From 243289aae39d69c5e7b30f594de0c36f3de3f5a1 Mon Sep 17 00:00:00 2001
From: Vasyl Saienko <vsaienko@mirantis.com>
Date: Sun, 15 Sep 2024 08:14:35 +0000
Subject: [PATCH] [mariadb] Remove ingress deployment

Ingress deployment is not used for a while and there are
more elegant ways to provide same functionality based on
controller to pick up master service.
Remove ingress deployment completely.

Change-Id: Ica5d778f5122f8a4f0713353aa5e0ef4e21c77f8
---
 mariadb/Chart.yaml                            |    2 +-
 mariadb/files/nginx.tmpl                      | 1630 -----------------
 mariadb/templates/configmap-ingress-conf.yaml |   25 -
 mariadb/templates/configmap-ingress-etc.yaml  |   29 -
 mariadb/templates/deployment-controller.yaml  |    3 -
 mariadb/templates/deployment-error.yaml       |   78 -
 mariadb/templates/deployment-ingress.yaml     |  322 ----
 mariadb/templates/service-error.yaml          |   32 -
 mariadb/templates/service-ingress.yaml        |   31 -
 mariadb/templates/service-master.yaml         |    3 -
 mariadb/values.yaml                           |   54 -
 mariadb/values_overrides/ingress-service.yaml |   17 -
 releasenotes/notes/mariadb.yaml               |    1 +
 13 files changed, 2 insertions(+), 2225 deletions(-)
 delete mode 100644 mariadb/files/nginx.tmpl
 delete mode 100755 mariadb/templates/configmap-ingress-conf.yaml
 delete mode 100644 mariadb/templates/configmap-ingress-etc.yaml
 delete mode 100644 mariadb/templates/deployment-error.yaml
 delete mode 100644 mariadb/templates/deployment-ingress.yaml
 delete mode 100644 mariadb/templates/service-error.yaml
 delete mode 100644 mariadb/templates/service-ingress.yaml
 delete mode 100644 mariadb/values_overrides/ingress-service.yaml

diff --git a/mariadb/Chart.yaml b/mariadb/Chart.yaml
index db4435e42..b4b34f5fe 100644
--- a/mariadb/Chart.yaml
+++ b/mariadb/Chart.yaml
@@ -15,7 +15,7 @@ apiVersion: v1
 appVersion: v10.6.7
 description: OpenStack-Helm MariaDB
 name: mariadb
-version: 0.2.48
+version: 0.2.49
 home: https://mariadb.com/kb/en/
 icon: http://badges.mariadb.org/mariadb-badge-180x60.png
 sources:
diff --git a/mariadb/files/nginx.tmpl b/mariadb/files/nginx.tmpl
deleted file mode 100644
index bb1f5f2b1..000000000
--- a/mariadb/files/nginx.tmpl
+++ /dev/null
@@ -1,1630 +0,0 @@
-{{ $all := . }}
-{{ $servers := .Servers }}
-{{ $cfg := .Cfg }}
-{{ $IsIPV6Enabled := .IsIPV6Enabled }}
-{{ $healthzURI := .HealthzURI }}
-{{ $backends := .Backends }}
-{{ $proxyHeaders := .ProxySetHeaders }}
-{{ $addHeaders := .AddHeaders }}
-
-# Configuration checksum: {{ $all.Cfg.Checksum }}
-
-# setup custom paths that do not require root access
-pid {{ .PID }};
-
-{{ if $cfg.UseGeoIP2 }}
-load_module /etc/nginx/modules/ngx_http_geoip2_module.so;
-{{ end }}
-
-{{ if $cfg.EnableBrotli }}
-load_module /etc/nginx/modules/ngx_http_brotli_filter_module.so;
-load_module /etc/nginx/modules/ngx_http_brotli_static_module.so;
-{{ end }}
-
-{{ if (shouldLoadAuthDigestModule $servers) }}
-load_module /etc/nginx/modules/ngx_http_auth_digest_module.so;
-{{ end }}
-
-{{ if (shouldLoadModSecurityModule $cfg $servers) }}
-load_module /etc/nginx/modules/ngx_http_modsecurity_module.so;
-{{ end }}
-
-{{ if (shouldLoadOpentelemetryModule $cfg $servers) }}
-load_module /etc/nginx/modules/otel_ngx_module.so;
-{{ end }}
-
-daemon off;
-
-worker_processes {{ $cfg.WorkerProcesses }};
-{{ if gt (len $cfg.WorkerCPUAffinity) 0 }}
-worker_cpu_affinity {{ $cfg.WorkerCPUAffinity }};
-{{ end }}
-
-worker_rlimit_nofile {{ $cfg.MaxWorkerOpenFiles }};
-
-{{/* http://nginx.org/en/docs/ngx_core_module.html#worker_shutdown_timeout */}}
-{{/* avoid waiting too long during a reload */}}
-worker_shutdown_timeout {{ $cfg.WorkerShutdownTimeout }} ;
-
-{{ if not (empty $cfg.MainSnippet) }}
-{{ $cfg.MainSnippet }}
-{{ end }}
-
-events {
-    multi_accept        {{ if $cfg.EnableMultiAccept }}on{{ else }}off{{ end }};
-    worker_connections  {{ $cfg.MaxWorkerConnections }};
-    use                 epoll;
-    {{ range $index , $v := $cfg.DebugConnections }}
-    debug_connection    {{ $v }};
-    {{ end }}
-}
-
-http {
-    {{ if (shouldLoadOpentelemetryModule $cfg $servers) }}
-    opentelemetry_config {{ $cfg.OpentelemetryConfig }};
-    {{ end }}
-
-    lua_package_path "/etc/nginx/lua/?.lua;;";
-
-    {{ buildLuaSharedDictionaries $cfg $servers }}
-
-    init_by_lua_block {
-        collectgarbage("collect")
-
-        -- init modules
-        local ok, res
-
-        ok, res = pcall(require, "lua_ingress")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          lua_ingress = res
-          lua_ingress.set_config({{ configForLua $all }})
-        end
-
-        ok, res = pcall(require, "configuration")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          configuration = res
-          configuration.prohibited_localhost_port = '{{ .StatusPort }}'
-        end
-
-        ok, res = pcall(require, "balancer")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          balancer = res
-        end
-
-        {{ if $all.EnableMetrics }}
-        ok, res = pcall(require, "monitor")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          monitor = res
-        end
-        {{ end }}
-
-        ok, res = pcall(require, "certificate")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          certificate = res
-          certificate.is_ocsp_stapling_enabled = {{ $cfg.EnableOCSP }}
-        end
-
-        ok, res = pcall(require, "plugins")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          plugins = res
-        end
-        -- load all plugins that'll be used here
-        plugins.init({ {{ range  $idx, $plugin := $cfg.Plugins }}{{ if $idx }},{{ end }}{{ $plugin | quote }}{{ end }} })
-    }
-
-    init_worker_by_lua_block {
-        lua_ingress.init_worker()
-        balancer.init_worker()
-        {{ if $all.EnableMetrics }}
-        monitor.init_worker({{ $all.MonitorMaxBatchSize }})
-        {{ end }}
-
-        plugins.run()
-    }
-
-    {{/* Enable the real_ip module only if we use either X-Forwarded headers or Proxy Protocol. */}}
-    {{/* we use the value of the real IP for the geo_ip module */}}
-    {{ if or (or $cfg.UseForwardedHeaders $cfg.UseProxyProtocol) $cfg.EnableRealIP }}
-    {{ if $cfg.UseProxyProtocol }}
-    real_ip_header      proxy_protocol;
-    {{ else }}
-    real_ip_header      {{ $cfg.ForwardedForHeader }};
-    {{ end }}
-
-    real_ip_recursive   on;
-    {{ range $trusted_ip := $cfg.ProxyRealIPCIDR }}
-    set_real_ip_from    {{ $trusted_ip }};
-    {{ end }}
-    {{ end }}
-
-    {{ if $all.Cfg.EnableModsecurity }}
-    modsecurity on;
-
-    {{ if (not (empty $all.Cfg.ModsecuritySnippet)) }}
-    modsecurity_rules '
-      {{ $all.Cfg.ModsecuritySnippet }}
-    ';
-    {{ else }}
-    modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;
-    {{ end }}
-
-    {{ if $all.Cfg.EnableOWASPCoreRules }}
-    modsecurity_rules_file /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf;
-    {{ end }}
-
-    {{ end }}
-
-    {{ if $cfg.UseGeoIP2 }}
-    # https://github.com/leev/ngx_http_geoip2_module#example-usage
-
-    {{ range $index, $file := $all.MaxmindEditionFiles }}
-    {{ if eq $file "GeoLite2-Country.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoLite2-Country.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_country_code source=$remote_addr country iso_code;
-        $geoip2_country_name source=$remote_addr country names en;
-        $geoip2_country_geoname_id source=$remote_addr country geoname_id;
-        $geoip2_continent_code source=$remote_addr continent code;
-        $geoip2_continent_name source=$remote_addr continent names en;
-        $geoip2_continent_geoname_id source=$remote_addr continent geoname_id;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoIP2-Country.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoIP2-Country.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_country_code source=$remote_addr country iso_code;
-        $geoip2_country_name source=$remote_addr country names en;
-        $geoip2_country_geoname_id source=$remote_addr country geoname_id;
-        $geoip2_continent_code source=$remote_addr continent code;
-        $geoip2_continent_name source=$remote_addr continent names en;
-        $geoip2_continent_geoname_id source=$remote_addr continent geoname_id;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoLite2-City.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoLite2-City.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_city_country_code source=$remote_addr country iso_code;
-        $geoip2_city_country_name source=$remote_addr country names en;
-        $geoip2_city_country_geoname_id source=$remote_addr country geoname_id;
-        $geoip2_city source=$remote_addr city names en;
-        $geoip2_city_geoname_id source=$remote_addr city geoname_id;
-        $geoip2_postal_code source=$remote_addr postal code;
-        $geoip2_dma_code source=$remote_addr location metro_code;
-        $geoip2_latitude source=$remote_addr location latitude;
-        $geoip2_longitude source=$remote_addr location longitude;
-        $geoip2_time_zone source=$remote_addr location time_zone;
-        $geoip2_region_code source=$remote_addr subdivisions 0 iso_code;
-        $geoip2_region_name source=$remote_addr subdivisions 0 names en;
-        $geoip2_region_geoname_id source=$remote_addr subdivisions 0 geoname_id;
-        $geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code;
-        $geoip2_subregion_name source=$remote_addr subdivisions 1 names en;
-        $geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id;
-        $geoip2_city_continent_code source=$remote_addr continent code;
-        $geoip2_city_continent_name source=$remote_addr continent names en;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoIP2-City.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoIP2-City.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_city_country_code source=$remote_addr country iso_code;
-        $geoip2_city_country_name source=$remote_addr country names en;
-        $geoip2_city_country_geoname_id source=$remote_addr country geoname_id;
-        $geoip2_city source=$remote_addr city names en;
-        $geoip2_city_geoname_id source=$remote_addr city geoname_id;
-        $geoip2_postal_code source=$remote_addr postal code;
-        $geoip2_dma_code source=$remote_addr location metro_code;
-        $geoip2_latitude source=$remote_addr location latitude;
-        $geoip2_longitude source=$remote_addr location longitude;
-        $geoip2_time_zone source=$remote_addr location time_zone;
-        $geoip2_region_code source=$remote_addr subdivisions 0 iso_code;
-        $geoip2_region_name source=$remote_addr subdivisions 0 names en;
-        $geoip2_region_geoname_id source=$remote_addr subdivisions 0 geoname_id;
-        $geoip2_subregion_code source=$remote_addr subdivisions 1 iso_code;
-        $geoip2_subregion_name source=$remote_addr subdivisions 1 names en;
-        $geoip2_subregion_geoname_id source=$remote_addr subdivisions 1 geoname_id;
-        $geoip2_city_continent_code source=$remote_addr continent code;
-        $geoip2_city_continent_name source=$remote_addr continent names en;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoLite2-ASN.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoLite2-ASN.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_asn source=$remote_addr autonomous_system_number;
-        $geoip2_org source=$remote_addr autonomous_system_organization;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoIP2-ASN.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoIP2-ASN.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_asn source=$remote_addr autonomous_system_number;
-        $geoip2_org source=$remote_addr autonomous_system_organization;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoIP2-ISP.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoIP2-ISP.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_isp source=$remote_addr isp;
-        $geoip2_isp_org source=$remote_addr organization;
-        $geoip2_asn source=$remote_addr default=0 autonomous_system_number;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoIP2-Connection-Type.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoIP2-Connection-Type.mmdb {
-        $geoip2_connection_type connection_type;
-    }
-    {{ end }}
-
-    {{ if eq $file "GeoIP2-Anonymous-IP.mmdb" }}
-    geoip2 /etc/ingress-controller/geoip/GeoIP2-Anonymous-IP.mmdb {
-        {{ if (gt $cfg.GeoIP2AutoReloadMinutes 0) }}
-        auto_reload {{ $cfg.GeoIP2AutoReloadMinutes }}m;
-        {{ end }}
-        $geoip2_is_anon source=$remote_addr is_anonymous;
-        $geoip2_is_anonymous source=$remote_addr default=0 is_anonymous;
-        $geoip2_is_anonymous_vpn source=$remote_addr default=0 is_anonymous_vpn;
-        $geoip2_is_hosting_provider source=$remote_addr default=0 is_hosting_provider;
-        $geoip2_is_public_proxy source=$remote_addr default=0 is_public_proxy;
-        $geoip2_is_tor_exit_node source=$remote_addr default=0 is_tor_exit_node;
-    }
-    {{ end }}
-
-    {{ end }}
-
-    {{ end }}
-
-    aio                 threads;
-
-    {{ if $cfg.EnableAioWrite }}
-    aio_write           on;
-    {{ end }}
-
-    tcp_nopush          on;
-    tcp_nodelay         on;
-
-    log_subrequest      on;
-
-    reset_timedout_connection on;
-
-    keepalive_timeout  {{ $cfg.KeepAlive }}s;
-    keepalive_requests {{ $cfg.KeepAliveRequests }};
-
-    client_body_temp_path           /tmp/nginx/client-body;
-    fastcgi_temp_path               /tmp/nginx/fastcgi-temp;
-    proxy_temp_path                 /tmp/nginx/proxy-temp;
-
-    client_header_buffer_size       {{ $cfg.ClientHeaderBufferSize }};
-    client_header_timeout           {{ $cfg.ClientHeaderTimeout }}s;
-    large_client_header_buffers     {{ $cfg.LargeClientHeaderBuffers }};
-    client_body_buffer_size         {{ $cfg.ClientBodyBufferSize }};
-    client_body_timeout             {{ $cfg.ClientBodyTimeout }}s;
-
-    {{ if gt $cfg.GRPCBufferSizeKb 0 }}
-    grpc_buffer_size {{ $cfg.GRPCBufferSizeKb }}k;
-    {{ end }}
-
-    {{ if and (ne $cfg.HTTP2MaxHeaderSize "") (ne $cfg.HTTP2MaxFieldSize "") }}
-    http2_max_field_size            {{ $cfg.HTTP2MaxFieldSize }};
-    http2_max_header_size           {{ $cfg.HTTP2MaxHeaderSize }};
-    {{ end }}
-
-    {{ if (gt $cfg.HTTP2MaxRequests 0) }}
-    http2_max_requests              {{ $cfg.HTTP2MaxRequests }};
-    {{ end }}
-
-    http2_max_concurrent_streams    {{ $cfg.HTTP2MaxConcurrentStreams }};
-
-    types_hash_max_size             2048;
-    server_names_hash_max_size      {{ $cfg.ServerNameHashMaxSize }};
-    server_names_hash_bucket_size   {{ $cfg.ServerNameHashBucketSize }};
-    map_hash_bucket_size            {{ $cfg.MapHashBucketSize }};
-
-    proxy_headers_hash_max_size     {{ $cfg.ProxyHeadersHashMaxSize }};
-    proxy_headers_hash_bucket_size  {{ $cfg.ProxyHeadersHashBucketSize }};
-
-    variables_hash_bucket_size      {{ $cfg.VariablesHashBucketSize }};
-    variables_hash_max_size         {{ $cfg.VariablesHashMaxSize }};
-
-    underscores_in_headers          {{ if $cfg.EnableUnderscoresInHeaders }}on{{ else }}off{{ end }};
-    ignore_invalid_headers          {{ if $cfg.IgnoreInvalidHeaders }}on{{ else }}off{{ end }};
-
-    limit_req_status                {{ $cfg.LimitReqStatusCode }};
-    limit_conn_status               {{ $cfg.LimitConnStatusCode }};
-
-    {{ buildOpentelemetry $cfg $servers }}
-
-    include /etc/nginx/mime.types;
-    default_type {{ $cfg.DefaultType }};
-
-    {{ if $cfg.EnableBrotli }}
-    brotli on;
-    brotli_comp_level {{ $cfg.BrotliLevel }};
-    brotli_min_length {{ $cfg.BrotliMinLength }};
-    brotli_types {{ $cfg.BrotliTypes }};
-    {{ end }}
-
-    {{ if $cfg.UseGzip }}
-    gzip on;
-    gzip_comp_level {{ $cfg.GzipLevel }};
-    {{- if $cfg.GzipDisable }}
-    gzip_disable "{{ $cfg.GzipDisable }}";
-    {{- end }}
-    gzip_http_version 1.1;
-    gzip_min_length {{ $cfg.GzipMinLength}};
-    gzip_types {{ $cfg.GzipTypes }};
-    gzip_proxied any;
-    gzip_vary on;
-    {{ end }}
-
-    # Custom headers for response
-    {{ range $k, $v := $addHeaders }}
-    more_set_headers {{ printf "%s: %s" $k $v | quote }};
-    {{ end }}
-
-    server_tokens {{ if $cfg.ShowServerTokens }}on{{ else }}off{{ end }};
-    {{ if not $cfg.ShowServerTokens }}
-    more_clear_headers Server;
-    {{ end }}
-
-    # disable warnings
-    uninitialized_variable_warn off;
-
-    # Additional available variables:
-    # $namespace
-    # $ingress_name
-    # $service_name
-    # $service_port
-    log_format upstreaminfo {{ if $cfg.LogFormatEscapeNone }}escape=none {{ else if $cfg.LogFormatEscapeJSON }}escape=json {{ end }}'{{ $cfg.LogFormatUpstream }}';
-
-    {{/* map urls that should not appear in access.log */}}
-    {{/* http://nginx.org/en/docs/http/ngx_http_log_module.html#access_log */}}
-    map $request_uri $loggable {
-        {{ range $reqUri := $cfg.SkipAccessLogURLs }}
-        {{ $reqUri }} 0;{{ end }}
-        default 1;
-    }
-
-    {{ if or $cfg.DisableAccessLog $cfg.DisableHTTPAccessLog }}
-    access_log off;
-    {{ else }}
-    {{ if $cfg.EnableSyslog }}
-    access_log syslog:server={{ $cfg.SyslogHost }}:{{ $cfg.SyslogPort }} upstreaminfo if=$loggable;
-    {{ else }}
-    access_log {{ or $cfg.HTTPAccessLogPath $cfg.AccessLogPath }} upstreaminfo {{ $cfg.AccessLogParams }} if=$loggable;
-    {{ end }}
-    {{ end }}
-
-    {{ if $cfg.EnableSyslog }}
-    error_log syslog:server={{ $cfg.SyslogHost }}:{{ $cfg.SyslogPort }} {{ $cfg.ErrorLogLevel }};
-    {{ else }}
-    error_log  {{ $cfg.ErrorLogPath }} {{ $cfg.ErrorLogLevel }};
-    {{ end }}
-
-    {{ buildResolvers $cfg.Resolver $cfg.DisableIpv6DNS }}
-
-    # See https://www.nginx.com/blog/websocket-nginx
-    map $http_upgrade $connection_upgrade {
-        default          upgrade;
-        {{ if (gt $cfg.UpstreamKeepaliveConnections 0) }}
-        # See http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive
-        ''               '';
-        {{ else }}
-        ''               close;
-        {{ end }}
-    }
-
-    # Reverse proxies can detect if a client provides a X-Request-ID header, and pass it on to the backend server.
-    # If no such header is provided, it can provide a random value.
-    map $http_x_request_id $req_id {
-        default   $http_x_request_id;
-        {{ if $cfg.GenerateRequestID }}
-        ""        $request_id;
-        {{ end }}
-    }
-
-    {{ if and $cfg.UseForwardedHeaders $cfg.ComputeFullForwardedFor }}
-    # We can't use $proxy_add_x_forwarded_for because the realip module
-    # replaces the remote_addr too soon
-    map $http_x_forwarded_for $full_x_forwarded_for {
-        {{ if $all.Cfg.UseProxyProtocol }}
-        default          "$http_x_forwarded_for, $proxy_protocol_addr";
-        ''               "$proxy_protocol_addr";
-        {{ else }}
-        default          "$http_x_forwarded_for, $realip_remote_addr";
-        ''               "$realip_remote_addr";
-        {{ end}}
-    }
-
-    {{ end }}
-
-    # Create a variable that contains the literal $ character.
-    # This works because the geo module will not resolve variables.
-    geo $literal_dollar {
-        default "$";
-    }
-
-    server_name_in_redirect off;
-    port_in_redirect        off;
-
-    ssl_protocols {{ $cfg.SSLProtocols }};
-
-    ssl_early_data {{ if $cfg.SSLEarlyData }}on{{ else }}off{{ end }};
-
-    # turn on session caching to drastically improve performance
-    {{ if $cfg.SSLSessionCache }}
-    ssl_session_cache shared:SSL:{{ $cfg.SSLSessionCacheSize }};
-    ssl_session_timeout {{ $cfg.SSLSessionTimeout }};
-    {{ end }}
-
-    # allow configuring ssl session tickets
-    ssl_session_tickets {{ if $cfg.SSLSessionTickets }}on{{ else }}off{{ end }};
-
-    {{ if not (empty $cfg.SSLSessionTicketKey ) }}
-    ssl_session_ticket_key /etc/ingress-controller/tickets.key;
-    {{ end }}
-
-    # slightly reduce the time-to-first-byte
-    ssl_buffer_size {{ $cfg.SSLBufferSize }};
-
-    {{ if not (empty $cfg.SSLCiphers) }}
-    # allow configuring custom ssl ciphers
-    ssl_ciphers '{{ $cfg.SSLCiphers }}';
-    ssl_prefer_server_ciphers on;
-    {{ end }}
-
-    {{ if not (empty $cfg.SSLDHParam) }}
-    # allow custom DH file http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_dhparam
-    ssl_dhparam {{ $cfg.SSLDHParam }};
-    {{ end }}
-
-    ssl_ecdh_curve {{ $cfg.SSLECDHCurve }};
-
-    # PEM sha: {{ $cfg.DefaultSSLCertificate.PemSHA }}
-    ssl_certificate     {{ $cfg.DefaultSSLCertificate.PemFileName }};
-    ssl_certificate_key {{ $cfg.DefaultSSLCertificate.PemFileName }};
-
-    {{ if and $cfg.CustomHTTPErrors (not $cfg.DisableProxyInterceptErrors) }}
-    proxy_intercept_errors on;
-    {{ end }}
-
-    {{ range $errCode := $cfg.CustomHTTPErrors }}
-    error_page {{ $errCode }} = @custom_upstream-default-backend_{{ $errCode }};{{ end }}
-
-    proxy_ssl_session_reuse on;
-
-    {{ if $cfg.AllowBackendServerHeader }}
-    proxy_pass_header Server;
-    {{ end }}
-
-    {{ range $header := $cfg.HideHeaders }}proxy_hide_header {{ $header }};
-    {{ end }}
-
-    {{ if not (empty $cfg.HTTPSnippet) }}
-    # Custom code snippet configured in the configuration configmap
-    {{ $cfg.HTTPSnippet }}
-    {{ end }}
-
-    upstream upstream_balancer {
-        ### Attention!!!
-        #
-        # We no longer create "upstream" section for every backend.
-        # Backends are handled dynamically using Lua. If you would like to debug
-        # and see what backends ingress-nginx has in its memory you can
-        # install our kubectl plugin https://kubernetes.github.io/ingress-nginx/kubectl-plugin.
-        # Once you have the plugin you can use "kubectl ingress-nginx backends" command to
-        # inspect current backends.
-        #
-        ###
-
-        server 0.0.0.1; # placeholder
-
-        balancer_by_lua_block {
-          balancer.balance()
-        }
-
-        {{ if (gt $cfg.UpstreamKeepaliveConnections 0) }}
-        keepalive {{ $cfg.UpstreamKeepaliveConnections }};
-        keepalive_time {{ $cfg.UpstreamKeepaliveTime }};
-        keepalive_timeout  {{ $cfg.UpstreamKeepaliveTimeout }}s;
-        keepalive_requests {{ $cfg.UpstreamKeepaliveRequests }};
-        {{ end }}
-    }
-
-    {{ range $rl := (filterRateLimits $servers ) }}
-    # Ratelimit {{ $rl.Name }}
-    geo $remote_addr $allowlist_{{ $rl.ID }} {
-        default 0;
-        {{ range $ip := $rl.Allowlist }}
-        {{ $ip }} 1;{{ end }}
-    }
-
-    # Ratelimit {{ $rl.Name }}
-    map $allowlist_{{ $rl.ID }} $limit_{{ $rl.ID }} {
-        0 {{ $cfg.LimitConnZoneVariable }};
-        1 "";
-    }
-    {{ end }}
-
-    {{/* build all the required rate limit zones. Each annotation requires a dedicated zone */}}
-    {{/* 1MB -> 16 thousand 64-byte states or about 8 thousand 128-byte states */}}
-    {{ range $zone := (buildRateLimitZones $servers) }}
-    {{ $zone }}
-    {{ end }}
-
-    # Cache for internal auth checks
-    proxy_cache_path /tmp/nginx/nginx-cache-auth levels=1:2 keys_zone=auth_cache:10m max_size=128m inactive=30m use_temp_path=off;
-
-    # Global filters
-    {{ range $ip := $cfg.BlockCIDRs }}deny {{ trimSpace $ip }};
-    {{ end }}
-
-    {{ if gt (len $cfg.BlockUserAgents) 0 }}
-    map $http_user_agent $block_ua {
-        default 0;
-
-        {{ range $ua := $cfg.BlockUserAgents }}{{ trimSpace $ua }} 1;
-        {{ end }}
-    }
-    {{ end }}
-
-    {{ if gt (len $cfg.BlockReferers) 0 }}
-    map $http_referer $block_ref {
-        default 0;
-
-        {{ range $ref := $cfg.BlockReferers }}{{ trimSpace $ref }} 1;
-        {{ end }}
-    }
-    {{ end }}
-
-    {{/* Build server redirects (from/to www) */}}
-    {{ range $redirect := .RedirectServers }}
-    ## start server {{ $redirect.From }}
-    server {
-        server_name {{ $redirect.From }};
-
-        {{ buildHTTPListener  $all $redirect.From }}
-        {{ buildHTTPSListener $all $redirect.From }}
-
-        ssl_certificate_by_lua_block {
-            certificate.call()
-        }
-
-        {{ if gt (len $cfg.BlockUserAgents) 0 }}
-        if ($block_ua) {
-           return 403;
-        }
-        {{ end }}
-        {{ if gt (len $cfg.BlockReferers) 0 }}
-        if ($block_ref) {
-           return 403;
-        }
-        {{ end }}
-
-        set_by_lua_block $redirect_to {
-            local request_uri = ngx.var.request_uri
-            if string.sub(request_uri, -1) == "/" then
-                request_uri = string.sub(request_uri, 1, -2)
-            end
-
-            {{ if $cfg.UseForwardedHeaders }}
-            local redirectScheme
-            if not ngx.var.http_x_forwarded_proto then
-                redirectScheme = ngx.var.scheme
-            else
-                redirectScheme = ngx.var.http_x_forwarded_proto
-            end
-            {{ else }}
-            local redirectScheme = ngx.var.scheme
-            {{ end }}
-
-            {{ if ne $all.ListenPorts.HTTPS 443 }}
-            {{ $redirect_port := (printf ":%v" $all.ListenPorts.HTTPS) }}
-            return string.format("%s://%s%s%s", redirectScheme, "{{ $redirect.To }}", "{{ $redirect_port }}", request_uri)
-            {{ else }}
-            return string.format("%s://%s%s", redirectScheme, "{{ $redirect.To }}", request_uri)
-            {{ end }}
-        }
-
-        return {{ $all.Cfg.HTTPRedirectCode }} $redirect_to;
-    }
-    ## end server {{ $redirect.From }}
-    {{ end }}
-
-    {{ range $server := $servers }}
-    {{ range $location := $server.Locations }}
-    {{ $applyGlobalAuth := shouldApplyGlobalAuth $location $all.Cfg.GlobalExternalAuth.URL }}
-    {{ $applyAuthUpstream := shouldApplyAuthUpstream $location $all.Cfg }}
-    {{ if and (eq $applyAuthUpstream true) (eq $applyGlobalAuth false) }}
-    ## start auth upstream {{ $server.Hostname }}{{ $location.Path }}
-    upstream {{ buildAuthUpstreamName $location $server.Hostname }} {
-        {{- $externalAuth := $location.ExternalAuth }}
-        server {{ extractHostPort $externalAuth.URL }};
-
-        keepalive {{ $externalAuth.KeepaliveConnections }};
-        keepalive_requests {{ $externalAuth.KeepaliveRequests }};
-        keepalive_timeout {{ $externalAuth.KeepaliveTimeout }}s;
-    }
-    ## end auth upstream {{ $server.Hostname }}{{ $location.Path }}
-    {{ end }}
-    {{ end }}
-    {{ end }}
-
-    {{ range $server := $servers }}
-    ## start server {{ $server.Hostname }}
-    server {
-        server_name {{ buildServerName $server.Hostname }} {{range $server.Aliases }}{{ . }} {{ end }};
-
-        {{ if $cfg.UseHTTP2 }}
-            http2 on;
-        {{ end }}
-
-        {{ if gt (len $cfg.BlockUserAgents) 0 }}
-        if ($block_ua) {
-           return 403;
-        }
-        {{ end }}
-        {{ if gt (len $cfg.BlockReferers) 0 }}
-        if ($block_ref) {
-           return 403;
-        }
-        {{ end }}
-
-        {{ template "SERVER" serverConfig $all $server }}
-
-        {{ if not (empty $cfg.ServerSnippet) }}
-        # Custom code snippet configured in the configuration configmap
-        {{ $cfg.ServerSnippet }}
-        {{ end }}
-
-        {{ template "CUSTOM_ERRORS" (buildCustomErrorDeps "upstream-default-backend" $cfg.CustomHTTPErrors $all.EnableMetrics $cfg.EnableModsecurity) }}
-    }
-    ## end server {{ $server.Hostname }}
-
-    {{ end }}
-
-    # backend for when default-backend-service is not configured or it does not have endpoints
-    server {
-        listen {{ $all.ListenPorts.Default }} default_server {{ if $all.Cfg.ReusePort }}reuseport{{ end }} backlog={{ $all.BacklogSize }};
-        {{ if $IsIPV6Enabled }}listen [::]:{{ $all.ListenPorts.Default }} default_server {{ if $all.Cfg.ReusePort }}reuseport{{ end }} backlog={{ $all.BacklogSize }};{{ end }}
-        set $proxy_upstream_name "internal";
-
-        access_log off;
-
-        location / {
-          return 404;
-        }
-    }
-
-    # default server, used for NGINX healthcheck and access to nginx stats
-    server {
-        # Ensure that modsecurity will not run on an internal location as this is not accessible from outside
-        {{ if $all.Cfg.EnableModsecurity }}
-        modsecurity off;
-        {{ end }}
-
-        listen 127.0.0.1:{{ .StatusPort }};
-        set $proxy_upstream_name "internal";
-
-        keepalive_timeout 0;
-        gzip off;
-
-        access_log off;
-
-        {{ if $cfg.EnableOpentelemetry }}
-        opentelemetry off;
-        {{ end }}
-        location {{ $healthzURI }} {
-            return 200;
-        }
-
-        location /is-dynamic-lb-initialized {
-            content_by_lua_block {
-                local configuration = require("configuration")
-                local backend_data = configuration.get_backends_data()
-                if not backend_data then
-                    ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
-                    return
-                end
-
-                ngx.say("OK")
-                ngx.exit(ngx.HTTP_OK)
-            }
-        }
-
-        location {{ .StatusPath }} {
-            stub_status on;
-        }
-
-        location /configuration {
-            client_max_body_size                    {{ luaConfigurationRequestBodySize $cfg }};
-            client_body_buffer_size                 {{ luaConfigurationRequestBodySize $cfg }};
-            proxy_buffering                         off;
-
-            content_by_lua_block {
-              configuration.call()
-            }
-        }
-
-        location / {
-            content_by_lua_block {
-                ngx.exit(ngx.HTTP_NOT_FOUND)
-            }
-        }
-    }
-}
-
-stream {
-    lua_package_path "/etc/nginx/lua/?.lua;/etc/nginx/lua/vendor/?.lua;;";
-
-    lua_shared_dict tcp_udp_configuration_data 5M;
-
-    {{ buildResolvers $cfg.Resolver $cfg.DisableIpv6DNS }}
-
-    init_by_lua_block {
-        collectgarbage("collect")
-
-        -- init modules
-        local ok, res
-
-        ok, res = pcall(require, "configuration")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          configuration = res
-        end
-
-        ok, res = pcall(require, "tcp_udp_configuration")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          tcp_udp_configuration = res
-          tcp_udp_configuration.prohibited_localhost_port = '{{ .StatusPort }}'
-
-        end
-
-        ok, res = pcall(require, "tcp_udp_balancer")
-        if not ok then
-          error("require failed: " .. tostring(res))
-        else
-          tcp_udp_balancer = res
-        end
-    }
-
-    init_worker_by_lua_block {
-        tcp_udp_balancer.init_worker()
-    }
-
-    lua_add_variable $proxy_upstream_name;
-
-    log_format log_stream '{{ $cfg.LogFormatStream }}';
-
-    {{ if or $cfg.DisableAccessLog $cfg.DisableStreamAccessLog }}
-    access_log off;
-    {{ else }}
-    access_log {{ or $cfg.StreamAccessLogPath $cfg.AccessLogPath }} log_stream {{ $cfg.AccessLogParams }};
-    {{ end }}
-
-
-    error_log  {{ $cfg.ErrorLogPath }} {{ $cfg.ErrorLogLevel }};
-    {{ if $cfg.EnableRealIP }}
-    {{ range $trusted_ip := $cfg.ProxyRealIPCIDR }}
-    set_real_ip_from    {{ $trusted_ip }};
-    {{ end }}
-    {{ end }}
-
-    upstream upstream_balancer {
-        server 0.0.0.1:1234; # placeholder
-
-        balancer_by_lua_block {
-          local cjson = require("cjson.safe")
-          local b = require "ngx.balancer"
-          local ngx = ngx
-          local ngx_log = ngx.log
-          local backends_data = tcp_udp_configuration.get_backends_data()
-          local new_backends, err = cjson.decode(backends_data)
-          if not new_backends then
-            ngx.log(ngx.ERR, "could not parse backends data: ", err)
-            return
-          end
-          for _, new_backend in pairs(new_backends) do
-            for _, addr in pairs(new_backend.endpoints) do
-              local address = addr["address"]
-              local port = addr["port"]
-              local ok, err = b.set_current_peer(address, port)
-            end
-          end
-        }
-    }
-
-    server {
-        listen 127.0.0.1:{{ .StreamPort }};
-
-        access_log off;
-
-        content_by_lua_block {
-          tcp_udp_configuration.call()
-        }
-    }
-
-    # TCP services
-    {{ range $tcpServer := .TCPBackends }}
-    server {
-        preread_by_lua_block {
-            ngx.var.proxy_upstream_name="tcp-{{ $tcpServer.Backend.Namespace }}-{{ $tcpServer.Backend.Name }}-{{ $tcpServer.Backend.Port }}";
-        }
-
-        {{ range $address := $all.Cfg.BindAddressIpv4 }}
-        listen                  {{ $address }}:{{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
-        {{ else }}
-        listen                  {{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
-        {{ end }}
-        {{ if $IsIPV6Enabled }}
-        {{ range $address := $all.Cfg.BindAddressIpv6 }}
-        listen                  {{ $address }}:{{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
-        {{ else }}
-        listen                  [::]:{{ $tcpServer.Port }}{{ if $tcpServer.Backend.ProxyProtocol.Decode }} proxy_protocol{{ end }};
-        {{ end }}
-        {{ end }}
-        proxy_timeout           {{ $cfg.ProxyStreamTimeout }};
-        proxy_next_upstream     {{ if $cfg.ProxyStreamNextUpstream }}on{{ else }}off{{ end }};
-        proxy_next_upstream_timeout {{ $cfg.ProxyStreamNextUpstreamTimeout }};
-        proxy_next_upstream_tries   {{ $cfg.ProxyStreamNextUpstreamTries }};
-
-        proxy_pass              upstream_balancer;
-        {{ if $tcpServer.Backend.ProxyProtocol.Encode }}
-        proxy_protocol          on;
-        {{ end }}
-    }
-    {{ end }}
-
-    # UDP services
-    {{ range $udpServer := .UDPBackends }}
-    server {
-        preread_by_lua_block {
-            ngx.var.proxy_upstream_name="udp-{{ $udpServer.Backend.Namespace }}-{{ $udpServer.Backend.Name }}-{{ $udpServer.Backend.Port }}";
-        }
-
-        {{ range $address := $all.Cfg.BindAddressIpv4 }}
-        listen                  {{ $address }}:{{ $udpServer.Port }} udp;
-        {{ else }}
-        listen                  {{ $udpServer.Port }} udp;
-        {{ end }}
-        {{ if $IsIPV6Enabled }}
-        {{ range $address := $all.Cfg.BindAddressIpv6 }}
-        listen                  {{ $address }}:{{ $udpServer.Port }} udp;
-        {{ else }}
-        listen                  [::]:{{ $udpServer.Port }} udp;
-        {{ end }}
-        {{ end }}
-        proxy_responses         {{ $cfg.ProxyStreamResponses }};
-        proxy_timeout           {{ $cfg.ProxyStreamTimeout }};
-        proxy_next_upstream     {{ if $cfg.ProxyStreamNextUpstream }}on{{ else }}off{{ end }};
-        proxy_next_upstream_timeout {{ $cfg.ProxyStreamNextUpstreamTimeout }};
-        proxy_next_upstream_tries   {{ $cfg.ProxyStreamNextUpstreamTries }};
-        proxy_pass              upstream_balancer;
-    }
-    {{ end }}
-
-    # Stream Snippets
-    {{ range $snippet := .StreamSnippets }}
-    {{ $snippet }}
-    {{ end }}
-}
-
-{{/* definition of templates to avoid repetitions */}}
-{{ define "CUSTOM_ERRORS" }}
-        {{ $enableMetrics := .EnableMetrics }}
-        {{ $modsecurityEnabled := .ModsecurityEnabled }}
-        {{ $upstreamName := .UpstreamName }}
-        {{ range $errCode := .ErrorCodes }}
-        location @custom_{{ $upstreamName }}_{{ $errCode }} {
-            internal;
-
-            # Ensure that modsecurity will not run on custom error pages or they might be blocked
-            {{ if $modsecurityEnabled }}
-            modsecurity off;
-            {{ end }}
-
-            proxy_intercept_errors off;
-
-            proxy_set_header       X-Code             {{ $errCode }};
-            proxy_set_header       X-Format           $http_accept;
-            proxy_set_header       X-Original-URI     $request_uri;
-            proxy_set_header       X-Namespace        $namespace;
-            proxy_set_header       X-Ingress-Name     $ingress_name;
-            proxy_set_header       X-Service-Name     $service_name;
-            proxy_set_header       X-Service-Port     $service_port;
-            proxy_set_header       X-Request-ID       $req_id;
-            proxy_set_header       X-Forwarded-For    $remote_addr;
-            proxy_set_header       Host               $best_http_host;
-
-            set $proxy_upstream_name {{ $upstreamName | quote }};
-
-            rewrite                (.*) / break;
-
-            proxy_pass            http://upstream_balancer;
-            log_by_lua_block {
-                {{ if $enableMetrics }}
-                monitor.call()
-                {{ end }}
-            }
-        }
-        {{ end }}
-{{ end }}
-
-{{/* CORS support from https://michielkalkman.com/snippets/nginx-cors-open-configuration.html */}}
-{{ define "CORS" }}
-     {{ $cors := .CorsConfig }}
-     # Cors Preflight methods needs additional options and different Return Code
-     {{ if $cors.CorsAllowOrigin }}
-        {{ buildCorsOriginRegex $cors.CorsAllowOrigin }}
-     {{ end }}
-     if ($request_method = 'OPTIONS') {
-        set $cors ${cors}options;
-     }
-
-     if ($cors = "true") {
-        more_set_headers 'Access-Control-Allow-Origin: $http_origin';
-        {{ if $cors.CorsAllowCredentials }} more_set_headers 'Access-Control-Allow-Credentials: {{ $cors.CorsAllowCredentials }}'; {{ end }}
-        more_set_headers 'Access-Control-Allow-Methods: {{ $cors.CorsAllowMethods }}';
-        more_set_headers 'Access-Control-Allow-Headers: {{ $cors.CorsAllowHeaders }}';
-        {{ if not (empty $cors.CorsExposeHeaders) }} more_set_headers 'Access-Control-Expose-Headers: {{ $cors.CorsExposeHeaders }}'; {{ end }}
-        more_set_headers 'Access-Control-Max-Age: {{ $cors.CorsMaxAge }}';
-     }
-
-     if ($cors = "trueoptions") {
-        more_set_headers 'Access-Control-Allow-Origin: $http_origin';
-        {{ if $cors.CorsAllowCredentials }} more_set_headers 'Access-Control-Allow-Credentials: {{ $cors.CorsAllowCredentials }}'; {{ end }}
-        more_set_headers 'Access-Control-Allow-Methods: {{ $cors.CorsAllowMethods }}';
-        more_set_headers 'Access-Control-Allow-Headers: {{ $cors.CorsAllowHeaders }}';
-        {{ if not (empty $cors.CorsExposeHeaders) }} more_set_headers 'Access-Control-Expose-Headers: {{ $cors.CorsExposeHeaders }}'; {{ end }}
-        more_set_headers 'Access-Control-Max-Age: {{ $cors.CorsMaxAge }}';
-        more_set_headers 'Content-Type: text/plain charset=UTF-8';
-        more_set_headers 'Content-Length: 0';
-        return 204;
-     }
-{{ end }}
-
-{{/* definition of server-template to avoid repetitions with server-alias */}}
-{{ define "SERVER" }}
-        {{ $all := .First }}
-        {{ $server := .Second }}
-
-        {{ buildHTTPListener  $all $server.Hostname }}
-        {{ buildHTTPSListener $all $server.Hostname }}
-
-        set $proxy_upstream_name "-";
-
-        {{ if not ( empty $server.CertificateAuth.MatchCN ) }}
-        {{ if gt (len $server.CertificateAuth.MatchCN) 0 }}
-        if ( $ssl_client_s_dn !~ {{ $server.CertificateAuth.MatchCN }} ) {
-            return 403 "client certificate unauthorized";
-        }
-        {{ end }}
-        {{ end }}
-
-        {{ if eq $server.Hostname "_" }}
-        ssl_reject_handshake {{ if $all.Cfg.SSLRejectHandshake }}on{{ else }}off{{ end }};
-        {{ end }}
-
-        ssl_certificate_by_lua_block {
-            certificate.call()
-        }
-
-        {{ if not (empty $server.AuthTLSError) }}
-        # {{ $server.AuthTLSError }}
-        return 403;
-        {{ else }}
-
-        {{ if not (empty $server.CertificateAuth.CAFileName) }}
-        # PEM sha: {{ $server.CertificateAuth.CASHA }}
-        ssl_client_certificate                  {{ $server.CertificateAuth.CAFileName }};
-        ssl_verify_client                       {{ $server.CertificateAuth.VerifyClient }};
-        ssl_verify_depth                        {{ $server.CertificateAuth.ValidationDepth }};
-
-        {{ if not (empty $server.CertificateAuth.CRLFileName) }}
-        # PEM sha: {{ $server.CertificateAuth.CRLSHA }}
-        ssl_crl                                 {{ $server.CertificateAuth.CRLFileName }};
-        {{ end }}
-
-        {{ if not (empty $server.CertificateAuth.ErrorPage)}}
-        error_page 495 496 = {{ $server.CertificateAuth.ErrorPage }};
-        {{ end }}
-        {{ end }}
-
-        {{ if not (empty $server.ProxySSL.CAFileName) }}
-        # PEM sha: {{ $server.ProxySSL.CASHA }}
-        proxy_ssl_trusted_certificate           {{ $server.ProxySSL.CAFileName }};
-        proxy_ssl_ciphers                       {{ $server.ProxySSL.Ciphers }};
-        proxy_ssl_protocols                     {{ $server.ProxySSL.Protocols }};
-        proxy_ssl_verify                        {{ $server.ProxySSL.Verify }};
-        proxy_ssl_verify_depth                  {{ $server.ProxySSL.VerifyDepth }};
-        {{ if not (empty $server.ProxySSL.ProxySSLName) }}
-        proxy_ssl_name                          {{ $server.ProxySSL.ProxySSLName }};
-        proxy_ssl_server_name                   {{ $server.ProxySSL.ProxySSLServerName }};
-        {{ end }}
-        {{ end }}
-
-        {{ if not (empty $server.ProxySSL.PemFileName) }}
-        proxy_ssl_certificate                   {{ $server.ProxySSL.PemFileName }};
-        proxy_ssl_certificate_key               {{ $server.ProxySSL.PemFileName }};
-        {{ end }}
-
-        {{ if not (empty $server.SSLCiphers) }}
-        ssl_ciphers                             {{ $server.SSLCiphers }};
-        {{ end }}
-
-        {{ if not (empty $server.SSLPreferServerCiphers) }}
-        ssl_prefer_server_ciphers               {{ $server.SSLPreferServerCiphers }};
-        {{ end }}
-
-        {{ if not (empty $server.ServerSnippet) }}
-        # Custom code snippet configured for host {{ $server.Hostname }}
-        {{ $server.ServerSnippet }}
-        {{ end }}
-
-        {{ range $errorLocation := (buildCustomErrorLocationsPerServer $server) }}
-        {{ template "CUSTOM_ERRORS" (buildCustomErrorDeps $errorLocation.UpstreamName $errorLocation.Codes $all.EnableMetrics $all.Cfg.EnableModsecurity) }}
-        {{ end }}
-
-        {{ buildMirrorLocations $server.Locations }}
-
-        {{ $enforceRegex := enforceRegexModifier $server.Locations }}
-        {{ range $location := $server.Locations }}
-        {{ $path := buildLocation $location $enforceRegex }}
-        {{ $proxySetHeader := proxySetHeader $location }}
-        {{ $authPath := buildAuthLocation $location $all.Cfg.GlobalExternalAuth.URL }}
-        {{ $applyGlobalAuth := shouldApplyGlobalAuth $location $all.Cfg.GlobalExternalAuth.URL }}
-        {{ $applyAuthUpstream := shouldApplyAuthUpstream $location $all.Cfg }}
-
-        {{ $externalAuth := $location.ExternalAuth }}
-        {{ if eq $applyGlobalAuth true }}
-        {{ $externalAuth = $all.Cfg.GlobalExternalAuth }}
-        {{ end }}
-
-        {{ if not (empty $location.Rewrite.AppRoot) }}
-        if ($uri = /) {
-            return 302 $scheme://$http_host{{ $location.Rewrite.AppRoot }};
-        }
-        {{ end }}
-
-        {{ if $authPath }}
-        location = {{ $authPath }} {
-            internal;
-
-            {{ if (or $all.Cfg.EnableOpentelemetry $location.Opentelemetry.Enabled) }}
-            opentelemetry on;
-            opentelemetry_propagate;
-            {{ end }}
-
-            {{ if not $all.Cfg.EnableAuthAccessLog }}
-            access_log off;
-            {{ end }}
-
-            # Ensure that modsecurity will not run on an internal location as this is not accessible from outside
-            {{ if $all.Cfg.EnableModsecurity }}
-            modsecurity off;
-            {{ end }}
-
-            {{ if $externalAuth.AuthCacheKey }}
-            set $tmp_cache_key '{{ $server.Hostname }}{{ $authPath }}{{ $externalAuth.AuthCacheKey }}';
-            set $cache_key '';
-
-            rewrite_by_lua_block {
-                ngx.var.cache_key = ngx.encode_base64(ngx.sha1_bin(ngx.var.tmp_cache_key))
-            }
-
-            proxy_cache auth_cache;
-
-            {{- range $dur := $externalAuth.AuthCacheDuration }}
-            proxy_cache_valid {{ $dur }};
-            {{- end }}
-
-            proxy_cache_key "$cache_key";
-            {{ end }}
-
-            # ngx_auth_request module overrides variables in the parent request,
-            # therefore we have to explicitly set this variable again so that when the parent request
-            # resumes it has the correct value set for this variable so that Lua can pick backend correctly
-            set $proxy_upstream_name {{ buildUpstreamName $location | quote }};
-
-            proxy_pass_request_body     off;
-            proxy_set_header            Content-Length          "";
-            proxy_set_header            X-Forwarded-Proto       "";
-            proxy_set_header            X-Request-ID            $req_id;
-
-            {{ if $externalAuth.Method }}
-            proxy_method                {{ $externalAuth.Method }};
-            proxy_set_header            X-Original-URI          $request_uri;
-            proxy_set_header            X-Scheme                $pass_access_scheme;
-            {{ end }}
-
-            proxy_set_header            Host                    {{ $externalAuth.Host }};
-            proxy_set_header            X-Original-URL          $scheme://$http_host$request_uri;
-            proxy_set_header            X-Original-Method       $request_method;
-            proxy_set_header            X-Sent-From             "nginx-ingress-controller";
-            proxy_set_header            X-Real-IP               $remote_addr;
-            {{ if and $all.Cfg.UseForwardedHeaders $all.Cfg.ComputeFullForwardedFor }}
-            proxy_set_header            X-Forwarded-For        $full_x_forwarded_for;
-            {{ else }}
-            proxy_set_header            X-Forwarded-For        $remote_addr;
-            {{ end }}
-
-            {{ if $externalAuth.RequestRedirect }}
-            proxy_set_header            X-Auth-Request-Redirect {{ $externalAuth.RequestRedirect }};
-            {{ else }}
-            proxy_set_header            X-Auth-Request-Redirect $request_uri;
-            {{ end }}
-
-            {{ if $externalAuth.AuthCacheKey }}
-            proxy_buffering                         "on";
-            {{ else }}
-            proxy_buffering                         {{ $location.Proxy.ProxyBuffering }};
-            {{ end }}
-            proxy_buffer_size                       {{ $location.Proxy.BufferSize }};
-            proxy_buffers                           {{ $location.Proxy.BuffersNumber }} {{ $location.Proxy.BufferSize }};
-            proxy_request_buffering                 {{ $location.Proxy.RequestBuffering }};
-
-            proxy_ssl_server_name       on;
-            proxy_pass_request_headers  on;
-            {{ if isValidByteSize $location.Proxy.BodySize true }}
-            client_max_body_size        {{ $location.Proxy.BodySize }};
-            {{ end }}
-            {{ if isValidByteSize $location.ClientBodyBufferSize false }}
-            client_body_buffer_size     {{ $location.ClientBodyBufferSize }};
-            {{ end }}
-
-            # Pass the extracted client certificate to the auth provider
-            {{ if not (empty $server.CertificateAuth.CAFileName) }}
-            {{ if $server.CertificateAuth.PassCertToUpstream }}
-            proxy_set_header ssl-client-cert        $ssl_client_escaped_cert;
-            {{ end }}
-            proxy_set_header ssl-client-verify      $ssl_client_verify;
-            proxy_set_header ssl-client-subject-dn  $ssl_client_s_dn;
-            proxy_set_header ssl-client-issuer-dn   $ssl_client_i_dn;
-            {{ end }}
-
-            {{- range $line := buildAuthProxySetHeaders $externalAuth.ProxySetHeaders}}
-            {{ $line }}
-            {{- end }}
-
-            {{ if not (empty $externalAuth.AuthSnippet) }}
-            {{ $externalAuth.AuthSnippet }}
-            {{ end }}
-
-            {{ if and (eq $applyAuthUpstream true) (eq $applyGlobalAuth false) }}
-            {{ $authUpstreamName := buildAuthUpstreamName $location $server.Hostname }}
-            # The target is an upstream with HTTP keepalive, that is why the
-            # Connection header is cleared and the HTTP version is set to 1.1 as
-            # the Nginx documentation suggests:
-            # http://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive
-            proxy_http_version 1.1;
-            proxy_set_header Connection "";
-            set $target {{ changeHostPort $externalAuth.URL $authUpstreamName }};
-            {{ else }}
-            proxy_http_version {{ $location.Proxy.ProxyHTTPVersion }};
-            set $target {{ $externalAuth.URL }};
-            {{ end }}
-            proxy_pass $target;
-        }
-        {{ end }}
-
-        {{ if isLocationAllowed $location }}
-        {{ if $externalAuth.SigninURL }}
-        location {{ buildAuthSignURLLocation $location.Path $externalAuth.SigninURL }} {
-            internal;
-
-            add_header Set-Cookie $auth_cookie;
-
-            {{ if $location.CorsConfig.CorsEnabled }}
-            {{ template "CORS" $location }}
-            {{ end }}
-
-            # Ensure that modsecurity will not run on an internal location as this is not accessible from outside
-            {{ if $all.Cfg.EnableModsecurity }}
-            modsecurity off;
-            {{ end }}
-
-            return 302 {{ buildAuthSignURL $externalAuth.SigninURL $externalAuth.SigninURLRedirectParam }};
-        }
-        {{ end }}
-        {{ end }}
-
-        location {{ $path }} {
-            {{ $ing := (getIngressInformation $location.Ingress $server.Hostname $location.IngressPath) }}
-            set $namespace      {{ $ing.Namespace | quote}};
-            set $ingress_name   {{ $ing.Rule | quote }};
-            set $service_name   {{ $ing.Service | quote }};
-            set $service_port   {{ $ing.ServicePort | quote }};
-            set $location_path  {{ $ing.Path | escapeLiteralDollar | quote }};
-            set $global_rate_limit_exceeding n;
-
-            {{ buildOpentelemetryForLocation $all.Cfg.EnableOpentelemetry $all.Cfg.OpentelemetryTrustIncomingSpan $location }}
-
-            {{ if $location.Mirror.Source }}
-            mirror {{ $location.Mirror.Source }};
-            mirror_request_body {{ $location.Mirror.RequestBody }};
-            {{ end }}
-
-            rewrite_by_lua_block {
-                lua_ingress.rewrite({{ locationConfigForLua $location $all }})
-                balancer.rewrite()
-                plugins.run()
-            }
-
-            # be careful with `access_by_lua_block` and `satisfy any` directives as satisfy any
-            # will always succeed when there's `access_by_lua_block` that does not have any lua code doing `ngx.exit(ngx.DECLINED)`
-            # other authentication method such as basic auth or external auth useless - all requests will be allowed.
-            #access_by_lua_block {
-            #}
-
-            header_filter_by_lua_block {
-                lua_ingress.header()
-                plugins.run()
-            }
-
-            body_filter_by_lua_block {
-                plugins.run()
-            }
-
-            log_by_lua_block {
-                balancer.log()
-                {{ if $all.EnableMetrics }}
-                monitor.call()
-                {{ end }}
-
-                plugins.run()
-            }
-
-            {{ if not $location.Logs.Access }}
-            access_log off;
-            {{ end }}
-
-            {{ if $location.Logs.Rewrite }}
-            rewrite_log on;
-            {{ end }}
-
-            {{ if $location.HTTP2PushPreload }}
-            http2_push_preload on;
-            {{ end }}
-
-            port_in_redirect {{ if $location.UsePortInRedirects }}on{{ else }}off{{ end }};
-
-            set $balancer_ewma_score -1;
-            set $proxy_upstream_name {{ buildUpstreamName $location | quote }};
-            set $proxy_host          $proxy_upstream_name;
-            set $pass_access_scheme  $scheme;
-
-            {{ if $all.Cfg.UseProxyProtocol }}
-            set $pass_server_port    $proxy_protocol_server_port;
-            {{ else }}
-            set $pass_server_port    $server_port;
-            {{ end }}
-
-            set $best_http_host      $http_host;
-            set $pass_port           $pass_server_port;
-
-            set $proxy_alternative_upstream_name "";
-
-            {{ buildModSecurityForLocation $all.Cfg $location }}
-
-            {{ if isLocationAllowed $location }}
-            {{ if gt (len $location.Denylist.CIDR) 0 }}
-            {{ range $ip := $location.Denylist.CIDR }}
-            deny {{ $ip }};{{ end }}
-            {{ end }}
-            {{ if gt (len $location.Allowlist.CIDR) 0 }}
-            {{ range $ip := $location.Allowlist.CIDR }}
-            allow {{ $ip }};{{ end }}
-            deny all;
-            {{ end }}
-
-            {{ if $location.CorsConfig.CorsEnabled }}
-            {{ template "CORS" $location }}
-            {{ end }}
-
-            {{ if not (isLocationInLocationList $location $all.Cfg.NoAuthLocations) }}
-            {{ if $authPath }}
-            # this location requires authentication
-            {{ if and (eq $applyAuthUpstream true) (eq $applyGlobalAuth false) }}
-            set $auth_cookie '';
-            add_header Set-Cookie $auth_cookie;
-            {{- range $line := buildAuthResponseHeaders $proxySetHeader $externalAuth.ResponseHeaders true }}
-            {{ $line }}
-            {{- end }}
-            # `auth_request` module does not support HTTP keepalives in upstream block:
-            # https://trac.nginx.org/nginx/ticket/1579
-            access_by_lua_block {
-                local res = ngx.location.capture('{{ $authPath }}', { method = ngx.HTTP_GET, body = '', share_all_vars = {{ $externalAuth.KeepaliveShareVars }} })
-                if res.status == ngx.HTTP_OK then
-                    ngx.var.auth_cookie = res.header['Set-Cookie']
-                    {{- range $line := buildAuthUpstreamLuaHeaders $externalAuth.ResponseHeaders }}
-                    {{ $line }}
-                    {{- end }}
-                    return
-                end
-                if res.status == ngx.HTTP_UNAUTHORIZED or res.status == ngx.HTTP_FORBIDDEN then
-                    ngx.exit(res.status)
-                end
-                ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
-            }
-            {{ else }}
-            auth_request        {{ $authPath }};
-            auth_request_set    $auth_cookie $upstream_http_set_cookie;
-            {{ if $externalAuth.AlwaysSetCookie }}
-            add_header          Set-Cookie $auth_cookie always;
-            {{ else }}
-            add_header          Set-Cookie $auth_cookie;
-            {{ end }}
-            {{- range $line := buildAuthResponseHeaders $proxySetHeader $externalAuth.ResponseHeaders false }}
-            {{ $line }}
-            {{- end }}
-            {{ end }}
-            {{ end }}
-
-            {{ if $externalAuth.SigninURL }}
-            set_escape_uri $escaped_request_uri $request_uri;
-            error_page 401 = {{ buildAuthSignURLLocation $location.Path $externalAuth.SigninURL }};
-            {{ end }}
-
-            {{ if $location.BasicDigestAuth.Secured }}
-            {{ if eq $location.BasicDigestAuth.Type "basic" }}
-            auth_basic {{ $location.BasicDigestAuth.Realm | quote }};
-            auth_basic_user_file {{ $location.BasicDigestAuth.File }};
-            {{ else }}
-            auth_digest {{ $location.BasicDigestAuth.Realm | quote }};
-            auth_digest_user_file {{ $location.BasicDigestAuth.File }};
-            {{ end }}
-            {{ $proxySetHeader }} Authorization "";
-            {{ end }}
-            {{ end }}
-
-            {{/* if the location contains a rate limit annotation, create one */}}
-            {{ $limits := buildRateLimit $location }}
-            {{ range $limit := $limits }}
-            {{ $limit }}{{ end }}
-
-            {{ if isValidByteSize $location.Proxy.BodySize true }}
-            client_max_body_size                    {{ $location.Proxy.BodySize }};
-            {{ end }}
-            {{ if isValidByteSize $location.ClientBodyBufferSize false }}
-            client_body_buffer_size                 {{ $location.ClientBodyBufferSize }};
-            {{ end }}
-
-            {{/* By default use vhost as Host to upstream, but allow overrides */}}
-            {{ if not (empty $location.UpstreamVhost) }}
-            {{ $proxySetHeader }} Host                   {{ $location.UpstreamVhost | quote }};
-            {{ else }}
-            {{ $proxySetHeader }} Host                   $best_http_host;
-            {{ end }}
-
-            # Pass the extracted client certificate to the backend
-            {{ if not (empty $server.CertificateAuth.CAFileName) }}
-            {{ if $server.CertificateAuth.PassCertToUpstream }}
-            {{ $proxySetHeader }} ssl-client-cert        $ssl_client_escaped_cert;
-            {{ end }}
-            {{ $proxySetHeader }} ssl-client-verify      $ssl_client_verify;
-            {{ $proxySetHeader }} ssl-client-subject-dn  $ssl_client_s_dn;
-            {{ $proxySetHeader }} ssl-client-issuer-dn   $ssl_client_i_dn;
-            {{ end }}
-
-            # Allow websocket connections
-            {{ $proxySetHeader }}                        Upgrade           $http_upgrade;
-            {{ if $location.Connection.Enabled}}
-            {{ $proxySetHeader }}                        Connection        {{ $location.Connection.Header }};
-            {{ else }}
-            {{ $proxySetHeader }}                        Connection        $connection_upgrade;
-            {{ end }}
-
-            {{ $proxySetHeader }} X-Request-ID           $req_id;
-            {{ $proxySetHeader }} X-Real-IP              $remote_addr;
-            {{ if and $all.Cfg.UseForwardedHeaders $all.Cfg.ComputeFullForwardedFor }}
-            {{ $proxySetHeader }} X-Forwarded-For        $full_x_forwarded_for;
-            {{ else }}
-            {{ $proxySetHeader }} X-Forwarded-For        $remote_addr;
-            {{ end }}
-            {{ $proxySetHeader }} X-Forwarded-Host       $best_http_host;
-            {{ $proxySetHeader }} X-Forwarded-Port       $pass_port;
-            {{ $proxySetHeader }} X-Forwarded-Proto      $pass_access_scheme;
-            {{ $proxySetHeader }} X-Forwarded-Scheme     $pass_access_scheme;
-            {{ if $all.Cfg.ProxyAddOriginalURIHeader }}
-            {{ $proxySetHeader }} X-Original-URI         $request_uri;
-            {{ end }}
-            {{ $proxySetHeader }} X-Scheme               $pass_access_scheme;
-
-            # Pass the original X-Forwarded-For
-            {{ $proxySetHeader }} X-Original-Forwarded-For {{ buildForwardedFor $all.Cfg.ForwardedForHeader }};
-
-            # mitigate HTTPoxy Vulnerability
-            # https://www.nginx.com/blog/mitigating-the-httpoxy-vulnerability-with-nginx/
-            {{ $proxySetHeader }} Proxy                  "";
-
-            # Custom headers to proxied server
-            {{ range $k, $v := $all.ProxySetHeaders }}
-            {{ $proxySetHeader }} {{ $k }}                    {{ $v | quote }};
-            {{ end }}
-
-            proxy_connect_timeout                   {{ $location.Proxy.ConnectTimeout }}s;
-            proxy_send_timeout                      {{ $location.Proxy.SendTimeout }}s;
-            proxy_read_timeout                      {{ $location.Proxy.ReadTimeout }}s;
-
-            proxy_buffering                         {{ $location.Proxy.ProxyBuffering }};
-            proxy_buffer_size                       {{ $location.Proxy.BufferSize }};
-            proxy_buffers                           {{ $location.Proxy.BuffersNumber }} {{ $location.Proxy.BufferSize }};
-            {{ if isValidByteSize $location.Proxy.ProxyMaxTempFileSize true }}
-            proxy_max_temp_file_size                {{ $location.Proxy.ProxyMaxTempFileSize }};
-            {{ end }}
-            proxy_request_buffering                 {{ $location.Proxy.RequestBuffering }};
-            proxy_http_version                      {{ $location.Proxy.ProxyHTTPVersion }};
-
-            proxy_cookie_domain                     {{ $location.Proxy.CookieDomain }};
-            proxy_cookie_path                       {{ $location.Proxy.CookiePath }};
-
-            # In case of errors try the next upstream server before returning an error
-            proxy_next_upstream                     {{ buildNextUpstream $location.Proxy.NextUpstream $all.Cfg.RetryNonIdempotent }};
-            proxy_next_upstream_timeout             {{ $location.Proxy.NextUpstreamTimeout }};
-            proxy_next_upstream_tries               {{ $location.Proxy.NextUpstreamTries }};
-
-            {{ if or (eq $location.BackendProtocol "GRPC") (eq $location.BackendProtocol "GRPCS") }}
-            # Grpc settings
-            grpc_connect_timeout                    {{ $location.Proxy.ConnectTimeout }}s;
-            grpc_send_timeout                       {{ $location.Proxy.SendTimeout }}s;
-            grpc_read_timeout                       {{ $location.Proxy.ReadTimeout }}s;
-            {{ end }}
-
-            {{/* Add any additional configuration defined */}}
-            {{ $location.ConfigurationSnippet }}
-
-            {{ if not (empty $all.Cfg.LocationSnippet) }}
-            # Custom code snippet configured in the configuration configmap
-            {{ $all.Cfg.LocationSnippet }}
-            {{ end }}
-
-            {{ if $location.CustomHeaders }}
-            # Custom Response Headers
-            {{ range $k, $v := $location.CustomHeaders.Headers }}
-            more_set_headers {{ printf "%s: %s" $k $v | escapeLiteralDollar | quote }};
-            {{ end }}
-            {{ end }}
-
-            {{/* if we are sending the request to a custom default backend, we add the required headers */}}
-            {{ if (hasPrefix $location.Backend "custom-default-backend-") }}
-            proxy_set_header       X-Code             503;
-            proxy_set_header       X-Format           $http_accept;
-            proxy_set_header       X-Namespace        $namespace;
-            proxy_set_header       X-Ingress-Name     $ingress_name;
-            proxy_set_header       X-Service-Name     $service_name;
-            proxy_set_header       X-Service-Port     $service_port;
-            proxy_set_header       X-Request-ID       $req_id;
-            {{ end }}
-
-            {{ if $location.Satisfy }}
-            satisfy {{ $location.Satisfy }};
-            {{ end }}
-
-            {{/* if a location-specific error override is set, add the proxy_intercept here */}}
-            {{ if and $location.CustomHTTPErrors (not $location.DisableProxyInterceptErrors) }}
-            # Custom error pages per ingress
-            proxy_intercept_errors on;
-            {{ end }}
-
-            {{ range $errCode := $location.CustomHTTPErrors }}
-            error_page {{ $errCode }} = @custom_{{ $location.DefaultBackendUpstreamName }}_{{ $errCode }};{{ end }}
-
-            {{ if (eq $location.BackendProtocol "FCGI") }}
-            include /etc/nginx/fastcgi_params;
-            {{ end }}
-            {{- if $location.FastCGI.Index -}}
-            fastcgi_index {{ $location.FastCGI.Index | quote }};
-            {{- end -}}
-            {{ range $k, $v := $location.FastCGI.Params }}
-            fastcgi_param {{ $k }} {{ $v | quote }};
-            {{ end }}
-
-            {{ if not (empty $location.Redirect.URL) }}
-            return {{ $location.Redirect.Code }} {{ $location.Redirect.URL }};
-            {{ end }}
-
-            {{ buildProxyPass $server.Hostname $all.Backends $location }}
-            {{ if (or (eq $location.Proxy.ProxyRedirectFrom "default") (eq $location.Proxy.ProxyRedirectFrom "off")) }}
-            proxy_redirect                          {{ $location.Proxy.ProxyRedirectFrom }};
-            {{ else if not (eq $location.Proxy.ProxyRedirectTo "off") }}
-            proxy_redirect                          {{ $location.Proxy.ProxyRedirectFrom }} {{ $location.Proxy.ProxyRedirectTo }};
-            {{ end }}
-            {{ else }}
-            # Location denied. Reason: {{ $location.Denied | quote }}
-            return 503;
-            {{ end }}
-            {{ if not (empty $location.ProxySSL.CAFileName) }}
-            # PEM sha: {{ $location.ProxySSL.CASHA }}
-            proxy_ssl_trusted_certificate           {{ $location.ProxySSL.CAFileName }};
-            proxy_ssl_ciphers                       {{ $location.ProxySSL.Ciphers }};
-            proxy_ssl_protocols                     {{ $location.ProxySSL.Protocols }};
-            proxy_ssl_verify                        {{ $location.ProxySSL.Verify }};
-            proxy_ssl_verify_depth                  {{ $location.ProxySSL.VerifyDepth }};
-            {{ end }}
-
-            {{ if not (empty $location.ProxySSL.ProxySSLName) }}
-            proxy_ssl_name                          {{ $location.ProxySSL.ProxySSLName }};
-            {{ end }}
-            {{ if not (empty $location.ProxySSL.ProxySSLServerName) }}
-            proxy_ssl_server_name                   {{ $location.ProxySSL.ProxySSLServerName }};
-            {{ end }}
-
-            {{ if not (empty $location.ProxySSL.PemFileName) }}
-            proxy_ssl_certificate                   {{ $location.ProxySSL.PemFileName }};
-            proxy_ssl_certificate_key               {{ $location.ProxySSL.PemFileName }};
-            {{ end }}
-        }
-        {{ end }}
-        {{ end }}
-
-        {{ if eq $server.Hostname "_" }}
-        # health checks in cloud providers require the use of port {{ $all.ListenPorts.HTTP }}
-        location {{ $all.HealthzURI }} {
-
-            {{ if $all.Cfg.EnableOpentelemetry }}
-            opentelemetry off;
-            {{ end }}
-
-            access_log off;
-            return 200;
-        }
-
-        # this is required to avoid error if nginx is being monitored
-        # with an external software (like sysdig)
-        location /nginx_status {
-
-            {{ if $all.Cfg.EnableOpentelemetry }}
-            opentelemetry off;
-            {{ end }}
-
-            {{ range $v := $all.NginxStatusIpv4Whitelist }}
-            allow {{ $v }};
-            {{ end }}
-            {{ if $all.IsIPV6Enabled -}}
-            {{ range $v := $all.NginxStatusIpv6Whitelist }}
-            allow {{ $v }};
-            {{ end }}
-            {{ end -}}
-            deny all;
-
-            access_log off;
-            stub_status on;
-        }
-
-        {{ end }}
-
-{{ end }}
diff --git a/mariadb/templates/configmap-ingress-conf.yaml b/mariadb/templates/configmap-ingress-conf.yaml
deleted file mode 100755
index e8f52bf29..000000000
--- a/mariadb/templates/configmap-ingress-conf.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-{{/*
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/}}
-
-{{- if .Values.manifests.configmap_ingress_conf }}
-{{- $envAll := . }}
-
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mariadb-ingress-conf
-data:
-{{ toYaml .Values.conf.ingress_conf | indent 2 }}
-{{- end }}
diff --git a/mariadb/templates/configmap-ingress-etc.yaml b/mariadb/templates/configmap-ingress-etc.yaml
deleted file mode 100644
index 4c9ae27c3..000000000
--- a/mariadb/templates/configmap-ingress-etc.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-{{/*
-Licensed under the Apache License, Version 2.0 (the "License" );
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/}}
-
-{{- if .Values.manifests.configmap_ingress_etc }}
-{{- $envAll := . }}
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mariadb-ingress-etc
-data:
-{{- if $envAll.Values.conf.ingress }}
-  nginx.tmpl: |
-{{ $envAll.Values.conf.ingress | indent 4 }}
-{{- else }}
-{{ ( $envAll.Files.Glob "files/nginx.tmpl" ).AsConfig | indent 2 }}
-{{- end }}
-{{- end }}
diff --git a/mariadb/templates/deployment-controller.yaml b/mariadb/templates/deployment-controller.yaml
index 598d084a4..a0fe46b2d 100644
--- a/mariadb/templates/deployment-controller.yaml
+++ b/mariadb/templates/deployment-controller.yaml
@@ -13,9 +13,6 @@ limitations under the License.
 */}}
 
 {{- if .Values.manifests.deployment_controller }}
-{{- if .Values.manifests.deployment_ingress }}
-{{- fail ".Values.manifests.deployment_ingress and .Values.manifests.deployment_controlle are mutually exclusive" }}
-{{- end }}
 {{- $envAll := . }}
 
 {{- $serviceAccountName := "mariadb-controller" }}
diff --git a/mariadb/templates/deployment-error.yaml b/mariadb/templates/deployment-error.yaml
deleted file mode 100644
index 4f3b68bd8..000000000
--- a/mariadb/templates/deployment-error.yaml
+++ /dev/null
@@ -1,78 +0,0 @@
-{{/*
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/}}
-
-{{- if .Values.manifests.deployment_error }}
-{{- $envAll := . }}
-
-{{- $serviceAccountName := "mariadb-ingress-error-pages" }}
-{{ tuple $envAll "error_pages" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mariadb-ingress-error-pages
-  annotations:
-    {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
-  labels:
-{{ tuple $envAll "mariadb" "ingress-error-pages" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
-spec:
-  replicas: {{ .Values.pod.replicas.error_page }}
-  selector:
-    matchLabels:
-{{ tuple $envAll "mariadb" "ingress-error-pages" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
-{{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }}
-  template:
-    metadata:
-      labels:
-{{ tuple $envAll "mariadb" "ingress-error-pages" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
-      annotations:
-{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
-        configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
-        configmap-etc-hash: {{ tuple "configmap-ingress-etc.yaml" . | include "helm-toolkit.utils.hash" }}
-{{ dict "envAll" $envAll "podName" "mariadb-ingress-error-pages" "containerNames" (list "init" "ingress-error-pages") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
-    spec:
-      shareProcessNamespace: true
-      serviceAccountName: {{ $serviceAccountName }}
-{{ dict "envAll" $envAll "application" "error_pages" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
-      affinity:
-{{ tuple $envAll "mariadb" "ingress-error-pages" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
-{{ if $envAll.Values.pod.tolerations.mariadb.enabled }}
-{{ tuple $envAll "mariadb" | include "helm-toolkit.snippets.kubernetes_tolerations" | indent 6 }}
-{{ end }}
-      nodeSelector:
-        {{ .Values.labels.error_server.node_selector_key }}: {{ .Values.labels.error_server.node_selector_value }}
-      terminationGracePeriodSeconds: {{ .Values.pod.lifecycle.termination_grace_period.error_pages.timeout | default "60" }}
-      initContainers:
-{{ tuple $envAll "error_pages" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
-      containers:
-        - name: ingress-error-pages
-{{ tuple $envAll "error_pages" | include "helm-toolkit.snippets.image" | indent 10 }}
-{{ dict "envAll" $envAll "application" "error_pages" "container" "server" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
-{{ tuple $envAll $envAll.Values.pod.resources.error_pages | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 8080
-              scheme: HTTP
-            initialDelaySeconds: 30
-            timeoutSeconds: 5
-          ports:
-            - containerPort: 8080
-          volumeMounts:
-            - name: pod-tmp
-              mountPath: /tmp
-      volumes:
-        - name: pod-tmp
-          emptyDir: {}
-{{- end }}
diff --git a/mariadb/templates/deployment-ingress.yaml b/mariadb/templates/deployment-ingress.yaml
deleted file mode 100644
index 6fbf33895..000000000
--- a/mariadb/templates/deployment-ingress.yaml
+++ /dev/null
@@ -1,322 +0,0 @@
-{{/*
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/}}
-
-{{- if (.Values.global).subchart_release_name }}
-{{- $_ := set . "deployment_name" .Chart.Name }}
-{{- else }}
-{{- $_ := set . "deployment_name" .Release.Name }}
-{{- end }}
-
-{{- if .Values.manifests.deployment_ingress }}
-{{- $envAll := . }}
-
-{{- $ingressClass := printf "%s-%s" .deployment_name "mariadb-ingress" }}
-
-{{- $serviceAccountName := printf "%s-%s" .deployment_name "ingress" }}
-{{ tuple $envAll "ingress" $serviceAccountName | include "helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount" }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ $serviceAccountName }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - endpoints
-      - nodes
-      - pods
-      - secrets
-    verbs:
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - nodes
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - "extensions"
-      - "networking.k8s.io"
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - "extensions"
-      - "networking.k8s.io"
-    resources:
-      - ingresses/status
-    verbs:
-      - update
-  - apiGroups:
-      - "networking.k8s.io"
-    resources:
-      - ingressclasses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - discovery.k8s.io
-    resources:
-      - endpointslices
-    verbs:
-      - get
-      - list
-      - watch
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ $serviceAccountName }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ $serviceAccountName }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ $serviceAccountName }}
-    namespace: {{ $envAll.Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: {{ $serviceAccountName }}
-  namespace: {{ $envAll.Release.Namespace }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - services
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - extensions
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - events
-    verbs:
-      - create
-      - patch
-  - apiGroups:
-      - extensions
-      - networking.k8s.io
-    resources:
-      - ingresses/status
-    verbs:
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - endpoints
-      - nodes
-      - pods
-      - secrets
-    verbs:
-      - list
-      - watch
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-      - pods
-      - secrets
-      - namespaces
-    verbs:
-      - get
-  - apiGroups:
-      - ""
-    resourceNames:
-      - {{ printf "%s-%s" .deployment_name $ingressClass | quote }}
-    resources:
-      - configmaps
-    verbs:
-      - get
-      - update
-  - apiGroups:
-      - ""
-    resources:
-      - configmaps
-    verbs:
-      - create
-  - apiGroups:
-      - ""
-    resources:
-      - endpoints
-    verbs:
-      - get
-      - create
-      - update
-  - apiGroups:
-      - coordination.k8s.io
-    resources:
-      - leases
-    verbs:
-      - get
-      - create
-      - update
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: {{ $serviceAccountName }}
-  namespace: {{ $envAll.Release.Namespace }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: {{ $serviceAccountName }}
-subjects:
-  - kind: ServiceAccount
-    name: {{ $serviceAccountName }}
-    namespace: {{ $envAll.Release.Namespace }}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mariadb-ingress
-  annotations:
-    {{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" }}
-  labels:
-{{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
-    app.kubernetes.io/instance: {{ $serviceAccountName }}
-    app.kubernetes.io/name: "mariadb"
-    app.kubernetes.io/component: "ingress"
-    app.kubernetes.io/managed-by: {{ $envAll.Release.Service }}
-{{- if $envAll.Chart.AppVersion }}
-    app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }}
-{{- end }}
-spec:
-  replicas: {{ .Values.pod.replicas.ingress }}
-  selector:
-    matchLabels:
-{{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 6 }}
-{{ tuple $envAll | include "helm-toolkit.snippets.kubernetes_upgrades_deployment" | indent 2 }}
-  template:
-    metadata:
-      labels:
-{{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 8 }}
-        app.kubernetes.io/instance: {{ $serviceAccountName }}
-        app.kubernetes.io/name: "mariadb"
-        app.kubernetes.io/component: "ingress"
-        app.kubernetes.io/managed-by: {{ $envAll.Release.Service }}
-{{- if $envAll.Chart.AppVersion }}
-        app.kubernetes.io/version: {{ $envAll.Chart.AppVersion | quote }}
-{{- end }}
-      annotations:
-{{ tuple $envAll | include "helm-toolkit.snippets.release_uuid" | indent 8 }}
-        configmap-bin-hash: {{ tuple "configmap-bin.yaml" . | include "helm-toolkit.utils.hash" }}
-        configmap-etc-hash: {{ tuple "configmap-ingress-etc.yaml" . | include "helm-toolkit.utils.hash" }}
-{{ dict "envAll" $envAll "podName" "mariadb-ingress" "containerNames" (list "init" "ingress") | include "helm-toolkit.snippets.kubernetes_mandatory_access_control_annotation" | indent 8 }}
-    spec:
-      shareProcessNamespace: true
-      serviceAccountName: {{ $serviceAccountName }}
-{{ dict "envAll" $envAll "application" "ingress" | include "helm-toolkit.snippets.kubernetes_pod_security_context" | indent 6 }}
-      affinity:
-{{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_pod_anti_affinity" | indent 8 }}
-{{ if $envAll.Values.pod.tolerations.mariadb.enabled }}
-{{ tuple $envAll "mariadb" | include "helm-toolkit.snippets.kubernetes_tolerations" | indent 6 }}
-{{ end }}
-      nodeSelector:
-        {{ .Values.labels.ingress.node_selector_key }}: {{ .Values.labels.ingress.node_selector_value }}
-      terminationGracePeriodSeconds: 60
-      initContainers:
-{{ tuple $envAll "ingress" list | include "helm-toolkit.snippets.kubernetes_entrypoint_init_container" | indent 8 }}
-      containers:
-        - name: ingress
-{{ tuple $envAll "ingress" | include "helm-toolkit.snippets.image" | indent 10 }}
-{{ dict "envAll" $envAll "application" "ingress" "container" "server" | include "helm-toolkit.snippets.kubernetes_container_security_context" | indent 10 }}
-{{ tuple $envAll $envAll.Values.pod.resources.ingress | include "helm-toolkit.snippets.kubernetes_resources" | indent 10 }}
-          readinessProbe:
-            tcpSocket:
-              port: {{ tuple "oslo_db" "internal" "mysql" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: 10254
-              scheme: HTTP
-            initialDelaySeconds: 10
-            timeoutSeconds: 1
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: RELEASE_NAME
-              value: {{ .deployment_name | quote }}
-            - name: INGRESS_CLASS
-              value: {{ $ingressClass | quote }}
-            - name: ERROR_PAGE_SERVICE
-              value: {{ tuple "oslo_db" "error_pages" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" | quote }}
-          command:
-            - /usr/bin/dumb-init
-            - /nginx-ingress-controller
-            - --election-id=$(RELEASE_NAME)
-            - --ingress-class=$(INGRESS_CLASS)
-            - --default-backend-service=$(POD_NAMESPACE)/$(ERROR_PAGE_SERVICE)
-            - --configmap=$(POD_NAMESPACE)/mariadb-ingress-conf
-            - --enable-ssl-chain-completion=false
-            - --tcp-services-configmap=$(POD_NAMESPACE)/mariadb-services-tcp
-          lifecycle:
-            preStop:
-              exec:
-                command:
-                  - kill -TERM 1
-          volumeMounts:
-            - name: mariadb-ingress-etc
-              mountPath: /etc/nginx/template/nginx.tmpl
-              subPath: nginx.tmpl
-              readOnly: true
-      volumes:
-        - name: mariadb-ingress-etc
-          configMap:
-            name: mariadb-ingress-etc
-            defaultMode: 0444
-{{- end }}
diff --git a/mariadb/templates/service-error.yaml b/mariadb/templates/service-error.yaml
deleted file mode 100644
index 04975cc32..000000000
--- a/mariadb/templates/service-error.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-{{/*
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/}}
-
-{{- if .Values.manifests.service_error }}
-{{- $envAll := . }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-{{ tuple $envAll "mariadb" "ingress-error-pages" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
-  name: {{ tuple "oslo_db" "error_pages" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
-spec:
-  clusterIP: None
-  ports:
-    - port: 80
-      protocol: TCP
-      targetPort: 8080
-  selector:
-{{ tuple $envAll "mariadb" "ingress-error-pages" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
-{{- end }}
diff --git a/mariadb/templates/service-ingress.yaml b/mariadb/templates/service-ingress.yaml
deleted file mode 100644
index 9dc23475e..000000000
--- a/mariadb/templates/service-ingress.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-{{/*
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-   http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/}}
-
-{{- if .Values.manifests.service_ingress }}
-{{- $envAll := . }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-{{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
-  name: {{ tuple "oslo_db" "internal" . | include "helm-toolkit.endpoints.hostname_short_endpoint_lookup" }}
-spec:
-  ports:
-    - name: mysql
-      port: {{ tuple "oslo_db" "internal" "mysql" . | include "helm-toolkit.endpoints.endpoint_port_lookup" }}
-      protocol: TCP
-  selector:
-{{ tuple $envAll "mariadb" "ingress" | include "helm-toolkit.snippets.kubernetes_metadata_labels" | indent 4 }}
-{{- end }}
diff --git a/mariadb/templates/service-master.yaml b/mariadb/templates/service-master.yaml
index 1472e6a32..e57824b18 100644
--- a/mariadb/templates/service-master.yaml
+++ b/mariadb/templates/service-master.yaml
@@ -13,9 +13,6 @@ limitations under the License.
 */}}
 
 {{- if .Values.manifests.service_master }}
-{{- if .Values.manifests.service_ingress }}
-{{- fail ".Values.manifests.service_ingress and .Values.manifests.service_master are mutually exclusive" }}
-{{- end }}
 
 {{- $envAll := . }}
 ---
diff --git a/mariadb/values.yaml b/mariadb/values.yaml
index 1c6e4dc76..68e4488d2 100644
--- a/mariadb/values.yaml
+++ b/mariadb/values.yaml
@@ -21,8 +21,6 @@ release_group: null
 images:
   tags:
     mariadb: docker.io/openstackhelm/mariadb:latest-ubuntu_focal
-    ingress: registry.k8s.io/ingress-nginx/controller:v1.11.2
-    error_pages: k8s.gcr.io/defaultbackend-amd64:1.5
     prometheus_create_mysql_user: docker.io/library/mariadb:10.5.9-focal
     prometheus_mysql_exporter: docker.io/prom/mysqld-exporter:v0.12.1
     prometheus_mysql_exporter_helm_tests: docker.io/openstackhelm/heat:wallaby-ubuntu_focal
@@ -43,15 +41,9 @@ labels:
   server:
     node_selector_key: openstack-control-plane
     node_selector_value: enabled
-  ingress:
-    node_selector_key: openstack-control-plane
-    node_selector_value: enabled
   prometheus_mysql_exporter:
     node_selector_key: openstack-control-plane
     node_selector_value: enabled
-  error_server:
-    node_selector_key: openstack-control-plane
-    node_selector_value: enabled
   job:
     node_selector_key: openstack-control-plane
     node_selector_value: enabled
@@ -95,20 +87,6 @@ pod:
           runAsUser: 999
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
-    ingress:
-      pod:
-        runAsUser: 65534
-      container:
-        server:
-          runAsUser: 0
-          readOnlyRootFilesystem: false
-    error_pages:
-      pod:
-        runAsUser: 65534
-      container:
-        server:
-          allowPrivilegeEscalation: false
-          readOnlyRootFilesystem: true
     prometheus_mysql_exporter:
       pod:
         runAsUser: 99
@@ -172,8 +150,6 @@ pod:
         effect: NoSchedule
   replicas:
     server: 3
-    ingress: 2
-    error_page: 1
     controller: 1
   lifecycle:
     upgrades:
@@ -183,9 +159,6 @@ pod:
         rolling_update:
           max_unavailable: 1
           max_surge: 3
-    termination_grace_period:
-      error_pages:
-        timeout: 10
     disruption_budget:
       mariadb:
         min_available: 0
@@ -198,13 +171,6 @@ pod:
       limits:
         memory: "1024Mi"
         cpu: "2000m"
-    ingress:
-      requests:
-        memory: "128Mi"
-        cpu: "100m"
-      limits:
-        memory: "1024Mi"
-        cpu: "2000m"
     jobs:
       tests:
         limits:
@@ -252,13 +218,6 @@ dependencies:
           - endpoint: node
             service: local_image_registry
   static:
-    error_pages:
-      jobs: null
-    ingress:
-      jobs: null
-      services:
-        - endpoint: error_pages
-          service: oslo_db
     mariadb_backup:
       jobs:
         - mariadb-ks-user
@@ -314,7 +273,6 @@ jobs:
 conf:
   tests:
     # This may either be:
-    # * internal: which will hit the endpoint exposed by the ingress controller
     # * direct: which will hit the backends directly via a k8s service ip
     # Note, deadlocks and failure are to be expected with concurrency if
     # hitting the `direct` endpoint.
@@ -326,10 +284,6 @@ conf:
       - --number-of-queries=1000
       - --number-char-cols=1
       - --number-int-cols=1
-  ingress: null
-  ingress_conf:
-    worker-processes: "auto"
-    log-format-stream: "\"$remote_addr [$time_local] $protocol $status $bytes_received $bytes_sent $upstream_addr $upstream_connect_time $upstream_first_byte_time $upstream_session_time $session_time\""
   mariadb_server:
     setup_wait:
       iteration: 30
@@ -600,7 +554,6 @@ endpoints:
       default: mariadb
       direct: mariadb-server
       discovery: mariadb-discovery
-      error_pages: mariadb-ingress-error-pages
     host_fqdn_override:
       default: null
     path: null
@@ -672,8 +625,6 @@ endpoints:
 network:
   mariadb: {}
   mariadb_discovery: {}
-  mariadb_ingress: {}
-  mariadb_ingress_error_pages: {}
   mariadb_master: {}
 
 network_policy:
@@ -696,11 +647,7 @@ manifests:
   certificates: false
   configmap_bin: true
   configmap_etc: true
-  configmap_ingress_conf: false
-  configmap_ingress_etc: false
   configmap_services_tcp: true
-  deployment_error: false
-  deployment_ingress: false
   job_image_repo_sync: true
   cron_job_mariadb_backup: false
   job_ks_user: false
@@ -720,7 +667,6 @@ manifests:
   secret_etc: true
   secret_registry: true
   service_discovery: true
-  service_ingress: false
   service_error: false
   service: true
   statefulset: true
diff --git a/mariadb/values_overrides/ingress-service.yaml b/mariadb/values_overrides/ingress-service.yaml
deleted file mode 100644
index 10825c07a..000000000
--- a/mariadb/values_overrides/ingress-service.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
----
-manifests:
-  deployment_ingress: true
-  deployment_error: true
-  service_ingress: true
-  configmap_ingress_conf: true
-  configmap_ingress_etc: true
-  service_error: true
-conf:
-  galera:
-    cluster_leader_ttl: 120
-endpoints:
-  oslo_db:
-    hosts:
-      default: mariadb
-      primary: mariadb-primary-service
-...
diff --git a/releasenotes/notes/mariadb.yaml b/releasenotes/notes/mariadb.yaml
index 4b7d32360..00f0dcc14 100644
--- a/releasenotes/notes/mariadb.yaml
+++ b/releasenotes/notes/mariadb.yaml
@@ -64,4 +64,5 @@ mariadb:
   - 0.2.46 Avoid using cluster endpoints
   - 0.2.47 Deploy exporter as sidecar
   - 0.2.48 Switch to mariadb controller deployment
+  - 0.2.49 Remove ingress deployment
 ...