Ingress Controllers and TLS Termination

The Ingress resource is a declaration. The controller is the actor. Nothing about the Ingress spec itself processes traffic: there's a separate controller watching the API server and reconciling your rules into actual proxy configuration. The gap between the two is where most Ingress failures happen.

The CKAD exam clusters come with a controller pre-installed. You won't deploy it yourself, but you do need to know what ingressClassName to use, why your Ingress might be silently ignored, and how TLS termination works at the Secret level. Those are the failure modes the exam tests, and they're the same ones that trip people up in production.