### Install libcap and check capabilities

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Install the libcap package and check the capabilities of the controller binary to verify it has the net_bind_service capability.

```bash
$ apk add libcap
(1/1) Installing libcap (2.50-r0)
Executing busybox-1.33.1-r7.trigger
OK: 26 MiB in 41 packages
$ getcap /nginx-ingress-controller
/nginx-ingress-controller cap_net_bind_service=ep

```

--------------------------------

### Install Kubernetes Dashboard

Source: https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth

Command to install the Kubernetes Dashboard using kubectl. This is a prerequisite for both the OAuth2 Proxy and Vouch Proxy examples.

```bash
kubectl create -f https://raw.githubusercontent.com/kubernetes/kops/master/addons/kubernetes-dashboard/v1.10.1.yaml
```

--------------------------------

### Create session affinity example Ingress

Source: https://kubernetes.github.io/ingress-nginx/examples/affinity/cookie

Use this command to create the session affinity example Ingress resource from the file 'ingress.yaml'. This is the only command provided in the documentation.

```bash
kubectl create -f ingress.yaml

```

--------------------------------

### Install ingress-nginx on OVHcloud using Helm

Source: https://kubernetes.github.io/ingress-nginx/deploy

Installs the ingress controller on OVHcloud using Helm. Adds the repository, updates it, and installs the chart in the ingress-nginx namespace.

```bash
helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update
helm -n ingress-nginx install ingress-nginx ingress-nginx/ingress-nginx --create-namespace

```

--------------------------------

### Install ingress-nginx on Scaleway

Source: https://kubernetes.github.io/ingress-nginx/deploy

Installs the ingress controller on Scaleway. Refer to the Scaleway documentation for proxy protocol configuration.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/scw/deploy.yaml

```

--------------------------------

### Install ingress-nginx on Exoscale

Source: https://kubernetes.github.io/ingress-nginx/deploy

Installs the ingress controller on Exoscale. The full list of supported annotations is in the Exoscale Cloud Controller Manager documentation.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/deploy/static/provider/exoscale/deploy.yaml

```

--------------------------------

### Deployment resource (partial example) for ingress-nginx controller

Source: https://kubernetes.github.io/ingress-nginx/deploy/upgrade

Partial example of the controller Deployment resource showing the image field with a specific version tag and digest. Used as a reference for upgrading by changing the image tag.

```yaml
kind: Deployment
metadata:
  name: ingress-nginx-controller
  namespace: ingress-nginx
spec:
  replicas: 1
  selector: ...
  template:
    metadata: ...
    spec:
      containers:
        - name: ingress-nginx-controller
          image: registry.k8s.io/ingress-nginx/controller:v1.0.4@sha256:545cff00370f28363dad31e3b59a94ba377854d3a11f18988f5f9e56841ef9ef
          args: ...
```

--------------------------------

### lua-shared-dicts: Example Setting certificate_data to 100M and Adding my_custom_plugin

Source: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap

Example that sets the default certificate_data dictionary to 100M and introduces a new dictionary named my_custom_plugin with a size of 5 (MB by default). Use this to override existing dictionaries or add new ones.

```text
lua-shared-dicts: "certificate_data: 100, my_custom_plugin: 5"

```

--------------------------------

### Install ingress-nginx on Digital Ocean

Source: https://kubernetes.github.io/ingress-nginx/deploy

Installs the ingress controller on Digital Ocean. The default service only configures one annotation; additional annotations may be needed for load balancer graphs.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/do/deploy.yaml

```

--------------------------------

### Validate metrics configuration with helm get values

Source: https://kubernetes.github.io/ingress-nginx/user-guide/monitoring

Use this command to verify that the controller is configured for metrics. It displays the values of the installed release, and you should see the metrics and podAnnotations settings as shown in the expected output.

```bash
helm get values ingress-nginx --namespace ingress-nginx
```

--------------------------------

### Install ingress-nginx on GCE-GKE

Source: https://kubernetes.github.io/ingress-nginx/deploy

Installs the ingress controller on GCE-GKE. Note that the default GKE LoadBalancer does not support the PROXY protocol.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/cloud/deploy.yaml

```

--------------------------------

### Strace the controller to debug system calls

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Install strace and trace the controller to see the system calls executed when it fails.

```bash
$ apk add strace
(1/1) Installing strace (5.12-r0)
Executing busybox-1.33.1-r7.trigger
OK: 28 MiB in 42 packages
$ strace /nginx-ingress-controller
execve("/nginx-ingress-controller", ["/nginx-ingress-controller"], 0x7ffeb9eb3240 /* 131 vars */) = 0
arch_prctl(ARCH_SET_FS, 0x29ea690)      = 0
...

```

--------------------------------

### Build and deploy the ingress controller with kind

Source: https://kubernetes.github.io/ingress-nginx/developer-guide/getting-started

Starts a local Kubernetes cluster using kind, builds the ingress controller, and deploys it. For v1.x.x versions, you may need to configure a custom kind node image for Kubernetes 1.22.

```bash
make dev-env
```

--------------------------------

### lua-shared-dicts: Example with 512k Size Unit for my_custom_plugin

Source: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap

Similar to the previous example, but sets the my_custom_plugin dictionary size to 512k (kilobytes). The size unit is case-insensitive and can be 'm' or 'k', defaulting to MB if omitted.

```text
lua-shared-dicts: "certificate_data: 100, my_custom_plugin: 512k"

```

--------------------------------

### Server Snippet Annotation Example

Source: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations

Example of using the nginx.ingress.kubernetes.io/server-snippet annotation to add custom configuration in the server block. This annotation can only be used once per host.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/server-snippet: |
      set $agentflag 0;

      if ($http_user_agent ~* "(Mobile)" ){
        set $agentflag 1;
      }

      if ( $agentflag = 1 ) {
        return 301 https://m.example.com;
      }

```

--------------------------------

### Deploy otel-collector, grafana and Jaeger backend

Source: https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/opentelemetry

Commands to add Helm charts, install cert-manager, create observability namespace, deploy OpenTelemetry collector operator and collector, Jaeger, Zipkin, Tempo, and Grafana.

```bash
# add helm charts needed for grafana and OpenTelemetry collector
helm repo add open-telemetry https://open-telemetry.github.io/opentelemetry-helm-charts
helm repo add grafana https://grafana.github.io/helm-charts
helm repo update
# deploy cert-manager needed for OpenTelemetry collector operator
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.15.3/cert-manager.yaml
# create observability namespace
kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/namespace.yaml
# install OpenTelemetry collector operator
helm upgrade --install otel-collector-operator -n otel --create-namespace open-telemetry/opentelemetry-operator
# deploy OpenTelemetry collector
kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/collector.yaml
# deploy Jaeger all-in-one
kubectl apply -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.37.0/jaeger-operator.yaml -n observability
kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/jaeger.yaml -n observability
# deploy zipkin
kubectl apply -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/zipkin.yaml -n observability
# deploy tempo and grafana
helm upgrade --install tempo grafana/tempo --create-namespace -n observability
helm upgrade -f https://raw.githubusercontent.com/esigo/nginx-example/main/observability/grafana/grafana-values.yaml --install grafana grafana/grafana --create-namespace -n observability

```

--------------------------------

### Promote IP to Static with gcloud

Source: https://kubernetes.github.io/ingress-nginx/examples/static-ip

Promotes the IP to static using gcloud compute addresses create. The example is for GKE/GCE and shows the created address details.

```bash
$ gcloud compute addresses create ingress-nginx-lb --addresses 104.154.109.191 --region us-central1
Created [https://www.googleapis.com/compute/v1/projects/kubernetesdev/regions/us-central1/addresses/ingress-nginx-lb].
---
address: 104.154.109.191
creationTimestamp: '2017-01-31T16:34:50.089-08:00'
description: ''
id: '5208037144487826373'
kind: compute#address
name: ingress-nginx-lb
region: us-central1
selfLink: https://www.googleapis.com/compute/v1/projects/kubernetesdev/regions/us-central1/addresses/ingress-nginx-lb
status: IN_USE
users:
- us-central1/forwardingRules/a09f6913ae80e11e6a8c542010af0000

```

--------------------------------

### List nodes with external IPs

Source: https://kubernetes.github.io/ingress-nginx/deploy/baremetal

Shows the output of `kubectl get node` for a 3-node cluster, where the external IP is added as an example (in most bare-metal environments this value is <None>).

```bash
$ kubectl get node
NAME     STATUS   ROLES    EXTERNAL-IP
host-1   Ready    master   203.0.113.1
host-2   Ready    node     203.0.113.2
host-3   Ready    node     203.0.113.3

```

--------------------------------

### Check Prometheus installation with helm ls

Source: https://kubernetes.github.io/ingress-nginx/user-guide/monitoring

Lists all Helm releases across namespaces to verify Prometheus is installed. The output shows the prometheus release in the prometheus namespace with status deployed.

```bash
helm ls -A

```

```text
NAME          NAMESPACE       REVISION    UPDATED                                 STATUS      CHART                           APP VERSION

```

```text
ingress-nginx ingress-nginx   10          2022-01-20 18:08:55.267373 -0800 PST    deployed    ingress-nginx-4.0.16            1.1.1

```

```text
prometheus    prometheus      1          2022-01-20 16:07:25.086828 -0800 PST    deployed    kube-prometheus-stack-30.1.0    0.53.1

```

--------------------------------

### Install ingress-nginx on bare metal clusters

Source: https://kubernetes.github.io/ingress-nginx/deploy

Installs the ingress controller on bare metal clusters using NodePort. Typically uses a port in the 30000-32767 range.

```bash
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.15.1/deploy/static/provider/baremetal/deploy.yaml

```

--------------------------------

### Check Ingress Resource Events with kubectl get and describe

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Use kubectl get ing to list Ingress resources and kubectl describe ing to view detailed events, rules, and annotations. The output shows the cafe-ingress resource with rules for cafe.com and backend services tea-svc and coffee-svc.

```bash
$ kubectl get ing -n <namespace-of-ingress-resource>
NAME           HOSTS      ADDRESS     PORTS     AGE
cafe-ingress   cafe.com   10.0.2.15   80        25s

$ kubectl describe ing <ingress-resource-name> -n <namespace-of-ingress-resource>
Name:             cafe-ingress
Namespace:        default
Address:          10.0.2.15
Default backend:  default-http-backend:80 (172.17.0.5:8080)
Rules:
  Host      Path  Backends
  ----      ----  --------
  cafe.com
            /tea      tea-svc:80 (<none>)
            /coffee   coffee-svc:80 (<none>)
Annotations:
  kubectl.kubernetes.io/last-applied-configuration:  {"apiVersion":"networking.k8s.io/v1","kind":"Ingress","metadata":{"annotations":{},"name":"cafe-ingress","namespace":"default","selfLink":"/apis/networking/v1/namespaces/default/ingresses/cafe-ingress"},"spec":{"rules":[{"host":"cafe.com","http":{"paths":[{"backend":{"serviceName":"tea-svc","servicePort":80},"path":"/tea"},{"backend":{"serviceName":"coffee-svc","servicePort":80},"path":"/coffee"}]}}]},"status":{"loadBalancer":{"ingress":[{"ip":"169.48.142.110"}]}}}

Events:
  Type    Reason  Age   From                      Message
  ----    ------  ----  ----                      -------
  Normal  CREATE  1m    ingress-nginx-controller  Ingress default/cafe-ingress
  Normal  UPDATE  58s   ingress-nginx-controller  Ingress default/cafe-ingress
```

--------------------------------

### Install additional ingress-nginx controller in separate namespace

Source: https://kubernetes.github.io/ingress-nginx/faq

Installs an additional ingress-nginx controller in a separate namespace. The values `controller.ingressClassResource.name` and `controller.ingressClass` must be set correctly: the first creates the IngressClass object, the second modifies the deployment of the actual controller pod.

```bash
helm install ingress-nginx-2 ingress-nginx/ingress-nginx  \
--namespace ingress-nginx-2 \
--set controller.ingressClassResource.name=nginx-two \
--set controller.ingressClass=nginx-two \
--set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \
--set controller.ingressClassResource.enabled=true \
--set controller.ingressClassByName=true

```

--------------------------------

### Ingress with multiple paths for warning example

Source: https://kubernetes.github.io/ingress-nginx/user-guide/ingress-path-matching

Defines an Ingress with two paths: a Prefix path /foo/bar/bar and a regex path /foo/bar/[A-Z0-9]{3}. This example illustrates unexpected matching behavior due to NGINX's first-match policy.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress-3
  annotations:
    nginx.ingress.kubernetes.io/use-regex: "true"
spec:
  ingressClassName: nginx
  rules:
  - host: test.com
    http:
      paths:
      - path: /foo/bar/bar
        pathType: Prefix
        backend:
          service:
            name: test
            port: 
              number: 80
      - path: /foo/bar/[A-Z0-9]{3}
        pathType: ImplementationSpecific
        backend:
          service:
            name: test
            port: 
              number: 80

```

--------------------------------

### Architecture diagram of the example

Source: https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/opentelemetry

Mermaid diagram showing the flow of requests and telemetry data between the browser, services, ingress-nginx, OpenTelemetry collector, and observability backends.

```mermaid
graph TB
    subgraph Browser
    start["http://esigo.dev/hello/nginx"]
    end

    subgraph app
        sa[service-a]
        sb[service-b]
        sa --> |name: nginx| sb
        sb --> |hello nginx!| sa
    end

    subgraph otel
        otc["Otel Collector"]
    end

    subgraph observability
        tempo["Tempo"]
        grafana["Grafana"]
        backend["Jaeger"]
        zipkin["Zipkin"]
    end

    subgraph ingress-nginx
        ngx[nginx]
    end

    subgraph ngx[nginx]
        ng[nginx]
        om[OpenTelemetry module]
    end

    subgraph Node
        app
        otel
        observability
        ingress-nginx
        om --> |otlp-gRPC| otc --> |jaeger| backend
        otc --> |zipkin| zipkin
        otc --> |otlp-gRPC| tempo --> grafana
        sa --> |otlp-gRPC| otc
        sb --> |otlp-gRPC| otc
        start --> ng --> sa
    end
```

--------------------------------

### Two Ingress definitions for path priority example

Source: https://kubernetes.github.io/ingress-nginx/user-guide/ingress-path-matching

Defines two Ingresses on the same host test.com. The first uses Prefix pathType for /foo/bar and /foo/bar/, the second uses ImplementationSpecific with a regex path /foo/bar/(.+) and the rewrite-target annotation.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress-1
spec:
  ingressClassName: nginx
  rules:
  - host: test.com
    http:
      paths:
      - path: /foo/bar
        pathType: Prefix
        backend:
          service:
            name: service1
            port:
              number: 80
      - path: /foo/bar/
        pathType: Prefix
        backend:
          service:
            name: service2
            port:
              number: 80

```

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress-2
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /$1
spec:
  ingressClassName: nginx
  rules:
  - host: test.com
    http:
      paths:
      - path: /foo/bar/(.+)
        pathType: ImplementationSpecific
        backend:
          service:
            name: service3
            port: 
              number: 80

```

--------------------------------

### NGINX location blocks for path priority example

Source: https://kubernetes.github.io/ingress-nginx/user-guide/ingress-path-matching

Shows the three location blocks generated for the test.com server from the two Ingress definitions above, ordered by descending length. The regex locations use the ~* modifier.

```nginx
location ~* ^/foo/bar/.+ {
  ...
}

location ~* "^/foo/bar/" {
  ...
}

location ~* "^/foo/bar" {
  ...
}

```

--------------------------------

### Check Nginx Configuration with kubectl exec

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Use kubectl get pods to identify the controller pod, then kubectl exec to cat the Nginx configuration file. The output shows the beginning of nginx.conf with directives like daemon off and worker_processes.

```bash
$ kubectl get pods -n <namespace-of-ingress-controller>
NAME                                        READY     STATUS    RESTARTS   AGE
ingress-nginx-controller-67956bf89d-fv58j   1/1       Running   0          1m

$ kubectl exec -it -n <namespace-of-ingress-controller> ingress-nginx-controller-67956bf89d-fv58j -- cat /etc/nginx/nginx.conf
daemon off;
worker_processes 2;
pid /run/nginx.pid;
worker_rlimit_nofile 523264;
worker_shutdown_timeout 240s;
events {
    multi_accept        on;
    worker_connections  16384;
    use                 epoll;
}
http {
....
```

--------------------------------

### Install additional ingress-nginx controller in same namespace with different election ID

Source: https://kubernetes.github.io/ingress-nginx/faq

Installs an additional ingress-nginx controller in the same namespace (e.g., kube-system) by specifying a different election ID (`controller.electionID=nginx-two-leader`) to avoid leader election conflicts.

```bash
helm install ingress-nginx-2 ingress-nginx/ingress-nginx  \
--namespace kube-system \
--set controller.electionID=nginx-two-leader \
--set controller.ingressClassResource.name=nginx-two \
--set controller.ingressClass=nginx-two \
--set controller.ingressClassResource.controllerValue="example.com/ingress-nginx-2" \
--set controller.ingressClassResource.enabled=true \
--set controller.ingressClassByName=true

```

--------------------------------

### ConfigMap data example

Source: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap

Shows how to override nginx-controller configuration values by adding key-value pairs to the data section of a ConfigMap. All values must be strings, so booleans and numbers need quotes.

```yaml
data:
  map-hash-bucket-size: "128"
  ssl-protocols: SSLv2

```

--------------------------------

### Check Ingress Controller Logs with kubectl get pods and logs

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Use kubectl get pods to find the controller pod and kubectl logs to view its logs. The output shows the NGINX Ingress controller release and build information.

```bash
$ kubectl get pods -n <namespace-of-ingress-controller>
NAME                                        READY     STATUS    RESTARTS   AGE
ingress-nginx-controller-67956bf89d-fv58j   1/1       Running   0          1m

$ kubectl logs -n <namespace> ingress-nginx-controller-67956bf89d-fv58j
-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:    0.14.0
  Build:      git-734361d
  Repository: https://github.com/kubernetes/ingress-nginx
-------------------------------------------------------------------------------
....
```

--------------------------------

### Check if Used Services Exist with kubectl get svc

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Use kubectl get svc --all-namespaces to list all services and verify that backend services like coffee-svc and tea-svc exist. The output shows services across namespaces with their types and cluster IPs.

```bash
$ kubectl get svc --all-namespaces
NAMESPACE     NAME                   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)         AGE
default       coffee-svc             ClusterIP   10.106.154.35    <none>        80/TCP          18m
default       kubernetes             ClusterIP   10.96.0.1        <none>        443/TCP         30m
default       tea-svc                ClusterIP   10.104.172.12    <none>        80/TCP          18m
kube-system   default-http-backend   NodePort    10.108.189.236   <none>        80:30001/TCP    30m
kube-system   kube-dns               ClusterIP   10.96.0.10       <none>        53/UDP,53/TCP   30m
kube-system   kubernetes-dashboard   NodePort    10.103.128.17    <none>        80:30000/TCP    30m
```

--------------------------------

### NGINX location blocks for warning example

Source: https://kubernetes.github.io/ingress-nginx/user-guide/ingress-path-matching

Shows the two location blocks generated for the test.com server from the preceding Ingress definition, in the order they appear. The regex location is listed first, which causes it to match first for requests like /foo/bar/bar.

```nginx
location ~* "^/foo/bar/[A-Z0-9]{3}" {
  ...
}

location ~* "^/foo/bar/bar" {
  ...
}

```

--------------------------------

### Check Ingress Controller Version with kubectl exec

Source: https://kubernetes.github.io/ingress-nginx/deploy

Run /nginx-ingress-controller --version inside the controller pod to check its version. The example sets POD_NAMESPACE and POD_NAME environment variables to identify a running controller pod, then executes the version command via kubectl exec.

```bash
POD_NAMESPACE=ingress-nginx
POD_NAME=$(kubectl get pods -n $POD_NAMESPACE -l app.kubernetes.io/name=ingress-nginx --field-selector=status.phase=Running -o name)
kubectl exec $POD_NAME -n $POD_NAMESPACE -- /nginx-ingress-controller --version

```

--------------------------------

### Create LoadBalancer Service and Get IP

Source: https://kubernetes.github.io/ingress-nginx/examples/static-ip

Creates a LoadBalancer Service and waits for it to acquire an external IP. The output shows the Service with the external IP 104.154.109.191.

```bash
$ kubectl create -f static-ip-svc.yaml
service "ingress-nginx-lb" created

$ kubectl get svc ingress-nginx-lb
NAME               CLUSTER-IP     EXTERNAL-IP       PORT(S)                      AGE
ingress-nginx-lb   10.0.138.113   104.154.109.191   80:31457/TCP,443:32240/TCP   15m

```

--------------------------------

### kubectl get ingresses --all-namespaces

Source: https://kubernetes.github.io/ingress-nginx/kubectl-plugin

Standard kubectl command to list ingresses across all namespaces, shown for comparison with the plugin's ingresses command.

```bash
$ kubectl get ingresses --all-namespaces
NAMESPACE   NAME               HOSTS                            ADDRESS     PORTS   AGE
default     example-ingress1   testaddr.local,testaddr2.local   localhost   80      5d
default     test-ingress-2     *                                localhost   80      5d

```

--------------------------------

### kubectl ingress-nginx lint with --from-version and --to-version

Source: https://kubernetes.github.io/ingress-nginx/kubectl-plugin

Shows only lints added for a particular ingress-nginx release by using the --from-version and --to-version flags. Example filters to version 0.24.0.

```bash
$ kubectl ingress-nginx lint --all-namespaces --verbose --from-version 0.24.0 --to-version 0.24.0
Checking ingresses...
✗ anamespace/this-nginx
  - Contains the removed session-cookie-hash annotation.
       Lint added for version 0.24.0
       https://github.com/kubernetes/ingress-nginx/issues/3743

Checking deployments...
✗ namespace2/ingress-nginx-controller
  - Uses removed config flag --enable-dynamic-certificates
      Lint added for version 0.24.0
      https://github.com/kubernetes/ingress-nginx/issues/3808

```

--------------------------------

### FastCGI server Pod (php:fpm-alpine)

Source: https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services

Defines a Pod running the php:fpm-alpine image and exposing port 9000, the conventional FastCGI port. The pod must return an HTML response generated by a PHP script for the example to work.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: example-app
  labels:
    app: example-app
spec:
  containers:
  - name: example-app
    image: php:fpm-alpine
    ports:
    - containerPort: 9000
      name: fastcgi

```

--------------------------------

### Create Ingress and Verify IP Assignment

Source: https://kubernetes.github.io/ingress-nginx/examples/static-ip

Creates an Ingress with the ingress.class annotation set to nginx and verifies that it gets the IP allocated in the previous step. The output shows the Ingress with the address 104.154.109.191.

```bash
$ kubectl create -f ingress-nginx.yaml
ingress "ingress-nginx" created

$ kubectl get ing ingress-nginx
NAME            HOSTS     ADDRESS           PORTS     AGE
ingress-nginx   *         104.154.109.191   80, 443   13m

$ curl 104.154.109.191 -kL
CLIENT VALUES:
client_address=10.180.1.25
command=GET
real path=/
query=nil
request_version=1.1
request_uri=http://104.154.109.191:8080/
...

```

--------------------------------

### Create Service from manifest file

Source: https://kubernetes.github.io/ingress-nginx/examples/grpc

Use this command to create the Service resource from the saved manifest file 'service.go-grpc-greeter-server.yaml'.

```bash
$ kubectl create -f service.go-grpc-greeter-server.yaml

```

--------------------------------

### Get values of prometheus release

Source: https://kubernetes.github.io/ingress-nginx/user-guide/monitoring

Displays the values of the installed prometheus release to validate that Prometheus has been reconfigured. The output shows the podMonitorSelectorNilUsesHelmValues and serviceMonitorSelectorNilUsesHelmValues flags set to false.

```bash
helm get values prometheus --namespace prometheus

```

```yaml
prometheus:
  prometheusSpec:
    podMonitorSelectorNilUsesHelmValues: false
    serviceMonitorSelectorNilUsesHelmValues: false

```

--------------------------------

### Enable Debug Logging with kubectl edit

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Use kubectl to get and edit the ingress-nginx-controller deployment, adding --v=X to the container args to increase log verbosity. The value of X determines the level: 2 shows diff details, 3 shows service/Ingress/endpoint changes and dumps nginx config as JSON, and 5 enables NGINX debug mode.

```bash
$ kubectl get deploy -n <namespace-of-ingress-controller>
NAME                       DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
default-http-backend       1         1         1            1           35m
ingress-nginx-controller   1         1         1            1           35m

$ kubectl edit deploy -n <namespace-of-ingress-controller> ingress-nginx-controller
# Add --v=X to "- args", where X is an integer

```

--------------------------------

### FastCGI Service (example-service)

Source: https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services

Service that selects the example-app pod and exposes port 9000, matching the FastCGI port defined in the pod.

```yaml
apiVersion: v1
kind: Service
metadata:
  name: example-service
spec:
  selector:
    app: example-app
  ports:
  - port: 9000
    targetPort: 9000
    name: fastcgi

```

--------------------------------

### Get values of ingress-nginx release

Source: https://kubernetes.github.io/ingress-nginx/user-guide/monitoring

Displays the values of the installed ingress-nginx release to validate that the controller has been reconfigured to export metrics. The output shows the metrics and serviceMonitor settings.

```bash
helm get values ingress-nginx --namespace ingress-nginx

```

```yaml
controller:
  metrics:
    enabled: true
    serviceMonitor:
      additionalLabels:
        release: prometheus
      enabled: true

```

--------------------------------

### Build and deploy demo app

Source: https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/opentelemetry

Commands to build images and deploy the demo application using make targets.

```bash
# build images
make images

# deploy demo app:
make deploy-app

```

--------------------------------

### Deploy controller and services with kubectl

Source: https://kubernetes.github.io/ingress-nginx/examples/customization/external-auth-headers

Deploys the authentication service, echo service, and ingress objects. The output shows the created resources and the running pods and ingresses.

```bash
$ kubectl create -f deploy/
deployment "demo-auth-service" created
service "demo-auth-service" created
ingress "demo-auth-service" created
deployment "demo-echo-service" created
service "demo-echo-service" created
ingress "public-demo-echo-service" created
ingress "secure-demo-echo-service" created

$ kubectl get po
NAME                                        READY     STATUS    RESTARTS   AGE
demo-auth-service-2769076528-7g9mh          1/1       Running            0          30s
demo-echo-service-3636052215-3vw8c          1/1       Running            0          29s

kubectl get ing
NAME                       HOSTS                                 ADDRESS   PORTS     AGE
public-demo-echo-service   public-demo-echo-service.kube.local             80        1m
secure-demo-echo-service   secure-demo-echo-service.kube.local             80        1m
```

--------------------------------

### Create main deployment and service

Source: https://kubernetes.github.io/ingress-nginx/examples/canary

This command creates the main deployment and service for the application. It applies a Kubernetes manifest that defines a Deployment named 'production' and a Service named 'production'. The deployment uses the image 'registry.k8s.io/ingress-nginx/e2e-test-echo:v1.2.9@sha256:9920d084b452b38ee663005a455aa7ed12c15afa512741ea9596e206a189bdf0' and sets environment variables for node name, pod name, namespace, and IP. The service exposes port 80 and selects pods with label 'app: production'.

```bash
echo "
---
# Deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: production
  labels:
    app: production
spec:
  replicas: 1
  selector:
    matchLabels:
      app: production
  template:
    metadata:
      labels:
        app: production
    spec:
      containers:
      - name: production
        image: registry.k8s.io/ingress-nginx/e2e-test-echo:v1.2.9@sha256:9920d084b452b38ee663005a455aa7ed12c15afa512741ea9596e206a189bdf0
        ports:
        - containerPort: 80
        env:
          - name: NODE_NAME
            valueFrom:
              fieldRef:
                fieldPath: spec.nodeName
          - name: POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                fieldPath: metadata.namespace
          - name: POD_IP
            valueFrom:
              fieldRef:
                fieldPath: status.podIP
---
# Service
apiVersion: v1
kind: Service
metadata:
  name: production
  labels:
    app: production
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: http
  selector:
    app: production
" | kubectl apply -f -
```

--------------------------------

### index.php test script for FastCGI

Source: https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services

A simple PHP script to be placed at /var/www/html/index.php inside the example-app pod. Use kubectl exec to create this file; it is not persistent if the pod is deleted.

```html
<!DOCTYPE html>
<html>
    <head>
        <title>PHP Test</title>
    </head>
    <body>
        <?php echo '<p>FastCGI Test Worked!</p>'; ?>
    </body>
</html>

```

--------------------------------

### Get cluster nodes to show external IPs

Source: https://kubernetes.github.io/ingress-nginx/deploy/baremetal

Shows the output of 'kubectl get node' for a 3-node cluster. In bare-metal environments, external IPs are often <None>.

```text
$ kubectl get node
NAME     STATUS   ROLES    EXTERNAL-IP
host-1   Ready    master   203.0.113.1
host-2   Ready    node     203.0.113.2
host-3   Ready    node     203.0.113.3


```

--------------------------------

### Get ingress-nginx NodePort Service

Source: https://kubernetes.github.io/ingress-nginx/deploy/baremetal

Shows the output of 'kubectl -n ingress-nginx get svc' displaying the NodePort service with ports 80 and 443 mapped to NodePorts 30100 and 30101.

```text
$ kubectl -n ingress-nginx get svc
NAME                   TYPE        CLUSTER-IP     PORT(S)
ingress-nginx          NodePort    10.0.220.217   80:30100/TCP,443:30101/TCP


```

--------------------------------

### Expected helm get values output

Source: https://kubernetes.github.io/ingress-nginx/user-guide/monitoring

This is the expected output from the helm get values command, showing the metrics and podAnnotations configuration. It confirms that the controller is set up to expose metrics on port 10254.

```yaml
..
controller:
  metrics:
    enabled: true
  podAnnotations:
    prometheus.io/port: "10254"
    prometheus.io/scrape: "true"
..
```

--------------------------------

### Set GO111MODULE and download dependencies

Source: https://kubernetes.github.io/ingress-nginx/developer-guide/getting-started

Sets the GO111MODULE environment variable to 'on' and downloads Go module dependencies. Required before building the project.

```bash
export GO111MODULE=on
```

```bash
go mod download
```

--------------------------------

### FastCGI ConfigMap (example-cm)

Source: https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services

ConfigMap required to set FastCGI directive parameters. Must be created before the Ingress object; otherwise the Ingress Controller pods need to be restarted.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: example-cm
data:
  SCRIPT_FILENAME: "/var/www/html/index.php"

```

--------------------------------

### Run Go unit tests

Source: https://kubernetes.github.io/ingress-nginx/developer-guide/getting-started

Runs the Go unit tests for the project.

```bash
make test
```

--------------------------------

### Deploy Vouch Proxy

Source: https://kubernetes.github.io/ingress-nginx/examples/auth/oauth-external-auth

Command to deploy Vouch Proxy and its Ingress rules from the `vouch-proxy.yaml` file.

```bash
$ kubectl create -f vouch-proxy.yaml
```

--------------------------------

### Enable ingress addon in minikube

Source: https://kubernetes.github.io/ingress-nginx/deploy

Use this command to enable the ingress-nginx controller via minikube's addons system.

```bash
minikube addons enable ingress

```

--------------------------------

### Deploy test HTTP service and verify

Source: https://kubernetes.github.io/ingress-nginx/examples/PREREQUISITES

Deploys the standard http-svc pod from the ingress-nginx repository and verifies it is running. The service is initially of type ClusterIP, and the output shows the service and pod status.

```bash
$ kubectl create -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/main/docs/examples/http-svc.yaml
service "http-svc" created
replicationcontroller "http-svc" created

$ kubectl get po
NAME             READY     STATUS    RESTARTS   AGE
http-svc-p1t3t   1/1       Running   0          1d

$ kubectl get svc
NAME             CLUSTER-IP     EXTERNAL-IP   PORT(S)            AGE
http-svc         10.0.122.116   <pending>     80:30301/TCP       1d
```

--------------------------------

### FastCGI Ingress with annotations

Source: https://kubernetes.github.io/ingress-nginx/user-guide/fcgi-services

Ingress that exposes the FastCGI service using the backend-protocol FCGI annotation and references the example-cm ConfigMap. Create this only after the ConfigMap exists.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "FCGI"
    nginx.ingress.kubernetes.io/fastcgi-index: "index.php"
    nginx.ingress.kubernetes.io/fastcgi-params-configmap: "example-cm"
  name: example-app
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: example-service
            port:
              name: fastcgi

```

--------------------------------

### Test image pull with curl to registry.k8s.io

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Command to test connectivity to the image repository by downloading the image manifest to /dev/null. The output shows the curl progress and a successful connection, indicating the repository is reachable from the local machine.

```bash
(⎈ |myprompt)➜  ~ curl registry.k8s.io/ingress-nginx/kube-webhook-certgen@sha256:549e71a6ca248c5abd51cdb73dbc3083df62cf92ed5e6147c780e30f7e007a47 > /dev/null
                    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                                    Dload  Upload   Total   Spent    Left  Speed
                    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
 (⎈ |myprompt)➜  ~
```

--------------------------------

### Create cluster-admin binding for GCE-GKE

Source: https://kubernetes.github.io/ingress-nginx/deploy

Required before installing the ingress controller on GCE-GKE. Grants cluster-admin permissions to the current user.

```bash
kubectl create clusterrolebinding cluster-admin-binding \
  --clusterrole cluster-admin \
  --user $(gcloud config get-value account)

```

--------------------------------

### Create a test pod to troubleshoot port binding

Source: https://kubernetes.github.io/ingress-nginx/troubleshooting

Use this YAML to create a pod that runs the controller image with 'sleep 3600' so you can exec in and manually run /nginx-ingress-controller. Update the namespace, nodeSelector, controller image, and securityContext to match your deployment. The pod adds NET_BIND_SERVICE capability and drops all others, with runAsUser 101.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: ingress-nginx-sleep
  namespace: default
  labels:
    app: nginx
spec:
  containers:
    - name: nginx
      image: ##_CONTROLLER_IMAGE_##
      resources:
        requests:
          memory: "512Mi"
          cpu: "500m"
        limits:
          memory: "1Gi"
          cpu: "1"
      command: ["sleep"]
      args: ["3600"]
      ports:
      - containerPort: 80
        name: http
        protocol: TCP
      - containerPort: 443
        name: https
        protocol: TCP
      securityContext:
        allowPrivilegeEscalation: true
        capabilities:
          add:
          - NET_BIND_SERVICE
          drop:
          - ALL
        runAsUser: 101
  restartPolicy: Never
  nodeSelector:
    kubernetes.io/hostname: ##_NODE_NAME_##
  tolerations:
  - key: "node.kubernetes.io/unschedulable"
    operator: "Exists"
    effect: NoSchedule

```

--------------------------------

### Describe Ingress nginx-test

Source: https://kubernetes.github.io/ingress-nginx/examples/tls-termination

Shows the output of kubectl describe ing nginx-test, confirming the Ingress works. The output includes the address, TLS termination details, and events.

```bash
$ kubectl describe ing nginx-test
Name:           nginx-test
Namespace:      default
Address:        104.198.183.6
Default backend:    default-http-backend:80 (10.180.0.4:8080,10.240.0.2:8080)
TLS:
  tls-secret terminates
Rules:
  Host  Path    Backends
  ----  ----    --------
  *
            http-svc:80 (<none>)
Annotations:
Events:
  FirstSeen LastSeen    Count   From                SubObjectPath   Type        Reason  Message
  --------- --------    -----   ----                -------------   --------    ------  -------
  7s        7s      1   {ingress-nginx-controller }         Normal      CREATE  default/nginx-test
  7s        7s      1   {ingress-nginx-controller }         Normal      UPDATE  default/nginx-test
  7s        7s      1   {ingress-nginx-controller }         Normal      CREATE  ip: 104.198.183.6
  7s        7s      1   {ingress-nginx-controller }         Warning     MAPPING Ingress rule 'default/nginx-test' contains no path definition. Assuming /

```

--------------------------------

### Create Kubernetes Deployment for gRPC app

Source: https://kubernetes.github.io/ingress-nginx/examples/grpc

This manifest creates a Deployment for the go-grpc-greeter-server container. Edit the image placeholder '<reponame>/go-grpc-greeter-server' to match your repository. The container listens on port 50051.

```yaml
cat <<EOF | kubectl apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: go-grpc-greeter-server
  name: go-grpc-greeter-server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: go-grpc-greeter-server
  template:
    metadata:
      labels:
        app: go-grpc-greeter-server
    spec:
      containers:
      - image: <reponame>/go-grpc-greeter-server   # Edit this for your reponame
        resources:
          limits:
            cpu: 100m
            memory: 100Mi
          requests:
            cpu: 50m
            memory: 50Mi
        name: go-grpc-greeter-server
        ports:
        - containerPort: 50051
EOF

```

--------------------------------

### Check ingress-nginx Service status

Source: https://kubernetes.github.io/ingress-nginx/deploy/baremetal

Shows the output of `kubectl -n ingress-nginx get svc` after MetalLB assigns an external IP to the ingress-nginx LoadBalancer Service.

```bash
$ kubectl -n ingress-nginx get svc
NAME                   TYPE          CLUSTER-IP     EXTERNAL-IP  PORT(S)
default-http-backend   ClusterIP     10.0.64.249    <none>       80/TCP
ingress-nginx          LoadBalancer  10.0.220.217   203.0.113.10  80:30100/TCP,443:30101/TCP

```

--------------------------------

### Create namespace for additional ingress-nginx controller

Source: https://kubernetes.github.io/ingress-nginx/faq

Creates a separate namespace for an additional ingress-nginx controller instance, which is the first step in installing multiple controllers in one cluster.

```bash
kubectl create namespace ingress-nginx-2

```

--------------------------------

### Test HTTP request to ingress-nginx

Source: https://kubernetes.github.io/ingress-nginx/deploy/baremetal

Shows a curl command and its response after MetalLB sets the external IP, demonstrating that the node starts responding to HTTP requests on the configured ports.

```bash
$ curl -D- http://203.0.113.10 -H 'Host: myapp.example.com'
HTTP/1.1 200 OK
Server: nginx/1.15.2

```

--------------------------------

### Check gRPC application pod status

Source: https://kubernetes.github.io/ingress-nginx/examples/grpc

Use this command to verify that your gRPC application pod is running and listening for connections. The output should show the pod with the name containing 'go-grpc-greeter-server'.

```bash
$ kubectl get po -A -o wide | grep go-grpc-greeter-server

```

--------------------------------

### Enable ingress addon in MicroK8s

Source: https://kubernetes.github.io/ingress-nginx/deploy

Use this command to enable the ingress-nginx controller via MicroK8s's addons system.

```bash
microk8s enable ingress

```

--------------------------------

### Update Ingress Controller with --publish-service

Source: https://kubernetes.github.io/ingress-nginx/examples/static-ip

Updates the ingress controller to adopt the static IP of the Service by passing the --publish-service flag. The example yaml used in the next step already has it set to "ingress-nginx-lb".

```bash
$ kubectl create -f ingress-nginx-controller.yaml
deployment "ingress-nginx-controller" created

```