</code></pre></div><p>It will install the controller in the <code>ingress-nginx</code> namespace, creating that namespace if it doesn't already exist.</p><divclass="admonition info"><pclass=admonition-title>Info</p><p>This command is <em>idempotent</em>:</p><ul><li>if the ingress controller is not installed, it will install it,</li><li>if the ingress controller is already installed, it will upgrade it.</li></ul></div><p><strong>If you don't have Helm</strong> or if you prefer to use a YAML manifest, you can run the following command instead:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.2/deploy/static/provider/cloud/deploy.yaml</span>
</code></pre></div><divclass="admonition info"><pclass=admonition-title>Info</p><p>The YAML manifest in the command above was generated with <code>helm template</code>, so you will end up with almost the same resources as if you had used Helm to install the controller.</p></div><divclass="admonition attention"><pclass=admonition-title>Attention</p></div><p>If you are running an old version of Kubernetes (1.18 or earlier), please read <ahref=#running-on-Kubernetes-versions-older-than-1.19>this paragraph</a> for specific instructions. Because of api deprecations, the default manifest may not work on your cluster. Specific manifests for supported Kubernetes versions are available within a subfolder of each provider.</p><h3id=pre-flight-check>Pre-flight check<aclass=headerlinkhref=#pre-flight-checktitle="Permanent link"> ¶</a></h3><p>A few pods should start in the <code>ingress-nginx</code> namespace:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl get pods --namespace=ingress-nginx</span>
</code></pre></div><p>After a while, they should all be running. The following command will wait for the ingress controller pod to be up, running, and ready:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl wait --namespace ingress-nginx \</span>
</code></pre></div><h3id=local-testing>Local testing<aclass=headerlinkhref=#local-testingtitle="Permanent link"> ¶</a></h3><p>Let's create a simple web server and the associated service:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl create deployment demo --image=httpd --port=80</span>
</code></pre></div><p>Then create an ingress resource. The following example uses an host that maps to <code>localhost</code>:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl create ingress demo-localhost --class=nginx \</span>
</code></pre></div><p>Now, forward a local port to the ingress controller:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl port-forward --namespace=ingress-nginx service/ingress-nginx-controller 8080:80</span>
</code></pre></div><p>At this point, if you access http://demo.localdev.me:8080/, you should see an HTML page telling you "It works!".</p><h3id=online-testing>Online testing<aclass=headerlinkhref=#online-testingtitle="Permanent link"> ¶</a></h3><p>If your Kubernetes cluster is a "real" cluster that supports services of type <code>LoadBalancer</code>, it will have allocated an external IP address or FQDN to the ingress controller.</p><p>You can see that IP address or FQDN with the following command:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl get service ingress-nginx-controller --namespace=ingress-nginx</span>
</code></pre></div><p>It will be the <code>EXTERNAL-IP</code> field. If that field shows <code><pending></code>, this means that your Kubernetes cluster wasn't able to provision the load balancer (generally, this is because it doesn't support services of type <code>LoadBalancer</code>).</p><p>Once you have the external IP address (or FQDN), set up a DNS record pointing to it. Then you can create an ingress resource. The following example assumes that you have set up a DNS record for <code>www.demo.io</code>:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl create ingress demo --class=nginx \</span>
</code></pre></div><p>Alternatively, the above command can be rewritten as follows for the <code>--rule</code> command and below. <divclass=highlight><pre><span></span><code><spanclass=go>kubectl create ingress demo --class=nginx \</span>
<spanclass=go> --rule www.demo.io/=demo:80</span>
</code></pre></div></p><p>You should then be able to see the "It works!" page when you connect to http://www.demo.io/. Congratulations, you are serving a public web site hosted on a Kubernetes cluster! 🎉</p><h2id=environment-specific-instructions>Environment-specific instructions<aclass=headerlinkhref=#environment-specific-instructionstitle="Permanent link"> ¶</a></h2><h3id=local-development-clusters>Local development clusters<aclass=headerlinkhref=#local-development-clusterstitle="Permanent link"> ¶</a></h3><h4id=minikube>minikube<aclass=headerlinkhref=#minikubetitle="Permanent link"> ¶</a></h4><p>The ingress controller can be installed through minikube's addons system:</p><divclass=highlight><pre><span></span><code><spanclass=go>minikube addons enable ingress</span>
</code></pre></div><h4id=microk8s>MicroK8s<aclass=headerlinkhref=#microk8stitle="Permanent link"> ¶</a></h4><p>The ingress controller can be installed through MicroK8s's addons system:</p><divclass=highlight><pre><span></span><code><spanclass=go>microk8s enable ingress</span>
</code></pre></div><p>Please check the MicroK8s <ahref=https://microk8s.io/docs/addon-ingress>documentation page</a> for details.</p><h4id=docker-desktop>Docker Desktop<aclass=headerlinkhref=#docker-desktoptitle="Permanent link"> ¶</a></h4><p>Kubernetes is available in Docker Desktop:</p><ul><li>Mac, from <ahref=https://docs.docker.com/docker-for-mac/release-notes/#stable-releases-of-2018>version 18.06.0-ce</a></li><li>Windows, from <ahref=https://docs.docker.com/docker-for-windows/release-notes/#docker-community-edition-18060-ce-win70-2018-07-25>version 18.06.0-ce</a></li></ul><p>First, make sure that Kubernetes is enabled in the Docker settings. The command <code>kubectl get nodes</code> should show a single node called <code>docker-desktop</code>.</p><p>The ingress controller can be installed on Docker Desktop using the default <ahref=#quick-start>quick start</a> instructions.</p><p>On most systems, if you don't have any other service of type <code>LoadBalancer</code> bound to port 80, the ingress controller will be assigned the <code>EXTERNAL-IP</code> of <code>localhost</code>, which means that it will be reachable on localhost:80. If that doesn't work, you might have to fall back to the <code>kubectl port-forward</code> method described in the <ahref=#local-testing>local testing section</a>.</p><h3id=cloud-deployments>Cloud deployments<aclass=headerlinkhref=#cloud-deploymentstitle="Permanent link"> ¶</a></h3><p>If the load balancers of your cloud provider do active healthchecks on their backends (most do), you can change the <code>externalTrafficPolicy</code> of the ingress controller Service to <code>Local</code> (instead of the default <code>Cluster</code>) to save an extra hop in some cases. If you're installing with Helm, this can be done by adding <code>--set controller.service.externalTrafficPolicy=Local</code> to the <code>helm install</code> or <code>helm upgrade</code> command.</p><p>Furthermore, if the load balancers of your cloud provider support the PROXY protocol, you can enable it, and it will let the ingress controller see the real IP address of the clients. Otherwise, it will generally see the IP address of the upstream load balancer. This must be done both in the ingress controller (with e.g. <code>--set controller.config.use-proxy-protocol=true</code>) and in the cloud provider's load balancer configuration to function correctly.</p><p>In the following sections, we provide YAML manifests that enable these options when possible, using the specific options of various cloud providers.</p><h4id=aws>AWS<aclass=headerlinkhref=#awstitle="Permanent link"> ¶</a></h4><p>In AWS we use a Network load balancer (NLB) to expose the NGINX Ingress controller behind a Service of <code>Type=LoadBalancer</code>.</p><divclass="admonition info"><pclass=admonition-title>Info</p><p>The provided templates illustrate the setup for legacy in-tree service load balancer for AWS NLB. AWS provides the documentation on how to use <ahref=https://docs.aws.amazon.com/eks/latest/userguide/network-load-balancing.html>Network load balancing on Amazon EKS</a> with <ahref=https://github.com/kubernetes-sigs/aws-load-balancer-controller>AWS Load Balancer Controller</a>.</p></div><h5id=network-load-balancer-nlb>Network Load Balancer (NLB)<aclass=headerlinkhref=#network-load-balancer-nlbtitle="Permanent link"> ¶</a></h5><divclass=highlight><pre><span></span><code><spanclass=go>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/aws/deploy.yaml</span>
</code></pre></div><h5id=tls-termination-in-aws-load-balancer-nlb>TLS termination in AWS Load Balancer (NLB)<aclass=headerlinkhref=#tls-termination-in-aws-load-balancer-nlbtitle="Permanent link"> ¶</a></h5><p>By default, TLS is terminated in the ingress controller. But it is also possible to terminate TLS in the Load Balancer. This section explains how to do that on AWS using an NLB.</p><ol><li>Download the <ahref=https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml>deploy.yaml</a> template</li></ol><divclass=highlight><pre><span></span><code><spanclass=go>wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/aws/nlb-with-tls-termination/deploy.yaml</span>
</code></pre></div><ol><li><p>Edit the file and change the VPC CIDR in use for the Kubernetes cluster: <divclass=highlight><pre><span></span><code>proxy-real-ip-cidr: XXX.XXX.XXX/XX
</code></pre></div></p></li><li><p>Change the AWS Certificate Manager (ACM) ID as well: <divclass=highlight><pre><span></span><code>arn:aws:acm:us-west-2:XXXXXXXX:certificate/XXXXXX-XXXXXXX-XXXXXXX-XXXXXXXX
</code></pre></div></p></li></ol><h5id=nlb-idle-timeouts>NLB Idle Timeouts<aclass=headerlinkhref=#nlb-idle-timeoutstitle="Permanent link"> ¶</a></h5><p>Idle timeout value for TCP flows is 350 seconds and <ahref=https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#connection-idle-timeout>cannot be modified</a>.</p><p>For this reason, you need to ensure the <ahref=https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout>keepalive_timeout</a> value is configured less than 350 seconds to work as expected.</p><p>By default NGINX <code>keepalive_timeout</code> is set to <code>75s</code>.</p><p>More information with regards to timeouts can be found in the <ahref=https://docs.aws.amazon.com/elasticloadbalancing/latest/network/network-load-balancers.html#connection-idle-timeout>official AWS documentation</a></p><h4id=gce-gke>GCE-GKE<aclass=headerlinkhref=#gce-gketitle="Permanent link"> ¶</a></h4><p>First, your user needs to have <code>cluster-admin</code> permissions on the cluster. This can be done with the following command:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl create clusterrolebinding cluster-admin-binding \</span>
</code></pre></div><p>Then, the ingress controller can be installed like this:</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/cloud/deploy.yaml</span>
</code></pre></div><divclass="admonition warning"><pclass=admonition-title>Warning</p><p>For private clusters, you will need to either add an additional firewall rule that allows master nodes access to port <code>8443/tcp</code> on worker nodes, or change the existing rule that allows access to ports <code>80/tcp</code>, <code>443/tcp</code> and <code>10254/tcp</code> to also allow access to port <code>8443/tcp</code>.</p><p>See the <ahref=https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#add_firewall_rules>GKE documentation</a> on adding rules and the <ahref=https://github.com/kubernetes/kubernetes/issues/79739>Kubernetes issue</a> for more detail.</p></div><divclass="admonition warning"><pclass=admonition-title>Warning</p><p>Proxy protocol is not supported in GCE/GKE.</p></div><h4id=azure>Azure<aclass=headerlinkhref=#azuretitle="Permanent link"> ¶</a></h4><divclass=highlight><pre><span></span><code><spanclass=go>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/cloud/deploy.yaml</span>
</code></pre></div><p>More information with regards to Azure annotations for ingress controller can be found in the <ahref=https://docs.microsoft.com/en-us/azure/aks/ingress-internal-ip#create-an-ingress-controller>official AKS documentation</a>.</p><h4id=digital-ocean>Digital Ocean<aclass=headerlinkhref=#digital-oceantitle="Permanent link"> ¶</a></h4><divclass=highlight><pre><span></span><code><spanclass=go>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/do/deploy.yaml</span>
</code></pre></div><p>The full list of annotations supported by Exoscale is available in the Exoscale Cloud Controller Manager <ahref=https://github.com/exoscale/exoscale-cloud-controller-manager/blob/master/docs/service-loadbalancer.md>documentation</a>.</p><h4id=oracle-cloud-infrastructure>Oracle Cloud Infrastructure<aclass=headerlinkhref=#oracle-cloud-infrastructuretitle="Permanent link"> ¶</a></h4><divclass=highlight><pre><span></span><code><spanclass=go>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/cloud/deploy.yaml</span>
</code></pre></div><p>A <ahref=https://github.com/oracle/oci-cloud-controller-manager/blob/master/docs/load-balancer-annotations.md>complete list of available annotations for Oracle Cloud Infrastructure</a> can be found in the <ahref=https://github.com/oracle/oci-cloud-controller-manager>OCI Cloud Controller Manager</a> documentation.</p><h3id=bare-metal-clusters>Bare metal clusters<aclass=headerlinkhref=#bare-metal-clusterstitle="Permanent link"> ¶</a></h3><p>This section is applicable to Kubernetes clusters deployed on bare metal servers, as well as "raw" VMs where Kubernetes was installed manually, using generic Linux distros (like CentOS, Ubuntu...)</p><p>For quick testing, you can use a <ahref=https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport>NodePort</a>. This should work on almost every cluster, but it will typically use a port in the range 30000-32767.</p><divclass=highlight><pre><span></span><code><spanclass=go>kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.3/deploy/static/provider/baremetal/deploy.yaml</span>
</code></pre></div><p>For more information about bare metal deployments (and how to use port 80 instead of a random port in the 30000-32767 range), see <ahref=baremetal/>bare-metal considerations</a>.</p><h2id=miscellaneous>Miscellaneous<aclass=headerlinkhref=#miscellaneoustitle="Permanent link"> ¶</a></h2><h3id=checking-ingress-controller-version>Checking ingress controller version<aclass=headerlinkhref=#checking-ingress-controller-versiontitle="Permanent link"> ¶</a></h3><p>Run <code>/nginx-ingress-controller --version</code> within the pod, for instance with <code>kubectl exec</code>:</p><divclass=highlight><pre><span></span><code><spanclass=go>POD_NAMESPACE=ingress-nginx</span>
</code></pre></div><h3id=scope>Scope<aclass=headerlinkhref=#scopetitle="Permanent link"> ¶</a></h3><p>By default, the controller watches Ingress objects from all namespaces. If you want to change this behavior, use the flag <code>--watch-namespace</code> or check the Helm chart value <code>controller.scope</code> to limit the controller to a single namespace.</p><p>See also <ahref=https://kubernetes.github.io/ingress-nginx/#how-to-easily-install-multiple-instances-of-the-ingress-nginx-controller-in-the-same-cluster>“How to easily install multiple instances of the Ingress NGINX controller in the same cluster”</a> for more details.</p><h3id=webhook-network-access>Webhook network access<aclass=headerlinkhref=#webhook-network-accesstitle="Permanent link"> ¶</a></h3><divclass="admonition warning"><pclass=admonition-title>Warning</p><p>The controller uses an <ahref=https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/>admission webhook</a> to validate Ingress definitions. Make sure that you don't have <ahref=https://kubernetes.io/docs/concepts/services-networking/network-policies/>Network policies</a> or additional firewalls preventing connections from the API server to the <code>ingress-nginx-controller-admission</code> service.</p></div><h3id=certificate-generation>Certificate generation<aclass=headerlinkhref=#certificate-generationtitle="Permanent link"> ¶</a></h3><divclass="admonition attention"><pclass=admonition-title>Attention</p><p>The first time the ingress controller starts, two <ahref=https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/>Jobs</a> create the SSL Certificate used by the admission webhook.</p></div><p>This can cause an initial delay of up to two minutes until it is possible to create and validate Ingress definitions.</p><p>You can wait until it is ready to run the next command:</p><divclass=highlight><pre><span></span><code><spanclass="l l-Scalar l-Scalar-Plain">kubectl wait --namespace ingress-nginx \</span>
</code></pre></div><h3id=running-on-kubernetes-versions-older-than-119>Running on Kubernetes versions older than 1.19<aclass=headerlinkhref=#running-on-kubernetes-versions-older-than-119title="Permanent link"> ¶</a></h3><p>Ingress resources evolved over time. They started with <code>apiVersion: extensions/v1beta1</code>, then moved to <code>apiVersion: networking.k8s.io/v1beta1</code> and more recently to <code>apiVersion: networking.k8s.io/v1</code>.</p><p>Here is how these Ingress versions are supported in Kubernetes: - before Kubernetes 1.19, only <code>v1beta1</code> Ingress resources are supported - from Kubernetes 1.19 to 1.21, both <code>v1beta1</code> and <code>v1</code> Ingress resources are supported - in Kubernetes 1.22 and above, only <code>v1</code> Ingress resources are supported</p><p>And here is how these Ingress versions are supported in NGINX Ingress Controller: - before version 1.0, only <code>v1beta1</code> Ingress resources are supported - in version 1.0 and above, only <code>v1</code> Ingress resources are</p><p>As a result, if you're running Kubernetes 1.19 or later, you should be able to use the latest version of the NGINX Ingress Controller; but if you're using an old version of Kubernetes (1.18 or earlier) you will have to use version 0.X of the NGINX Ingress Controller (e.g. version 0.49).</p><p>The Helm chart of the NGINX Ingress Controller switched to version 1 in version 4 of the chart. In other words, if you're running Kubernetes 1.19 or earlier, you should use version 3.X of the chart (this can be done by adding <code>--version='<4'</code> to the <code>helm install</code> command).</p></article></div></div></main><footerclass=md-footer><divclass=md-footer-nav><navclass="md-footer-nav__inner md-grid"aria-label=Footer><ahref=../kubectl-plugin/class="md-footer-nav__link md-footer-nav__link--prev"rel=prev><divclass="md-footer-nav__button md-icon"><svgxmlns=http://www.w3.org/2000/svgviewbox="0 0 24 24"><pathd="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg></div><divclass=md-footer-nav__title><divclass=md-ellipsis><spanclass=md-footer-nav__direction> Previous </span> kubectl plugin </div></div></a><ahref=baremetal/class="md-footer-nav__link md-footer-nav__link--next"rel=next><divclass=md-footer-nav__title><divclass=md-ellipsis><spanclass=md-footer-nav__direction> Next </span> Bare-metal considerations </div></div><divclass="md-footer-nav__button md-icon"><svgxmlns=http://www.w3.org/2000/svgviewbox="0 0 24 24"><pathd="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4z"/></svg></div></a></nav></div><divclass="md-footer-meta md-typeset"><divclass="md-footer-meta__inner md-grid"><divclass=md-footer-copyright> Made with <ahref=https://squidfunk.github.io/mkdocs-material/target=_blankrel=noopener> Material for MkDocs </a></div></div></div></footer></div><scriptsrc=../assets/javascripts/vendor.93c04032.min.js></script><scriptsrc=../assets/javascripts/bundle.83e5331e.min.js></script><scriptid=__langtype=application/json>{"clipboard.copy":"Copy to clipboard","clipboard.copied":"Copied to clipboard","search.config.lang":"en","search.config.pipeline":"trimmer, stopWordFilter","search.config.separator":"[\\s\\-]+","search.placeholder":"Search","search.result.placeholder":"Type to start searching","search.result.none":"No matching documents","search.result.one":"1 matching document","search.result.other":"# matching documents","search.result.more.one":"1 more on this page","search.result.more.other":"# more on this page","search.result.term.missing":"Missing"}</script><script>
