NGINX Ingress Deployment

Legacy edge mode. Uses the cluster ingress-nginx controller and a single Ingress resource (bh-ingress).

Reference release: controller v1.15.1 · Helm chart 4.15.1 — kubernetes/ingress-nginx releases

note

Gateway API with Envoy is recommended for new deployments. See Gateway API Deployment. NGINX remains supported for backward compatibility.

When to use

• Existing ingress-nginx already on the cluster
• Simpler single-Ingress pattern (no Gateway API CRDs)
• Migration path from Azure / nginx-based setups

---

Install ingress-nginx on GKE

Install from the official Helm repository. Pin chart version 4.15.1 (deploys controller v1.15.1).

1. Add the Helm repository

helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
helm repo update

Upstream install guide: ingress-nginx deploy documentation.

2. GKE values overlay

The default chart is cloud-neutral. For GKE, create a values file (for example values-gcp-ingress-nginx.yaml):

# values-gcp-ingress-nginx.yaml — GKE LoadBalancer annotations

controller:
  service:
    annotations:
      cloud.google.com/l4-rbs: "enabled"
      cloud.google.com/network-tier: "Standard"

Setting	Purpose
cloud.google.com/l4-rbs: "enabled"	Regional external passthrough Network Load Balancer
cloud.google.com/network-tier: Standard	Standard-tier external IP (match reference dev; use Premium if required by policy)

3. Install or upgrade

helm upgrade --install ingress-nginx ingress-nginx/ingress-nginx \
  --version 4.15.1 \
  --namespace ingress-nginx \
  --create-namespace \
  -f values-gcp-ingress-nginx.yaml

4. Verify controller

kubectl get pods -n ingress-nginx
kubectl get svc -n ingress-nginx

Wait until the controller Service has an EXTERNAL-IP before pointing DNS or deploying the platform chart.

---

Shared VPC firewall

Create on host project (target: GKE node service account):

Port	Source
TCP 10256	130.211.0.0/22, 35.191.0.0/16, … (Google health check ranges)
TCP 80, 443	0.0.0.0/0 (or your corporate CIDR)

Without these rules the load balancer shows 0% healthy.

---

Deploy platform chart (ingress mode)

After ingress-nginx is running, deploy bighammer with ingress enabled:

global:
  ingress:
    enabled: true
  gateway:
    enabled: false

Full deploy steps: Platform Deployment.

---

TLS

Ingress uses global.ingress.tlsSecretName (default <env>-gcp-bighammer-tls). SSL/TLS options (ingress vs gateway): TLS Options.

---

DNS

Point global.ingress.*HostName A records to the nginx Service EXTERNAL-IP:

kubectl get svc -n ingress-nginx

---

Verify end-to-end

kubectl get ingress -n bh-control-plane
curl -kI https://<ui-hostname>

---

Switch to Envoy Gateway

Complete Gateway API Deployment Steps 1–3, then redeploy bighammer with:

global:
  ingress:
    enabled: false
  gateway:
    enabled: true

This removes the nginx Ingress and creates app HTTPRoute resources. The bh-gateway release in envoy-gateway-system is unchanged unless you uninstall it separately.

---

Related

Topic	Link
ingress-nginx releases	github.com/kubernetes/ingress-nginx/releases
Official Helm install	kubernetes.github.io/ingress-nginx/deploy
Gateway API (recommended)	Gateway API Deployment
Azure equivalent	Azure NGINX Ingress