annotations. This tests understanding of networking.k8s.io/v1 Ingress API, metadata, spec, rules, host, paths, backend, service, port, pathType, tls configuration, secretName, and common NGINX Ingress Controller annotations for SSL redirection.

Reference. https://kubernetes.io/docs/concepts/services-networking/ingress/, https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#ssl-redirect

No community discussion yet for this question.