{
  "schema_version": 2,
  "id": "operate/kubernetes/networking/ingressorroutespec",
  "title": "Establish external routing on the RedisEnterpriseCluster",
  "url": "https://redis.io/docs/latest/operate/kubernetes/8.2.0/networking/ingressorroutespec/",
  "summary": "",
  "content": "An Ingress is an API resource that provides a standardized and flexible way to manage external access to services running within a Kubernetes cluster.\n\n\u003e [!WARNING]\n\u003e The community [Ingress-NGINX controller](https://github.com/kubernetes/ingress-nginx) (`kubernetes/ingress-nginx`) is retired. Best-effort maintenance ended in March 2026 and the project no longer ships releases, bug fixes, or security updates. If you are not already using it, use HAProxy or Istio.\n\n## Install Ingress controller\n\nRedis Enterprise for Kubernetes supports the Ingress controllers below:\n* [HAProxy](https://haproxy-ingress.github.io/)\n* [Istio](https://istio.io/latest/docs/setup/getting-started/)\n* [Ingress-NGINX](https://kubernetes.github.io/ingress-nginx/) (retired; existing deployments only)\n\nOpenShift users can use [routes](https://redis.io/docs/latest/operate/kubernetes/networking/routes) instead of an Ingress.\n\nInstall your chosen Ingress controller, making sure `ssl-passthrough` is enabled. It is on by default for HAProxy and off by default for Ingress-NGINX. For Ingress-NGINX, start the controller with the `--enable-ssl-passthrough` flag.\n\n## Configure DNS\n\n1. Choose the API hostname and database hostname suffix you will use, replacing `\u003cplaceholders\u003e` with your own values. The recommended formats are:\n\n     * REC API hostname (`apiFqdnUrl`): `api-\u003crec-name\u003e-\u003crec-namespace\u003e.\u003csubdomain\u003e`\n     * Database hostname suffix (`dbFqdnSuffix`): `.db-\u003crec-name\u003e-\u003crec-namespace\u003e.\u003csubdomain\u003e`\n\n     The operator appends each database name to `dbFqdnSuffix` to build the per-database hostname. For example, a database named `mydb` with the suffix above resolves to `mydb.db-\u003crec-name\u003e-\u003crec-namespace\u003e.\u003csubdomain\u003e`. For the wildcard DNS record, replace the database name with `*`, which resolves to `*.db-\u003crec-name\u003e-\u003crec-namespace\u003e.\u003csubdomain\u003e`.\n\n1. Retrieve the `EXTERNAL-IP` of your Ingress controller's `LoadBalancer` service.\n\n     ``` sh\n     $ kubectl get svc \u003chaproxy-ingress | ingress-ngnix-controller\u003e \\\n                         -n \u003cingress-ctrl-namespace\u003e\n     ```\n\n     Below is example output for an HAProxy ingress controller running on a K8s cluster hosted by AWS.  \n\n     ``` sh\n     NAME              TYPE           CLUSTER-IP    EXTERNAL-IP                                                              PORT(S)                      AGE   \n     haproxy-ingress   LoadBalancer   10.43.62.53   a56e24df8c6173b79a63d5da54fd9cff-676486416.us-east-1.elb.amazonaws.com   80:30610/TCP,443:31597/TCP   21m\n     ```\n\n1. Create DNS records to resolve your chosen REC API hostname and database hostname to the `EXTERNAL-IP` found in the previous step.\n\n## Edit the REC spec\n\nEdit the RedisEnterpriseCluster (REC) spec to add the `ingressOrRouteSpec` field, replacing `\u003cplaceholders\u003e` below with your own values.\n\n### NGINX or HAproxy ingress controllers\n\n* Define the REC API hostname (`apiFqdnUrl`) and database hostname suffix (`dbFqdnSuffix`) you chose when configuring DNS.\n* Set `method` to `ingress`.\n* Set `ssl-passthrough` to \"true\".\n* Add any additional annotations required for your ingress controller. See [NGINX docs](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/) or [HAproxy docs](https://haproxy-ingress.github.io/docs/configuration/keys/) for more information.\n\n```sh\nkubectl patch rec \u003crec-name\u003e --type merge --patch \"{\\\"spec\\\": \\\n    {\\\"ingressOrRouteSpec\\\": \\\n      {\\\"apiFqdnUrl\\\": \\\"api-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\", \\\n      \\\"dbFqdnSuffix\\\": \\\".db-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\", \\\n      \\\"ingressAnnotations\\\": \\\n       {\\\"kubernetes.io/ingress.class\\\": \\\"\u003cingress-controller\u003e\\\", \\\n       \\\"\u003cingress-controller-annotation\u003e/ssl-passthrough\\\": \\\"true\\\"}, \\\n      \\\"method\\\": \\\"ingress\\\"}}}\"\n```\n\nSet `\u003cingress-controller\u003e` to `haproxy` or `nginx`. The operator validates that `ingressAnnotations` includes `kubernetes.io/ingress.class` and is the only annotation key it requires; add any other controller-specific annotations alongside it.\n\n### OpenShift routes\n\n* Define the REC API hostname (`apiFqdnUrl`) and database hostname suffix (`dbFqdnSuffix`) you chose when configuring DNS.\n* Set `method` to `openShiftRoute`.\n\n```sh\nkubectl patch rec \u003crec-name\u003e --type merge --patch \"{\\\"spec\\\": \\\n     {\\\"ingressOrRouteSpec\\\": \\\n     {\\\"apiFqdnUrl\\\": \\\"api-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\" \\ \n     \\\"dbFqdnSuffix\\\": \\\".db-\u003crec-name\u003e-\u003crec-namespace\u003e.example.com\\\", \\\n     \\\"method\\\": \\\"openShiftRoute\\\"}}}\"\n```\n\nOpenShift routes do not require any `ingressAnnotations` in the `ingressOrRouteSpec`.\n",
  "tags": ["docs","operate","kubernetes"],
  "last_updated": "2026-10-19T14:33:15-05:00"
}