# Need migration help for following ingress from k8s INC to F5 NIC

**URL:** <https://community.nginx.org/t/need-migration-help-for-following-ingress-from-k8s-inc-to-f5-nic/9483>\
**Category:** NGINX Ingress Controller\
**Tags:** annotations, nginx-ingress, reverse-proxy\
**Created:** [May 13, 2026, 10:51am UTC](https://community.nginx.org/t/need-migration-help-for-following-ingress-from-k8s-inc-to-f5-nic/9483 "2026-05-13T10:51:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![parallel\_stories](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/parallel_stories/32/4056_2.png) [@parallel\_stories](https://community.nginx.org/u/parallel_stories)\
**Post date:** [May 13, 2026, 10:51am UTC](https://community.nginx.org/t/need-migration-help-for-following-ingress-from-k8s-inc-to-f5-nic/9483/1 "2026-05-13T10:51:30Z")

</div>

_Please use this template for troubleshooting questions._

**My issue: We need help in converting this ingress from k8s INC to F5 NIC with best way possible. Preferably sticking to ingress yaml only for easier migration. Only go to additional CRDs if needed.**

\*\*How I encountered the problem: We are getting 404 for the following instead of 200.

The ingress we were using for k8s INC:  
\*\*

```auto
apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: myapp-ingress

namespace: myapp

annotations:

kubernetes.io/ingress.class: nginx

nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$request_uri

nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth

nginx.ingress.kubernetes.io/rewrite-target: /$2

nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/24, 192.168.1.0/24, 172.16.0.0/16

nginx.ingress.kubernetes.io/x-forwarded-prefix: /myapp/

spec:

rules:

  - host: app.example.com

http:

paths:

      - backend:

service:

name: myapp-svc

port:

number: 3000

path: /myapp(/|$)(.*)

pathType: ImplementationSpecific

tls:

  - hosts:

    - app.example.com

secretName: my-tls-certs

```

\*\*Solutions I’ve tried:  
\*\*

# — Our attempted F5 NGINX Ingress Controller translation (not working) —

```auto
apiVersion: networking.k8s.io/v1

kind: Ingress

metadata:

name: myapp-ingress-f5

namespace: myapp

annotations:

nginx.org/location-snippets: |

auth_request https://$host/oauth2/auth;

  auth_request_set $auth_header https://$host/oauth2/start?rd=$request_uri;

  auth_request_set $auth_type "";

  auth_request_set $auth_secret "";

  proxy_set_header X-Forwarded-Prefix /myapp/;

nginx.org/mergeable-ingress-type: minion

nginx.org/rewrite-target: /$2

spec:

ingressClassName: nginx

rules:

  - host: app.example.com

http:

paths:

      - backend:

service:

name: myapp-svc

port:

number: 3000

path: /myapp(/|$)(.*)

pathType: ImplementationSpecific

```

**Version of NIC and/or NGINX: NIC v5.3.1**

\*\*Deployment environment: Self managed kubernetes. Nodeport. AWS Cloud provider.

- Note that whitelistsourcerange, we couldn’t find any alternative. Also, we get this value as a $(list\_of\_ips\_separated\_by\_commas) from consul db.
- We are unable to add server snippet for any of the above solutions, as ti says only master ingress can have server snippet. WE do have a master ingress and this is a minion ingress.  
-what is the auth-url alternative in f5. We have couple of apps using it\*\*

---

<div class="post-metadata">

**Author:** ![hshannon](https://avatars.discourse-cdn.com/v4/letter/h/bcef8e/32.png) [@hshannon](https://community.nginx.org/u/hshannon)\
**Post date:** [May 18, 2026, 2:59pm UTC](https://community.nginx.org/t/need-migration-help-for-following-ingress-from-k8s-inc-to-f5-nic/9483/2 "2026-05-18T14:59:19Z")

</div>

I think the `accessControl` policy and `externalAuth` might be what you want.

If you want to stay with Ingress, you can try use policies resources and refer to them in an Ingress with an annotation like `nginx.org/policies: whitelist-policy, ouath2policy`.

Note that this requires upgrading from 5.3.1. The `accessControl` policy is available from 5.4+, and the `externalAuth` policy is not yet in any stable release and is only available in the `main` branch build, so it is not recommended for production use yet.

You `policy` objects could look like the following:

accesscontrol :

```auto
apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: whitelist-policy
  namespace: myapp
spec:
  accessControl:
    allow:
      - 10.0.0.0/24
      - 192.168.1.0/24
      - 172.16.0.0/16

```

externalAuth (see the [mergeable ingress example](https://github.com/nginx/kubernetes-ingress/blob/73d9068eb7e982043ea626368ceec0a71751d14d/examples/ingress-resources/external-auth-mergeable/README.md) ):

```auto
apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: ouath2policy
  namespace: myapp
spec:
  externalAuth:
    authURI: "/oauth2/auth"
    authSigninURI: "/oauth2/start?rd=$request_uri"
    authServiceName: "<servicename"

```

and you ingress could be like:

```auto
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress-f5
  namespace: myapp
  annotations:
    nginx.org/mergeable-ingress-type: "minion"
    nginx.org/policies: "myapp-external-auth,myapp-allowlist"
    ...
spec:
  ingressClassName: nginx
  rules:
    - host: app.example.com
   ...

```

---

<div class="post-metadata">

**Author:** ![parallel\_stories](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/parallel_stories/32/4056_2.png) [@parallel\_stories](https://community.nginx.org/u/parallel_stories)\
**Post date:** [May 21, 2026, 4:02am UTC](https://community.nginx.org/t/need-migration-help-for-following-ingress-from-k8s-inc-to-f5-nic/9483/3 "2026-05-21T04:02:49Z")

</div>

> [@hshannon](#):
>
> ```auto
> apiVersion: networking.k8s.io/v1
> kind: Ingress
> metadata:
> name: myapp-ingress-f5
> namespace: myapp
> annotations:
> nginx.org/mergeable-ingress-type: "minion"
> nginx.org/policies: "myapp-external-auth,myapp-allowlist"
> ...
> spec:
> ingressClassName: nginx
> rules:
> - host: app.example.com
> ...
> 
> ```

This is really helpful @hshannon I will try this policy approach and get back on this.

---

<div class="post-metadata">

**Author:** ![ve.patel](https://avatars.discourse-cdn.com/v4/letter/v/f14d63/32.png) [@ve.patel](https://community.nginx.org/u/ve.patel)\
**Post date:** [June 2, 2026, 10:42am UTC](https://community.nginx.org/t/need-migration-help-for-following-ingress-from-k8s-inc-to-f5-nic/9483/4 "2026-06-02T10:42:53Z")

</div>

hi @parallel_stories , external\_auth policy is now available in 5.5.0 release [Policy resources | NGINX Documentation](https://docs.nginx.com/nginx-ingress-controller/configuration/policy-resource/#externalauth)

> **[kubernetes-ingress/examples/ingress-resources/external-auth at v5.5.0 ·...](https://github.com/nginx/kubernetes-ingress/tree/v5.5.0/examples/ingress-resources/external-auth)**
>
> v5.5.0/examples/ingress-resources/external-auth

---

<div class="post-metadata">

**Author:** ![system](https://drob5swvtjqxg.cloudfront.net/user_avatar/community.nginx.org/system/32/19_2.png) [@system](https://community.nginx.org/u/system)\
**Post date:** [July 2, 2026, 10:43am UTC](https://community.nginx.org/t/need-migration-help-for-following-ingress-from-k8s-inc-to-f5-nic/9483/5 "2026-07-02T10:43:51Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.