<p>is it possible to deploy an ingress controller (nginx) without a public ip address? </p>

<p>Thanks!</p>

<blockquote>
  <p>is it possible to deploy an ingress controller (nginx) without a public ip address?</p>
</blockquote>

<p>Without question, yes, if the Ingress controller's <code>Service</code> is of <code>type: NodePort</code> then the Ingress controller's private IP address is <strong>every</strong> <code>Node</code>'s IP address, on the port(s) pointing to <code>:80</code> and <code>:443</code> of the <code>Service</code>. Secretly, that's exactly what is happening anyway with <code>type: LoadBalancer</code>, just with the extra sugar coating of the cloud provider mapping between the load balancer's IP address and the binding to the <code>Node</code>'s ports.</p>

<p>So, to close that loop: if you wished to have a 100% internal Ingress controller, then use a <code>hostNetwork: true</code> and bind the Ingress controller's <code>ports:</code> to be the <strong>host</strong>'s port 80 and 443; then, make a DNS (A record|CNAME record) for each virtual-host that resolve to the address of every <code>Node</code> in the cluster, and poof: 100% non-Internet-facing Ingress controller.</p>
