Getting external traffic into a cluster
A Service of type ClusterIP is only reachable from inside the cluster. Three
ways out, in increasing order of control:
NodePort opens the same high port on every node. Cheap, but the port range is
constrained and you still need something in front to load balance across nodes.
LoadBalancer asks the cloud provider for one address per service. Simple, and
expensive once you have more than a handful of services.
Ingress puts one HTTP router in front of many services and routes by host and
path. It needs an ingress controller actually running in the cluster — the
Ingress object on its own does nothing, which is the most common reason a
freshly applied manifest silently never receives traffic.
Terminate TLS at the ingress and keep the certificate in a Secret the controller
can read; a certificate mounted into the workload pod instead will not be used.
