> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qodo.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Google Cloud GKE ingress

> Use GKE Ingress with the release's NEG and BackendConfig values, pre-created TLS, and controller-specific class selection.

* **Deployment model**: On-premises
* **Configuration reference**: Qodo Helm chart `7.22.0`.

Use this pattern with the GKE Ingress controller and the HTTP load-balancing
addon. Prepare a VPC-native cluster, load-balancer firewall access, the
required Google Cloud permissions, and a ready `qodo-tls` Secret covering
all resolved Qodo hosts. For more information, see
[Configure ingress](https://docs.qodo.ai/on-prem/ingress.md).

## Configure values

Download [`ingress-google-cloud-values.yaml` in the values archive](https://docs.qodo.ai/examples/on-prem/values-examples.zip).
This example creates an external GKE Application Load Balancer:

```yaml ingress-google-cloud-values.yaml theme={null}
# Qodo chart values for external GKE Ingress.
# Also apply qodo-onprem/values-gke.yaml AFTER this overlay.
# qodo-tls must already contain the certificate and key for all six hosts.
global:
  tlsSecretName: qodo-tls
  ingress:
    enabled: true
    className: ""
    annotations:
      kubernetes.io/ingress.class: gce
      kubernetes.io/ingress.allow-http: "false"

```

Keep `className` empty. GKE selects its controller through the
`kubernetes.io/ingress.class` annotation. The HTTPS-only configuration
requires the TLS Secret to be ready first.

Also apply `values-gke.yaml` from the same Qodo release. It annotates each
public ClusterIP Service for network endpoint groups (NEGs), creates the
Platform and QAR timeout BackendConfigs, and configures Zitadel's
`/debug/healthz` health check on port `8083`.
These settings belong on Services and BackendConfigs; setting only the
Ingress annotation is insufficient. For more information, see
[GKE Ingress configuration](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/ingress-configuration).

```bash theme={null}
helm upgrade --install qodo ./qodo-onprem \
  --kube-context "$KUBE_CONTEXT" --namespace "$NAMESPACE" \
  -f qodo-onprem/onprem-base.yaml -f my-values.yaml \
  -f ingress-google-cloud-values.yaml -f qodo-onprem/values-gke.yaml
```

Define `KUBE_CONTEXT` and `NAMESPACE` as in the shared ingress page. Keep
the release's GKE layer last, and do not use it with a different ingress
controller. For an internal load balancer, change the annotation to
`gce-internal` and satisfy GKE's regional subnet, proxy-only subnet, firewall,
certificate, and caller-connectivity prerequisites first. A private address
must remain reachable from your Git webhook provider. For more information,
see [Configure an internal Application Load Balancer](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balance-ingress).

## Verify the load balancer

```bash theme={null}
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" \
  get backendconfigs,ingress
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" \
  describe ingress qodo-qodo
```

Check the Service NEG annotations and cloud backend health. Complete the
shared TLS, discovery, browser login, SDK, and webhook acceptance checks.

| Symptom | Check and recovery |
| - | - |
| Controller expects NodePort or LoadBalancer Services | Apply the matching release's `values-gke.yaml` and check NEGs |
| No address or the wrong controller handles the Ingress | Leave `className` empty and check the `gce` or `gce-internal` annotation |
| Zitadel is an unhealthy backend | Check `qodo-zitadel-hc`, its Service annotation, port `8083`, and `/debug/healthz` |
| HTTPS never becomes ready | Check the TLS Secret exists before applying the HTTPS-only Ingress |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.