diff --git a/.github/workflows/kustomize-ingress.yaml b/.github/workflows/kustomize-ingress.yaml
deleted file mode 100644
index 53c748bb..00000000
--- a/.github/workflows/kustomize-ingress.yaml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: Kustomize GitHub Actions for ingress
-
-on:
-  pull_request:
-    paths:
-      - base-kustomize/ingress/**
-      - .github/workflows/kustomize-ingress.yaml
-jobs:
-  kustomize:
-    strategy:
-      matrix:
-        overlays:
-          - external
-          - internal
-    name: Kustomize
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - uses: azure/setup-helm@v3
-        with:
-          version: latest
-          token: "${{ secrets.GITHUB_TOKEN }}"
-        id: helm
-      - name: Kustomize Install
-        working-directory: /usr/local/bin/
-        run: |
-          if [ ! -f /usr/local/bin/kustomize ]; then
-            curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | sudo bash
-          fi
-      - name: Pull OSH infra submodule
-        run: |
-          git submodule update --init submodules/openstack-helm-infra
-      - name: Make OSH infra submodule
-        run: |
-          cd submodules/openstack-helm-infra
-          make ingress
-      - name: Run Kustomize Build
-        run: |
-          kustomize build base-kustomize/ingress/${{ matrix.overlays }} --enable-helm --helm-command ${{ steps.helm.outputs.helm-path }} > /tmp/rendered.yaml
-      - name: Return Kustomize Build
-        uses: actions/upload-artifact@v2
-        with:
-          name: kustomize-ingress-artifact-${{ matrix.overlays }}
-          path: /tmp/rendered.yaml
diff --git a/.github/workflows/kustomize-skyline.yaml b/.github/workflows/kustomize-skyline.yaml
index 8ae0fb15..5bcd035e 100644
--- a/.github/workflows/kustomize-skyline.yaml
+++ b/.github/workflows/kustomize-skyline.yaml
@@ -12,7 +12,6 @@ jobs:
         overlays:
           - base
           - aio
-          - fqdn
     name: Kustomize
     runs-on: ubuntu-latest
     steps:
diff --git a/ansible/inventory/openstack-flex/group_vars/k8s_cluster/addons.yml b/ansible/inventory/openstack-flex/group_vars/k8s_cluster/addons.yml
index 9f953495..35a8b1ff 100644
--- a/ansible/inventory/openstack-flex/group_vars/k8s_cluster/addons.yml
+++ b/ansible/inventory/openstack-flex/group_vars/k8s_cluster/addons.yml
@@ -101,15 +101,15 @@ rbd_provisioner_enabled: false
 ingress_nginx_enabled: false
 # ingress_nginx_host_network: false
 ingress_publish_status_address: ""
-ingress_nginx_nodeselector:
-  kubernetes.io/os: "linux"
-  node-role.kubernetes.io/control-plane: ""
-ingress_nginx_tolerations:
-  - key: "openstack-compute-node"
-    operator: "Equal"
-    value: "enabled"
-    effect: "NoSchedule"
-ingress_nginx_namespace: "ingress-nginx"
+#ingress_nginx_nodeselector:
+#  kubernetes.io/os: "linux"
+#  node-role.kubernetes.io/control-plane: ""
+#ingress_nginx_tolerations:
+#  - key: "openstack-compute-node"
+#    operator: "Equal"
+#    value: "enabled"
+#    effect: "NoSchedule"
+#ingress_nginx_namespace: "ingress-nginx"
 # ingress_nginx_insecure_port: 80
 # ingress_nginx_secure_port: 443
 # ingress_nginx_configmap:
@@ -122,9 +122,9 @@ ingress_nginx_namespace: "ingress-nginx"
 # ingress_nginx_extra_args:
 #   - --default-ssl-certificate=default/foo-tls
 # ingress_nginx_termination_grace_period_seconds: 300
-ingress_nginx_class: nginx
-ingress_nginx_without_class: false
-ingress_nginx_default: true
+#ingress_nginx_class: nginx
+#ingress_nginx_without_class: false
+#ingress_nginx_default: false
 
 # ALB ingress controller deployment
 ingress_alb_enabled: false
diff --git a/base-helm-configs/barbican/barbican-helm-overrides.yaml b/base-helm-configs/barbican/barbican-helm-overrides.yaml
index 4161a7f7..6f116bdd 100644
--- a/base-helm-configs/barbican/barbican-helm-overrides.yaml
+++ b/base-helm-configs/barbican/barbican-helm-overrides.yaml
@@ -702,7 +702,7 @@ manifests:
   configmap_bin: true
   configmap_etc: true
   deployment_api: true
-  ingress_api: true
+  ingress_api: false
   job_bootstrap: true
   job_db_init: false
   job_db_sync: true
@@ -716,10 +716,10 @@ manifests:
   pod_test: true
   secret_db: true
   network_policy: false
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: true
   secret_registry: true
-  service_ingress_api: true
+  service_ingress_api: false
   service_api: true
 ...
diff --git a/base-helm-configs/ceilometer/ceilometer-helm-overrides.yaml b/base-helm-configs/ceilometer/ceilometer-helm-overrides.yaml
index 952324d7..0c98b9b7 100644
--- a/base-helm-configs/ceilometer/ceilometer-helm-overrides.yaml
+++ b/base-helm-configs/ceilometer/ceilometer-helm-overrides.yaml
@@ -2178,5 +2178,5 @@ manifests:
   secret_rabbitmq: true
   secret_registry: true
   service_api: true
-  service_ingress_api: true
+  service_ingress_api: false
 ...
diff --git a/base-helm-configs/cinder/cinder-helm-overrides.yaml b/base-helm-configs/cinder/cinder-helm-overrides.yaml
index e3b90f20..312a87a1 100644
--- a/base-helm-configs/cinder/cinder-helm-overrides.yaml
+++ b/base-helm-configs/cinder/cinder-helm-overrides.yaml
@@ -1438,7 +1438,7 @@ manifests:
   deployment_backup: false
   deployment_scheduler: true
   deployment_volume: false
-  ingress_api: true
+  ingress_api: false
   job_backup_storage_init: true
   job_bootstrap: false
   job_clean: true
@@ -1457,9 +1457,9 @@ manifests:
   pvc_backup: true
   network_policy: false
   secret_db: false
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: false
   secret_registry: true
   service_api: true
-  service_ingress_api: true
+  service_ingress_api: false
diff --git a/base-helm-configs/designate/designate-helm-overrides.yaml b/base-helm-configs/designate/designate-helm-overrides.yaml
index b6744b41..65f6d63e 100644
--- a/base-helm-configs/designate/designate-helm-overrides.yaml
+++ b/base-helm-configs/designate/designate-helm-overrides.yaml
@@ -728,7 +728,7 @@ manifests:
   deployment_producer: true
   deployment_mdns: true
   deployment_sink: false
-  ingress_api: true
+  ingress_api: false
   job_bootstrap: true
   job_db_init: true
   job_db_sync: true
@@ -743,11 +743,11 @@ manifests:
   pdb_mdns: true
   pdb_sink: false
   secret_db: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: true
   secret_registry: true
   service_api: true
   service_mdns: true
-  service_ingress_api: true
+  service_ingress_api: false
 ...
diff --git a/base-helm-configs/glance/glance-helm-overrides.yaml b/base-helm-configs/glance/glance-helm-overrides.yaml
index cac4bdba..f94438cc 100644
--- a/base-helm-configs/glance/glance-helm-overrides.yaml
+++ b/base-helm-configs/glance/glance-helm-overrides.yaml
@@ -978,7 +978,7 @@ manifests:
   configmap_bin: true
   configmap_etc: true
   deployment_api: true
-  ingress_api: true
+  ingress_api: false
   job_bootstrap: true
   job_clean: true
   job_db_init: false
@@ -996,11 +996,11 @@ manifests:
   pvc_images: true
   network_policy: false
   secret_db: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: true
   secret_registry: true
-  service_ingress_api: true
+  service_ingress_api: false
   service_api: true
 
 # NOTE: This is for enable helm resource-policy to keep glance-images PVC.
diff --git a/base-helm-configs/gnocchi/gnocchi-helm-overrides.yaml b/base-helm-configs/gnocchi/gnocchi-helm-overrides.yaml
index b8bd082a..993a24a9 100644
--- a/base-helm-configs/gnocchi/gnocchi-helm-overrides.yaml
+++ b/base-helm-configs/gnocchi/gnocchi-helm-overrides.yaml
@@ -653,7 +653,7 @@ manifests:
   daemonset_metricd: true
   daemonset_statsd: true
   deployment_api: true
-  ingress_api: true
+  ingress_api: false
   job_bootstrap: true
   job_clean: true
   job_db_drop: false
@@ -670,8 +670,8 @@ manifests:
   pod_gnocchi_test: false
   secret_db: true
   secret_keystone: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   service_api: true
-  service_ingress_api: true
+  service_ingress_api: false
   service_statsd: true
 ...
diff --git a/base-helm-configs/heat/heat-helm-overrides.yaml b/base-helm-configs/heat/heat-helm-overrides.yaml
index 04875b92..ddf8488d 100644
--- a/base-helm-configs/heat/heat-helm-overrides.yaml
+++ b/base-helm-configs/heat/heat-helm-overrides.yaml
@@ -1224,8 +1224,8 @@ manifests:
   deployment_cfn: true
   deployment_cloudwatch: false
   deployment_engine: true
-  ingress_api: true
-  ingress_cfn: true
+  ingress_api: false
+  ingress_cfn: false
   ingress_cloudwatch: false
   job_bootstrap: true
   job_db_init: false
@@ -1244,14 +1244,14 @@ manifests:
   pod_rally_test: false
   network_policy: false
   secret_db: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: true
   secret_registry: true
   service_api: true
   service_cfn: true
   service_cloudwatch: false
-  service_ingress_api: true
-  service_ingress_cfn: true
+  service_ingress_api: false
+  service_ingress_cfn: false
   service_ingress_cloudwatch: false
   statefulset_engine: false
diff --git a/base-helm-configs/horizon/horizon-helm-overrides.yaml b/base-helm-configs/horizon/horizon-helm-overrides.yaml
index 73e77af5..09a13807 100644
--- a/base-helm-configs/horizon/horizon-helm-overrides.yaml
+++ b/base-helm-configs/horizon/horizon-helm-overrides.yaml
@@ -7292,7 +7292,7 @@ manifests:
   configmap_etc: true
   configmap_logo: true
   deployment: true
-  ingress_api: true
+  ingress_api: false
   job_db_init: false
   job_db_sync: true
   job_db_drop: false
@@ -7301,8 +7301,8 @@ manifests:
   pod_helm_test: false
   network_policy: false
   secret_db: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_registry: true
-  service_ingress: true
+  service_ingress: false
   service: true
diff --git a/base-helm-configs/keystone/keystone-helm-overrides.yaml b/base-helm-configs/keystone/keystone-helm-overrides.yaml
index d1b5be0e..49d3fdef 100644
--- a/base-helm-configs/keystone/keystone-helm-overrides.yaml
+++ b/base-helm-configs/keystone/keystone-helm-overrides.yaml
@@ -1092,7 +1092,7 @@ manifests:
   cron_credential_rotate: true
   cron_fernet_rotate: true
   deployment_api: true
-  ingress_api: true
+  ingress_api: false
   job_bootstrap: true
   job_credential_cleanup: false
   job_credential_setup: true
@@ -1109,9 +1109,9 @@ manifests:
   secret_credential_keys: true
   secret_db: true
   secret_fernet_keys: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: true
   secret_registry: true
-  service_ingress_api: true
+  service_ingress_api: false
   service_api: true
diff --git a/base-helm-configs/neutron/neutron-helm-overrides.yaml b/base-helm-configs/neutron/neutron-helm-overrides.yaml
index 77d67366..663947c7 100644
--- a/base-helm-configs/neutron/neutron-helm-overrides.yaml
+++ b/base-helm-configs/neutron/neutron-helm-overrides.yaml
@@ -2517,7 +2517,7 @@ manifests:
   daemonset_ovn_metadata_agent: true
   deployment_ironic_agent: false
   deployment_server: true
-  ingress_server: true
+  ingress_server: false
   job_bootstrap: true
   job_db_init: false
   job_db_sync: true
@@ -2531,9 +2531,9 @@ manifests:
   pod_rally_test: false
   network_policy: false
   secret_db: false
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: false
   secret_registry: true
-  service_ingress_server: true
+  service_ingress_server: false
   service_server: true
diff --git a/base-helm-configs/nova/nova-helm-overrides.yaml b/base-helm-configs/nova/nova-helm-overrides.yaml
index 3c3ae6b5..498b4b41 100644
--- a/base-helm-configs/nova/nova-helm-overrides.yaml
+++ b/base-helm-configs/nova/nova-helm-overrides.yaml
@@ -2532,10 +2532,10 @@ manifests:
   deployment_novncproxy: true
   deployment_spiceproxy: false
   deployment_scheduler: true
-  ingress_metadata: true
-  ingress_novncproxy: true
+  ingress_metadata: false
+  ingress_novncproxy: false
   ingress_spiceproxy: false
-  ingress_osapi: true
+  ingress_osapi: false
   job_bootstrap: true
   job_storage_init: false
   job_db_init: false
@@ -2554,14 +2554,14 @@ manifests:
   secret_db_api: true
   secret_db_cell0: true
   secret_db: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: true
   secret_registry: true
-  service_ingress_metadata: true
-  service_ingress_novncproxy: true
+  service_ingress_metadata: false
+  service_ingress_novncproxy: false
   service_ingress_spiceproxy: false
-  service_ingress_osapi: true
+  service_ingress_osapi: false
   service_metadata: true
   service_novncproxy: true
   service_spiceproxy: false
diff --git a/base-helm-configs/octavia/octavia-helm-overrides.yaml b/base-helm-configs/octavia/octavia-helm-overrides.yaml
index abe0ba39..6db7c8a7 100644
--- a/base-helm-configs/octavia/octavia-helm-overrides.yaml
+++ b/base-helm-configs/octavia/octavia-helm-overrides.yaml
@@ -722,7 +722,7 @@ manifests:
   deployment_api: true
   deployment_worker: true
   deployment_housekeeping: true
-  ingress_api: true
+  ingress_api: false
   job_bootstrap: true
   job_db_init: false
   job_db_sync: true
@@ -737,9 +737,9 @@ manifests:
   network_policy: false
   secret_credential_keys: true
   secret_db: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_keystone: true
   secret_rabbitmq: true
   secret_registry: true
-  service_ingress_api: true
+  service_ingress_api: false
   service_api: true
diff --git a/base-helm-configs/placement/placement-helm-overrides.yaml b/base-helm-configs/placement/placement-helm-overrides.yaml
index b58a6e96..a1bf1cc6 100644
--- a/base-helm-configs/placement/placement-helm-overrides.yaml
+++ b/base-helm-configs/placement/placement-helm-overrides.yaml
@@ -459,10 +459,10 @@ manifests:
   job_ks_user: true
   network_policy: false
   secret_db: true
-  secret_ingress_tls: true
+  secret_ingress_tls: false
   secret_registry: true
   pdb: true
-  ingress: true
+  ingress: false
   secret_keystone: true
-  service_ingress: true
+  service_ingress: false
   service: true
diff --git a/base-kustomize/argocd/base/values.yaml b/base-kustomize/argocd/base/values.yaml
index b62fa7fe..43d5e6bc 100644
--- a/base-kustomize/argocd/base/values.yaml
+++ b/base-kustomize/argocd/base/values.yaml
@@ -21,7 +21,7 @@ server:
   ingress:
     annotations:
       nginx.ingress.kubernetes.io/backend-protocol: HTTPS
-    enabled: true
+    enabled: false
     ingressClassName: "nginx-cluster"
     hosts: ["argocd.dfw-ospcv2-staging.ohthree.com"]
     tls:
diff --git a/base-kustomize/barbican/letsencrypt/kustomization.yaml b/base-kustomize/barbican/letsencrypt/kustomization.yaml
deleted file mode 100644
index 65b93a56..00000000
--- a/base-kustomize/barbican/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: barbican-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/cinder/letsencrypt/kustomization.yaml b/base-kustomize/cinder/letsencrypt/kustomization.yaml
deleted file mode 100644
index 600c2979..00000000
--- a/base-kustomize/cinder/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: cinder-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/designate/letsencrypt/kustomization.yaml b/base-kustomize/designate/letsencrypt/kustomization.yaml
deleted file mode 100644
index 5fb919f6..00000000
--- a/base-kustomize/designate/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: designate-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/glance/letsencrypt/kustomization.yaml b/base-kustomize/glance/letsencrypt/kustomization.yaml
deleted file mode 100644
index 36dd9501..00000000
--- a/base-kustomize/glance/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: glance-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/grafana/base/grafana-values.yaml b/base-kustomize/grafana/base/grafana-values.yaml
index 13b92f7a..e78b6a74 100644
--- a/base-kustomize/grafana/base/grafana-values.yaml
+++ b/base-kustomize/grafana/base/grafana-values.yaml
@@ -4,7 +4,7 @@ tenant_id: 122333 # TODO: update this value to use your Azure Tenant ID
 ####
 
 ingress:
-  enabled: true
+  enabled: false
   annotations:
     nginx.ingress.kubernetes.io/rewrite-target: /
   path: /
diff --git a/base-kustomize/heat/letsencrypt/kustomization.yaml b/base-kustomize/heat/letsencrypt/kustomization.yaml
deleted file mode 100644
index 72dcb904..00000000
--- a/base-kustomize/heat/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: heat-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
-  - target:
-      kind: Ingress
-      name: cloudformation-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/horizon/letsencrypt/kustomization.yaml b/base-kustomize/horizon/letsencrypt/kustomization.yaml
deleted file mode 100644
index 77ac7bd9..00000000
--- a/base-kustomize/horizon/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: horizon-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/ingress/external/helm/ingress-helm-overrides.yaml b/base-kustomize/ingress/external/helm/ingress-helm-overrides.yaml
deleted file mode 100644
index c32f6b7c..00000000
--- a/base-kustomize/ingress/external/helm/ingress-helm-overrides.yaml
+++ /dev/null
@@ -1,1104 +0,0 @@
-## nginx configuration
-## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md
-##
-
-## Overrides for generated resource names
-# See templates/_helpers.tpl
-nameOverride: "ingress-nginx"
-# fullnameOverride:
-
-# -- Override the deployment namespace; defaults to .Release.Namespace
-namespaceOverride: ""
-## Labels to apply to all resources
-##
-commonLabels: {}
-# scmhash: abc123
-# myLabel: aakkmd
-
-controller:
-  name: controller
-  enableAnnotationValidations: false
-  image:
-    ## Keep false as default for now!
-    chroot: false
-    registry: registry.k8s.io
-    image: ingress-nginx/controller
-    ## for backwards compatibility consider setting the full image url via the repository value below
-    ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-    ## repository:
-    tag: "v1.10.1"
-    digest: sha256:e24f39d3eed6bcc239a56f20098878845f62baa34b9f2be2fd2c38ce9fb0f29e
-    digestChroot: sha256:c155954116b397163c88afcb3252462771bd7867017e8a17623e83601bab7ac7
-    pullPolicy: IfNotPresent
-    runAsNonRoot: true
-    # www-data -> uid 101
-    runAsUser: 101
-    allowPrivilegeEscalation: false
-    seccompProfile:
-      type: RuntimeDefault
-    readOnlyRootFilesystem: false
-  # -- Use an existing PSP instead of creating one
-  existingPsp: ""
-  # -- Configures the controller container name
-  containerName: controller
-  # -- Configures the ports that the nginx-controller listens on
-  containerPort:
-    http: 80
-    https: 443
-  # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
-  config: {}
-  # -- Annotations to be added to the controller config configuration configmap.
-  configAnnotations: {}
-  # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers
-  proxySetHeaders: {}
-  # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
-  addHeaders: {}
-  # -- Optionally customize the pod dnsConfig.
-  dnsConfig: {}
-  # -- Optionally customize the pod hostAliases.
-  hostAliases: []
-  # - ip: 127.0.0.1
-  #   hostnames:
-  #   - foo.local
-  #   - bar.local
-  # - ip: 10.1.2.3
-  #   hostnames:
-  #   - foo.remote
-  #   - bar.remote
-  # -- Optionally customize the pod hostname.
-  hostname: {}
-  # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.
-  # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller
-  # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
-  dnsPolicy: ClusterFirst
-  # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
-  # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
-  reportNodeInternalIp: false
-  # -- Process Ingress objects without ingressClass annotation/ingressClassName field
-  # Overrides value for --watch-ingress-without-class flag of the controller binary
-  # Defaults to false
-  watchIngressWithoutClass: false
-  # -- Process IngressClass per name (additionally as per spec.controller).
-  ingressClassByName: false
-  # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto"
-  # Defaults to false
-  enableTopologyAwareRouting: false
-  # -- This configuration defines if Ingress Controller should allow users to set
-  # their own *-snippet annotations, otherwise this is forbidden / dropped
-  # when users add those annotations.
-  # Global snippets in ConfigMap are still respected
-  allowSnippetAnnotations: false
-  # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
-  # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
-  # is merged
-  hostNetwork: false
-  ## Use host ports 80 and 443
-  ## Disabled by default
-  hostPort:
-    # -- Enable 'hostPort' or not
-    enabled: false
-    ports:
-      # -- 'hostPort' http port
-      http: 80
-      # -- 'hostPort' https port
-      https: 443
-  # NetworkPolicy for controller component.
-  networkPolicy:
-    # -- Enable 'networkPolicy' or not
-    enabled: false
-  # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
-  electionID: ""
-  # -- This section refers to the creation of the IngressClass resource.
-  # IngressClasses are immutable and cannot be changed after creation.
-  # We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required.
-  ingressClassResource:
-    # -- Name of the IngressClass
-    name: nginx
-    # -- Create the IngressClass or not
-    enabled: true
-    # -- If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation.
-    # Ingress creation gets rejected if there are multiple default IngressClasses.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class
-    default: false
-    # -- Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value.
-    # This value is also being set as the `--controller-class` argument of this Ingress Controller.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
-    controllerValue: k8s.io/ingress-nginx
-    # -- A link to a custom resource containing additional configuration for the controller.
-    # This is optional if the controller consuming this IngressClass does not require additional parameters.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
-    parameters: {}
-    # parameters:
-    #   apiGroup: k8s.example.com
-    #   kind: IngressParameters
-    #   name: external-lb
-  # -- For backwards compatibility with ingress.class annotation, use ingressClass.
-  # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation
-  ingressClass: nginx
-  # -- Labels to add to the pod container metadata
-  podLabels: {}
-  #  key: value
-
-  # -- Security context for controller pods
-  podSecurityContext: {}
-  # -- sysctls for controller pods
-  ## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
-  sysctls: {}
-  # sysctls:
-  #   "net.core.somaxconn": "8192"
-  # -- Security context for controller containers
-  containerSecurityContext: {}
-  # -- Allows customization of the source of the IP address or FQDN to report
-  # in the ingress status field. By default, it reads the information provided
-  # by the service. If disable, the status field reports the IP address of the
-  # node or nodes where an ingress controller pod is running.
-  publishService:
-    # -- Enable 'publishService' or not
-    enabled: true
-    # -- Allows overriding of the publish service to bind to
-    # Must be <namespace>/<service_name>
-    pathOverride: ""
-  # Limit the scope of the controller to a specific namespace
-  scope:
-    # -- Enable 'scope' or not
-    enabled: false
-    # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)
-    namespace: ""
-    # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels
-    # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.
-    namespaceSelector: ""
-  # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)
-  configMapNamespace: ""
-  tcp:
-    # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)
-    configMapNamespace: ""
-    # -- Annotations to be added to the tcp config configmap
-    annotations: {}
-  udp:
-    # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)
-    configMapNamespace: ""
-    # -- Annotations to be added to the udp config configmap
-    annotations: {}
-  # -- Maxmind license key to download GeoLite2 Databases.
-  ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
-  maxmindLicenseKey: ""
-  # -- Additional command line arguments to pass to Ingress-Nginx Controller
-  # E.g. to specify the default SSL certificate you can use
-  extraArgs: {}
-  ## extraArgs:
-  ##   default-ssl-certificate: "<namespace>/<secret_name>"
-  ##   time-buckets: "0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10"
-  ##   length-buckets: "10,20,30,40,50,60,70,80,90,100"
-  ##   size-buckets: "10,100,1000,10000,100000,1e+06,1e+07"
-
-  # -- Additional environment variables to set
-  extraEnvs: []
-  # extraEnvs:
-  #   - name: FOO
-  #     valueFrom:
-  #       secretKeyRef:
-  #         key: FOO
-  #         name: secret-resource
-
-  # -- Use a `DaemonSet` or `Deployment`
-  kind: Deployment
-  # -- Annotations to be added to the controller Deployment or DaemonSet
-  ##
-  annotations: {}
-  #  keel.sh/pollSchedule: "@every 60m"
-
-  # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels
-  ##
-  labels: {}
-  #  keel.sh/policy: patch
-  #  keel.sh/trigger: poll
-
-  # -- The update strategy to apply to the Deployment or DaemonSet
-  ##
-  updateStrategy: {}
-  #  rollingUpdate:
-  #    maxUnavailable: 1
-  #  type: RollingUpdate
-
-  # -- `minReadySeconds` to avoid killing pods before we are ready
-  ##
-  minReadySeconds: 0
-  # -- Node tolerations for server scheduling to nodes with taints
-  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-  ##
-  tolerations: []
-  #  - key: "key"
-  #    operator: "Equal|Exists"
-  #    value: "value"
-  #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
-
-  # -- Affinity and anti-affinity rules for server scheduling to nodes
-  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-  ##
-  affinity: {}
-  # # An example of preferred pod anti-affinity, weight is in the range 1-100
-  # podAntiAffinity:
-  #   preferredDuringSchedulingIgnoredDuringExecution:
-  #   - weight: 100
-  #     podAffinityTerm:
-  #       labelSelector:
-  #         matchExpressions:
-  #         - key: app.kubernetes.io/name
-  #           operator: In
-  #           values:
-  #           - ingress-nginx
-  #         - key: app.kubernetes.io/instance
-  #           operator: In
-  #           values:
-  #           - ingress-nginx
-  #         - key: app.kubernetes.io/component
-  #           operator: In
-  #           values:
-  #           - controller
-  #       topologyKey: kubernetes.io/hostname
-
-  # # An example of required pod anti-affinity
-  # podAntiAffinity:
-  #   requiredDuringSchedulingIgnoredDuringExecution:
-  #   - labelSelector:
-  #       matchExpressions:
-  #       - key: app.kubernetes.io/name
-  #         operator: In
-  #         values:
-  #         - ingress-nginx
-  #       - key: app.kubernetes.io/instance
-  #         operator: In
-  #         values:
-  #         - ingress-nginx
-  #       - key: app.kubernetes.io/component
-  #         operator: In
-  #         values:
-  #         - controller
-  #     topologyKey: "kubernetes.io/hostname"
-
-  # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.
-  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-  ##
-  topologySpreadConstraints: []
-  # - labelSelector:
-  #     matchLabels:
-  #       app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
-  #       app.kubernetes.io/instance: '{{ .Release.Name }}'
-  #       app.kubernetes.io/component: controller
-  #   topologyKey: topology.kubernetes.io/zone
-  #   maxSkew: 1
-  #   whenUnsatisfiable: ScheduleAnyway
-  # - labelSelector:
-  #     matchLabels:
-  #       app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
-  #       app.kubernetes.io/instance: '{{ .Release.Name }}'
-  #       app.kubernetes.io/component: controller
-  #   topologyKey: kubernetes.io/hostname
-  #   maxSkew: 1
-  #   whenUnsatisfiable: ScheduleAnyway
-
-  # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready
-  ## wait up to five minutes for the drain of connections
-  ##
-  terminationGracePeriodSeconds: 300
-  # -- Node labels for controller pod assignment
-  ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
-  ##
-  nodeSelector:
-    kubernetes.io/os: linux
-  ## Liveness and readiness probe values
-  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
-  ##
-  ## startupProbe:
-  ##   httpGet:
-  ##     # should match container.healthCheckPath
-  ##     path: "/healthz"
-  ##     port: 10254
-  ##     scheme: HTTP
-  ##   initialDelaySeconds: 5
-  ##   periodSeconds: 5
-  ##   timeoutSeconds: 2
-  ##   successThreshold: 1
-  ##   failureThreshold: 5
-  livenessProbe:
-    httpGet:
-      # should match container.healthCheckPath
-      path: "/healthz"
-      port: 10254
-      scheme: HTTP
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 1
-    successThreshold: 1
-    failureThreshold: 5
-  readinessProbe:
-    httpGet:
-      # should match container.healthCheckPath
-      path: "/healthz"
-      port: 10254
-      scheme: HTTP
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 1
-    successThreshold: 1
-    failureThreshold: 3
-  # -- Path of the health check endpoint. All requests received on the port defined by
-  # the healthz-port parameter are forwarded internally to this path.
-  healthCheckPath: "/healthz"
-  # -- Address to bind the health check endpoint.
-  # It is better to set this option to the internal node address
-  # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.
-  healthCheckHost: ""
-  # -- Annotations to be added to controller pods
-  ##
-  podAnnotations: {}
-  replicaCount: 1
-  # -- Minimum available pods set in PodDisruptionBudget.
-  # Define either 'minAvailable' or 'maxUnavailable', never both.
-  minAvailable: 1
-  # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
-  # maxUnavailable: 1
-
-  ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
-  ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
-  ## Ideally, there should be no limits.
-  ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/
-  resources:
-    ##  limits:
-    ##    cpu: 100m
-    ##    memory: 90Mi
-    requests:
-      cpu: 100m
-      memory: 90Mi
-  # Mutually exclusive with keda autoscaling
-  autoscaling:
-    enabled: false
-    annotations: {}
-    minReplicas: 1
-    maxReplicas: 11
-    targetCPUUtilizationPercentage: 50
-    targetMemoryUtilizationPercentage: 50
-    behavior: {}
-    # scaleDown:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 1
-    #     periodSeconds: 180
-    # scaleUp:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 2
-    #     periodSeconds: 60
-  autoscalingTemplate: []
-  # Custom or additional autoscaling metrics
-  # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
-  # - type: Pods
-  #   pods:
-  #     metric:
-  #       name: nginx_ingress_controller_nginx_process_requests_total
-  #     target:
-  #       type: AverageValue
-  #       averageValue: 10000m
-
-  # Mutually exclusive with hpa autoscaling
-  keda:
-    apiVersion: "keda.sh/v1alpha1"
-    ## apiVersion changes with keda 1.x vs 2.x
-    ## 2.x = keda.sh/v1alpha1
-    ## 1.x = keda.k8s.io/v1alpha1
-    enabled: false
-    minReplicas: 1
-    maxReplicas: 11
-    pollingInterval: 30
-    cooldownPeriod: 300
-    # fallback:
-    #   failureThreshold: 3
-    #   replicas: 11
-    restoreToOriginalReplicaCount: false
-    scaledObject:
-      annotations: {}
-      # Custom annotations for ScaledObject resource
-      #  annotations:
-      # key: value
-    triggers: []
-    # - type: prometheus
-    #   metadata:
-    #     serverAddress: http://<prometheus-host>:9090
-    #     metricName: http_requests_total
-    #     threshold: '100'
-    #     query: sum(rate(http_requests_total{deployment="my-deployment"}[2m]))
-
-    behavior: {}
-    # scaleDown:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 1
-    #     periodSeconds: 180
-    # scaleUp:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 2
-    #     periodSeconds: 60
-  # -- Enable mimalloc as a drop-in replacement for malloc.
-  ## ref: https://github.com/microsoft/mimalloc
-  ##
-  enableMimalloc: true
-  ## Override NGINX template
-  customTemplate:
-    configMapName: ""
-    configMapKey: ""
-  service:
-    # -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.
-    enabled: true
-    external:
-      # -- Enable the external controller service or not. Useful for internal-only deployments.
-      enabled: true
-    # -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.
-    annotations:
-      metallb.universe.tf/address-pool: openstack-external
-    # -- Labels to be added to both controller services.
-    labels: {}
-    # -- Type of the external controller service.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
-    type: LoadBalancer
-    # -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.
-    # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
-    clusterIP: ""
-    # -- List of node IP addresses at which the external controller service is available.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-    externalIPs: []
-    # -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
-    loadBalancerIP: ""
-    # -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.
-    loadBalancerSourceRanges: []
-    # -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
-    loadBalancerClass: ""
-    # -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation
-    # allocateLoadBalancerNodePorts: true
-
-    # -- External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it.
-    # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-    externalTrafficPolicy: ""
-    # -- Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
-    # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
-    sessionAffinity: ""
-    # -- Specifies the health check node port (numeric port number) for the external controller service.
-    # If not specified, the service controller allocates a port from your cluster's node port range.
-    # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-    # healthCheckNodePort: 0
-
-    # -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
-    # Fields `ipFamilies` and `clusterIP` depend on the value of this field.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-    ipFamilyPolicy: SingleStack
-    # -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-    ipFamilies:
-      - IPv4
-    # -- Enable the HTTP listener on both controller services or not.
-    enableHttp: true
-    # -- Enable the HTTPS listener on both controller services or not.
-    enableHttps: true
-    ports:
-      # -- Port the external HTTP listener is published with.
-      http: 80
-      # -- Port the external HTTPS listener is published with.
-      https: 443
-    targetPorts:
-      # -- Port of the ingress controller the external HTTP listener is mapped to.
-      http: http
-      # -- Port of the ingress controller the external HTTPS listener is mapped to.
-      https: https
-    # -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
-    appProtocol: true
-    nodePorts:
-      # -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.
-      http: ""
-      # -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.
-      https: ""
-      # -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.
-      # Example:
-      # tcp:
-      #   8080: 30080
-      tcp: {}
-      # -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.
-      # Example:
-      # udp:
-      #   53: 30053
-      udp: {}
-    internal:
-      # -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.
-      enabled: false
-      # -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
-      annotations: {}
-      # -- Type of the internal controller service.
-      # Defaults to the value of `controller.service.type`.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
-      type: ""
-      # -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.
-      # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
-      clusterIP: ""
-      # -- List of node IP addresses at which the internal controller service is available.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-      externalIPs: []
-      # -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
-      loadBalancerIP: ""
-      # -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.
-      loadBalancerSourceRanges: []
-      # -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
-      loadBalancerClass: ""
-      # -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation
-      # allocateLoadBalancerNodePorts: true
-
-      # -- External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it.
-      # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-      externalTrafficPolicy: ""
-      # -- Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
-      # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
-      sessionAffinity: ""
-      # -- Specifies the health check node port (numeric port number) for the internal controller service.
-      # If not specified, the service controller allocates a port from your cluster's node port range.
-      # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-      # healthCheckNodePort: 0
-
-      # -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
-      # Fields `ipFamilies` and `clusterIP` depend on the value of this field.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-      ipFamilyPolicy: SingleStack
-      # -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-      ipFamilies:
-        - IPv4
-      ports: {}
-      # -- Port the internal HTTP listener is published with.
-      # Defaults to the value of `controller.service.ports.http`.
-      # http: 80
-      # -- Port the internal HTTPS listener is published with.
-      # Defaults to the value of `controller.service.ports.https`.
-      # https: 443
-
-      targetPorts: {}
-      # -- Port of the ingress controller the internal HTTP listener is mapped to.
-      # Defaults to the value of `controller.service.targetPorts.http`.
-      # http: http
-      # -- Port of the ingress controller the internal HTTPS listener is mapped to.
-      # Defaults to the value of `controller.service.targetPorts.https`.
-      # https: https
-
-      # -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
-      appProtocol: true
-      nodePorts:
-        # -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.
-        http: ""
-        # -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.
-        https: ""
-        # -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.
-        # Example:
-        # tcp:
-        #   8080: 30080
-        tcp: {}
-        # -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.
-        # Example:
-        # udp:
-        #   53: 30053
-        udp: {}
-  # shareProcessNamespace enables process namespace sharing within the pod.
-  # This can be used for example to signal log rotation using `kill -USR1` from a sidecar.
-  shareProcessNamespace: false
-  # -- Additional containers to be added to the controller pod.
-  # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.
-  extraContainers: []
-  #  - name: my-sidecar
-  #    image: nginx:latest
-  #  - name: lemonldap-ng-controller
-  #    image: lemonldapng/lemonldap-ng-controller:0.2.0
-  #    args:
-  #      - /lemonldap-ng-controller
-  #      - --alsologtostderr
-  #      - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration
-  #    env:
-  #      - name: POD_NAME
-  #        valueFrom:
-  #          fieldRef:
-  #            fieldPath: metadata.name
-  #      - name: POD_NAMESPACE
-  #        valueFrom:
-  #          fieldRef:
-  #            fieldPath: metadata.namespace
-  #    volumeMounts:
-  #    - name: copy-portal-skins
-  #      mountPath: /srv/var/lib/lemonldap-ng/portal/skins
-
-  # -- Additional volumeMounts to the controller main container.
-  extraVolumeMounts: []
-  #  - name: copy-portal-skins
-  #   mountPath: /var/lib/lemonldap-ng/portal/skins
-
-  # -- Additional volumes to the controller pod.
-  extraVolumes: []
-  #  - name: copy-portal-skins
-  #    emptyDir: {}
-
-  # -- Containers, which are run before the app containers are started.
-  extraInitContainers: []
-  # - name: init-myservice
-  #   image: busybox
-  #   command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
-
-  # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module
-  extraModules: []
-  # - name: mytestmodule
-  #   image:
-  #     registry: registry.k8s.io
-  #     image: ingress-nginx/mytestmodule
-  #     ## for backwards compatibility consider setting the full image url via the repository value below
-  #     ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-  #     ## repository:
-  #     tag: "v1.0.0"
-  #     digest: ""
-  #     distroless: false
-  #   containerSecurityContext:
-  #     runAsNonRoot: true
-  #     runAsUser: <user-id>
-  #     allowPrivilegeEscalation: false
-  #     seccompProfile:
-  #       type: RuntimeDefault
-  #     capabilities:
-  #       drop:
-  #       - ALL
-  #     readOnlyRootFilesystem: true
-  #   resources: {}
-  #
-  # The image must contain a `/usr/local/bin/init_module.sh` executable, which
-  # will be executed as initContainers, to move its config files within the
-  # mounted volume.
-
-  opentelemetry:
-    enabled: false
-    name: opentelemetry
-    image:
-      registry: registry.k8s.io
-      image: ingress-nginx/opentelemetry
-      ## for backwards compatibility consider setting the full image url via the repository value below
-      ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-      ## repository:
-      tag: "v20230721-3e2062ee5"
-      digest: sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
-      distroless: true
-    containerSecurityContext:
-      runAsNonRoot: true
-      # -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.
-      runAsUser: 65532
-      allowPrivilegeEscalation: false
-      seccompProfile:
-        type: RuntimeDefault
-      capabilities:
-        drop:
-          - ALL
-      readOnlyRootFilesystem: true
-    resources: {}
-  admissionWebhooks:
-    name: admission
-    annotations: {}
-    # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem".
-
-    ## Additional annotations to the admission webhooks.
-    ## These annotations will be added to the ValidatingWebhookConfiguration and
-    ## the Jobs Spec of the admission webhooks.
-    enabled: true
-    # -- Additional environment variables to set
-    extraEnvs: []
-    # extraEnvs:
-    #   - name: FOO
-    #     valueFrom:
-    #       secretKeyRef:
-    #         key: FOO
-    #         name: secret-resource
-    # -- Admission Webhook failure policy to use
-    failurePolicy: Fail
-    # timeoutSeconds: 10
-    port: 8443
-    certificate: "/usr/local/certificates/cert"
-    key: "/usr/local/certificates/key"
-    namespaceSelector: {}
-    objectSelector: {}
-    # -- Labels to be added to admission webhooks
-    labels: {}
-    # -- Use an existing PSP instead of creating one
-    existingPsp: ""
-    service:
-      annotations: {}
-      # clusterIP: ""
-      externalIPs: []
-      # loadBalancerIP: ""
-      loadBalancerSourceRanges: []
-      servicePort: 443
-      type: ClusterIP
-    createSecretJob:
-      name: create
-      # -- Security context for secret creation containers
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        allowPrivilegeEscalation: false
-        seccompProfile:
-          type: RuntimeDefault
-        capabilities:
-          drop:
-            - ALL
-        readOnlyRootFilesystem: true
-      resources: {}
-      # limits:
-      #   cpu: 10m
-      #   memory: 20Mi
-      # requests:
-      #   cpu: 10m
-      #   memory: 20Mi
-    patchWebhookJob:
-      name: patch
-      # -- Security context for webhook patch containers
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        allowPrivilegeEscalation: false
-        seccompProfile:
-          type: RuntimeDefault
-        capabilities:
-          drop:
-            - ALL
-        readOnlyRootFilesystem: true
-      resources: {}
-    patch:
-      enabled: true
-      image:
-        registry: registry.k8s.io
-        image: ingress-nginx/kube-webhook-certgen
-        ## for backwards compatibility consider setting the full image url via the repository value below
-        ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-        ## repository:
-        tag: v1.4.1
-        digest: sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366
-        pullPolicy: IfNotPresent
-      # -- Provide a priority class name to the webhook patching job
-      ##
-      priorityClassName: ""
-      podAnnotations: {}
-      # NetworkPolicy for webhook patch
-      networkPolicy:
-        # -- Enable 'networkPolicy' or not
-        enabled: false
-      nodeSelector:
-        kubernetes.io/os: linux
-      tolerations: []
-      # -- Labels to be added to patch job resources
-      labels: {}
-      # -- Security context for secret creation & webhook patch pods
-      securityContext: {}
-    # Use certmanager to generate webhook certs
-    certManager:
-      enabled: false
-      # self-signed root certificate
-      rootCert:
-        # default to be 5y
-        duration: ""
-      admissionCert:
-        # default to be 1y
-        duration: ""
-        # issuerRef:
-        #   name: "issuer"
-        #   kind: "ClusterIssuer"
-  metrics:
-    port: 10254
-    portName: metrics
-    # if this port is changed, change healthz-port: in extraArgs: accordingly
-    enabled: false
-    service:
-      annotations: {}
-      # prometheus.io/scrape: "true"
-      # prometheus.io/port: "10254"
-      # -- Labels to be added to the metrics service resource
-      labels: {}
-      # clusterIP: ""
-
-      # -- List of IP addresses at which the stats-exporter service is available
-      ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-      ##
-      externalIPs: []
-      # loadBalancerIP: ""
-      loadBalancerSourceRanges: []
-      servicePort: 10254
-      type: ClusterIP
-      # externalTrafficPolicy: ""
-      # nodePort: ""
-    serviceMonitor:
-      enabled: false
-      additionalLabels: {}
-      annotations: {}
-      ## The label to use to retrieve the job name from.
-      ## jobLabel: "app.kubernetes.io/name"
-      namespace: ""
-      namespaceSelector: {}
-      ## Default: scrape .Release.Namespace or namespaceOverride only
-      ## To scrape all, use the following:
-      ## namespaceSelector:
-      ##   any: true
-      scrapeInterval: 30s
-      # honorLabels: true
-      targetLabels: []
-      relabelings: []
-      metricRelabelings: []
-    prometheusRule:
-      enabled: false
-      additionalLabels: {}
-      # namespace: ""
-      rules: []
-      # # These are just examples rules, please adapt them to your needs
-      # - alert: NGINXConfigFailed
-      #   expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0
-      #   for: 1s
-      #   labels:
-      #     severity: critical
-      #   annotations:
-      #     description: bad ingress config - nginx config test failed
-      #     summary: uninstall the latest ingress changes to allow config reloads to resume
-      # # By default a fake self-signed certificate is generated as default and
-      # # it is fine if it expires. If `--default-ssl-certificate` flag is used
-      # # and a valid certificate passed please do not filter for `host` label!
-      # # (i.e. delete `{host!="_"}` so also the default SSL certificate is
-      # # checked for expiration)
-      # - alert: NGINXCertificateExpiry
-      #   expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!="_"}) by (host) - time()) < 604800
-      #   for: 1s
-      #   labels:
-      #     severity: critical
-      #   annotations:
-      #     description: ssl certificate(s) will expire in less then a week
-      #     summary: renew expiring certificates to avoid downtime
-      # - alert: NGINXTooMany500s
-      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
-      #   for: 1m
-      #   labels:
-      #     severity: warning
-      #   annotations:
-      #     description: Too many 5XXs
-      #     summary: More than 5% of all requests returned 5XX, this requires your attention
-      # - alert: NGINXTooMany400s
-      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
-      #   for: 1m
-      #   labels:
-      #     severity: warning
-      #   annotations:
-      #     description: Too many 4XXs
-      #     summary: More than 5% of all requests returned 4XX, this requires your attention
-  # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:
-  # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds
-  # to 300, allowing the draining of connections up to five minutes.
-  # If the active connections end before that, the pod will terminate gracefully at that time.
-  # To effectively take advantage of this feature, the Configmap feature
-  # worker-shutdown-timeout new value is 240s instead of 10s.
-  ##
-  lifecycle:
-    preStop:
-      exec:
-        command:
-          - /wait-shutdown
-  priorityClassName: ""
-# -- Rollback limit
-##
-revisionHistoryLimit: 10
-## Default 404 backend
-##
-defaultBackend:
-  ##
-  enabled: false
-  name: defaultbackend
-  image:
-    registry: registry.k8s.io
-    image: defaultbackend-amd64
-    ## for backwards compatibility consider setting the full image url via the repository value below
-    ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-    ## repository:
-    tag: "1.5"
-    pullPolicy: IfNotPresent
-    runAsNonRoot: true
-    # nobody user -> uid 65534
-    runAsUser: 65534
-    allowPrivilegeEscalation: false
-    seccompProfile:
-      type: RuntimeDefault
-    readOnlyRootFilesystem: true
-  # -- Use an existing PSP instead of creating one
-  existingPsp: ""
-  extraArgs: {}
-  serviceAccount:
-    create: true
-    name: ""
-    automountServiceAccountToken: true
-  # -- Additional environment variables to set for defaultBackend pods
-  extraEnvs: []
-  port: 8080
-  ## Readiness and liveness probes for default backend
-  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
-  ##
-  livenessProbe:
-    failureThreshold: 3
-    initialDelaySeconds: 30
-    periodSeconds: 10
-    successThreshold: 1
-    timeoutSeconds: 5
-  readinessProbe:
-    failureThreshold: 6
-    initialDelaySeconds: 0
-    periodSeconds: 5
-    successThreshold: 1
-    timeoutSeconds: 5
-  # -- The update strategy to apply to the Deployment or DaemonSet
-  ##
-  updateStrategy: {}
-  #  rollingUpdate:
-  #    maxUnavailable: 1
-  #  type: RollingUpdate
-
-  # -- `minReadySeconds` to avoid killing pods before we are ready
-  ##
-  minReadySeconds: 0
-  # -- Node tolerations for server scheduling to nodes with taints
-  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-  ##
-  tolerations: []
-  #  - key: "key"
-  #    operator: "Equal|Exists"
-  #    value: "value"
-  #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
-
-  affinity: {}
-  # -- Security context for default backend pods
-  podSecurityContext: {}
-  # -- Security context for default backend containers
-  containerSecurityContext: {}
-  # -- Labels to add to the pod container metadata
-  podLabels: {}
-  #  key: value
-
-  # -- Node labels for default backend pod assignment
-  ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
-  ##
-  nodeSelector:
-    kubernetes.io/os: linux
-  # -- Annotations to be added to default backend pods
-  ##
-  podAnnotations: {}
-  replicaCount: 1
-  minAvailable: 1
-  resources: {}
-  # limits:
-  #   cpu: 10m
-  #   memory: 20Mi
-  # requests:
-  #   cpu: 10m
-  #   memory: 20Mi
-
-  extraVolumeMounts: []
-  ## Additional volumeMounts to the default backend container.
-  #  - name: copy-portal-skins
-  #   mountPath: /var/lib/lemonldap-ng/portal/skins
-
-  extraVolumes: []
-  ## Additional volumes to the default backend pod.
-  #  - name: copy-portal-skins
-  #    emptyDir: {}
-
-  extraConfigMaps: []
-  ## Additional configmaps to the default backend pod.
-  #  - name: my-extra-configmap-1
-  #    labels:
-  #      type: config-1
-  #    data:
-  #      extra_file_1.html: |
-  #        <!-- Extra HTML content for ConfigMap 1 -->
-  #  - name: my-extra-configmap-2
-  #    labels:
-  #      type: config-2
-  #    data:
-  #      extra_file_2.html: |
-  #        <!-- Extra HTML content for ConfigMap 2 -->
-
-  autoscaling:
-    annotations: {}
-    enabled: false
-    minReplicas: 1
-    maxReplicas: 2
-    targetCPUUtilizationPercentage: 50
-    targetMemoryUtilizationPercentage: 50
-  # NetworkPolicy for default backend component.
-  networkPolicy:
-    # -- Enable 'networkPolicy' or not
-    enabled: false
-  service:
-    annotations: {}
-    # clusterIP: ""
-
-    # -- List of IP addresses at which the default backend service is available
-    ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-    ##
-    externalIPs: []
-    # loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    servicePort: 80
-    type: ClusterIP
-  priorityClassName: ""
-  # -- Labels to be added to the default backend resources
-  labels: {}
-## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
-rbac:
-  create: true
-  scope: false
-## If true, create & use Pod Security Policy resources
-## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
-podSecurityPolicy:
-  enabled: false
-serviceAccount:
-  create: true
-  name: ""
-  automountServiceAccountToken: true
-  # -- Annotations for the controller service account
-  annotations: {}
-# -- Optional array of imagePullSecrets containing private registry credentials
-## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-imagePullSecrets: []
-# - name: secretName
-
-# -- TCP service key-value pairs
-## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
-##
-tcp: {}
-#  "8080": "default/example-tcp-svc:9000"
-
-# -- UDP service key-value pairs
-## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
-##
-udp: {}
-#  "53": "kube-system/kube-dns:53"
-
-# -- Prefix for TCP and UDP ports names in ingress controller service
-## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
-portNamePrefix: ""
-# -- (string) A base64-encoded Diffie-Hellman parameter.
-# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
-## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
-dhParam: ""
diff --git a/base-kustomize/ingress/external/kustomization.yaml b/base-kustomize/ingress/external/kustomization.yaml
deleted file mode 100644
index 42615c0e..00000000
--- a/base-kustomize/ingress/external/kustomization.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-resources:
-  - ns-ingress-nginx.yaml
-
-helmCharts:
-  - name: ingress-nginx
-    releaseName: ingress-nginx
-    repo: https://kubernetes.github.io/ingress-nginx
-    valuesInline:
-      deployment:
-        cluster:
-          class: nginx-cluster
-    valuesFile: helm/ingress-helm-overrides.yaml
-    namespace: ingress-nginx
-    includeCRDs: true
diff --git a/base-kustomize/ingress/external/ns-ingress-nginx.yaml b/base-kustomize/ingress/external/ns-ingress-nginx.yaml
deleted file mode 100644
index d004d4df..00000000
--- a/base-kustomize/ingress/external/ns-ingress-nginx.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    kubernetes.io/metadata.name: ingress-nginx
-    name: ingress-nginx
-  name: ingress-nginx
diff --git a/base-kustomize/ingress/internal/helm/ingress-helm-overrides.yaml b/base-kustomize/ingress/internal/helm/ingress-helm-overrides.yaml
deleted file mode 100644
index 567dbaa1..00000000
--- a/base-kustomize/ingress/internal/helm/ingress-helm-overrides.yaml
+++ /dev/null
@@ -1,1103 +0,0 @@
-## nginx configuration
-## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/index.md
-##
-
-## Overrides for generated resource names
-# See templates/_helpers.tpl
-# nameOverride:
-# fullnameOverride:
-
-# -- Override the deployment namespace; defaults to .Release.Namespace
-namespaceOverride: ""
-## Labels to apply to all resources
-##
-commonLabels: {}
-# scmhash: abc123
-# myLabel: aakkmd
-
-controller:
-  name: controller
-  enableAnnotationValidations: false
-  image:
-    ## Keep false as default for now!
-    chroot: false
-    registry: registry.k8s.io
-    image: ingress-nginx/controller
-    ## for backwards compatibility consider setting the full image url via the repository value below
-    ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-    ## repository:
-    tag: "v1.10.1"
-    digest: sha256:e24f39d3eed6bcc239a56f20098878845f62baa34b9f2be2fd2c38ce9fb0f29e
-    digestChroot: sha256:c155954116b397163c88afcb3252462771bd7867017e8a17623e83601bab7ac7
-    pullPolicy: IfNotPresent
-    runAsNonRoot: true
-    # www-data -> uid 101
-    runAsUser: 101
-    allowPrivilegeEscalation: false
-    seccompProfile:
-      type: RuntimeDefault
-    readOnlyRootFilesystem: false
-  # -- Use an existing PSP instead of creating one
-  existingPsp: ""
-  # -- Configures the controller container name
-  containerName: controller
-  # -- Configures the ports that the nginx-controller listens on
-  containerPort:
-    http: 80
-    https: 443
-  # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
-  config: {}
-  # -- Annotations to be added to the controller config configuration configmap.
-  configAnnotations: {}
-  # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers
-  proxySetHeaders: {}
-  # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers
-  addHeaders: {}
-  # -- Optionally customize the pod dnsConfig.
-  dnsConfig: {}
-  # -- Optionally customize the pod hostAliases.
-  hostAliases: []
-  # - ip: 127.0.0.1
-  #   hostnames:
-  #   - foo.local
-  #   - bar.local
-  # - ip: 10.1.2.3
-  #   hostnames:
-  #   - foo.remote
-  #   - bar.remote
-  # -- Optionally customize the pod hostname.
-  hostname: {}
-  # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'.
-  # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller
-  # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet.
-  dnsPolicy: ClusterFirst
-  # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network
-  # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply
-  reportNodeInternalIp: false
-  # -- Process Ingress objects without ingressClass annotation/ingressClassName field
-  # Overrides value for --watch-ingress-without-class flag of the controller binary
-  # Defaults to false
-  watchIngressWithoutClass: false
-  # -- Process IngressClass per name (additionally as per spec.controller).
-  ingressClassByName: false
-  # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto"
-  # Defaults to false
-  enableTopologyAwareRouting: false
-  # -- This configuration defines if Ingress Controller should allow users to set
-  # their own *-snippet annotations, otherwise this is forbidden / dropped
-  # when users add those annotations.
-  # Global snippets in ConfigMap are still respected
-  allowSnippetAnnotations: false
-  # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm),
-  # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920
-  # is merged
-  hostNetwork: false
-  ## Use host ports 80 and 443
-  ## Disabled by default
-  hostPort:
-    # -- Enable 'hostPort' or not
-    enabled: false
-    ports:
-      # -- 'hostPort' http port
-      http: 80
-      # -- 'hostPort' https port
-      https: 443
-  # NetworkPolicy for controller component.
-  networkPolicy:
-    # -- Enable 'networkPolicy' or not
-    enabled: false
-  # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader'
-  electionID: ""
-  # -- This section refers to the creation of the IngressClass resource.
-  # IngressClasses are immutable and cannot be changed after creation.
-  # We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required.
-  ingressClassResource:
-    # -- Name of the IngressClass
-    name: nginx-openstack
-    # -- Create the IngressClass or not
-    enabled: true
-    # -- If true, Ingresses without `ingressClassName` get assigned to this IngressClass on creation.
-    # Ingress creation gets rejected if there are multiple default IngressClasses.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#default-ingress-class
-    default: false
-    # -- Controller of the IngressClass. An Ingress Controller looks for IngressClasses it should reconcile by this value.
-    # This value is also being set as the `--controller-class` argument of this Ingress Controller.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
-    controllerValue: k8s.io/ingress-nginx-openstack
-    # -- A link to a custom resource containing additional configuration for the controller.
-    # This is optional if the controller consuming this IngressClass does not require additional parameters.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#ingress-class
-    parameters: {}
-    # parameters:
-    #   apiGroup: k8s.example.com
-    #   kind: IngressParameters
-    #   name: external-lb
-  # -- For backwards compatibility with ingress.class annotation, use ingressClass.
-  # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation
-  ingressClass: nginx-openstack
-  # -- Labels to add to the pod container metadata
-  podLabels: {}
-  #  key: value
-
-  # -- Security context for controller pods
-  podSecurityContext: {}
-  # -- sysctls for controller pods
-  ## Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/
-  sysctls: {}
-  # sysctls:
-  #   "net.core.somaxconn": "8192"
-  # -- Security context for controller containers
-  containerSecurityContext: {}
-  # -- Allows customization of the source of the IP address or FQDN to report
-  # in the ingress status field. By default, it reads the information provided
-  # by the service. If disable, the status field reports the IP address of the
-  # node or nodes where an ingress controller pod is running.
-  publishService:
-    # -- Enable 'publishService' or not
-    enabled: true
-    # -- Allows overriding of the publish service to bind to
-    # Must be <namespace>/<service_name>
-    pathOverride: ""
-  # Limit the scope of the controller to a specific namespace
-  scope:
-    # -- Enable 'scope' or not
-    enabled: false
-    # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE)
-    namespace: ""
-    # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels
-    # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces.
-    namespaceSelector: ""
-  # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE)
-  configMapNamespace: ""
-  tcp:
-    # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE)
-    configMapNamespace: ""
-    # -- Annotations to be added to the tcp config configmap
-    annotations: {}
-  udp:
-    # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE)
-    configMapNamespace: ""
-    # -- Annotations to be added to the udp config configmap
-    annotations: {}
-  # -- Maxmind license key to download GeoLite2 Databases.
-  ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases
-  maxmindLicenseKey: ""
-  # -- Additional command line arguments to pass to Ingress-Nginx Controller
-  # E.g. to specify the default SSL certificate you can use
-  extraArgs: {}
-  ## extraArgs:
-  ##   default-ssl-certificate: "<namespace>/<secret_name>"
-  ##   time-buckets: "0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10"
-  ##   length-buckets: "10,20,30,40,50,60,70,80,90,100"
-  ##   size-buckets: "10,100,1000,10000,100000,1e+06,1e+07"
-
-  # -- Additional environment variables to set
-  extraEnvs: []
-  # extraEnvs:
-  #   - name: FOO
-  #     valueFrom:
-  #       secretKeyRef:
-  #         key: FOO
-  #         name: secret-resource
-
-  # -- Use a `DaemonSet` or `Deployment`
-  kind: Deployment
-  # -- Annotations to be added to the controller Deployment or DaemonSet
-  ##
-  annotations: {}
-  #  keel.sh/pollSchedule: "@every 60m"
-
-  # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels
-  ##
-  labels: {}
-  #  keel.sh/policy: patch
-  #  keel.sh/trigger: poll
-
-  # -- The update strategy to apply to the Deployment or DaemonSet
-  ##
-  updateStrategy: {}
-  #  rollingUpdate:
-  #    maxUnavailable: 1
-  #  type: RollingUpdate
-
-  # -- `minReadySeconds` to avoid killing pods before we are ready
-  ##
-  minReadySeconds: 0
-  # -- Node tolerations for server scheduling to nodes with taints
-  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-  ##
-  tolerations: []
-  #  - key: "key"
-  #    operator: "Equal|Exists"
-  #    value: "value"
-  #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
-
-  # -- Affinity and anti-affinity rules for server scheduling to nodes
-  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-  ##
-  affinity: {}
-  # # An example of preferred pod anti-affinity, weight is in the range 1-100
-  # podAntiAffinity:
-  #   preferredDuringSchedulingIgnoredDuringExecution:
-  #   - weight: 100
-  #     podAffinityTerm:
-  #       labelSelector:
-  #         matchExpressions:
-  #         - key: app.kubernetes.io/name
-  #           operator: In
-  #           values:
-  #           - ingress-nginx
-  #         - key: app.kubernetes.io/instance
-  #           operator: In
-  #           values:
-  #           - ingress-nginx
-  #         - key: app.kubernetes.io/component
-  #           operator: In
-  #           values:
-  #           - controller
-  #       topologyKey: kubernetes.io/hostname
-
-  # # An example of required pod anti-affinity
-  # podAntiAffinity:
-  #   requiredDuringSchedulingIgnoredDuringExecution:
-  #   - labelSelector:
-  #       matchExpressions:
-  #       - key: app.kubernetes.io/name
-  #         operator: In
-  #         values:
-  #         - ingress-nginx
-  #       - key: app.kubernetes.io/instance
-  #         operator: In
-  #         values:
-  #         - ingress-nginx
-  #       - key: app.kubernetes.io/component
-  #         operator: In
-  #         values:
-  #         - controller
-  #     topologyKey: "kubernetes.io/hostname"
-
-  # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in.
-  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-  ##
-  topologySpreadConstraints: []
-  # - labelSelector:
-  #     matchLabels:
-  #       app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
-  #       app.kubernetes.io/instance: '{{ .Release.Name }}'
-  #       app.kubernetes.io/component: controller
-  #   topologyKey: topology.kubernetes.io/zone
-  #   maxSkew: 1
-  #   whenUnsatisfiable: ScheduleAnyway
-  # - labelSelector:
-  #     matchLabels:
-  #       app.kubernetes.io/name: '{{ include "ingress-nginx.name" . }}'
-  #       app.kubernetes.io/instance: '{{ .Release.Name }}'
-  #       app.kubernetes.io/component: controller
-  #   topologyKey: kubernetes.io/hostname
-  #   maxSkew: 1
-  #   whenUnsatisfiable: ScheduleAnyway
-
-  # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready
-  ## wait up to five minutes for the drain of connections
-  ##
-  terminationGracePeriodSeconds: 300
-  # -- Node labels for controller pod assignment
-  ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
-  ##
-  nodeSelector:
-    kubernetes.io/os: linux
-  ## Liveness and readiness probe values
-  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
-  ##
-  ## startupProbe:
-  ##   httpGet:
-  ##     # should match container.healthCheckPath
-  ##     path: "/healthz"
-  ##     port: 10254
-  ##     scheme: HTTP
-  ##   initialDelaySeconds: 5
-  ##   periodSeconds: 5
-  ##   timeoutSeconds: 2
-  ##   successThreshold: 1
-  ##   failureThreshold: 5
-  livenessProbe:
-    httpGet:
-      # should match container.healthCheckPath
-      path: "/healthz"
-      port: 10254
-      scheme: HTTP
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 1
-    successThreshold: 1
-    failureThreshold: 5
-  readinessProbe:
-    httpGet:
-      # should match container.healthCheckPath
-      path: "/healthz"
-      port: 10254
-      scheme: HTTP
-    initialDelaySeconds: 10
-    periodSeconds: 10
-    timeoutSeconds: 1
-    successThreshold: 1
-    failureThreshold: 3
-  # -- Path of the health check endpoint. All requests received on the port defined by
-  # the healthz-port parameter are forwarded internally to this path.
-  healthCheckPath: "/healthz"
-  # -- Address to bind the health check endpoint.
-  # It is better to set this option to the internal node address
-  # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode.
-  healthCheckHost: ""
-  # -- Annotations to be added to controller pods
-  ##
-  podAnnotations: {}
-  replicaCount: 1
-  # -- Minimum available pods set in PodDisruptionBudget.
-  # Define either 'minAvailable' or 'maxUnavailable', never both.
-  minAvailable: 1
-  # -- Maximum unavailable pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored.
-  # maxUnavailable: 1
-
-  ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes
-  ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903
-  ## Ideally, there should be no limits.
-  ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/
-  resources:
-    ##  limits:
-    ##    cpu: 100m
-    ##    memory: 90Mi
-    requests:
-      cpu: 100m
-      memory: 90Mi
-  # Mutually exclusive with keda autoscaling
-  autoscaling:
-    enabled: false
-    annotations: {}
-    minReplicas: 1
-    maxReplicas: 11
-    targetCPUUtilizationPercentage: 50
-    targetMemoryUtilizationPercentage: 50
-    behavior: {}
-    # scaleDown:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 1
-    #     periodSeconds: 180
-    # scaleUp:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 2
-    #     periodSeconds: 60
-  autoscalingTemplate: []
-  # Custom or additional autoscaling metrics
-  # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics
-  # - type: Pods
-  #   pods:
-  #     metric:
-  #       name: nginx_ingress_controller_nginx_process_requests_total
-  #     target:
-  #       type: AverageValue
-  #       averageValue: 10000m
-
-  # Mutually exclusive with hpa autoscaling
-  keda:
-    apiVersion: "keda.sh/v1alpha1"
-    ## apiVersion changes with keda 1.x vs 2.x
-    ## 2.x = keda.sh/v1alpha1
-    ## 1.x = keda.k8s.io/v1alpha1
-    enabled: false
-    minReplicas: 1
-    maxReplicas: 11
-    pollingInterval: 30
-    cooldownPeriod: 300
-    # fallback:
-    #   failureThreshold: 3
-    #   replicas: 11
-    restoreToOriginalReplicaCount: false
-    scaledObject:
-      annotations: {}
-      # Custom annotations for ScaledObject resource
-      #  annotations:
-      # key: value
-    triggers: []
-    # - type: prometheus
-    #   metadata:
-    #     serverAddress: http://<prometheus-host>:9090
-    #     metricName: http_requests_total
-    #     threshold: '100'
-    #     query: sum(rate(http_requests_total{deployment="my-deployment"}[2m]))
-
-    behavior: {}
-    # scaleDown:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 1
-    #     periodSeconds: 180
-    # scaleUp:
-    #   stabilizationWindowSeconds: 300
-    #   policies:
-    #   - type: Pods
-    #     value: 2
-    #     periodSeconds: 60
-  # -- Enable mimalloc as a drop-in replacement for malloc.
-  ## ref: https://github.com/microsoft/mimalloc
-  ##
-  enableMimalloc: true
-  ## Override NGINX template
-  customTemplate:
-    configMapName: ""
-    configMapKey: ""
-  service:
-    # -- Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service.
-    enabled: true
-    external:
-      # -- Enable the external controller service or not. Useful for internal-only deployments.
-      enabled: true
-    # -- Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service.
-    annotations: {}
-    # -- Labels to be added to both controller services.
-    labels: {}
-    # -- Type of the external controller service.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
-    type: LoadBalancer
-    # -- Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services.
-    # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
-    clusterIP: ""
-    # -- List of node IP addresses at which the external controller service is available.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-    externalIPs: []
-    # -- Deprecated: Pre-defined IP address of the external controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
-    loadBalancerIP: ""
-    # -- Restrict access to the external controller service. Values must be CIDRs. Allows any source address by default.
-    loadBalancerSourceRanges: []
-    # -- Load balancer class of the external controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
-    loadBalancerClass: ""
-    # -- Enable node port allocation for the external controller service or not. Applies to type `LoadBalancer` only.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation
-    # allocateLoadBalancerNodePorts: true
-
-    # -- External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it.
-    # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-    externalTrafficPolicy: ""
-    # -- Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
-    # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
-    sessionAffinity: ""
-    # -- Specifies the health check node port (numeric port number) for the external controller service.
-    # If not specified, the service controller allocates a port from your cluster's node port range.
-    # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-    # healthCheckNodePort: 0
-
-    # -- Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
-    # Fields `ipFamilies` and `clusterIP` depend on the value of this field.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-    ipFamilyPolicy: SingleStack
-    # -- List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-    ipFamilies:
-      - IPv4
-    # -- Enable the HTTP listener on both controller services or not.
-    enableHttp: true
-    # -- Enable the HTTPS listener on both controller services or not.
-    enableHttps: true
-    ports:
-      # -- Port the external HTTP listener is published with.
-      http: 80
-      # -- Port the external HTTPS listener is published with.
-      https: 443
-    targetPorts:
-      # -- Port of the ingress controller the external HTTP listener is mapped to.
-      http: http
-      # -- Port of the ingress controller the external HTTPS listener is mapped to.
-      https: https
-    # -- Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.
-    # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
-    appProtocol: true
-    nodePorts:
-      # -- Node port allocated for the external HTTP listener. If left empty, the service controller allocates one from the configured node port range.
-      http: ""
-      # -- Node port allocated for the external HTTPS listener. If left empty, the service controller allocates one from the configured node port range.
-      https: ""
-      # -- Node port mapping for external TCP listeners. If left empty, the service controller allocates them from the configured node port range.
-      # Example:
-      # tcp:
-      #   8080: 30080
-      tcp: {}
-      # -- Node port mapping for external UDP listeners. If left empty, the service controller allocates them from the configured node port range.
-      # Example:
-      # udp:
-      #   53: 30053
-      udp: {}
-    internal:
-      # -- Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this.
-      enabled: false
-      # -- Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer
-      annotations: {}
-      # -- Type of the internal controller service.
-      # Defaults to the value of `controller.service.type`.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types
-      type: ""
-      # -- Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services.
-      # This value is immutable. Set once, it can not be changed without deleting and re-creating the service.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address
-      clusterIP: ""
-      # -- List of node IP addresses at which the internal controller service is available.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-      externalIPs: []
-      # -- Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
-      loadBalancerIP: ""
-      # -- Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default.
-      loadBalancerSourceRanges: []
-      # -- Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class
-      loadBalancerClass: ""
-      # -- Enable node port allocation for the internal controller service or not. Applies to type `LoadBalancer` only.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-nodeport-allocation
-      # allocateLoadBalancerNodePorts: true
-
-      # -- External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it.
-      # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-      externalTrafficPolicy: ""
-      # -- Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None".
-      # Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity
-      sessionAffinity: ""
-      # -- Specifies the health check node port (numeric port number) for the internal controller service.
-      # If not specified, the service controller allocates a port from your cluster's node port range.
-      # Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip
-      # healthCheckNodePort: 0
-
-      # -- Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack.
-      # Fields `ipFamilies` and `clusterIP` depend on the value of this field.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-      ipFamilyPolicy: SingleStack
-      # -- List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services
-      ipFamilies:
-        - IPv4
-      ports: {}
-      # -- Port the internal HTTP listener is published with.
-      # Defaults to the value of `controller.service.ports.http`.
-      # http: 80
-      # -- Port the internal HTTPS listener is published with.
-      # Defaults to the value of `controller.service.ports.https`.
-      # https: 443
-
-      targetPorts: {}
-      # -- Port of the ingress controller the internal HTTP listener is mapped to.
-      # Defaults to the value of `controller.service.targetPorts.http`.
-      # http: http
-      # -- Port of the ingress controller the internal HTTPS listener is mapped to.
-      # Defaults to the value of `controller.service.targetPorts.https`.
-      # https: https
-
-      # -- Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol.
-      # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol
-      appProtocol: true
-      nodePorts:
-        # -- Node port allocated for the internal HTTP listener. If left empty, the service controller allocates one from the configured node port range.
-        http: ""
-        # -- Node port allocated for the internal HTTPS listener. If left empty, the service controller allocates one from the configured node port range.
-        https: ""
-        # -- Node port mapping for internal TCP listeners. If left empty, the service controller allocates them from the configured node port range.
-        # Example:
-        # tcp:
-        #   8080: 30080
-        tcp: {}
-        # -- Node port mapping for internal UDP listeners. If left empty, the service controller allocates them from the configured node port range.
-        # Example:
-        # udp:
-        #   53: 30053
-        udp: {}
-  # shareProcessNamespace enables process namespace sharing within the pod.
-  # This can be used for example to signal log rotation using `kill -USR1` from a sidecar.
-  shareProcessNamespace: false
-  # -- Additional containers to be added to the controller pod.
-  # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example.
-  extraContainers: []
-  #  - name: my-sidecar
-  #    image: nginx:latest
-  #  - name: lemonldap-ng-controller
-  #    image: lemonldapng/lemonldap-ng-controller:0.2.0
-  #    args:
-  #      - /lemonldap-ng-controller
-  #      - --alsologtostderr
-  #      - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration
-  #    env:
-  #      - name: POD_NAME
-  #        valueFrom:
-  #          fieldRef:
-  #            fieldPath: metadata.name
-  #      - name: POD_NAMESPACE
-  #        valueFrom:
-  #          fieldRef:
-  #            fieldPath: metadata.namespace
-  #    volumeMounts:
-  #    - name: copy-portal-skins
-  #      mountPath: /srv/var/lib/lemonldap-ng/portal/skins
-
-  # -- Additional volumeMounts to the controller main container.
-  extraVolumeMounts: []
-  #  - name: copy-portal-skins
-  #   mountPath: /var/lib/lemonldap-ng/portal/skins
-
-  # -- Additional volumes to the controller pod.
-  extraVolumes: []
-  #  - name: copy-portal-skins
-  #    emptyDir: {}
-
-  # -- Containers, which are run before the app containers are started.
-  extraInitContainers: []
-  # - name: init-myservice
-  #   image: busybox
-  #   command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;']
-
-  # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module
-  extraModules: []
-  # - name: mytestmodule
-  #   image:
-  #     registry: registry.k8s.io
-  #     image: ingress-nginx/mytestmodule
-  #     ## for backwards compatibility consider setting the full image url via the repository value below
-  #     ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-  #     ## repository:
-  #     tag: "v1.0.0"
-  #     digest: ""
-  #     distroless: false
-  #   containerSecurityContext:
-  #     runAsNonRoot: true
-  #     runAsUser: <user-id>
-  #     allowPrivilegeEscalation: false
-  #     seccompProfile:
-  #       type: RuntimeDefault
-  #     capabilities:
-  #       drop:
-  #       - ALL
-  #     readOnlyRootFilesystem: true
-  #   resources: {}
-  #
-  # The image must contain a `/usr/local/bin/init_module.sh` executable, which
-  # will be executed as initContainers, to move its config files within the
-  # mounted volume.
-
-  opentelemetry:
-    enabled: false
-    name: opentelemetry
-    image:
-      registry: registry.k8s.io
-      image: ingress-nginx/opentelemetry
-      ## for backwards compatibility consider setting the full image url via the repository value below
-      ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-      ## repository:
-      tag: "v20230721-3e2062ee5"
-      digest: sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
-      distroless: true
-    containerSecurityContext:
-      runAsNonRoot: true
-      # -- The image's default user, inherited from its base image `cgr.dev/chainguard/static`.
-      runAsUser: 65532
-      allowPrivilegeEscalation: false
-      seccompProfile:
-        type: RuntimeDefault
-      capabilities:
-        drop:
-          - ALL
-      readOnlyRootFilesystem: true
-    resources: {}
-  admissionWebhooks:
-    name: admission
-    annotations: {}
-    # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem".
-
-    ## Additional annotations to the admission webhooks.
-    ## These annotations will be added to the ValidatingWebhookConfiguration and
-    ## the Jobs Spec of the admission webhooks.
-    enabled: true
-    # -- Additional environment variables to set
-    extraEnvs: []
-    # extraEnvs:
-    #   - name: FOO
-    #     valueFrom:
-    #       secretKeyRef:
-    #         key: FOO
-    #         name: secret-resource
-    # -- Admission Webhook failure policy to use
-    failurePolicy: Fail
-    # timeoutSeconds: 10
-    port: 8443
-    certificate: "/usr/local/certificates/cert"
-    key: "/usr/local/certificates/key"
-    namespaceSelector: {}
-    objectSelector: {}
-    # -- Labels to be added to admission webhooks
-    labels: {}
-    # -- Use an existing PSP instead of creating one
-    existingPsp: ""
-    service:
-      annotations: {}
-      # clusterIP: ""
-      externalIPs: []
-      # loadBalancerIP: ""
-      loadBalancerSourceRanges: []
-      servicePort: 443
-      type: ClusterIP
-    createSecretJob:
-      name: create
-      # -- Security context for secret creation containers
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        allowPrivilegeEscalation: false
-        seccompProfile:
-          type: RuntimeDefault
-        capabilities:
-          drop:
-            - ALL
-        readOnlyRootFilesystem: true
-      resources: {}
-      # limits:
-      #   cpu: 10m
-      #   memory: 20Mi
-      # requests:
-      #   cpu: 10m
-      #   memory: 20Mi
-    patchWebhookJob:
-      name: patch
-      # -- Security context for webhook patch containers
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        allowPrivilegeEscalation: false
-        seccompProfile:
-          type: RuntimeDefault
-        capabilities:
-          drop:
-            - ALL
-        readOnlyRootFilesystem: true
-      resources: {}
-    patch:
-      enabled: true
-      image:
-        registry: registry.k8s.io
-        image: ingress-nginx/kube-webhook-certgen
-        ## for backwards compatibility consider setting the full image url via the repository value below
-        ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-        ## repository:
-        tag: v1.4.1
-        digest: sha256:36d05b4077fb8e3d13663702fa337f124675ba8667cbd949c03a8e8ea6fa4366
-        pullPolicy: IfNotPresent
-      # -- Provide a priority class name to the webhook patching job
-      ##
-      priorityClassName: ""
-      podAnnotations: {}
-      # NetworkPolicy for webhook patch
-      networkPolicy:
-        # -- Enable 'networkPolicy' or not
-        enabled: false
-      nodeSelector:
-        kubernetes.io/os: linux
-      tolerations: []
-      # -- Labels to be added to patch job resources
-      labels: {}
-      # -- Security context for secret creation & webhook patch pods
-      securityContext: {}
-    # Use certmanager to generate webhook certs
-    certManager:
-      enabled: false
-      # self-signed root certificate
-      rootCert:
-        # default to be 5y
-        duration: ""
-      admissionCert:
-        # default to be 1y
-        duration: ""
-        # issuerRef:
-        #   name: "issuer"
-        #   kind: "ClusterIssuer"
-  metrics:
-    port: 10254
-    portName: metrics
-    # if this port is changed, change healthz-port: in extraArgs: accordingly
-    enabled: false
-    service:
-      annotations: {}
-      # prometheus.io/scrape: "true"
-      # prometheus.io/port: "10254"
-      # -- Labels to be added to the metrics service resource
-      labels: {}
-      # clusterIP: ""
-
-      # -- List of IP addresses at which the stats-exporter service is available
-      ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-      ##
-      externalIPs: []
-      # loadBalancerIP: ""
-      loadBalancerSourceRanges: []
-      servicePort: 10254
-      type: ClusterIP
-      # externalTrafficPolicy: ""
-      # nodePort: ""
-    serviceMonitor:
-      enabled: false
-      additionalLabels: {}
-      annotations: {}
-      ## The label to use to retrieve the job name from.
-      ## jobLabel: "app.kubernetes.io/name"
-      namespace: ""
-      namespaceSelector: {}
-      ## Default: scrape .Release.Namespace or namespaceOverride only
-      ## To scrape all, use the following:
-      ## namespaceSelector:
-      ##   any: true
-      scrapeInterval: 30s
-      # honorLabels: true
-      targetLabels: []
-      relabelings: []
-      metricRelabelings: []
-    prometheusRule:
-      enabled: false
-      additionalLabels: {}
-      # namespace: ""
-      rules: []
-      # # These are just examples rules, please adapt them to your needs
-      # - alert: NGINXConfigFailed
-      #   expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0
-      #   for: 1s
-      #   labels:
-      #     severity: critical
-      #   annotations:
-      #     description: bad ingress config - nginx config test failed
-      #     summary: uninstall the latest ingress changes to allow config reloads to resume
-      # # By default a fake self-signed certificate is generated as default and
-      # # it is fine if it expires. If `--default-ssl-certificate` flag is used
-      # # and a valid certificate passed please do not filter for `host` label!
-      # # (i.e. delete `{host!="_"}` so also the default SSL certificate is
-      # # checked for expiration)
-      # - alert: NGINXCertificateExpiry
-      #   expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds{host!="_"}) by (host) - time()) < 604800
-      #   for: 1s
-      #   labels:
-      #     severity: critical
-      #   annotations:
-      #     description: ssl certificate(s) will expire in less then a week
-      #     summary: renew expiring certificates to avoid downtime
-      # - alert: NGINXTooMany500s
-      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
-      #   for: 1m
-      #   labels:
-      #     severity: warning
-      #   annotations:
-      #     description: Too many 5XXs
-      #     summary: More than 5% of all requests returned 5XX, this requires your attention
-      # - alert: NGINXTooMany400s
-      #   expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5
-      #   for: 1m
-      #   labels:
-      #     severity: warning
-      #   annotations:
-      #     description: Too many 4XXs
-      #     summary: More than 5% of all requests returned 4XX, this requires your attention
-  # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook:
-  # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds
-  # to 300, allowing the draining of connections up to five minutes.
-  # If the active connections end before that, the pod will terminate gracefully at that time.
-  # To effectively take advantage of this feature, the Configmap feature
-  # worker-shutdown-timeout new value is 240s instead of 10s.
-  ##
-  lifecycle:
-    preStop:
-      exec:
-        command:
-          - /wait-shutdown
-  priorityClassName: ""
-# -- Rollback limit
-##
-revisionHistoryLimit: 10
-## Default 404 backend
-##
-defaultBackend:
-  ##
-  enabled: false
-  name: defaultbackend
-  image:
-    registry: registry.k8s.io
-    image: defaultbackend-amd64
-    ## for backwards compatibility consider setting the full image url via the repository value below
-    ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
-    ## repository:
-    tag: "1.5"
-    pullPolicy: IfNotPresent
-    runAsNonRoot: true
-    # nobody user -> uid 65534
-    runAsUser: 65534
-    allowPrivilegeEscalation: false
-    seccompProfile:
-      type: RuntimeDefault
-    readOnlyRootFilesystem: true
-  # -- Use an existing PSP instead of creating one
-  existingPsp: ""
-  extraArgs: {}
-  serviceAccount:
-    create: true
-    name: ""
-    automountServiceAccountToken: true
-  # -- Additional environment variables to set for defaultBackend pods
-  extraEnvs: []
-  port: 8080
-  ## Readiness and liveness probes for default backend
-  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
-  ##
-  livenessProbe:
-    failureThreshold: 3
-    initialDelaySeconds: 30
-    periodSeconds: 10
-    successThreshold: 1
-    timeoutSeconds: 5
-  readinessProbe:
-    failureThreshold: 6
-    initialDelaySeconds: 0
-    periodSeconds: 5
-    successThreshold: 1
-    timeoutSeconds: 5
-  # -- The update strategy to apply to the Deployment or DaemonSet
-  ##
-  updateStrategy: {}
-  #  rollingUpdate:
-  #    maxUnavailable: 1
-  #  type: RollingUpdate
-
-  # -- `minReadySeconds` to avoid killing pods before we are ready
-  ##
-  minReadySeconds: 0
-  # -- Node tolerations for server scheduling to nodes with taints
-  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
-  ##
-  tolerations: []
-  #  - key: "key"
-  #    operator: "Equal|Exists"
-  #    value: "value"
-  #    effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)"
-
-  affinity: {}
-  # -- Security context for default backend pods
-  podSecurityContext: {}
-  # -- Security context for default backend containers
-  containerSecurityContext: {}
-  # -- Labels to add to the pod container metadata
-  podLabels: {}
-  #  key: value
-
-  # -- Node labels for default backend pod assignment
-  ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/
-  ##
-  nodeSelector:
-    kubernetes.io/os: linux
-  # -- Annotations to be added to default backend pods
-  ##
-  podAnnotations: {}
-  replicaCount: 1
-  minAvailable: 1
-  resources: {}
-  # limits:
-  #   cpu: 10m
-  #   memory: 20Mi
-  # requests:
-  #   cpu: 10m
-  #   memory: 20Mi
-
-  extraVolumeMounts: []
-  ## Additional volumeMounts to the default backend container.
-  #  - name: copy-portal-skins
-  #   mountPath: /var/lib/lemonldap-ng/portal/skins
-
-  extraVolumes: []
-  ## Additional volumes to the default backend pod.
-  #  - name: copy-portal-skins
-  #    emptyDir: {}
-
-  extraConfigMaps: []
-  ## Additional configmaps to the default backend pod.
-  #  - name: my-extra-configmap-1
-  #    labels:
-  #      type: config-1
-  #    data:
-  #      extra_file_1.html: |
-  #        <!-- Extra HTML content for ConfigMap 1 -->
-  #  - name: my-extra-configmap-2
-  #    labels:
-  #      type: config-2
-  #    data:
-  #      extra_file_2.html: |
-  #        <!-- Extra HTML content for ConfigMap 2 -->
-
-  autoscaling:
-    annotations: {}
-    enabled: false
-    minReplicas: 1
-    maxReplicas: 2
-    targetCPUUtilizationPercentage: 50
-    targetMemoryUtilizationPercentage: 50
-  # NetworkPolicy for default backend component.
-  networkPolicy:
-    # -- Enable 'networkPolicy' or not
-    enabled: false
-  service:
-    annotations: {}
-    # clusterIP: ""
-
-    # -- List of IP addresses at which the default backend service is available
-    ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-    ##
-    externalIPs: []
-    # loadBalancerIP: ""
-    loadBalancerSourceRanges: []
-    servicePort: 80
-    type: ClusterIP
-  priorityClassName: ""
-  # -- Labels to be added to the default backend resources
-  labels: {}
-## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266
-rbac:
-  create: true
-  scope: false
-## If true, create & use Pod Security Policy resources
-## https://kubernetes.io/docs/concepts/policy/pod-security-policy/
-podSecurityPolicy:
-  enabled: false
-serviceAccount:
-  create: true
-  name: ""
-  automountServiceAccountToken: true
-  # -- Annotations for the controller service account
-  annotations: {}
-# -- Optional array of imagePullSecrets containing private registry credentials
-## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-imagePullSecrets: []
-# - name: secretName
-
-# -- TCP service key-value pairs
-## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
-##
-tcp: {}
-#  "8080": "default/example-tcp-svc:9000"
-
-# -- UDP service key-value pairs
-## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md
-##
-udp: {}
-#  "53": "kube-system/kube-dns:53"
-
-# -- Prefix for TCP and UDP ports names in ingress controller service
-## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration
-portNamePrefix: ""
-# -- (string) A base64-encoded Diffie-Hellman parameter.
-# This can be generated with: `openssl dhparam 4096 2> /dev/null | base64`
-## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param
-dhParam: ""
diff --git a/base-kustomize/ingress/internal/kustomization.yaml b/base-kustomize/ingress/internal/kustomization.yaml
deleted file mode 100644
index e2c2d836..00000000
--- a/base-kustomize/ingress/internal/kustomization.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-helmCharts:
-  - name: ingress-nginx
-    releaseName: ingress-openstack-internal
-    repo: https://kubernetes.github.io/ingress-nginx
-    valuesInline:
-      deployment:
-        cluster:
-          class: nginx
-    valuesFile: helm/ingress-helm-overrides.yaml
-    namespace: openstack
-    includeCRDs: true
diff --git a/base-kustomize/keystone/letsencrypt/kustomization.yaml b/base-kustomize/keystone/letsencrypt/kustomization.yaml
deleted file mode 100644
index 394f3d8e..00000000
--- a/base-kustomize/keystone/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: keystone-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/neutron/letsencrypt/kustomization.yaml b/base-kustomize/neutron/letsencrypt/kustomization.yaml
deleted file mode 100644
index 1e6b4270..00000000
--- a/base-kustomize/neutron/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: neutron-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/nova/letsencrypt/kustomization.yaml b/base-kustomize/nova/letsencrypt/kustomization.yaml
deleted file mode 100644
index 57a890ec..00000000
--- a/base-kustomize/nova/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: nova-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
-  - target:
-      kind: Ingress
-      name: metadata-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
-  - target:
-      kind: Ingress
-      name: novncproxy-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/octavia/letsencrypt/kustomization.yaml b/base-kustomize/octavia/letsencrypt/kustomization.yaml
deleted file mode 100644
index c6b2199f..00000000
--- a/base-kustomize/octavia/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: octavia-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/placement/letsencrypt/kustomization.yaml b/base-kustomize/placement/letsencrypt/kustomization.yaml
deleted file mode 100644
index 0c6295f8..00000000
--- a/base-kustomize/placement/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: placement-namespace-fqdn
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/skyline/base/ingress-apiserver.yaml b/base-kustomize/skyline/base/ingress-apiserver.yaml
deleted file mode 100644
index d4391c85..00000000
--- a/base-kustomize/skyline/base/ingress-apiserver.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: skyline
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/rewrite-target: /
-spec:
-  ingressClassName: "nginx"
-  rules:
-    - host: skyline
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: skyline-apiserver
-                port:
-                  name: "s-apiserver"
-    - host: skyline.openstack
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: skyline-apiserver
-                port:
-                  name: "s-apiserver"
-    - host: skyline.openstack.svc.cluster.local
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: skyline-apiserver
-                port:
-                  name: "s-apiserver"
diff --git a/base-kustomize/skyline/base/kustomization.yaml b/base-kustomize/skyline/base/kustomization.yaml
index b98ec8f4..92fa6202 100644
--- a/base-kustomize/skyline/base/kustomization.yaml
+++ b/base-kustomize/skyline/base/kustomization.yaml
@@ -3,7 +3,6 @@ resources:
   - services.yaml
   - configmap-bin.yaml
   - deployment-apiserver.yaml
-  - ingress-apiserver.yaml
   - hpa-skyline-apiserver.yaml
   - pdb-apiserver.yaml
   - skyline-routes.yaml
diff --git a/base-kustomize/skyline/fqdn/kustomization.yaml b/base-kustomize/skyline/fqdn/kustomization.yaml
deleted file mode 100644
index ac4f2c4f..00000000
--- a/base-kustomize/skyline/fqdn/kustomization.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-bases:
-  - ../base
-
-patches:
-  - target:
-      kind: Ingress
-      name: skyline
-    patch: |-
-      - op: add
-        path: /spec/rules
-        value:
-          - host: dfw-ospcv2-staging.ohthree.com
-            http:
-              paths:
-                - path: /
-                  pathType: ImplementationSpecific
-                  backend:
-                    service:
-                      name: skyline-apiserver
-                      port:
-                        name: "s-apiserver"
-      - op: add
-        path: /spec/tls
-        value:
-          - hosts:
-            - dfw-ospcv2-staging.ohthree.com
-            secretName: horizon-tls-public
diff --git a/base-kustomize/skyline/letsencrypt/kustomization.yaml b/base-kustomize/skyline/letsencrypt/kustomization.yaml
deleted file mode 100644
index e6271803..00000000
--- a/base-kustomize/skyline/letsencrypt/kustomization.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-bases:
-  - ../fqdn
-
-patches:
-  - target:
-      kind: Ingress
-      name: skyline
-    patch: |-
-      - op: add
-        path: /metadata/annotations
-        value:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          acme.cert-manager.io/http01-edit-in-place: "true"
diff --git a/base-kustomize/vault/base/values.yaml b/base-kustomize/vault/base/values.yaml
index 2ccfd96d..34bead7e 100644
--- a/base-kustomize/vault/base/values.yaml
+++ b/base-kustomize/vault/base/values.yaml
@@ -408,7 +408,7 @@ server:
   # If deployment is on OpenShift, the following block is ignored.
   # In order to expose the service, use the route section below
   ingress:
-    enabled: true
+    enabled: false
     labels: {}
       # traffic: external
     annotations:
diff --git a/docs/build-local-images.md b/docs/build-local-images.md
deleted file mode 100644
index 2f73ab33..00000000
--- a/docs/build-local-images.md
+++ /dev/null
@@ -1,54 +0,0 @@
-# Building Custom Images
-
-## Octavia OVN with customer providers
-
-By default Octavia will run with Amphora, however, because we've OVN available to our environment we can also configure the OVN provider for use within the cluster. While the genestack defaults will include a container image that meets our needs, the following snippet will walk you through the manual build process making use of the internal kubernetes registry.
-
-``` shell
-# Pre-made container files for build purposes can be found within the repo.
-cd /opt/genestack/Containerfiles
-
-# Install buildah.
-apt update
-apt -y install buildah
-
-# Build the ovn integration into the ovn release image. Note the version argument.
-# this option is variable and should be adjusted for your specific needs.
-buildah build -f OctaviaOVN-Containerfile --build-arg VERSION=master-ubuntu_jammy
-# List the local images to get the IP of the new image.
-buildah images
-
-REPOSITORY               TAG                   IMAGE ID         CREATED          SIZE
-<none>                   <none>                THISISTHENEWIMG  11 minutes ago   388 MB
-docker.io/loci/octavia   master-ubuntu_jammy   THISISTHEBASE    3 weeks ago      323 MB
-
-# Push the new image to our internal registry.
-buildah push --tls-verify=false THISISTHENEWIMG docker://registry.kube-system/octavia:ubuntu_jammy-ovn
-
-# You can validate that the image is present.
-curl -k https://registry.kube-system/v2/_catalog
-
-# Create an override file.
-cat > /opt/octavia-ovn-helm-overrides.yaml <<EOF
-images:
-  tags:
-    octavia_db_sync: registry.kube-system/octavia:ubuntu_jammy-ovn
-    octavia_api: registry.kube-system/octavia:ubuntu_jammy-ovn
-    octavia_worker: registry.kube-system/octavia:ubuntu_jammy-ovn
-    octavia_housekeeping: registry.kube-system/octavia:ubuntu_jammy-ovn
-    octavia_health_manager: registry.kube-system/octavia:ubuntu_jammy-ovn
-EOF
-
-# Retrieve the registry CA
-kubectl --namespace kube-system get secret registry-kube-system-cert -o jsonpath='{.data.ca\.crt}' | base64 -d > /opt/registry.ca
-```
-
-!!! note
-
-    the above commands make the assumption that you're running a docker registry within the kube-system namespace and are running the provided genestack ingress definition to support that environment. If you have a different registry you will need to adjust the commands to fit your environment.
-
-Once the above commands have been executed, the file `/opt/octavia-ovn-helm-overrides.yaml` will be present and can be included in our helm command when we deploy Octavia.
-
-!!! tip
-
-    If you're using the local registry with a self-signed certificate, you will need to include the CA `/opt/registry.ca` in all of your potential worker nodes so that the container image is able to be pulled.
diff --git a/docs/infrastructure-ingress.md b/docs/infrastructure-ingress.md
deleted file mode 100644
index 453fb720..00000000
--- a/docs/infrastructure-ingress.md
+++ /dev/null
@@ -1,35 +0,0 @@
-# Deploy the ingress controllers
-
-!!! tip
-
-    When deploying Ingress for the first time, make sure to build the helm charts. Information on building the helm charts can be [found here](openstack-helm-make.md).
-
-We need two different Ingress controllers, one in the `openstack` namespace, the other in the `ingress-nginx` namespace. The `openstack` controller is for east-west connectivity, the `ingress-nginx` controller is for north-south.
-
-### Deploy our ingress controller within the ingress-nginx Namespace
-
-``` shell
-kubectl kustomize --enable-helm /opt/genestack/base-kustomize/ingress/external | kubectl apply --namespace ingress-nginx -f -
-```
-
-### Deploy our ingress controller within the OpenStack Namespace
-
-``` shell
-kubectl kustomize --enable-helm /opt/genestack/base-kustomize/ingress/internal | kubectl apply --namespace openstack -f -
-```
-
-The openstack ingress controller uses the class name `nginx-openstack`.
-
-#### Patching the ingress ConfigMap
-
-Sometimes you may need to make an update to your ingress setup which is managed in the ConfigMaps.
-
-!!! example "Patching the worker processes"
-
-    ``` shell
-    kubectl -n ${NAMESPACE} patch configmaps ingress-conf -p '{"data": {"worker-processes": "8"}}'
-    ```
-
-!!! note
-
-    If you make a system level change in the ConfigMap you will need to recreate the pods.
diff --git a/manifests/registry/ingress.yaml b/manifests/registry/ingress.yaml
deleted file mode 100644
index f05a5026..00000000
--- a/manifests/registry/ingress.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: selfsigned-cluster-issuer
-    nginx.ingress.kubernetes.io/rewrite-target: /
-    nginx.ingress.kubernetes.io/proxy-body-size: "500m"
-  name: registry
-  namespace: kube-system
-spec:
-  ingressClassName: nginx-system
-  rules:
-    - host: registry.kube-system
-      http:
-        paths:
-          - backend:
-              service:
-                name: registry
-                port:
-                  name: registry
-            path: /
-            pathType: ImplementationSpecific
-  tls: # < placing a host in the TLS config will determine what ends up in the cert's subjectAltNames
-    - hosts:
-        - registry.kube-system
-      secretName: registry-kube-system-cert
diff --git a/mkdocs.yml b/mkdocs.yml
index fc557de0..070e6abb 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -161,7 +161,7 @@ nav:
           - Infrastructure:
               - infrastructure-overview.md
               - Namespace: infrastructure-namespace.md
-              - Ingress: infrastructure-ingress.md
+              - Gateway API: infrastructure-gateway-api.md
               - LetsEncrypt: infrastructure-letsencrypt.md
               - MariaDB:
                   - infrastructure-mariadb.md
@@ -171,7 +171,6 @@ nav:
               - Libvirt: infrastructure-libvirt.md
               - OVN: infrastructure-ovn-setup.md
               - MetalLB: infrastructure-metallb.md
-              - Gateway API: infrastructure-gateway-api.md
               - Loki: infrastructure-loki.md
           - OpenStack:
               - openstack-overview.md
@@ -216,7 +215,6 @@ nav:
           - OVN traffic flow introduction: ovn-traffic-flow-intro.md
           - OVN Database Backup: infrastructure-ovn-db-backup.md
           - MariaDB Operations: infrastructure-mariadb-ops.md
-          - Building Local Images: build-local-images.md
       - Third Party Tools:
           - OSIE: extra-osie.md
       - OpenStack: