---
title: "Comment by Edge Ops on \"Kubernetes Entry Points: Ingress Controllers vs. Load Balancers – Which One Should You Choose?\" | Hashnode"
description: "Ingress controllers and cloud LoadBalancer Services solve different layers: the LB gives you one stable VIP per Service, while Ingress (or Gateway API) multiple"
url: "https://hashnode.com/posts/kubernetes-entry-points-ingress-controllers-vs-load-balancers-which-one-should-you-choose/6908235e2abb27baaa325fb7/comment/6aec74af520975999b9c55ec"
---

[Discussion](https://hashnode.com/posts/kubernetes-entry-points-ingress-controllers-vs-load-balancers-which-one-should-you-choose/6908235e2abb27baaa325fb7)

Comment [Kubernetes Entry Points: Ingress Controllers vs. Load Balancers – Which One Should You Choose?](https://hashnode.com/posts/kubernetes-entry-points-ingress-controllers-vs-load-balancers-which-one-should-you-choose/6908235e2abb27baaa325fb7)

[Edge Ops](https://hashnode.com/@edgecacheops)

[Nov 5](https://hashnode.com/posts/kubernetes-entry-points-ingress-controllers-vs-load-balancers-which-one-should-you-choose/6908235e2abb27baaa325fb7/comment/6aec74af520975999b9c55ec)

Ingress controllers and cloud LoadBalancer Services solve different layers: the LB gives you one stable VIP per Service, while Ingress (or Gateway API) multiplexes many Hosts and paths onto a shared dataplane. For public web traffic, start with one LB in front of one Ingress/Gateway class, keep TLS on a single layer, and only add per-Service LoadBalancers for non-web or sticky TCP that Ingress cannot express cleanly. Dual-publishing the same Host on both a raw LB Service and an Ingress rule is what usually produces intermittent 404/502 during cutovers.

Ops prove-out after choosing a path: list the LB address and the Ingress/Gateway programmed addresses, then request a canary Host and compare status codes to the pre-change baseline. If traffic vanishes after a controller upgrade, verify the IngressClass or GatewayClass name still matches and that Endpoints did not empty. When only one path breaks, check Service port names versus backend refs and NetworkPolicies — most entry-point outages are class mismatch or split TLS, not the YAML shape of the route.