/usr/bin/nginx-ingress

NGINX Ingress Controller Version=5.7.1 Commit=eccb6b82f0d2b0537fa449e5f2c583cd99f1f2d8 Date=2026-11-03T15:02:33Z DirtyState=false Arch=linux/amd64 Go=go1.27.3
Usage of /usr/bin/nginx-ingress:
  -agent
    	Enable NGINX Agent
  -agent-instance-group string
    	Grouping used to associate NGINX Ingress Controller instances (default "nginx-ingress-controller")
  -allow-empty-ingress-host
    	Allows Ingress resources to omit the host field. If multiple Ingress resources without a host conflict,
    		NGINX Ingress Controller resolves the collision using the winner selection algorithm. To use multiple
    		Ingress resources without a host across namespaces without conflict, use mergeable Ingress. To configure
    		TLS, use -default-server-tls-secret. To configure listener ports, use -default-http-listener-port or
    		-default-https-listener-port. Default is false.
  -app-protect-dos-debug
    	Enable debugging for App Protect Dos. Requires -nginx-plus and -enable-app-protect-dos.
  -app-protect-dos-max-daemons int
    	Max number of ADMD instances. Requires -nginx-plus and -enable-app-protect-dos.
  -app-protect-dos-max-workers int
    	Max number of nginx processes to support. Requires -nginx-plus and -enable-app-protect-dos.
  -app-protect-dos-memory int
    	RAM memory size to consume in MB. Requires -nginx-plus and -enable-app-protect-dos.
  -app-protect-enforcer-address string
    	Sets address for App Protect v5 Enforcer. Requires -nginx-plus and -enable-app-protect. (default "127.0.0.1:50000")
  -app-protect-log-level string
    	Sets log level for App Protect. Allowed values: fatal, error, warn, info, debug, trace. Requires -nginx-plus and -enable-app-protect. (default "fatal")
  -default-http-listener-port default_server
    	Sets a custom port for the HTTP NGINX default_server. [1024 - 65535] (default 80)
  -default-https-listener-port default_server
    	Sets a custom port for the HTTPS default_server. [1024 - 65535] (default 443)
  -default-server-tls-secret string
    	A Secret with a TLS certificate and key for TLS termination of the default server. Format: <namespace>/<name>.
    		If not set, than the certificate and key in the file "/etc/nginx/secrets/default" are used.
    		If "/etc/nginx/secrets/default" doesn't exist, the Ingress Controller will configure NGINX to reject TLS connections to the default server.
    		If a secret is set, but the Ingress Controller is not able to fetch it from Kubernetes API or it is not set and the Ingress Controller
    		fails to read the file "/etc/nginx/secrets/default", the Ingress Controller will fail to start.
  -disable-ipv6
    	Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack
  -enable-app-protect
    	Enable support for NGINX App Protect. Requires -nginx-plus.
  -enable-app-protect-dos
    	Enable support for NGINX App Protect dos. Requires -nginx-plus.
  -enable-app-protect-ip-intelligence
    	Enable App Protect IP Intelligence. Requires -nginx-plus and -enable-app-protect.
  -enable-cert-manager
    	Enable cert-manager controller for VirtualServer resources. Requires -enable-custom-resources
  -enable-config-safety
    	Enable config validation prior to reloading NGINX.
  -enable-custom-resources
    	Enable custom resources (default true)
  -enable-directive-autoadjust
    	Enable automatic adjustment of NGINX directives to avoid conflicting NGINX configuration. Results may vary and might not be ideal in all cases.
  -enable-external-dns
    	Enable external-dns controller for VirtualServer resources. Requires -enable-custom-resources
  -enable-latency-metrics
    	Enable collection of latency metrics for upstreams. Requires -enable-prometheus-metrics
  -enable-leader-election
    	Enable Leader election to avoid multiple replicas of the controller reporting the status of Ingress, VirtualServer and VirtualServerRoute resources -- only one replica will report status (default true). See -report-ingress-status flag. (default true)
  -enable-oidc
    	Enable OIDC Policies.
  -enable-prometheus-metrics
    	Enable exposing NGINX or NGINX Plus metrics in the Prometheus format
  -enable-service-insight
    	Enable service insight for external load balancers. Requires -nginx-plus
  -enable-snippets
    	Enable custom NGINX configuration snippets in Ingress, VirtualServer, VirtualServerRoute and TransportServer resources.
  -enable-telemetry-reporting
    	Enable gathering and reporting of product related telemetry. (default true)
  -enable-tls-passthrough
    	Enable TLS Passthrough on default port 443. Requires -enable-custom-resources
  -enable-topology-aware-routing
    	Honor EndpointSlice topology hints (set by Service spec.trafficDistribution or the service.kubernetes.io/topology-mode annotation) when selecting upstream endpoints, preferring endpoints on the same node or in the same zone as the Ingress Controller pod.
    			Spread Ingress Controller replicas across zones in proportion to client traffic, as each replica only routes to its own node or zone.
    			The zone is read from the topology.kubernetes.io/zone label of the pod's node at startup; restart the Ingress Controller if that label changes.
  -external-service string
    	Specifies the name of the service with the type LoadBalancer through which the Ingress Controller pods are exposed externally.
    		The external address of the service is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources. For Ingress resources only: Requires -report-ingress-status.
  -global-configuration string
    	The namespace/name of the GlobalConfiguration resource for global configuration of the Ingress Controller. Requires -enable-custom-resources. Format: <namespace>/<name>
  -health-status
    	Add a location based on the value of health-status-uri to the default server. The location responds with the 200 status code for any request.
    		Useful for external health-checking of the Ingress Controller
  -health-status-uri string
    	Sets the URI of health status location in the default server. Requires -health-status (default "/nginx-health")
  -ingress-class string
    	A class of the Ingress Controller.

    		An IngressClass resource with the name equal to the class must be deployed. Otherwise, the Ingress Controller will fail to start.
    		The Ingress Controller only processes resources that belong to its class - i.e. have the "ingressClassName" field resource equal to the class.

    		The Ingress Controller processes all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the "ingressClassName" field for all versions of kubernetes. (default "nginx")
  -ingress-template-path string
    	Path to the ingress NGINX configuration template for an ingress resource.
    		(default for NGINX "nginx.ingress.tmpl"; default for NGINX Plus "nginx-plus.ingress.tmpl")
  -ingresslink string
    	Specifies the name of the IngressLink resource, which exposes the Ingress Controller pods via a BIG-IP system.
    		The IP of the BIG-IP system is used when reporting the status of Ingress, VirtualServer and VirtualServerRoute resources. For Ingress resources only: Requires -report-ingress-status.
  -latency-metrics-buckets string
    	Comma-separated list of buckets in milliseconds, in strictly ascending order, for the upstream_server_response_latency_ms histogram, e.g. "5,10,25,50,100,250,500,1000". Requires -enable-latency-metrics. When not set, a default set of buckets is used. Reducing the number of buckets lowers the metric's time-series cardinality.
  -leader-election-lock-name string
    	Specifies the name of the ConfigMap, within the same namespace as the controller, used as the lock for leader election. Requires -enable-leader-election. (default "nginx-ingress-leader-election")
  -log-format string
    	Set log format to either glog, text, or json. (default "glog")
  -log-level string
    	Sets log level for Ingress Controller. Allowed values: fatal, error, warning, info, debug, trace. (default "info")
  -main-template-path string
    	Path to the main NGINX configuration template. (default for NGINX "nginx.tmpl"; default for NGINX Plus "nginx-plus.tmpl")
  -mgmt-configmap string
    	A ConfigMap resource for customizing NGINX configuration. If a ConfigMap is set,
    		but the Ingress Controller is not able to fetch it from Kubernetes API, the Ingress Controller will fail to start.
    		Format: <namespace>/<name>
  -nginx-configmaps string
    	A ConfigMap resource for customizing NGINX configuration. If a ConfigMap is set,
    		but the Ingress Controller is not able to fetch it from Kubernetes API, the Ingress Controller will fail to start.
    		Format: <namespace>/<name>
  -nginx-debug
    	Enable debugging for NGINX. Uses the nginx-debug binary. Requires 'error-log-level: debug' in the ConfigMap.
  -nginx-plus
    	Enable support for NGINX Plus
  -nginx-reload-timeout int
    	The timeout in milliseconds which the Ingress Controller will wait for a successful NGINX reload after a change or at the initial start. (default 60000) (default 60000)
  -nginx-status
    	Enable the NGINX stub_status, or the NGINX Plus API. (default true)
  -nginx-status-allow-cidrs string
    	Add IP/CIDR blocks to the allow list for NGINX stub_status or the NGINX Plus API. Separate multiple IP/CIDR by commas. (default "127.0.0.1,::1")
  -nginx-status-port int
    	Set the port where the NGINX stub_status or the NGINX Plus API is exposed. [1024 - 65535] (default 8080)
  -plm-storage-ca-secret string
    	Kubernetes Secret containing a ca.crt for verifying the PLM SeaweedFS server
    	certificate. Format: namespace/name. Optional. Requires -plm-storage-url.
  -plm-storage-client-ssl-secret string
    	Kubernetes Secret containing tls.crt and tls.key for mTLS to the PLM SeaweedFS
    	filer. Format: namespace/name. Optional. Requires -plm-storage-url.
  -plm-storage-credentials-secret string
    	Kubernetes Secret holding the S3 admin key for the PLM SeaweedFS filer under the
    	seaweedfs_admin_secret key. Format: namespace/name. Requires -plm-storage-url.
  -plm-storage-insecure-skip-verify
    	Disable TLS verification of the PLM SeaweedFS server certificate. For dev/test only.
    	NIC prints a startup warning when set. Requires -plm-storage-url.
  -plm-storage-url string
    	SeaweedFS S3 endpoint URL for the F5 WAF Policy Controller (PLM). When non-empty,
    	enables the PLM integration: NIC watches the appprotect.f5.com/v1 CRDs installed by the PLM
    	Helm chart instead of the legacy v1beta1 CRDs. Empty (default) disables PLM.
    	Must be http:// or https://. Requires -nginx-plus and -enable-app-protect.
  -prometheus-metrics-listen-port int
    	Set the port where the Prometheus metrics are exposed. [1024 - 65535] (default 9113)
  -prometheus-tls-secret string
    	A Secret with a TLS certificate and key for TLS termination of the prometheus endpoint.
  -proxy string
    	Use a proxy server to connect to Kubernetes API started by "kubectl proxy" command. For testing purposes only.
    		The Ingress Controller does not start NGINX and does not write any generated NGINX configuration files to disk
  -ready-status
    	Enables the readiness endpoint '/nginx-ready'. The endpoint returns a success code when NGINX has loaded all the config after the startup (default true)
  -ready-status-port int
    	Set the port where the readiness endpoint is exposed. [1024 - 65535] (default 8081)
  -report-ingress-status
    	Updates the address field in the status of Ingress resources. Requires the -external-service or -ingresslink flag, or the 'external-status-address' key in the ConfigMap.
  -service-insight-listen-port int
    	Set the port where the Service Insight stats are exposed. Requires -nginx-plus. [1024 - 65535] (default 9114)
  -service-insight-tls-secret string
    	A Secret with a TLS certificate and key for TLS termination of the service insight.
  -ssl-dynamic-reload
    	Enable reloading of SSL Certificates without restarting the NGINX process. (default true)
  -tls-passthrough-port int
    	Set custom port for TLS Passthrough. [1024 - 65535] (default 443)
  -transportserver-template-path string
    	Path to the TransportServer NGINX configuration template for a TransportServer resource.
    		(default for NGINX "nginx.transportserver.tmpl"; default for NGINX Plus "nginx-plus.transportserver.tmpl")
  -version
    	Print the version, git-commit hash and build date and exit
  -virtualserver-template-path string
    	Path to the VirtualServer NGINX configuration template for a VirtualServer resource.
    		(default for NGINX "nginx.virtualserver.tmpl"; default for NGINX Plus "nginx-plus.virtualserver.tmpl")
  -watch-namespace string
    	Comma separated list of namespaces the Ingress Controller should watch for resources. By default the Ingress Controller watches all namespaces. Mutually exclusive with "watch-namespace-label".
  -watch-namespace-label string
    	Configures the Ingress Controller to watch only those namespaces with label foo=bar. By default the Ingress Controller watches all namespaces. Mutually exclusive with "watch-namespace".
  -watch-secret-namespace string
    	Comma separated list of namespaces the Ingress Controller should watch for secrets. If this arg is not configured, the Ingress Controller watches the same namespaces for all resources. See "watch-namespace" and "watch-namespace-label".
  -weight-changes-dynamic-reload
    	Enable changing weights of split clients without reloading NGINX. Requires -nginx-plus
  -wildcard-tls-secret string
    	A Secret with a TLS certificate and key for TLS termination of every Ingress/VirtualServer host for which TLS termination is enabled but the Secret is not specified.
    			Format: <namespace>/<name>. If the argument is not set, for such Ingress/VirtualServer hosts NGINX will break any attempt to establish a TLS connection.
    			If the argument is set, but the Ingress Controller is not able to fetch the Secret from Kubernetes API, the Ingress Controller will fail to start.