# Use Helm to Install NGINX Ingress Controller with NGINX Plus This page describes how to use Helm to install F5 NGINX Ingress Controller with NGINX Plus. It explains the requirements for NGINX Ingress Controller, creating secrets, how to obtain and install the Helm chart, and what custom resource definitions (CRDs) are installed during the process. By following these instructions, you will finish with a functional NGINX Ingress Controller instance for your Kubernetes cluster. ## Before you begin - An active NGINX Plus subscription (Purchased or trial) - A [supported Kubernetes version](/nic/technical-specifications.md#supported-kubernetes-versions) - A functional Kubernetes cluster - [Helm 3.19+.](https://helm.sh/docs/intro/install) Throughout this page, you will see placeholder values indicated with angular brackets, such as **\**. Replace them accordingly for your installation. ### Quickstart If you do not require extra guidance to understand the installation process or have customization requirements, here are the steps to install NGINX Ingress Controller. You will require your NGINX Plus license JWT to follow these steps: if you do not have it, the steps are explained in the [Download your JSON web token](#download-your-json-web-token) section. **Note:** These commands should be run in the same directory as your **license.jwt** file. Create a secret for the NGINX Plus license: ```shell kubectl create secret generic nplus-license --from-file license.jwt ``` Create a secret for the F5 registry: ```shell kubectl create secret docker-registry regcred \ --docker-server=private-registry.nginx.com \ --docker-username=$(cat license.jwt) \ --docker-password=none ``` Use Helm to install NGINX Ingress Controller with NGINX Plus: ```shell helm install oci://ghcr.io/nginx/charts/nginx-ingress \ --version \ --set controller.image.repository=private-registry.nginx.com/nginx-ic/nginx-plus-ingress \ --set controller.image.tag= \ --set controller.nginxplus=true \ --set controller.serviceAccount.imagePullSecretName=regcred \ --set controller.mgmt.licenseTokenSecretName=nplus-license ``` **Note:** The `edge` version **is not intended for production use**. It is intended for testing and development purposes only. If you'd like to test the latest changes in NGINX Ingress Controller before a new release, you can install the `edge` version, which is built from the `main` branch of the [NGINX Ingress Controller repository](https://github.com/nginx/kubernetes-ingress). You can install the `edge` version by specifying the `--version` flag with the value `0.0.0-edge`: ```shell helm install oci://ghcr.io/nginx/charts/nginx-ingress \ --version 0.0.0-edge \ --set controller.image.repository=private-registry.nginx.com/nginx-ic/nginx-plus-ingress \ --set controller.image.tag= \ --set controller.nginxplus=true \ --set controller.serviceAccount.imagePullSecretName=regcred \ --set controller.mgmt.licenseTokenSecretName=nplus-license ``` ## Download your JSON web token 1. Log in to [MyF5](https://my.f5.com/manage/s/). 1. Go to **My Products & Plans > Subscriptions** to see your active subscriptions. 1. Find your NGINX subscription, and select the **Subscription ID** for details. 1. Download the **JSON Web Token** file from the subscription page. ## Create license and registry secrets **Note:** The commands in the rest of this document should be run in the same directory as your **license.jwt** file. JWTs are sensitive information and should be stored securely. Delete them after use to prevent unauthorized access. Once you have obtained your license JWT, create a Kubernetes secret using `kubectl create`: ```shell kubectl create secret generic nplus-license --from-file license.jwt ``` #### Example output ```text secret/nplus-license created ``` Then create another Kubernetes secret to allow interactions with the F5 registry: ```shell kubectl create secret docker-registry regcred \ --docker-server=private-registry.nginx.com \ --docker-username=$(cat license.jwt) \ --docker-password=none ``` #### Example output ```text secret/regcred created ``` ## Install the Helm chart You have two options for installing the Helm chart: directly from the F5 registry, or using the source. ### F5 Registry To install NGINX Ingress Controller using the F5 registry, run this command with your release name: ``` helm install oci://ghcr.io/nginx/charts/nginx-ingress \ --version \ --set controller.image.repository=private-registry.nginx.com/nginx-ic/nginx-plus-ingress \ --set controller.image.tag= \ --set controller.nginxplus=true \ --set controller.serviceAccount.imagePullSecretName=regcred \ --set controller.mgmt.licenseTokenSecretName=nplus-license ``` #### Example output ```text Pulled: ghcr.io/nginx/charts/nginx-ingress: Digest: sha256:bb452d593c31b6be39f459f9604882e170227429821bac01e7ddd7da16d91ba1 NAME: h4-plus-registry LAST DEPLOYED: Fri Nov 28 14:47:15 2025 NAMESPACE: default STATUS: deployed REVISION: 1 DESCRIPTION: Install complete TEST SUITE: None NOTES: NGINX Ingress Controller has been installed. For release notes for this version please see: https://docs.nginx.com/nginx-ingress-controller/releases/ Installation and upgrade instructions: https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/installation-with-helm/ ``` ### From source To install NGINX Ingress Controller from source, first pull the chart by running this command: ```shell helm pull oci://ghcr.io/nginx/charts/nginx-ingress --untar --version ``` #### Example output ```text Pulled: ghcr.io/nginx/charts/nginx-ingress: Digest: sha256:bb452d593c31b6be39f459f9604882e170227429821bac01e7ddd7da16d91ba1 ``` Then use the `cd` command to change your working directory to _nginx-ingress_: ```shell cd nginx-ingress ``` Finally, install the chart with your release name with `helm install`: ```shell helm install . --set controller.image.repository=private-registry.nginx.com/nginx-ic/nginx-plus-ingress --set controller.nginxplus=true ``` #### Example output ```text NAME: h4-plus-source LAST DEPLOYED: Fri Nov 28 14:49:14 2025 NAMESPACE: default STATUS: deployed REVISION: 1 DESCRIPTION: Install complete TEST SUITE: None NOTES: NGINX Ingress Controller has been installed. For release notes for this version please see: https://docs.nginx.com/nginx-ingress-controller/releases/ Installation and upgrade instructions: https://docs.nginx.com/nginx-ingress-controller/installation/installing-nic/installation-with-helm/ ``` ## Verify the deployment To verify that NGINX Ingress Controller has been installed correctly, you can review `ingressclasses` with `kubectl get`: ```shell kubectl get ingressclasses ``` #### Example output ```text NAME CONTROLLER PARAMETERS AGE nginx nginx.org/ingress-controller 33s ``` ## Custom Resource Definitions When installing the chart, Helm will install the required CRDs. Without them, NGINX Ingress Controller pods will not become _Ready_. If you do not use the custom resources that require those CRDs, add the parameter `--skip-crds` in your `helm install` command. The following chart parameters should be set to `false`: - `controller.enableCustomResources` - `controller.appprotect.enable` - `controller.appprotectdos.enable` ## Next steps - [NGINX Ingress Controller Helm chart parameters](/nic/install/helm/parameters.md) - [Security recommendations](/nic/configuration/security.md) - [Basic configuration](/nic/configuration/ingress-resources/basic-configuration.md) - [Extensibility with NGINX Plus](/nic/overview/nginx-plus.md)