services / Google Cloud / Ingress for Google Kubernetes Engine

Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. Traffic routing is controlled by rules defined on the Ingress resource.

Creating an Ingress does not automatically expose Services. It also needs an Ingress Controller. Kubernetes Engine ships with a Google-hosted Ingress Controller. However, you can also choose to deploy another Ingress Controller, such as Nginx. Configuring other controllers requires manual setup of other Google Cloud components, like NAT gateway, Firewall rules, and VPC network.

container.​ingresses.​create

Ingress configures public access to a Kubernetes backend service.

Risks

1. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links