<p>I've read everywhere that to set Https to access a kubernetes cluster you need to have an Ingress <strong>and not simply a LoadBalancer service</strong> which also exposes the cluster outside.</p>

<p>My question is pretty theoretical: if an Ingress (and it is) is composed of a <strong>LoadBalancer</strong> service, a <strong>Controller</strong> (a deployment/pod of an nginx image for example) and a set of <strong>Rules</strong> (in order to correctly proxy the incoming requests inside the cluster), <strong>why can't we set Https in front of a LoadBalancer instead of an Ingress</strong>?</p>

<p>As title of exercise <strong>I've built the three components separately</strong> by myself (a LoadBalancer, a Controller/API Gateway with some Rules): these three together already get the incoming requests and proxy them inside the cluster according to specific rules so, I can say, I have built an Ingress by myself. Can't I add https to this structure and do I need to set a redundant part (a k8s Ingress) in front of the cluster?</p>

Alessandro Argentieri
<p>Not sure if I fully understood your question.</p>

<p>In <code>Kubernetes</code> you are exposing you cluster/application using <a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">service</a>, which is well described <a href="https://kubernetes.io/docs/tutorials/kubernetes-basics/expose/expose-intro/" rel="nofollow noreferrer">here</a>. Good compare of all <code>services</code> can be found in <a href="https://www.ovh.com/blog/getting-external-traffic-into-kubernetes-clusterip-nodeport-loadbalancer-and-ingress/" rel="nofollow noreferrer">this article</a>.</p>

<p>When you are creating service type <code>LoadBalancer</code> it creates <code>L4 LoadBalancer</code>. <strong>L4</strong> is aware of information like <code>source IP:port</code> and <code>destination IP:port</code>, but don't have any information about application layer (Layer 7). <code>HTTP/HTTPS LoadBalancers</code> are on Layer 7, so they are aware of application. More information about Load Balancing can be found <a href="https://cloud.google.com/load-balancing/docs/load-balancing-overview" rel="nofollow noreferrer">here</a>.</p>

<blockquote>
  <p>Layer 4-based load balancing to direct traffic based on data from network and transport layer protocols, such as IP address and TCP or UDP port</p>
  
  <p>Layer 7-based load balancing to add content-based routing decisions based on attributes, such as the HTTP header and the uniform resource identifier</p>
</blockquote>

<p><a href="https://docs.nginx.com/nginx-ingress-controller/overview/#what-is-the-ingress" rel="nofollow noreferrer">Ingress</a> is something like <code>LoadBalancer</code> with L7 support. </p>

<blockquote>
  <p>The Ingress is a Kubernetes resource that lets you configure an HTTP load balancer for applications running on Kubernetes, represented by one or more Services. Such a load balancer is necessary to deliver those applications to clients outside of the Kubernetes cluster.</p>
</blockquote>

<p><code>Ingress</code> also provides many advantages. For example if you have many services in your cluster you can create one <code>LoadBalancer</code> and <code>Ingress</code> which will be able to redirect traffic to proper service and allows you to cut costs of creating a few <code>LoadBalancers</code>. </p>

<p>In order for the <code>Ingress</code> resource to work, the cluster must have an <code>ingress controller</code> running.</p>

<blockquote>
  <p>The Ingress controller is an application that runs in a cluster and configures an HTTP load balancer according to Ingress resources. The load balancer can be a software load balancer running in the cluster or a hardware or cloud load balancer running externally. Different load balancers require different Ingress controller implementations.
  In the case of NGINX, the Ingress controller is deployed in a pod along with the load balancer.</p>
</blockquote>

<p>There are many <a href="https://kubernetes.io/docs/concepts/services-networking/ingress-controllers/" rel="nofollow noreferrer">Ingress Controllers</a>, but the most popular is <code>Nginx Ingress Controller</code></p>

<p>So my answer regarding:</p>

<blockquote>
  <p>why can't we set Https in front of a LoadBalancer instead of an Ingress?</p>
</blockquote>

<p>It's not only about securing your cluster using HTTPS but also many capabilities and features which Ingress provides.</p>

<p>Very good documentation regarding HTTP(S) Load Balancing can be found on <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="nofollow noreferrer">GKE Docs</a>.</p>
