Deploy Ingress-NGINX Controller¶

An Ingress is a Kubernetes API object that exposes HTTP/HTTPS routes from outside the cluster to Services inside it. It lets to define path-based or host-based routing rules in one place, rather than creating individual LoadBalancer Services per application.

An Ingress object alone does nothing — it requires an Ingress Controller to read those rules and configure the underlying proxy (NGINX, Traefik, HAProxy, etc.) accordingly.

Available Ingress Controllers¶

Kubernetes does not ship a built-in Ingress Controller. Choose one based on the use case. The most commonly used controllers are:

How Platform Affects Deployment¶

The ingress-nginx controller is deployed differently depending on where the cluster runs. The key difference is how traffic enters the cluster:

Prerequisites¶

• A running Kubernetes cluster with kubectl configured
• All nodes show Ready status:

kubectl get nodes

• Helm installed (optional — only needed for Helm-based install)

Step 1 — Deploy the Controller¶

Choose the method that matches the environment.

Option A — Manifest (Platform-Specific)¶

minikube¶

minikube addons enable ingress

Bare-metal / kubeadm (this runbook's primary target)¶

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/baremetal/deploy.yaml

AWS (EKS)¶

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/aws/deploy.yaml

GKE / Azure / Oracle Cloud / Other Cloud¶

kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/cloud/deploy.yaml

Option B — Helm (Any Platform)¶

helm upgrade --install ingress-nginx ingress-nginx \
  --repo https://kubernetes.github.io/ingress-nginx \
  --namespace ingress-nginx --create-namespace

To inspect all available Helm values before installing:

helm show values ingress-nginx --repo https://kubernetes.github.io/ingress-nginx

Step 2 — Verify the Controller is Running¶

Wait for the controller pod to become ready (up to 2 minutes on first install — two Jobs run to generate the admission webhook SSL certificate):

kubectl wait --namespace ingress-nginx \
  --for=condition=ready pod \
  --selector=app.kubernetes.io/component=controller \
  --timeout=120s

Then verify pods and the Service:

kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx

Step 3 — Check the Controller Version¶

POD_NAMESPACE=ingress-nginx
POD_NAME=$(kubectl get pods -n $POD_NAMESPACE \
  -l app.kubernetes.io/name=ingress-nginx \
  --field-selector=status.phase=Running -o name)

kubectl exec $POD_NAME -n $POD_NAMESPACE -- /nginx-ingress-controller --version

Firewall Requirements¶

gcloud compute firewall-rules create allow-master-to-webhook \
  --allow tcp:8443 \
  --target-tags <node-tag>

What Gets Created¶

Running the baremetal manifest creates the following resources:

• Namespace: ingress-nginx
• Deployment: ingress-nginx-controller (runs the NGINX proxy)
• Service: ingress-nginx-controller of type NodePort
• Service: ingress-nginx-controller-admission (webhook)
• IngressClass: nginx (set as cluster default)
• RBAC resources: ClusterRole, ClusterRoleBinding, Role, RoleBinding
• ValidatingWebhookConfiguration: validates Ingress objects on creation

Step 4 — Use ingress-nginx in an Ingress Resource¶

Once the controller is running, reference it in Ingress manifests using the ingressClassName field. This tells Kubernetes which controller should handle this Ingress object.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: <ingress-name>
  namespace: <namespace>
  annotations:
    # Optional: kept for compatibility with older controllers (pre-1.18)
    kubernetes.io/ingress.class: nginx
spec:
  ingressClassName: nginx       # Must match the IngressClass name
  rules:
    - host: <domain.com>
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: <service-name>
                port:
                  number: <port>

Apply it:

kubectl apply -f <ingress-manifest>.yaml

Verify the Ingress received an address:

kubectl get ingress -n <namespace>

Expected output:

NAME             CLASS   HOSTS              ADDRESS         PORTS
<ingress-name>   nginx   <domain.com>       192.168.1.240   80, 443