NGINX Ingress Deployment

Edge mode for Azure. Uses the cluster ingress-nginx controller and a single Ingress resource (bh-ingress).

Reference release: controller v1.15.1 · Helm chart 4.15.1 — kubernetes/ingress-nginx releases

note

On Azure, BigHammer reference deployments use nginx Ingress. Gateway API with Envoy is documented for GCP; Azure customers may adopt Gateway API separately if required by policy.

When to use

• Standard BigHammer on AKS
• Simpler single-Ingress pattern (no Gateway API CRDs)
• Migration path from on-premises nginx-based setups

---

Install ingress-nginx on AKS

Install from the official Helm repository. Pin chart version 4.15.1 (deploys controller v1.15.1).

1. Add the Helm repository

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

Upstream install guide: ingress-nginx deploy documentation.

2. AKS values overlay

Create a values file (for example values-azure-ingress-nginx.yaml):

# values-azure-ingress-nginx.yaml — AKS LoadBalancer annotations

controller:
  service:
    annotations:
      service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: /healthz
      # service.beta.kubernetes.io/azure-load-balancer-internal: "true"  # internal LB only

Setting	Purpose
azure-load-balancer-health-probe-request-path	Azure LB health probe path for nginx /healthz
azure-load-balancer-internal	Set "true" for internal-only ingress (private cluster pattern)

3. Install or upgrade

helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx \
  --version 4.15.1 \
  --namespace ingress-nginx \
  --create-namespace \
  -f values-azure-ingress-nginx.yaml

4. Verify controller

kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx

Wait until the controller Service has an EXTERNAL-IP (or internal IP for private LB) before pointing DNS or deploying the platform chart.

---

Network security

Ensure NSG / firewall rules allow:

Port	Source
TCP 80, 443	Your corporate CIDR or 0.0.0.0/0 per policy
TCP 10254 (health)	Azure load balancer probe ranges

Without health probe configuration, the load balancer may show unhealthy backends.

---

Deploy platform chart (ingress mode)

After ingress-nginx is running, deploy bighammer with ingress enabled:

global:
  ingress:
    enabled: true

Full deploy steps: Platform Deployment.

---

TLS

Ingress uses global.ingress.tlsSecretName (default pattern: <env>-az-bighammer-tls). SSL/TLS options: TLS Options.

---

DNS

Point global.ingress.*HostName A records to the nginx Service EXTERNAL-IP:

kubectl get svc -n ingress-nginx

Hostname pattern	Example
UI	ui.<env>.<domain>
Catalog API	catalog.<env>.<domain>
Keycloak	kc.<env>.<domain>

Align hostnames with certificate SANs from TLS Options.

---

Troubleshooting

Symptom	Check
502 / no healthy backends	LB health probe path; pod readiness on /healthz
Certificate error	kubectl get secret <tlsSecretName> -n bh-control-plane
Wrong backend	kubectl describe ingress bh-ingress -n bh-control-plane

---

Related

Topic	Link
TLS	TLS Options
Cluster prep order	Cluster preparation
GCP equivalent	GCP NGINX Ingress
Azure equivalent	Azure NGINX Ingress