Skip to content
SPECIFICTION
Get listed

NGINX Ingress Controller

docs.nginx.com

Free plan Self-hosted
Visit docs.nginx.com
Spec score 7.1 #21 of 28 in Kubernetes Ingress Controllers

What it is

NGINX Ingress Controller is a self-hosted Kubernetes Ingress Controller for load balancing WebSocket, gRPC, TCP, and UDP applications. It provides content-based routing and TLS/SSL termination, with further NGINX settings exposed through annotations and ConfigMaps. Manifest installation can use Deployment, DaemonSet, or StatefulSet modes. Policy resources cover access control, rate limiting, API keys, authentication, mutual TLS, WAF, CORS, and HSTS, although some require NGINX Plus. The controller can expose NGINX and controller metrics in Prometheus format, including a ServiceMonitor with Prometheus Operator. Documented integrations include cert-manager, ExternalDNS, Prometheus, Istio, Linkerd, Open Service Mesh, and F5 products. The free NGINX Open Source plan costs nothing and requires a Kubernetes cluster. NGINX Plus requires a subscription and registry credentials, and adds metrics, balancing methods, persistence, health checks, and JWT validation.

Spec sheet

Purpose
NGINX Ingress Controller is a Kubernetes Ingress Controller that load balances WebSocket, gRPC, TCP, and UDP applications.Read 30 Sep 2026 · docs.nginx.com
Integrations
Documented integrations include F5 WAF for NGINX, F5 DoS for NGINX, F5 BIG-IP, cert-manager, ExternalDNS, Prometheus, Istio, Linkerd, and Open Service Mesh.Read 30 Sep 2026 · docs.nginx.com
Support
Technical support applies to provider-supported Kubernetes platforms that pass Kubernetes conformance tests; F5 customer support covers the latest controller version and versions released within two years of the current release.Read 30 Sep 2026 · docs.nginx.com
Maker
F5 lists its headquarters as Seattle, Washington, and its founding year as 1996.Read 30 Sep 2026 · f5.com
Deployment choices
Manifest installation supports Deployment, DaemonSet, or StatefulSet deployment modes.Read 30 Sep 2026 · docs.nginx.com
NGINX Plus features
NGINX Plus adds real-time metrics, additional load-balancing methods, session persistence options, active health checks, and JWT validation.Read 30 Sep 2026 · docs.nginx.com
Plus licensing telemetry
NGINX Plus requires a JWT for subscription validation and reports usage telemetry by default every hour and when NGINX is reloaded.Read 30 Sep 2026 · docs.nginx.com
Prometheus
The controller can expose NGINX and controller metrics in Prometheus format, including through a ServiceMonitor when using Prometheus Operator.Read 30 Sep 2026 · docs.nginx.com
Read-only filesystem
A read-only root filesystem is recommended to reduce attack surface but is not enabled by default.Read 30 Sep 2026 · docs.nginx.com
Release support
The maker says each annual Long-Term Support release is supported for up to three years and receives security and stability bug fixes.Read 30 Sep 2026 · docs.nginx.com
Routing and TLS
It supports content-based routing and TLS/SSL termination, with additional NGINX features configurable through annotations and ConfigMaps.Read 30 Sep 2026 · docs.nginx.com
Security guidance
The maker recommends encrypting Kubernetes Secrets at rest and documents least-privilege RBAC, while noting the default ServiceAccount can access all Secrets in the cluster.Read 30 Sep 2026 · docs.nginx.com
Security policies
Policy resources include access control, rate limiting, API keys, authentication, mTLS, WAF, CORS, and HSTS options, with some policies requiring NGINX Plus.Read 30 Sep 2026 · docs.nginx.com

Plans and prices

NGINX Ingress Controller with NGINX Open Source Free Kubernetes cluster required · uses NGINX Open Source Read 30 Sep 2026 · docs.nginx.com
NGINX Plus Ingress Controller Priced on request NGINX Ingress Controller subscription required · JWT or certificate credentials required for registry access Read 30 Sep 2026 · docs.nginx.com

Every NGINX Ingress Controller plan and price →

Strong points and limits

Strong points

  • Balances WebSocket, gRPC, TCP, and UDP applications
  • Deployment, DaemonSet, or StatefulSet installation
  • Prometheus-format metrics exposure
  • Broad policy resource coverage
  • Free NGINX Open Source plan

Limits

  • Free plan requires a Kubernetes cluster
  • Some policies require NGINX Plus
  • Default ServiceAccount can access all cluster Secrets

Who it suits

It suits Kubernetes operators needing self-hosted ingress, routing, TLS termination, and policy controls. Teams considering Plus should account for its subscription and credential requirements.

Verdict

NGINX Ingress Controller covers core Kubernetes ingress, routing, observability, and security-policy needs in a self-hosted model. The main boundary is that several advanced capabilities depend on NGINX Plus, while the free option uses NGINX Open Source.

Where Specifiction places it

Alternatives to NGINX Ingress ControllerAll alternatives →