Container Service for Kubernetes:Expose services with NGINX Ingress

Console

kubectl

1. Create a file named test-ingress.yaml with the following content:

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: test-nginx-ingress
     namespace: default
   spec:
     ingressClassName: nginx
     rules:
     - host: test-nginx-ingress.com # Replace with your actual registered domain name
       http:
         paths:
         - path: /coffee
           backend:
             service: 
               name: coffee-svc
               port:
                 number: 80
           pathType: ImplementationSpecific
         - path: /tea
           backend:
             service: 
               name: tea-svc
               port:
                 number: 80
           pathType: ImplementationSpecific
     - host: www.test-nginx-ingress.com # Replace with your actual registered domain name
       http:
         paths:
         - path: /coffee
           backend:
             service: 
               name: coffee-svc
               port:
                 number: 80
           pathType: ImplementationSpecific
         - path: /tea
           backend:
             service: 
               name: tea-svc
               port:
                 number: 80
           pathType: ImplementationSpecific

   Key parameter descriptions:

   • name: The name of the Ingress. In this example, the name is test-nginx-ingress.

   • host: The domain name used to access the service. In this example, the domain name is test-nginx-ingress.com. Replace this with your actual registered domain.

   • path: The URL path for the rule. All inbound requests must match the host and path before the CLB forwards traffic to the backend. In this example, the paths are /coffee and /tea.

   • backend: Defines the destination where traffic should be sent, consisting of a service name and port.

     • Service name: The name of the backend service to which the Ingress forwards traffic. In this example, the service names are coffee-svc and tea-svc.

     • Service port: The port exposed by the service. In this example, the port is 80.

2. Create the Ingress.

   kubectl apply -f test-ingress.yaml

3. View the Ingress details and obtain its public IP address, such as 8.xxx.xxx.117.

   kubectl get ingress

   Expected output:

   NAME                 CLASS   HOSTS                                               ADDRESS         PORTS   AGE
   test-nginx-ingress   nginx   test-nginx-ingress.com,www.test-nginx-ingress.com   8.xxx.xxx.117   80      2m39s

4. Replace the placeholder IP with your actual public IP address and run the following command to verify that the NGINX Ingress is functioning correctly:

   curl http://8.xxx.xxx.117/coffee -H "Host: test-nginx-ingress.com"

   Expected output:

   ...
   <title>Hello World</title>
   ...
   <p>Server&nbsp;address:10.xxx.xxx.19:80Server&nbsp;name:coffee-96d4bc87-l29dhDate:08/Aug/2025:02:21:02 +0000URI:/coffee

Console

kubectl

1. Log on to the Certificate Management Service console. In the left navigation pane, choose Certificate Management > SSL Certificates.

2. On the Commercial Certificates tab, select the certificate that you want to download, and click Download in the lower-left corner of the certificate list.

3. In the dialog box that appears, select Nginx as the server type, then download and decompress the certificate package.

4. Run the following command to create a Secret using the downloaded certificate file (.pem) and private key file (.key).

   kubectl create secret tls nginx-ingress-tls --cert test-nginx-ingress.com.pem --key test-nginx-ingress.com.key -n default

5. Run the following command to add a TLS configuration to the test-nginx-ingress Ingress. Replace test-nginx-ingress.com with your actual registered domain name.

   kubectl patch ingress test-nginx-ingress -p '{"spec":{"tls":[{"hosts":["test-nginx-ingress.com"],"secretName":"nginx-ingress-tls"}]}}'

6. Run the following command using your actual public IP address to verify that the domain name and service path are accessible over HTTPS.

   curl -v -k https://8.xxx.xxx.117/coffee -H "Host: test-nginx-ingress.com"

   • Parameter description:

     • -v: Displays detailed communication process, including TLS handshake information.

     • -k (or --insecure): Skips certificate verification. Use this option if you are using a self-signed certificate.

   • Expected output:

     ...
     *   Trying 8.xxx.xxx.117:443...
     * Connected to 8.xxx.xxx.117 (8.xxx.xxx.117) port 443
     * ALPN: curl offers h2,http/1.1
     * (304) (OUT), TLS handshake, Client hello (1):
     * (304) (IN), TLS handshake, Server hello (2):
     * (304) (IN), TLS handshake, Unknown (8):
     * (304) (IN), TLS handshake, Certificate (11):
     * (304) (IN), TLS handshake, CERT verify (15):
     * (304) (IN), TLS handshake, Finished (20):
     * (304) (OUT), TLS handshake, Finished (20):
     ...
     <title>Hello World</title>
     ...
     <p>Server&nbsp;address:10.xxx.xxx.159:80Server&nbsp;name:coffee-96d4bc87-6cstvDate:14/Aug/2025:09:27:42 +0000URI:/coffee