Kubernetes Ingress Nginx

Deploys the ingress-nginx controller on Kubernetes using the upstream Helm chart (default version 4.11.1), with provider-specific load balancer configuration for GKE, EKS, and AKS, optional internal load balancer mode, configurable chart version, and optional namespace creation.

What Gets Created

When you deploy a KubernetesIngressNginx resource, OpenMCF provisions:

• Namespace — created only when createNamespace is true
• Helm Release (ingress-nginx) — deploys the ingress-nginx controller from https://kubernetes.github.io/kubernetes-ingress-nginx, pinned to the specified chartVersion (default 4.11.1), with atomic rollback enabled, cleanup on failure, wait-for-jobs, and a 180-second timeout; the controller service is set to type LoadBalancer with the default ingress class enabled and watchIngressWithoutClass turned on
• Load Balancer Annotations — provider-specific annotations applied to the controller service based on the selected provider config (gke, eks, or aks) and the internal flag

Prerequisites

• Kubernetes credentials configured via environment variables or OpenMCF provider config
• A Kubernetes namespace that already exists, or set createNamespace to true
• Cloud provider load balancer support — the target cluster must support LoadBalancer-type services (GKE, EKS, AKS, or equivalent)
• Static IP / subnet resources pre-created if referencing them in provider-specific configuration (e.g., GKE static IP, EKS subnets)

Quick Start

Create a file ingress-nginx.yaml:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesIngressNginx
metadata:
  name: my-ingress
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.KubernetesIngressNginx.my-ingress
spec:
  namespace: ingress-nginx
  createNamespace: true

Deploy:

openmcf apply -f ingress-nginx.yaml

This creates an ingress-nginx controller in the ingress-nginx namespace with the default chart version (4.11.1), an external LoadBalancer service, the default ingress class enabled, and no provider-specific annotations.

Configuration Reference

Required Fields

Optional Fields

Note on valueFrom: Fields of type StringValueOrRef (such as namespace, eks.additionalSecurityGroupIds, and eks.subnetIds) accept either a literal string value or a valueFrom block that references another OpenMCF resource's output field. See the Foreign Key References example below.

Examples

External Load Balancer on GKE with Static IP

Deploy ingress-nginx on a GKE cluster using a reserved static IP for the external load balancer:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesIngressNginx
metadata:
  name: gke-external
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.KubernetesIngressNginx.gke-external
spec:
  namespace: ingress-nginx
  createNamespace: true
  chartVersion: "4.11.1"
  gke:
    staticIpName: prod-ingress-ip

Internal Load Balancer on EKS

Deploy an internal-only ingress-nginx controller on EKS, pinned to specific subnets and with additional security groups:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesIngressNginx
metadata:
  name: eks-internal
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.KubernetesIngressNginx.eks-internal
spec:
  namespace: ingress-system
  createNamespace: true
  internal: true
  eks:
    additionalSecurityGroupIds:
      - sg-0123456789abcdef0
      - sg-abcdef0123456789a
    subnetIds:
      - subnet-aaa111
      - subnet-bbb222

AKS with Managed Identity

Deploy ingress-nginx on AKS with Azure Workload Identity and a pre-existing public IP:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesIngressNginx
metadata:
  name: aks-ingress
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.KubernetesIngressNginx.aks-ingress
spec:
  namespace: ingress-nginx
  createNamespace: true
  aks:
    managedIdentityClientId: 12345678-abcd-efgh-ijkl-123456789abc
    publicIpName: prod-ingress-pip

Using Foreign Key References

Reference an OpenMCF-managed namespace and EKS security groups from other resources instead of hardcoding values:

apiVersion: kubernetes.openmcf.org/v1
kind: KubernetesIngressNginx
metadata:
  name: platform-ingress
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: prod.KubernetesIngressNginx.platform-ingress
spec:
  namespace:
    valueFrom:
      kind: KubernetesNamespace
      name: platform-namespace
      field: spec.name
  createNamespace: false
  internal: true
  eks:
    additionalSecurityGroupIds:
      - valueFrom:
          kind: AwsSecurityGroup
          name: ingress-sg
          field: status.outputs.id
    subnetIds:
      - valueFrom:
          kind: AwsVpc
          name: platform-vpc
          field: status.outputs.public_subnet_ids

Stack Outputs

After deployment, the following outputs are available in status.outputs:

Related Components

• KubernetesNamespace — provides the target namespace via valueFrom reference
• KubernetesHelmRelease — alternative for deploying arbitrary Helm charts when the ingress-nginx component does not cover your use case
• KubernetesDeployment — application workloads that use Ingress resources routed through the ingress-nginx controller
• KubernetesService — backend services exposed via Ingress rules