Ingress vs Gateway API: Routing Traffic into Kubernetes

Services are reachable inside the cluster. To route outside HTTP traffic to them by hostname and path, Kubernetes offers two APIs: the long-standing Ingress and its successor, the Gateway API.

Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: shop
spec:
  ingressClassName: nginx
  tls:
    - hosts: [shop.example.com]
      secretName: shop-tls
  rules:
    - host: shop.example.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend: { service: { name: api, port: { number: 80 } } }
          - path: /
            pathType: Prefix
            backend: { service: { name: web, port: { number: 80 } } }

Ingress is simple and widely supported, but anything beyond basic routing (rewrites, header matching, canaries) depends on controller-specific annotations that differ between implementations.

Gateway API

The Gateway API splits responsibilities: platform teams manage Gateway resources (listeners, TLS), and app teams attach HTTPRoutes to them. Advanced features are part of the standard instead of annotations.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: shop
spec:
  parentRefs:
    - name: public-gateway
      namespace: infra
  hostnames: [shop.example.com]
  rules:
    - matches:
        - path: { type: PathPrefix, value: /api }
      backendRefs:
        - name: api
          port: 80
          weight: 90
        - name: api-canary      # send 10% of traffic to the new version
          port: 80
          weight: 10
    - backendRefs:
        - name: web
          port: 80

Which should you use?

• New clusters and platforms: Gateway API. It's the direction the Kubernetes project is heading, and most major controllers and cloud load balancers support it.
• Existing Ingress setups keep working; migrate when you need Gateway features or your controller recommends it. Tools like ingress2gateway help convert resources.

Either way you need a controller installed (NGINX-based, Envoy-based, Traefik, or your cloud's) that implements the API. The resources alone do nothing.