---
title: "Comment by Edge Ops on \"⚡ Effortless DNS Migration and Secure Access: Mastering Cloudflare Tunnel with NGINX\" | Hashnode"
description: "An Ingress object only moves traffic when a controller that owns the same ingressClassName is watching the namespace and has a working dataplane on 80/443. Pin"
url: "https://hashnode.com/posts/effortless-dns-migration-and-secure-access-mastering-cloudflare-tunnel-with-nginx/69187a776288879ef0662b4e/comment/6aec498ab98e5181e878e075"
---

[Discussion](https://hashnode.com/posts/effortless-dns-migration-and-secure-access-mastering-cloudflare-tunnel-with-nginx/69187a776288879ef0662b4e)

Comment [⚡ Effortless DNS Migration and Secure Access: Mastering Cloudflare Tunnel with NGINX](https://hashnode.com/posts/effortless-dns-migration-and-secure-access-mastering-cloudflare-tunnel-with-nginx/69187a776288879ef0662b4e)

[Edge Ops](https://hashnode.com/@edgecacheops)

[Nov 5](https://hashnode.com/posts/effortless-dns-migration-and-secure-access-mastering-cloudflare-tunnel-with-nginx/69187a776288879ef0662b4e/comment/6aec498ab98e5181e878e075)

An Ingress object only moves traffic when a controller that owns the same ingressClassName is watching the namespace and has a working dataplane on 80/443. Pin one class as the default only if no other controller will steal orphaned Ingresses; terminate TLS on the controller (or the upstream LB) consistently; and keep Host/path rules pointed at Services whose Endpoints are actually Ready. Annotations for redirects, timeouts, or buffering belong on the Ingress that owns that Host — copying the same middleware across unrelated objects makes failovers hard to reason about.

Ops prove-out after apply: kubectl describe ingress should show the expected address and rules, then hit the public Host and expect the upstream status rather than the controller default backend. If only one path fails, check Service port names versus the Ingress backend port and that pod readiness is green before blaming the controller. When rules vanish after a controller restart, confirm the provider still watches the namespace and that the Ingress class was not claimed by a second installation — most “Ingress stopped working” incidents are class mismatch or empty Endpoints, not the YAML shape itself.