Migrate from ingress-nginx to the ngrok Kubernetes Operator

kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx

​

What you’ll need

• An ngrok account on the Pay-as-you-go plan, which you need to bring your own domain.
• A cluster where ingress-nginx serves at least one Ingress for a domain you control.
• Access to your domain’s DNS records.
• kubectl and Helm 3.0.0 or later.

helm repo add ngrok https://charts.ngrok.com
helm repo update

export NGROK_AUTHTOKEN=your copied auth token goes here
export NGROK_API_KEY=your copied api key goes here

$env:NGROK_AUTHTOKEN = "your copied auth token goes here"
$env:NGROK_API_KEY   = "your copied api key goes here"

helm install ngrok-operator ngrok/ngrok-operator \
--namespace ngrok-operator \
--create-namespace \
--set credentials.apiKey=$NGROK_API_KEY \
--set credentials.authtoken=$NGROK_AUTHTOKEN

export ENCODED_NGROK_AUTHTOKEN=$(echo -n "$NGROK_AUTHTOKEN" | base64)
export ENCODED_NGROK_API_KEY=$(echo -n "$NGROK_API_KEY" | base64)

kubectl create namespace ngrok-operator
kubectl apply -f -<<EOF
apiVersion: v1
kind: Secret
metadata:
  name: ngrok-operator-credentials
  namespace: ngrok-operator
data:
  API_KEY: "$ENCODED_NGROK_API_KEY"
  AUTHTOKEN: "$ENCODED_NGROK_AUTHTOKEN"
EOF

helm install ngrok-operator ngrok/ngrok-operator \
--namespace ngrok-operator \
--create-namespace \
--set credentials.secret.name=ngrok-operator-credentials

kubectl get secret $TLS_SECRET -n $NAMESPACE -o jsonpath='{.data.tls\.crt}' | base64 -d > tls.crt
kubectl get secret $TLS_SECRET -n $NAMESPACE -o jsonpath='{.data.tls\.key}' | base64 -d > tls.key

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app-ngrok
  namespace: default
spec:
  ingressClassName: ngrok
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-app
                port:
                  number: 80

kubectl apply -f ngrok-ingress.yaml
kubectl get ingress my-app-ngrok -n default

curl --connect-to app.example.com:443:$CNAME_TARGET:443 https://app.example.com/

kubectl delete ingress my-app -n default

​

Map ingress-nginx annotations to ngrok

​

Example: IP allowlist and rate limit

metadata:
  annotations:
    nginx.ingress.kubernetes.io/whitelist-source-range: "203.0.113.0/24"
    nginx.ingress.kubernetes.io/limit-rpm: "60"

apiVersion: ngrok.k8s.ngrok.com/v1alpha1
kind: NgrokTrafficPolicy
metadata:
  name: my-app-policy
  namespace: default
spec:
  policy:
    on_tcp_connect:
      - actions:
          - type: restrict-ips
            config:
              enforce: true
              allow:
                - 203.0.113.0/24
    on_http_request:
      - actions:
          - type: rate-limit
            config:
              name: 60 requests per minute per client
              algorithm: sliding_window
              capacity: 60
              rate: 60s
              bucket_key:
                - conn.client_ip
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app-ngrok
  namespace: default
  annotations:
    ngrok.com/traffic-policy: my-app-policy
spec:
  ingressClassName: ngrok
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: my-app
                port:
                  number: 80

​

Use Gateway API instead

1. Set gatewayClassName: ngrok on each Gateway. ingress2gateway names the class after your old ingress class.
2. Change each Gateway listener to protocol: HTTPS and port: 443. ingress2gateway writes HTTP listeners on port 80, and the Operator creates only an http:// endpoint for them, so HTTPS requests fail with ERR_NGROK_3200. Leave the port in each HTTPRoute’s backendRefs unchanged, because it’s your Service’s port.
3. Replace each RegularExpression path match with a PathPrefix or Exact match. ingress2gateway writes matches such as (?i)/.* for an Ingress that uses rewrite-target or use-regex. The Operator doesn’t support regular expression matches and compares the value as a literal path prefix, so those routes return 404.

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-app
  namespace: default
spec:
  gatewayClassName: ngrok
  listeners:
    - name: app-example-com
      hostname: app.example.com
      protocol: HTTPS
      port: 443
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-app
  namespace: default
spec:
  parentRefs:
    - name: my-app
  hostnames:
    - app.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: my-app
          port: 80