Kubernetes Ingress
Ingress — a K8s resource describing HTTP(S) routing: which host/path goes to which Service. Requires an Ingress Controller (ingress-nginx, Traefik, HAProxy Ingress). cert-manager automatically issues Let's Encrypt certs. Controller annotations add rate-limit, CORS, basic-auth without a separate sidecar.
Below: details, example, related terms, FAQ.
Details
- Install nginx-ingress via helm: helm install ingress-nginx ingress-nginx/ingress-nginx
- cert-manager + ClusterIssuer issues certs automatically
- Path-based routing: /api → api-svc, /web → web-svc
- Rate-limit: nginx.ingress.kubernetes.io/limit-rps: "10"
- Alternative: Gateway API (K8s 1.29+) — more expressive, will replace Ingress
Example
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: api
annotations:
cert-manager.io/cluster-issuer: letsencrypt
nginx.ingress.kubernetes.io/limit-rps: "10"
spec:
ingressClassName: nginx
tls:
- hosts: [api.example.com]
secretName: api-tls
rules:
- host: api.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service: { name: api-svc, port: { number: 80 } }Related
Why teams trust us
How it works
Enter site URL
Security headers analyzed
Get grade A–F
What Does the Security Analysis Check?
The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.
Header Analysis
Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
SSL Check
TLS version, certificate expiry, chain of trust, HSTS support.
Leak Detection
Finding exposed server versions, debug modes, open configs, and directories.
Report with Recommendations
Detailed report explaining each issue with specific steps to fix it.
Who uses this
Security teams
HTTP header audit
DevOps
config verification
Developers
CSP & HSTS setup
Auditors
compliance checks
Common Mistakes
Strict-Transport-Security.Server: Apache/2.4.52 helps attackers find exploits. Hide the version.DENY or SAMEORIGIN.nosniff, browsers may misinterpret file types (MIME sniffing).Best Practices
Content-Security-Policy-Report-Only, monitor violations, then enforce.Server, X-Powered-By, X-AspNet-Version from responses.Get more with a free account
Security check history and HTTP security header monitoring.
Sign up freeLearn more
Frequently Asked Questions
Ingress vs Service LoadBalancer?
LoadBalancer — one external IP per Service (expensive in cloud). Ingress — one LB for the whole cluster + L7 routing to multiple Services.
Do I need Gateway API?
New clusters — consider it. Existing — Ingress is stable and production-grade, migration is not a priority.
Is cert-manager required?
No, you can paste TLS secrets by hand. But with 3+ domains cert-manager saves hours per month.