[PoC] Kubernetes ingress controller

[patatoid]

Summary

Here is a proof of concept of zero-trust brought to Kubernetes through the implementation of a gateway as an ingress controller and microgateways as sidecars. This enables mTLS interactions between the main ingress and the services with a common authority for the instances forming a cluster as an identity platform to have both authentication, authorization and security provided to secure the infrastructure.

Features

• An ingress controller that forward the incoming requests to the services
  • using Kubernetes templates definitions
  • annotations to configure the upstreams
  • enables on top of routing TLS/mTLS, authorization, rate limiting
• A microgateway sitting along with the services as a process controlling incoming traffic
• Example Ansible playbooks to test the infrastructure on a Kubernetes Cluster

Test

1. You can use a local instance of kubernetes linke minikube with a one liner installer then start it

minikube start

2. Install kubectl, ansible and kubernetes plugin

sudo apt install ansible kubectl curl
kubectl config use-context minikube
ansible-galaxy collection install kubernetes.core

3. Run the playbooks

ansible-playbook -i ansible/hosts ansible/ingress-controller.yml
ansible-playbook -i ansible/hosts ansible/oauth.yml
ansible-playbook -i ansible/hosts ansible/kagome.yml

4. Expose the locally the ingress service and map hosts

minikube -n boruta-staging service boruta-ingress-controller

# /etc/hosts

<minikube ip>    kagome.local

5. Perform the test

You'll then be able to request the service at curl http://kagome.local:30080/echo passing through the ingress the connection will go through a mTLS tunnel toward the echo service.

$ kubectl -n boruta-staging logs -l app=boruta-ingress-controller
[...]
2026-06-04T21:25:56.668Z request_id=1cde6e93 [info] boruta_gateway GET /echo - sent 200 from 10.244.0.1 tls=http in 58ms
2026-06-04T21:25:56.668Z request_id=1cde6e93 [info] boruta_gateway gateway proxy - success upstream_id=154ffd5c-7d0d-4ab1-8d8e-7dfe47d36f15 upstream_host=kagome-web.kagome.svc.cluster.local upstream_port=8044 upstream_tls=mtls request_time=1274 gateway_time=538 upstream_time=736