Perfomance penalty for Nginx Ingress Controller vs Nginx

[jerryjxj]

In the same enviornments, one host exposes service with Nginx and another one exposes with Nginx Ingress Controller. I used tool Vegeta. 30 concurrent connections and 60 seconds setting are used in the testing. The results are below:
Nginx: [https://myhost1.com]
Bucket # % Histogram
[0s, 5ms] 2537 84.57% ###############################################################
[5ms, 10ms] 428 14.27% ##########
[10ms, 15ms] 20 0.67%
[15ms, 20ms] 5 0.17%
[20ms, 25ms] 3 0.10%
[25ms, 30ms] 1 0.03%
[30ms, 50ms] 2 0.07%
[50ms, 80ms] 1 0.03%
[80ms, 100ms] 1 0.03%
[100ms, 150ms] 2 0.07%
[150ms, 300ms] 0 0.00%
[300ms, +Inf] 0 0.00%

Ingress: [https://myhost2.com]
Bucket # % Histogram
[0s, 5ms] 2524 84.13% ###############################################################
[5ms, 10ms] 338 11.27% ########
[10ms, 15ms] 33 1.10%
[15ms, 20ms] 12 0.40%
[20ms, 25ms] 28 0.93%
[25ms, 30ms] 43 1.43% #
[30ms, 50ms] 7 0.23%
[50ms, 80ms] 6 0.20%
[80ms, 100ms] 0 0.00%
[100ms, 150ms] 0 0.00%
[150ms, 300ms] 9 0.30%
[300ms, +Inf] 0 0.00%

I checked code of Nginx Ingress controller and found the controller itsself takes control of incomming connections and then forwards the content to Nginx server. Why should it be designed so?

[aledbf]

Why should it be designed so?

To allow ssl passthrough, i.e. TLS termination in the pod behind the service.

[jerryjxj]

@aledbf , But for Niginx Controller implimentation, even for SSL passthrough, Nginx itsself supports this feature. The current situation is Remote client --> Controller --> Nginx --> service pod. It seems no need to have Controller here. Did I make a misunderstanding on SSL passthrough for ingress?

BTW, SSL passthrough seems not working in the master code. I followed the instruction in #1854 # but I failed to get the correct Nginx configuration in the Controller.

[ossinkine]

Agree with @jerryjxj
At least it looks redundant, if you don't need SSL passthrough. There is no configuration to connect to Nginx directly.
Also Ingress Controller seems to be not optimized for high load. So on our system sometimes Controller stops responding on HTTPS request (direct request to Nginx on 80 port works good) even on 10-20 rps (maybe this is not related to the number of requests).