# How to handle Ingress annotations mentioned below

**URL:** <https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258>\
**Category:** NGINX Gateway Fabric\
**Tags:** ingress-nginx, annotations, nginx-gateway-fabric, reverse-proxy\
**Created:** [April 7, 2026, 7:01am UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258 "2026-04-07T07:01:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rajasekhar.yannam](https://avatars.discourse-cdn.com/v4/letter/r/91b2a8/32.png) [@rajasekhar.yannam](https://community.nginx.org/u/rajasekhar.yannam)\
**Post date:** [April 7, 2026, 7:01am UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258/1 "2026-04-07T07:01:01Z")

</div>

_Please use this template for troubleshooting questions._

**My issue: I am able to address below annotations in the HTTPRoute or Gateway.**

> apiVersion: [networking.k8s.io/v1](http://networking.k8s.io/v1)  
> kind: Ingress  
> metadata:  
> annotations:  
> meta.helm.sh/release-name: dev-dc  
> meta.helm.sh/release-namespace: default  
> [nginx.ingress.kubernetes.io/auth-tls-match-cn:](http://nginx.ingress.kubernetes.io/auth-tls-match-cn:) CN=Pipeline Builder  
> [nginx.ingress.kubernetes.io/auth-tls-secret:](http://nginx.ingress.kubernetes.io/auth-tls-secret:) default/wac-certs  
> [nginx.ingress.kubernetes.io/auth-tls-verify-client:](http://nginx.ingress.kubernetes.io/auth-tls-verify-client:) “true”  
> [nginx.ingress.kubernetes.io/auth-tls-verify-depth:](http://nginx.ingress.kubernetes.io/auth-tls-verify-depth:) “5”  
> [nginx.ingress.kubernetes.io/proxy-body-size:](http://nginx.ingress.kubernetes.io/proxy-body-size:) 512m

**How I encountered the problem:** While I am running pipeline, I am not able to authenticate as the above annotations or not handled properly in my Gateway or HTTPRoute

**Solutions I’ve tried:**

**Version of NGF and/or NGINX:** 3.0.0

**Deployment environment: Dev**

---

<div class="post-metadata">

**Author:** ![Ciara](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/ciara/32/1305_2.png) [@Ciara](https://community.nginx.org/u/Ciara)\
**Post date:** [April 7, 2026, 12:15pm UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258/2 "2026-04-07T12:15:12Z")

</div>

Hi @rajasekhar.yannam , thanks so much for your interest in our project!

Here’s how these annotations map to NGF with Gateway API:

**`auth-tls-secret` + `auth-tls-verify-client`** These are addressed by `FrontendTLSValidation`, which is coming in the next NGF release. You’ll configure this on your Gateway listener:

```auto
tls:
  frontendValidation:
    caCertificateRefs:
      - kind: ConfigMap
        name: wac-certs

```

See the [Gateway API FrontendTLSConfig spec](https://gateway-api.sigs.k8s.io/reference/spec/#frontendtlsconfig) for full details.

**`auth-tls-match-cn`** Gateway API has no native concept of filtering by client certificate CN. One approach is to propagate the cert subject as a request header using `RequestHeaderModifier` and have your backend perform the CN check. Support for NGINX variables in `RequestHeaderModifier` is also coming in the next release, so you’ll be able to do:

```auto
filters:
  - type: RequestHeaderModifier
    requestHeaderModifier:
      set:
        - name: X-SSL-Client-DN
          value: $ssl_client_s_dn

```

**However -** Note that `auth-tls-match-cn` enforces CN validation at the gateway, returning 403 before the request reaches your backend. The `RequestHeaderModifier` approach shifts that enforcement to the backend and so it is not an equivalent replacement if you require the gateway to be the enforcement point. If this is important for your use case, please let us know by opening [an issue](https://github.com/nginx/nginx-gateway-fabric/issues/new?template=enhancement.md)!

`auth-tls-verify-depth` There is currently no equivalent for this in Gateway API or NGF. As above, if this is important for your use case, please let us know by opening [an issue](https://github.com/nginx/nginx-gateway-fabric/issues/new?template=enhancement.md)!

**`proxy-body-size`** This is supported today via `ProxySettingsPolicy`. See the [proxy settings documentation](https://docs.nginx.com/nginx-gateway-fabric/traffic-management/proxy-settings/) for configuration details.

I hope this helps!

Ciara

---

<div class="post-metadata">

**Author:** ![rajasekhar.yannam](https://avatars.discourse-cdn.com/v4/letter/r/91b2a8/32.png) [@rajasekhar.yannam](https://community.nginx.org/u/rajasekhar.yannam)\
**Post date:** [April 7, 2026, 2:02pm UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258/3 "2026-04-07T14:02:43Z")

</div>

Hi @Ciara , Thank you for prompt response. I will definitely verify the given solutions. Meanwhile, Could you please let me know when can we expect the next release, So u am eager to apply these changes.

---

<div class="post-metadata">

**Author:** ![Ciara](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/ciara/32/1305_2.png) [@Ciara](https://community.nginx.org/u/Ciara)\
**Post date:** [April 8, 2026, 3:03pm UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258/4 "2026-04-08T15:03:42Z")

</div>

We are targeting the week of May 4th for our next release including these changes @rajasekhar.yannam!

---

<div class="post-metadata">

**Author:** ![rajasekhar.yannam](https://avatars.discourse-cdn.com/v4/letter/r/91b2a8/32.png) [@rajasekhar.yannam](https://community.nginx.org/u/rajasekhar.yannam)\
**Post date:** [April 21, 2026, 10:52am UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258/5 "2026-04-21T10:52:34Z")

</div>

@Ciara , As we are using K8S Cluster V1.27 and not able to upgrade as of now, We are bound to use NGF V2.4.2. This version does not support frontendValidation and custombackedpolicies which supports tls option. Is there any way that i can get to use client certifcates. Apprecite for your kind help.

---

<div class="post-metadata">

**Author:** ![sodonova](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/sodonova/32/4295_2.png) [@sodonova](https://community.nginx.org/u/sodonova)\
**Post date:** [April 23, 2026, 2:53pm UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258/6 "2026-04-23T14:53:46Z")

</div>

Hi @rajasekhar.yannam you could likely accomplish this with a SnippetsFilter or SnippetsPolicy

For example, if you had a TLS secret with a ca.crt field like this:

```auto
apiVersion: v1
kind: Secret
metadata:
  name: ca-secret-valid
  namespace: default
type: kubernetes.io/tls
data:
  ca.crt: LS0tLS1CRUdJ...(data omitted)

```

If you mount this secret to you NGF deployment, his would create a secret in `/etc/nginx/secrets/ca-secret-valid.crt`

This is what the mount setup would look like:

```auto
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    spec:
      containers:
        volumeMounts:
        - name: client-cert-volume
      volumes:
      - name: client-cert-volume
        secret:
          secretName: ca-secret-valid

```

You might then be able to reference that, at a HTTPRoute level like this:

```auto
apiVersion: gateway.nginx.org/v1alpha1
kind: SnippetsFilter
metadata:
  name: client-cert-snippet
spec:
  snippets:
    - context: http.server.location
      value: |
        ssl_client_certificate /etc/nginx/secrets/ca-secret-valid-1.crt;
        ssl_verify_client on;
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
    - name: gateway
      sectionName: http
  hostnames:
    - "cafe.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /coffee
      filters:
        - type: ExtensionRef
          extensionRef:
            group: gateway.nginx.org
            kind: SnippetsFilter
            name: client-cert-snippet
      backendRefs:
        - name: coffee
          port: 80

```

I’m not 100% sure if this exact configuration would work, but something along these lines should help you accomplish this.

Keep in mind, Snippets are **disabled** by defailt.

We document how Snippets work, and how to enable them here: [Snippets | NGINX Documentation](https://docs.nginx.com/nginx-gateway-fabric/traffic-management/snippets/)

Hope that helps!

---

<div class="post-metadata">

**Author:** ![system](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/system/32/19_2.png) [@system](https://community.nginx.org/u/system)\
**Post date:** [May 23, 2026, 2:54pm UTC](https://community.nginx.org/t/how-to-handle-ingress-annotations-mentioned-below/9258/7 "2026-05-23T14:54:06Z")

</div>

Closed on May 23, 2026, 2:54pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.