Upgrading Nginx Ingress Controller

You must upgrade the Nginx Ingress Controller (nginx-ingress-controller) based on your Kubernetes and OpenShift versions.
The certified versions of NGINX Ingress Controller with the Kubernetes and OpenShift orchestration platform is as follows:

Nginx Ingress Controller version

Supported Kubernetes version

OpenShift version

1.7.0

1.24 or 1.25

4.11 or 4.12

1.8.1

1.26

4.13

1.9.3

1.27

4.13

Use the information in this section to upgrade the Nginx Ingress controller from version:

Important

You might experience downtime while upgrading nginx-ingress-controller to version 1.8.1.

Related topics

Preparing-for-upgrade

Best practice
Run the following command to check the version of nginx-ingress-controller:

# kubectl -n ingress-nginx get ds -o yaml | grep -i image:

Sample output:

image: k8s.gcr.io/ingress-nginx/controller:v1.2.0@sha256:d8196e3bc1e72547c5dec66d6556c0ff92a23f6d0919b206be170bc90d5f9185

To upgrade the Nginx Ingress Controller

  1. To get the ingress class used for the NGINX Ingress Controller, run the following command:

    kubectl get ds -n ingress-nginx -o yaml | grep -i "\-\-ingress-class"

    Look for --ingress-class in the command output.
    Example: --ingress-class=nginx

  2. Based on the version of your Kubernetes or OpenShift, run the following commands to get the deploy.yaml file for the NGINX Ingress Controller

    $ wget https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.8.1/deploy/static/provider/cloud/deploy.yaml
  3. Make sure that the ingress-class (that you verified in step 1) is mentioned in the deploy.yaml file.

  4. Run the following command to delete the jobs (ingress-nginx-admission-create and ingress-nginx-admission-patch):

    kubectl delete job ingress-nginx-admission-create ingress-nginx-admission-patch -n ingress-nginx --ignore-not-found=true

    Important

    Ignore the errors or warnings if the ingress-nginx-admission-create and ingress-nginx-admission-patch jobs are not present. 

  5. Make the following changes in the deploy.yaml file:

    1. Change the kind field of the ingress-nginx-controller from Deployment to DaemonSet

      apiVersion: apps/v1
      kind: DaemonSet
      metadata:
        labels:
          app.kubernetes.io/component: controller
          app.kubernetes.io/instance: ingress-nginx
          app.kubernetes.io/name: ingress-nginx
          app.kubernetes.io/part-of: ingress-nginx
          app.kubernetes.io/version: 1.9.3
        name: ingress-nginx-controller
       namespace: ingress-nginx


    2. Change the spec.strategy field to spec.updateStrategy

      spec:
        minReadySeconds: 0
        revisionHistoryLimit: 10
        selector:
          matchLabels:
            app.kubernetes.io/component: controller
            app.kubernetes.io/instance: ingress-nginx
            app.kubernetes.io/name: ingress-nginx
        updateStrategy:
          rollingUpdate:
            maxUnavailable: 1
          type: RollingUpdate


    3. In the args section, set the default certificate to my-tls-secret:

      spec:
            containers:
           - args:
             - /nginx-ingress-controller
             - --publish-service=$(POD_NAMESPACE)/ingress-nginx-controller
             - --election-id=ingress-controller-leader
             - --controller-class=k8s.io/ingress-nginx
             - --ingress-class=nginx
             - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
             - --validating-webhook=:8443
             - --validating-webhook-certificate=/usr/local/certificates/cert
             - --validating-webhook-key=/usr/local/certificates/key
             - --default-ssl-certificate=ingress-nginx/my-tls-secret           # <<<<<<<<<<<<<<

  6. Run the following command to apply the deploy.yaml:

    kubectl apply -f deploy.yaml


  7. Run the following command to verify that the Nginx Ingress Controller pods are running on all worker nodes:

    kubectl -n ingress-nginx get pods

  8. Run the command to verify the version of the Nginx Ingress Controller from one of the pod logs:

    kubectl logs <ingress controller pod> -n ingress-nginx | less

    Where -n ingress-nginx is the ingress namespace.

    The version of the Nginx Ingress Controller must be 1.8.1.

  9. Run the command to make sure that the same ports of the Nginx Ingress Controller service are configured in the load balancer:

    kubectl -n ingress-nginx get service

Performing post upgrade task

Important

Perform this step if you are upgrading the NGINX Ingress Controller to version 1.9.3 and later.

  1. In the ingress-nginx namespace, open the nginx-configuration configmap and review the value of allow-snippet-annotations configuration parameter.
  2. If the value of allow-snippet-annotations is false, set it to true:
    allow-snippet-annotations: "true".

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*