All products Terraform Kubernetes helm
tf-k8s-ingress-nginx

Deploys Ingress Nginx into a Kubernetes cluster via Helm.

Log in to Corewide IaC registry

Once you have a Corewide Solutions Portal account, this one-time action will use your browser session to retrieve credentials:

 shellterraform login solutions.corewide.com
Provision instructions

Initialize mandatory providers:

Copy and paste into your Terraform configuration and insert the variables:

 hclmodule "tf_k8s_ingress_nginx" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 6.2.0"

  # specify module inputs here or try one of the examples below
  ...
}

Initialize the setup:

 shellterraform init
Define update strategy

Corewide DevOps team strictly follows Semantic Versioning Specification to provide our clients with products that have predictable upgrades between versions. We recommend pinning patch versions of our modules using pessimistic constraint operator (~>) to prevent breaking changes during upgrades.

To get new features during the upgrades (without breaking compatibility), use ~> 6.2 and run terraform init -upgrade

For the safest setup, use strict pinning with version = "6.2.0"

Deploys Ingress Nginx into a Kubernetes cluster via Helm.

Deploy Ingress Nginx with cert-manager and required parameters only:

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 6.2"

  acme_email = "[email protected]"
}

Deploy Ingress Nginx with mandatory parameters and cert-manager's AWS Route53 integration for DNS-01 challenge. AWS Route53 RBAC configured with tf-k8s-cert-manager-dns-aws module and EKS cluster deployed with tf-aws-k8s-eks module:

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 6.2"

  acme_email = "[email protected]"

  cert_manager = {
    chart_version               = "1.21.0"
    dns_solver_config           = module.aws_cert_manager_iam.issuer_spec
    service_account_annotations = module.aws_cert_manager_iam.service_account_annotation
  }
}

module "eks" {
  source  = "solutions.corewide.com/aws/tf-aws-k8s-eks/aws"
  version = "~> 8.0"
  # ...
}

module "aws_cert_manager_iam" {
  source  = "solutions.corewide.com/aws/tf-k8s-cert-manager-dns-aws/aws"
  version = "~> 2.0"

  region            = "us-east-1"
  hosted_zone_id    = "FOO"
  oidc_provider_arn = module.eks.eks_identity_provider.arn
  oidc_provider_url = module.eks.eks_identity_provider.url
}

Deploy Ingress Nginx with mandatory parameters and cert-manager's Google Cloud DNS integration for DNS-01 challenge. Google Cloud DNS RBAC configured with tf-k8s-cert-manager-dns-gcp module:

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 6.2"

  acme_email = "[email protected]"

  cert_manager = {
    chart_version               = "1.21.0"
    dns_solver_config           = module.gcp_cert_manager_iam.issuer_spec
    service_account_annotations = module.gcp_cert_manager_iam.service_account_annotation
  }
}

module "gcp_cert_manager_iam" {
  source  = "solutions.corewide.com/google-cloud/tf-k8s-cert-manager-dns-gcp/google"
  version = "~> 2.0"
}

Deploy Ingress Nginx with mandatory parameters and cert-manager's Azure DNS integration for DNS-01 challenge. Azure DNS RBAC configured with tf-k8s-cert-manager-dns-azure module and AKS cluster deployed with tf-azure-k8s-aks module:

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 6.2"

  acme_email = "[email protected]"

  cert_manager = {
    chart_version          = "1.21.0"
    dns_solver_config      = module.azure_cert_manager_iam.issuer_spec
    pod_labels             = module.azure_cert_manager_iam.pod_label
    service_account_labels = module.azure_cert_manager_iam.service_account_label
  }
}

resource "azurerm_resource_group" "main" {
  name     = "foo"
  location = "westus2"
}

module "aks" {
  source  = "solutions.corewide.com/azure/tf-azure-k8s-aks/azurerm"
  version = "~> 5.2"
  # ...
}

module "azure_cert_manager_iam" {
  source  = "solutions.corewide.com/azure/tf-k8s-cert-manager-dns-azure/azurerm"
  version = "~> 1.0"

  resource_group_name = azurerm_resource_group.main.name
  region              = azurerm_resource_group.main.location
  hosted_zone_name    = "example.com"
  hosted_zone_id      = "/subscriptions/bar/dnsZones/example.com"
  subscription_id     = "bar"
  oidc_provider_url   = module.aks.cluster.oidc_issuer_url
}

Deploy Ingress Nginx with JSON log format enabled. If ingress_nginx.enable_json_log_format is enabled, Ingress Nginx will use the following JSON access log format (unless overridden using ingress_nginx.values_override):

 json{
  "msec": "$msec",                           // request unixtime in seconds with a milliseconds resolution
  "connection": "$connection",               // Connection serial number for current worker process
  "connection_requests": "$connection_requests", // Number of requests made over the current connection
  "pid": "$pid",                             // Process ID
  "request_id": "$request_id",               // Unique request ID
  "request_length": "$request_length",       // Length of the request in bytes including headers and body
  "remote_addr": "$remote_addr",             // Client IP address
  "remote_user": "$remote_user",             // Client user
  "remote_port": "$remote_port",             // Client port
  "time_local": "$time_local",               // Local time of the request in common log format
  "time_iso8601": "$time_iso8601",           // ISO8601-formatted request time
  "request": "$request",                     // Full HTTP request line (method, URI, protocol)
  "request_uri": "$request_uri",             // URI path with query string
  "args": "$args",                           // Query string parameters only (without path)
  "status": "$status",                       // HTTP response status code
  "body_bytes_sent": "$body_bytes_sent",     // Number of bytes sent in response body (no headers)
  "bytes_sent": "$bytes_sent",               // Total bytes sent (body + headers)
  "http_referer": "$http_referer",           // Referring URL
  "http_user_agent": "$http_user_agent",     // User-Agent string from client
  "http_x_forwarded_for": "$http_x_forwarded_for", // Original client IP from proxy/load balancer
  "http_host": "$http_host",                 // Host header sent by the client
  "server_name": "$server_name",             // Name of the server handling the request
  "request_time": "$request_time",           // Time spent processing the request (seconds with milliseconds)
  "upstream": "$upstream_addr",              // Upstream server address (IP:port)
  "upstream_connect_time": "$upstream_connect_time", // Time to connect to upstream server
  "upstream_header_time": "$upstream_header_time", // Time to receive first byte from upstream
  "upstream_response_time": "$upstream_response_time", // Total time taken by upstream to respond
  "upstream_response_length": "$upstream_response_length", // Length of upstream response
  "upstream_cache_status": "$upstream_cache_status", // Cache status (HIT, MISS, etc.)
  "ssl_protocol": "$ssl_protocol",           // TLS/SSL protocol version used
  "ssl_cipher": "$ssl_cipher",               // TLS/SSL cipher used
  "scheme": "$scheme",                       // Request scheme
  "request_method": "$request_method",       // HTTP method
  "server_protocol": "$server_protocol",     // Protocol version
  "pipe": "$pipe",                           // 'p' for pipelined requests, '.' otherwise
  "gzip_ratio": "$gzip_ratio",               // Gzip compression ratio
  "http_cf_ray": "$http_cf_ray"              // Cloudflare Ray ID (if Cloudflare is used)
}

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 6.2"

  acme_email = "[email protected]"

  ingress_nginx = {
    enable_json_log_format = true
  }
}

NOTE: Values of annotations and labels must always be passed as strings regardless of their actual type.

Deploy Ingress Nginx with custom configuration and cert-manager. Allows using configuration-snippet in Ingress annotations:

 hclmodule "ingress" {
  source  = "solutions.corewide.com/kubernetes/tf-k8s-ingress-nginx/helm"
  version = "~> 6.2"

  acme_email = "[email protected]"

  cert_manager = {
    chart_version = "1.21.0"
  }

  ingress_nginx = {
    name         = "ingress"
    namespace    = "ingress"
    replicas     = 3
    helm_timeout = 600

    values_override = {
      controller = {
        allowSnippetAnnotations = true

        config = {
          annotations-risk-level = "Critical"
        }
      }
    }
  }
}
Variable Description Type Default Required Sensitive
acme_email E-mail that Let's Encrypt cluster issuer will use to request certificates string yes no
k8s_flavor Name of managed Kubernetes to enable cloud-specific adjustments. Applicable values are: aks or eks string yes no
cert_manager cert-manager parameters. The parameters are passed to tf-k8s-cert-manager module any {} no no
ingress_nginx Ingress Nginx parameters object {} no no
ingress_nginx.chart_version Version of Ingress Nginx Helm chart (date based version tags - YYYY.MM.DD) string 2026.7.20 no no
ingress_nginx.create_namespace Indicates creation of dedicated namespace for Ingress Nginx deployment bool true no no
ingress_nginx.enable_json_log_format Enable JSON logging format for Ingress Nginx bool false no no
ingress_nginx.enable_metrics Enable Prometheus metrics of Ingress Nginx bool true no no
ingress_nginx.enable_real_ip_detection Enable/disable Ingress Nginx Real IP detection bool true no no
ingress_nginx.helm_timeout Time in seconds for Helm resource to install in Kubernetes number 600 no no
ingress_nginx.ingress_class_name Name of Ingress Class of Ingress Nginx string nginx no no
ingress_nginx.name Name to override Ingress Nginx release name string ingress-nginx no no
ingress_nginx.namespace Namespace to install Ingress Nginx into string ingress-nginx no no
ingress_nginx.replicas Number of Ingress Nginx controller replicas number 2 no no
ingress_nginx.values_override Custom values to override Ingress Nginx Helm chart defaults map(any) {} no no
ingress_nginx.version Version of Ingress Nginx Helm chart (Deprecated and will be deleted in v6.5) string no no
Output Description Type Sensitive
ingress_class Name of Ingress Class of Ingress Nginx attribute no
ingress_hostname Hostname of Ingress Nginx Load Balancer computed no
ingress_ip External IP of Ingress Nginx Load Balancer computed no
Dependency Version Kind
terraform >= 1.3 CLI
hashicorp/helm ~> 3.1 provider
hashicorp/kubernetes ~> 3.0 provider
tf-k8s-cert-manager ~> 2.1 module

These components are included as is under the terms of their corresponding licenses.

Component License
Ingress Nginx Controller Apache-2.0
cert-manager Apache-2.0

References

Not sure where to start?
Let's find your perfect match.