In production environments, the choice of ingress controller for EKS/AKS/GKE depends on TLS requirements, integration needs, and operational maturity.

Actionable Workflow

1. Assess TLS and authentication requirements:

   • Do you need end-to-end encryption and certificate validation?
   • Is mTLS or SNI required for backend services?

2. Evaluate integration with cloud provider:

   • AWS ALB Ingress Controller integrates natively with ALBs but lacks backend cert validation.
   • Azure Application Gateway or NGINX for AKS offer varying degrees of TLS control.
   • GKE’s native HTTP(S) Load Balancer pairs well with Istio or Envoy for advanced use cases.

3. Consider operational complexity:

   • Teams with cloud-specific expertise often prefer native controllers (e.g., AWS ALB).
   • Greenfield projects may opt for Gateway API-compatible controllers (e.g., Traefik, Envoy Gateway) for flexibility.

4. Test in staging:

   • Simulate certificate expiration, backend failures, and TLS misconfigurations.
   • Validate latency and throughput under expected load.

5. Implement monitoring and rotation policies:

   • Use cert-manager for automated certificate lifecycle management.
   • Alert on expiring certificates and failed TLS handshakes.

Policy Example: Certificate Rotation

apiVersion: cert-manager.io/v1  
kind: Certificate  
metadata:  
  name: prod-tls  
  namespace: ingress-controllers  
spec:  
  secretName: prod-tls-secret  
  duration: 2160h # 90 days  
  renewBefore: 360h # 15 days  
  issuerRef:  
    name: letsencrypt-prod  
    kind: ClusterIssuer  
  dnsNames:  
  - "*.example.com"  

Tradeoff: Automated rotation reduces manual effort but requires careful monitoring of ACME challenge handling. Misconfigured DNS or network policies can stall renewals.

Tooling

• AWS ALB Ingress Controller:

  • Pros: Native AWS integration, seamless ALB provisioning.
  • Cons: No backend certificate validation; encryption without authentication.

• NGINX Ingress Controller:

  • Pros: Mature, flexible TLS configuration, active community.
  • Cons: Resource-intensive compared to Envoy-based solutions.

• Traefik (Gateway API):

  • Pros: Supports Gateway API, modern architecture, middleware for rate limiting, auth.
  • Cons: Steeper learning curve; less cloud-native integration than AWS ALB.

• Envoy Gateway:

  • Pros: Cloud-agnostic, tight integration with service meshes, Gateway API compliance.
  • Cons: Requires additional tooling for certificate management.

Caveats

• ALB “Encryption Without Authentication”:

  • The AWS ALB controller annotates target groups with backend-protocol: HTTPS, but ALB does not validate backend certificates. Expired or self-signed certs at the pod will go unnoticed.

• Passthrough TLS with NLB:

  • Using NLB in TCP passthrough mode shifts TLS termination to in-cluster controllers (e.g., NGINX, Envoy), enabling certificate validation but increasing latency and resource usage.

• Service Mesh Overhead:

  • Istio or Linkerd can enforce mTLS and certificate validation but add sidecar latency and operational complexity.

Troubleshooting

Common Failure Points:

• ALB 504 Gateway Timeout:

  • Check pod readiness probes and backend health checks.
  • Verify ALB target group configuration: kubectl describe ingress <name>.

• Certificate Not Validated:

  • For ALB: Confirm sslPolicy is set in ALB annotations.
  • For NGINX/Traefik: Check kubectl get secret <secret-name> and verify TLS config in ingress resources.

• Gateway API Mismatches:

  • Ensure GatewayClass and Gateway resources are correctly linked to the controller.
  • Use kubectl describe gateway <name> to debug provisioning state.

Quick Check for TLS Handshake Failures:

kubectl logs -l app=ingress-controller --tail=100 | grep -i "tls|cert"  

In practice, most teams start with the cloud-native controller (e.g., AWS ALB) for simplicity, then migrate to Envoy or Traefik with Gateway API as TLS and traffic management needs grow. Always validate certificate chains and authentication workflows—encryption alone isn’t security.

Source thread: Which is widely used ingress controller along with EKS/AKS/GKE?