For private clusters, you will need to either add an additional firewall rule that allows master nodes access to port 8443/tcp on worker nodes, or change the existing rule that allows access to ports 80/tcp, 443/tcp and 10254/tcp to also allow access to port 8443/tcp. See the GKE documentation on adding rules and the Kubernetes issue for more detail. Community Edition 7.2.1. Released on September 21, 2020.It is free and open source.Also you can get it from the GitHub mirror.: Enterprise Edition 7.2.0. Released on September 7, 2020.
Attention
The default configuration watches Ingress object from all the namespaces.
To change this behavior use the flag --watch-namespace to limit the scope to a particular namespace.
Warning
If multiple Ingresses define paths for the same host, the ingress controller merges the definitions.
Danger
The admission webhook requires connectivity between Kubernetes API server and the ingress controller.
In case Network policies or additional firewalls, please allow access to port 8443.
Attention
The first time the ingress controller starts, two Jobs create the SSL Certificate used by the admission webhook.For this reason, there is an initial delay of up to two minutes until it is possible to create and validate Ingress definitions.
You can wait until it is ready to run the next command:
Contents ¶
Provider Specific Steps ¶
Docker for Mac ¶
Kubernetes is available in Docker for Mac (from version 18.06.0-ce)
minikube ¶
For standard usage:
AWS ¶
In AWS we use a Network load balancer (NLB) to expose the NGINX Ingress controller behind a Service of Type=LoadBalancer.
Network Load Balancer (NLB) ¶
TLS termination in AWS Load Balancer (ELB) ¶
In some scenarios is required to terminate TLS in the Load Balancer and not in the ingress controller.
For this purpose we provide a template:
- Download deploy-tls-termination.yaml
Edit the file and change:
VPC CIDR in use for the Kubernetes cluster:
proxy-real-ip-cidr: XXX.XXX.XXX/XX
- AWS Certificate Manager (ACM) ID
arn:aws:acm:us-west-2:XXXXXXXX:certificate/XXXXXX-XXXXXXX-XXXXXXX-XXXXXXXX
- Deploy the manifest:
NLB Idle Timeouts ¶
Idle timeout value for TCP flows is 350 seconds and cannot be modified.
For this reason, you need to ensure the keepalive_timeout value is configured less than 350 seconds to work as expected.
By default NGINX keepalive_timeout is set to 75s.
Minikube Version
More information with regards to timeouts can be found in the official AWS documentation
GCE-GKE ¶
Info
Initialize your user as a cluster-admin with the following command:
Danger
For private clusters, you will need to either add an additional firewall rule that allows master nodes access to port 8443/tcp on worker nodes, or change the existing rule that allows access to ports 80/tcp, 443/tcp and 10254/tcp to also allow access to port 8443/tcp.
See the GKE documentation on adding rules and the Kubernetes issue for more detail.
Failure
Proxy protocol is not supported in GCE/GKE
Azure ¶
Digital Ocean ¶
Scaleway ¶
Bare-metal ¶
Using NodePort:
Tip
Upgrade Minikube
For extended notes regarding deployments on bare-metal, see Bare-metal considerations.
Verify installation ¶
Info
In minikube the ingress addon is installed in the namespace kube-system instead of ingress-nginx
To check if the ingress controller pods have started, run the following command:
Once the ingress controller pods are running, you can cancel the command typing Ctrl+C.
Now, you are ready to create your first ingress.
Minikube Mac Os
Detect installed version ¶
To detect which version of the ingress controller is running, exec into the pod and run nginx-ingress-controller version command.
Using Helm ¶
Install Minikube On Mac
NGINX Ingress controller can be installed via Helm using the chart from the project repository.To install the chart with the release name ingress-nginx:
If you are using Helm 2 then specify release name using --name flag