NGINX Ingress Controller

NGINX Ingress Controller manages Kubernetes ingress traffic, load balancing WebSocket, gRPC, TCP, and UDP applications. It supports content-based routing and TLS/SSL termination, with additional NGINX settings controlled through annotations and ConfigMaps. Manifest installation offers Deployment, DaemonSet, and StatefulSet modes, and the controller can expose NGINX and controller metrics in Prometheus format, including through a ServiceMonitor with Prometheus Operator.

Its policy resources cover access control, rate limiting, API keys, authentication, mTLS, WAF, CORS, and HSTS; some require NGINX Plus. Plus also adds real-time metrics, further load-balancing methods, session persistence, active health checks, and JWT validation. The free plan uses NGINX Open Source and requires a Kubernetes cluster. NGINX Plus requires a subscription, with JWT or certificate credentials for registry access. The self-hosted product documents integrations including F5 products, cert-manager, ExternalDNS, Prometheus, Istio, Linkerd, and Open Service Mesh. F5 recommends encrypting Kubernetes Secrets at rest and least-privilege RBAC; it notes the default ServiceAccount can access all cluster Secrets.

NGINX Ingress Controller provides Kubernetes traffic management, with the free NGINX Open Source plan and additional capabilities available through NGINX Plus. Teams should account for the cluster requirement, policy tier differences, and the documented Secret-access guidance.

It suits teams managing application ingress on Kubernetes that need traffic routing, TLS termination, or policy controls. Its self-hosted deployment and documented integrations may fit teams already using Kubernetes and related tools.

Overview

NGINX Ingress Controller routes Kubernetes application traffic through NGINX and suits teams that need a self-hosted ingress layer for several network protocols. Its open-source plan covers core load balancing, routing, and TLS termination; teams needing richer monitoring, health checks, or policy controls will need to weigh the NGINX Plus subscription.

Key features

The controller load balances WebSocket, gRPC, TCP, and UDP applications, with content-based routing and TLS/SSL termination. Annotations and ConfigMaps let operators configure additional NGINX behavior, while canary routing, TLS automation, and rate limiting support common ingress needs. That breadth makes it a flexible fit for Kubernetes environments, though it assumes a cluster and familiarity with NGINX configuration.

Policy resources cover access control, API keys, authentication, mutual TLS, web application firewall rules, CORS, and HSTS. Some policies require NGINX Plus, so teams should confirm that the controls they plan to use fit their chosen tier. Plus also adds real-time metrics, more load-balancing methods, session persistence, active health checks, and JWT validation—useful operational and security additions for deployments that need them.

Metrics can be exposed in Prometheus format, including through a ServiceMonitor with Prometheus Operator. Documented integrations include F5 WAF for NGINX, F5 DoS for NGINX, F5 BIG-IP, cert-manager, ExternalDNS, Istio, Linkerd, and Open Service Mesh. Manifest installation supports Deployment, DaemonSet, or StatefulSet modes, giving teams choices for how to run the controller.

Security setup deserves attention: the default ServiceAccount can access every Secret in the cluster. F5 documents least-privilege RBAC and recommends encrypting Secrets at rest; it also recommends a read-only root filesystem, which is not enabled by default. NGINX Plus uses JWT credentials for subscription validation and reports usage telemetry by default hourly and when NGINX reloads.

Pricing

NGINX Ingress Controller with NGINX Open Source: free. It requires a Kubernetes cluster and uses NGINX Open Source. This is the practical starting point for teams that need ingress, routing, and TLS capabilities without a paid subscription.

NGINX Plus Ingress Controller: custom pricing. An NGINX Ingress Controller subscription is required, as are JWT or certificate credentials for registry access. This tier is for teams that need Plus features such as real-time metrics, active health checks, session persistence, or JWT validation; the subscription requirement and telemetry are material operational considerations.

Platforms

NGINX Ingress Controller is self-hosted and requires Kubernetes. It is a fit for teams operating their own cluster, not for readers looking for a hosted ingress service.

Who it's for

Choose it if your team already runs Kubernetes and wants one controller for WebSocket, gRPC, TCP, and UDP traffic, with configurable NGINX behavior and a path from the free edition to Plus features. It is less suitable when you cannot manage cluster-level Secret permissions carefully or need Plus capabilities without taking on a subscription.

Pros and cons

• Pros: Protocol coverage spans WebSocket, gRPC, TCP, and UDP, so one controller can handle varied application traffic.
• Pros: Annotations and ConfigMaps expose additional NGINX configuration, while canary routing and TLS automation cover useful ingress workflows.
• Pros: Prometheus-format metrics and integrations with cert-manager, ExternalDNS, and service-mesh projects fit established Kubernetes operations.
• Cons: Kubernetes is required, and the default ServiceAccount can access all cluster Secrets unless operators apply least-privilege RBAC.
• Cons: Several advanced features and policies depend on NGINX Plus, which requires a subscription and reports usage telemetry by default.
• Cons: A read-only root filesystem is recommended for reducing attack surface but is not enabled by default, adding a security configuration task.

Alternatives

For a broader set of Kubernetes Ingress Controllers, compare options against your cluster and policy requirements. Airlock Microgateway has a free Community Edition for small environments or local development, with throughput enforcement and six-month license validity. ngrok offers a free plan with included usage, up to three online endpoints, and up to 1 GB of data transfer. For an open-source gateway deployable as a binary, Docker container, or Kubernetes workload, consider agentgateway. BFE Ingress Controller is another free option under Apache 2.0 with no plan limits stated. Contour is a free, open-source Kubernetes ingress controller with community support. Envoy Gateway is a free open-source project. F5 BIG-IP Container Ingress Services is free software, but requires a compatible licensed BIG-IP system and AS3. HAProxy Ingress is a free self-hosted option that requires a Kubernetes cluster; version 0.16 requires Kubernetes 1.21 or newer.

Verdict

NGINX Ingress Controller is a strong choice for Kubernetes teams that want flexible, self-hosted traffic management across multiple protocols, with a free entry point and a Plus upgrade for deeper operational controls. Look elsewhere if the cluster requirement, Secret-access hardening, or subscription boundary around advanced features does not fit your team.