Ingress controller
The Kubernetes component that reads Ingress (or Gateway API) objects and configures a proxy to route outside traffic to services in the cluster. It turns user-supplied objects into proxy configuration and often holds TLS secrets, so input validation, network exposure and its permissions decide how much one bug can reach.
- Defined in
- Kubernetes: Ingress controllers
Covered in
Case study: ingress-nginx CVE-2025-1974 and the exposed admission webhook (2025)
How an admission webhook open to the whole Pod network made ingress-nginx's configuration-injection bugs a 9.8 cluster-takeover risk in 2025, and what its 2026 retirement means.
Prove network and admission policies enforce the intended boundary
Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
Practice: Privileged container lab: Reject a privileged workload before deployment · NetworkPolicy lab: Lock down a shop namespace · Local project: Verify Kubernetes admission and network boundaries