Definition. In Kubernetes, an Ingress resource describes how HTTP traffic from outside reaches services. It only takes effect through an ingress controller, such as Traefik, which translates it into the configuration of its reverse proxy and usually terminates TLS as well.

Why it matters. The ingress controller is the edge between the internet and the cluster. TLS options, redirects and headers decided here determine the security of the applications behind it. According to the Kubernetes project, maintenance of Ingress-NGINX ended in March 2026, so clusters running it face a switch, for example to Traefik or the Gateway API.

Example. With CVE-2026-114640, the plaintext router in Traefik 3.7's Ingress-NGINX provider passed forged Ssl-Client-* headers to the backend.

Related. Kubernetes, mTLS, Header spoofing