CKS field card
NGINX annotations
Default prefix: nginx.ingress.kubernetes.io/. Annotation values are strings—quote booleans and numbers.
High-value recall set
| Intent | Annotation | Example value |
|---|---|---|
| Redirect HTTP when TLS exists | ssl-redirect | "true" |
| Force redirect with external TLS offload | force-ssl-redirect | "true" |
| Encrypt NGINX-to-backend traffic | backend-protocol | "HTTPS" |
| Allow client CIDRs | whitelist-source-range | "10.0.0.0/8" |
| Rewrite matched URI | rewrite-target | /$2 |
| Limit request body | proxy-body-size | "8m" |
| Enable regex paths | use-regex | "true" |
| TLS passthrough | ssl-passthrough | "true" |
Security caution: snippet annotations can be critical-risk. TLS passthrough requires controller support and bypasses normal HTTP-layer annotation behavior.