{
  "schema_version": 2,
  "id": "operate/kubernetes/networking/ingressorroutespec",
  "title": "Establish external routing on the RedisEnterpriseCluster",
  "url": "https://redis.io/docs/latest/operate/kubernetes/7.8.6/networking/ingressorroutespec/",
  "summary": "",
  "content": "An Ingress is an API resource that provides a standardized and flexible way to manage external access to services running within a Kubernetes cluster.\n\n\u003e [!WARNING]\n\u003e The community [Ingress-NGINX controller](https://github.com/kubernetes/ingress-nginx) (`kubernetes/ingress-nginx`) is retired. Best-effort maintenance ended in March 2026 and the project no longer ships releases, bug fixes, or security updates. If you are not already using it, use HAProxy or Istio, or migrate to a [Gateway API](https://gateway-api.sigs.k8s.io/) implementation.\n\n## Install Ingress controller\n\nRedis Enterprise for Kubernetes supports the Ingress controllers below:\n* [HAProxy](https://haproxy-ingress.github.io/)\n* [Istio](https://istio.io/latest/docs/setup/getting-started/)\n* [Ingress-NGINX](https://kubernetes.github.io/ingress-nginx/) (retired; existing deployments only)\n\nOpenShift users can use [routes](https://redis.io/docs/latest/operate/kubernetes/networking/routes) instead of an Ingress.\n\nInstall your chosen Ingress controller, making sure `ssl-passthrough` is enabled. It is on by default for HAProxy and off by default for Ingress-NGINX. For Ingress-NGINX, start the controller with the `--enable-ssl-passthrough` flag.\n\n## Configure DNS\n\n1. Choose the API hostname and database hostname suffix you will use, replacing `\u003cplaceholders\u003e` with your own values. The recommended formats are:\n\n     * REC API hostname (`apiFqdnUrl`): `api-\u003crec-name\u003e-\u003crec-namespace\u003e.\u003csubdomain\u003e`\n     * Database hostname suffix (`dbFqdnSuffix`): `-db-\u003crec-name\u003e-\u003crec-namespace\u003e.\u003csubdomain\u003e`\n\n     The operator appends each database name to `dbFqdnSuffix` to build the per-database hostname. For example, a database named `mydb` with the suffix above resolves to `mydb-db-\u003crec-name\u003e-\u003crec-namespace\u003e.\u003csubdomain\u003e`. For the wildcard DNS record, use `*` in place of the database name followed by the suffix.\n\n1. Retrieve the `EXTERNAL-IP` of your Ingress controller's `LoadBalancer` service.\n\n     ``` sh\n     $ kubectl get svc \u003chaproxy-ingress | ingress-ngnix-controller\u003e \\\n                         -n \u003cingress-ctrl-namespace\u003e\n     ```\n\n     Below is example output for an HAProxy ingress controller running on a K8s cluster hosted by AWS.  \n\n     ``` sh\n     NAME              TYPE           CLUSTER-IP    EXTERNAL-IP                                                              PORT(S)                      AGE   \n     haproxy-ingress   LoadBalancer   10.43.62.53   a56e24df8c6173b79a63d5da54fd9cff-676486416.us-east-1.elb.amazonaws.com   80:30610/TCP,443:31597/TCP   21m\n     ```\n\n1. Create DNS records to resolve your chosen REC API hostname and database hostname to the `EXTERNAL-IP` found in the previous step.\n\n## Edit the REC spec\n\nEdit the RedisEnterpriseCluster (REC) spec to add the `ingressOrRouteSpec` field, replacing `\u003cplaceholders\u003e` below with your own values.\n\n### NGINX or HAproxy ingress controllers\n\n* Define the REC API hostname (`apiFqdnUrl`) and database hostname suffix (`dbFqdnSuffix`) you chose when configuring DNS.\n* Set `method` to `ingress`.\n* Set `ssl-passthrough` to \"true\".\n* Add any additional annotations required for your ingress controller. See [NGINX docs](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) or [HAproxy docs](https://haproxy-ingress.github.io/docs/configuration/keys/) for more information.\n\n```sh\nkubectl patch rec \u003crec-name\u003e --type merge --patch \"{\\\"spec\\\": \\\n    {\\\"ingressOrRouteSpec\\\": \\\n      {\\\"apiFqdnUrl\\\": \\\"api-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\", \\\n      \\\"dbFqdnSuffix\\\": \\\"-db-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\", \\\n      \\\"ingressAnnotations\\\": \\\n       {\\\"kubernetes.io/ingress.class\\\": \\\"\u003cingress-controller\u003e\\\", \\\n       \\\"\u003cingress-controller-annotation\u003e/ssl-passthrough\\\": \\\"true\\\"}, \\\n      \\\"method\\\": \\\"ingress\\\"}}}\"\n```\n\nSet `\u003cingress-controller\u003e` to `haproxy` or `nginx`. The operator validates that `ingressAnnotations` includes `kubernetes.io/ingress.class` and is the only annotation key it requires; add any other controller-specific annotations alongside it.\n\n### OpenShift routes\n\n* Define the REC API hostname (`apiFqdnUrl`) and database hostname suffix (`dbFqdnSuffix`) you chose when configuring DNS.\n* Set `method` to `openShiftRoute`.\n\n```sh\nkubectl patch rec \u003crec-name\u003e --type merge --patch \"{\\\"spec\\\": \\\n     {\\\"ingressOrRouteSpec\\\": \\\n     {\\\"apiFqdnUrl\\\": \\\"api-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\" \\ \n     \\\"dbFqdnSuffix\\\": \\\"-db-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\", \\\n     \\\"method\\\": \\\"openShiftRoute\\\"}}}\"\n```\n\nOpenShift routes do not require any `ingressAnnotations` in the `ingressOrRouteSpec`.\n",
  "tags": ["docs","operate","kubernetes"],
  "last_updated": "2026-10-21T09:46:20-07:00"
}