Ingress-specific policy behavior

Ingress resources support Policy resources, but with some differences from VirtualServer and VirtualServerRoute resources. Review the following behavior before you attach a policy to an Ingress.

Ingress doesn’t support every policy type

Ingress policy support is narrower than VirtualServer support. If you need route-level control for features like JWT, OIDC (NJS), cache, or rate limiting, use VirtualServer and VirtualServerRoute instead.

WAF on Ingress must use "nginx.com/policies"

WAF is a Plus-only feature. When you use a WAF policy with Ingress, reference it through:

metadata:
  annotations:
    nginx.com/policies: waf-policy

Don’t attach WAF to Ingress with nginx.org/policies.

Important

On Ingress, nginx.org/policies and nginx.com/policies aren’t interchangeable. Reference WAF policies only through nginx.com/policies.

Egress mTLS on Ingress only configures TLS parameters

egressMTLS defines how NGINX authenticates to the upstream and verifies the upstream certificate. It doesn’t switch the upstream transport from plain HTTP to HTTPS.

For Ingress, you still need the upstream connection itself to use TLS. Common ways to do this include:

• nginx.org/ssl-services for HTTPS upstreams
• nginx.org/grpc-services for gRPC upstreams

For example:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: webapp-ingress
  annotations:
    nginx.org/policies: egress-mtls-policy
    nginx.org/ssl-services: "secure-app"
spec:
  ingressClassName: nginx
  rules:
  - host: webapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: secure-app
            port:
              number: 8443

Without upstream TLS, the egress mTLS policy has TLS settings but no TLS connection to apply them to. NGINX then typically sends plain HTTP to an HTTPS upstream port.

For Ingress, egressMTLS configures how NGINX uses TLS when connecting to the upstream. It doesn’t decide whether the upstream connection uses TLS. Configure that separately, for example with nginx.org/ssl-services or nginx.org/grpc-services.

Mergeable Ingress behavior

For mergeable Ingress:

• Policies on the master apply to inherited minion configuration.
• Policies on the minion override policies of the same type from the master.

This matches the general expectation that a more specific resource overrides a broader one.

For egressMTLS, there is one extra detail:

• The master or standard Ingress policy applies at server scope.
• The minion override applies at location scope, so the minion can replace the value set by the master.

What’s next

Learn about policy precedence and override rules.