Which of these does the request actually touch?
A request arrives for an application running in a cluster. Drawn on the canvas is everything involved in getting it there: the routing rules, the service definition, the cluster's own record of which pods are ready, and the components the bytes pass through.
Only some of these are on the path. The rest are configuration — read once by a controller, turned into a routing table, and never touched again by any individual request.
Boundaries, outermost first: Control plane (read by the controller): EndpointSlices (the ready pods' IPs), API server (the cluster's state), Ingress rules (host and path) Outside every boundary: Browser, Application pod (one of four), DNS (the public record), Ingress controller (a proxy, in a pod), Cloud load balancer (the public address) Connections: Browser calls DNS — resolve Browser calls Cloud load balancer — then connect Cloud load balancer calls Ingress controller Ingress controller calls Application pod — picks a ready one Ingress rules controls API server EndpointSlices controls API server API server controls Ingress controller — watches