Allow default_server listeners to be customised

charts/nginx-ingress/templates/controller-daemonset.yaml

@@ -237,6 +237,7 @@ spec:
           - -enable-cert-manager={{ .Values.controller.enableCertManager }}
           - -enable-oidc={{ .Values.controller.enableOIDC }}
           - -enable-external-dns={{ .Values.controller.enableExternalDNS }}
+          - -disable-default-listeners={{ .Values.controller.disableDefaultListeners }}
 {{- if .Values.controller.globalConfiguration.create }}
           - -global-configuration=$(POD_NAMESPACE)/{{ include "nginx-ingress.controller.fullname" . }}
 {{- end }}

charts/nginx-ingress/templates/controller-deployment.yaml

@@ -244,6 +244,7 @@ spec:
           - -enable-cert-manager={{ .Values.controller.enableCertManager }}
           - -enable-oidc={{ .Values.controller.enableOIDC }}
           - -enable-external-dns={{ .Values.controller.enableExternalDNS }}
+          - -disable-default-listeners={{ .Values.controller.disableDefaultListeners }}
 {{- if .Values.controller.globalConfiguration.create }}
           - -global-configuration=$(POD_NAMESPACE)/{{ include "nginx-ingress.controller.fullname" . }}
 {{- end }}

charts/nginx-ingress/values.schema.json

@@ -1262,6 +1262,14 @@
             false
           ]
         },
+        "disableDefaultListeners": {
+          "type": "boolean",
+          "default": false,
+          "title": "The disableDefaultListeners",
+          "examples": [
+            false
+          ]
+        },
         "readOnlyRootFilesystem": {
           "type": "boolean",
           "default": false,
@@ -1411,6 +1419,7 @@
           },
           "enableLatencyMetrics": false,
           "disableIPV6": false,
+          "disableDefaultListeners": false,
           "readOnlyRootFilesystem": false
         }
       ]
@@ -1776,6 +1785,7 @@
         },
         "enableLatencyMetrics": false,
         "disableIPV6": false,
+        "disableDefaultListeners": false,
         "readOnlyRootFilesystem": false
       },
       "rbac": {

charts/nginx-ingress/values.yaml

@@ -116,7 +116,7 @@ controller:
     ## Used as an alternative to specifying a certificate and key using `controller.defaultTLS.cert` and `controller.defaultTLS.key` parameters.
     ## Note: Alternatively, omitting the default server secret completely will configure NGINX to reject TLS connections to the default server.
     ## Format: <namespace>/<secret_name>
-    secret: ""
+    secret: "default/default-server-secret"
 
   wildcardTLS:
     ## The base64-encoded TLS certificate for every Ingress/VirtualServer host that has TLS enabled but no secret specified.
@@ -373,7 +373,11 @@ controller:
       targetPort: 443
 
     ## A list of custom ports to expose through the Ingress Controller service. Follows the conventional Kubernetes yaml syntax for service ports.
-    customPorts: []
+    customPorts:
+      - port: 8000
+        targetPort: 8000
+        protocol: TCP
+        name: http-8000
 
   serviceAccount:
     ## The annotations of the service account of the Ingress Controller pods.
@@ -441,6 +445,9 @@ controller:
   ## Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack.
   disableIPV6: false
 
+  ## Disable both HTTP and HTTPS default server listeners.
+  disableDefaultListeners: false
+
   ## Configure root filesystem as read-only and add volumes for temporary data.
   readOnlyRootFilesystem: false
 

cmd/nginx-ingress/flags.go

@@ -194,6 +194,9 @@ var (
 	disableIPV6 = flag.Bool("disable-ipv6", false,
 		`Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack`)
 
+	disableDefaultListeners = flag.Bool("disable-default-listeners", false,
+		`Disable port 80 and 443 default_server listeners`)
+
 	startupCheckFn func() error
 )
 

cmd/nginx-ingress/main.go

@@ -90,6 +90,7 @@ func main() {
 
 	staticCfgParams := &configs.StaticConfigParams{
 		DisableIPV6:                    *disableIPV6,
+		DisableDefaultListeners:        *disableDefaultListeners,
 		HealthStatus:                   *healthStatus,
 		HealthStatusURI:                *healthStatusURI,
 		NginxStatus:                    *nginxStatus,

docs/content/configuration/global-configuration/command-line-arguments.md

@@ -508,3 +508,11 @@ Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack.
 Default `false`.
  
 <a name="cmdoption-disable-ipv6"></a>
+
+### -disable-default-listeners
+
+Disable both HTTP and HTTPS default server listeners.
+
+Default `false`.
+&nbsp;
+<a name="cmdoption-disable-default-listeners"></a>

docs/content/installation/installation-with-helm.md

@@ -332,6 +332,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.podDisruptionBudget.maxUnavailable` | The number of Ingress Controller pods that can be unavailable. This is a mutually exclusive setting with "minAvailable". | 0 |
 |`controller.strategy` | Specifies the strategy used to replace old Pods with new ones. Docs for [Deployment update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) and [Daemonset update strategy](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#daemonset-update-strategy) | {} |
 |`controller.disableIPV6` | Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack. | false |
+|`controller.disableDefaultListeners` | Disable both HTTP and HTTPS default server listeners. | false |
 |`controller.readOnlyRootFilesystem` | Configure root filesystem as read-only and add volumes for temporary data. | false |
 |`rbac.create` | Configures RBAC. | true |
 |`prometheus.create` | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |

internal/configs/config_params.go

@@ -114,6 +114,7 @@ type ConfigParams struct {
 // StaticConfigParams holds immutable NGINX configuration parameters that affect the main NGINX config.
 type StaticConfigParams struct {
 	DisableIPV6                    bool
+	DisableDefaultListeners        bool
 	HealthStatus                   bool
 	HealthStatusURI                string
 	NginxStatus                    bool

internal/configs/configmaps.go

@@ -514,6 +514,7 @@ func GenerateNginxMainConfig(staticCfgParams *StaticConfigParams, config *Config
 		DefaultServerAccessLogOff:          config.DefaultServerAccessLogOff,
 		DefaultServerReturn:                config.DefaultServerReturn,
 		DisableIPV6:                        staticCfgParams.DisableIPV6,
+		DisableDefaultListeners:            staticCfgParams.DisableDefaultListeners,
 		ErrorLogLevel:                      config.MainErrorLogLevel,
 		HealthStatus:                       staticCfgParams.HealthStatus,
 		HealthStatusURI:                    staticCfgParams.HealthStatusURI,

internal/configs/version1/config.go

@@ -165,6 +165,7 @@ type MainConfig struct {
 	DefaultServerAccessLogOff          bool
 	DefaultServerReturn                string
 	DisableIPV6                        bool
+	DisableDefaultListeners            bool
 	ErrorLogLevel                      string
 	HealthStatus                       bool
 	HealthStatusURI                    string

internal/configs/version1/nginx-plus.tmpl

@@ -153,17 +153,21 @@ http {
         set $resource_namespace "";
         set $service "";
 
+        {{if not .DisableDefaultListeners}}
         listen 80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};
         {{if not .DisableIPV6}}listen [::]:80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};{{end}}
+        {{end}}
 
         {{if .TLSPassthrough}}
         listen unix:/var/lib/nginx/passthrough-https.sock ssl default_server{{if .HTTP2}} http2{{end}} proxy_protocol;
         set_real_ip_from unix:;
         real_ip_header proxy_protocol;
         {{else}}
+        {{if not .DisableDefaultListeners}}
         listen 443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};
         {{if not .DisableIPV6}}listen [::]:443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};{{end}}
         {{end}}
+        {{end}}
 
         {{if .SSLRejectHandshake}}
         ssl_reject_handshake on;

internal/configs/version1/nginx.tmpl

@@ -106,17 +106,21 @@ http {
         set $resource_namespace "";
         set $service "";
 
+        {{if not .DisableDefaultListeners}}
         listen 80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};
         {{if not .DisableIPV6}}listen [::]:80 default_server{{if .ProxyProtocol}} proxy_protocol{{end}};{{end}}
+        {{end}}
 
         {{if .TLSPassthrough}}
         listen unix:/var/lib/nginx/passthrough-https.sock ssl default_server{{if .HTTP2}} http2{{end}} proxy_protocol;
         set_real_ip_from unix:;
         real_ip_header proxy_protocol;
         {{else}}
+        {{if not .DisableDefaultListeners}}
         listen 443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};
         {{if not .DisableIPV6}}listen [::]:443 ssl default_server{{if .HTTP2}} http2{{end}}{{if .ProxyProtocol}} proxy_protocol{{end}};{{end}}
         {{end}}
+        {{end}}
 
         {{if .SSLRejectHandshake}}
         ssl_reject_handshake on;