Data Flow: Ingress

Purpose: For platform engineers, explains the ingress data flow from external traffic to application pods.

Flow Summary

Components

Component	Namespace	Role
MetalLB	metallb-system	Assigns external IPs via L2/BGP advertisements
Gateway API Controller	gateway-system	L7 traffic routing and policy enforcement
HTTPRoute	customer-apps	Maps hostnames/paths to backend Services
cert-manager	cert-manager	Provisions and renews TLS certificates for Gateway listeners

Sequence

1. Client sends request to an external IP advertised by MetalLB.
2. MetalLB forwards the packet to a node running the Gateway API controller (or ).
3. The controller terminates TLS using a certificate issued by cert-manager.
4. The controller matches the request against HTTPRoute rules (host, path, headers).
5. Matched traffic is forwarded to the target Kubernetes Service.
6. kube-proxy (or Cilium) load-balances across healthy pods.

Key Configuration

• Gateway resources define listeners (ports, protocols, TLS references).
• HTTPRoute resources define routing rules and attach to a Gateway.
• ClusterIssuer resources configure cert-manager's CA or ACME endpoint.
• MetalLB IPAddressPool and L2Advertisement resources control IP allocation.

Related

• Logical Diagram — full cluster architecture
• Gateway & TLS Configuration