<p>I'm fairly new to k8s and I'm trying to assemble an internal api infrastructure - meaning it's only available within k8s. I want to be able to map api endpoints the way the ingress controller does for example.</p>
<ul>
<li>Service &quot;A&quot; in namespace &quot;X&quot; maps to internal://sales</li>
<li>Service &quot;B&quot; in namespace &quot;Y&quot; maps to internal://sales/reports</li>
</ul>
<p>Is there a way to do this without using an ingress controller or by using an ingress controller that's not exposed externally?</p>

yozepi
<p>An ingress-controller isn't really a special workload compared to other workloads/services deployed to the cluster. Mapping external traffic into the cluster happens because the <code>Service</code> of the ingress controller is exposed to the outside (in most cases) using the <code>type: LoadBalancer</code> which triggers the cloud infrastructure to provide a public IP and a cloud load balancer that maps to the cluster VMs (on the service exposed ports).</p>
<p>Nobody prevents you from <strong>not</strong> setting that service type to <code>LoadBalancer</code> effectively making your ingress-controller internal. If you want to use custom domain names, that will require some DNS CNAME records pointing to your cluster-local service name of the ingress-controller, but that is definitely possible.</p>
<p>Please make sure how your ingress-controller of choice is deployed exactly. Some use <code>DaemonSet</code>s and <code>HostPort</code>s for performance reasons, which means you need to take extra care for your firewall setup.</p>
<p>Nevertheless, you should consider if you really want to use an ingress-controller here as with running your real services internally, you already have stable DNS names you can use. Using an ingress-controller introduces additional hops of your packets as the request first goes to an ingress controller instance (which could be running on a different node) and then is forwarded to the real target workload.</p>
<p>If you have a fixed set of workloads, you could also go with an nginx deployment to handle that proxying/rewriting of urls and paths. Check <a href="http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass" rel="nofollow noreferrer">the nginx docs</a> for some sample config. From a networking perspective, that's not really different to the ingress-controller setup and also introduces the additional hop.</p>
