diff --git a/3node/helm-charts/nginx-private-ingress/.helmignore b/3node/helm-charts/nginx-private-ingress/.helmignore
new file mode 100644
index 0000000000000000000000000000000000000000..50af0317254197a5a019f4ac2f8ecc223f93f5a7
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/.helmignore
@@ -0,0 +1,22 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/3node/helm-charts/nginx-private-ingress/Chart.yaml b/3node/helm-charts/nginx-private-ingress/Chart.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..eef349c8e4986eb8015642b11305bc52471169ba
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/Chart.yaml
@@ -0,0 +1,21 @@
+apiVersion: v2
+name: private-ingress
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application.
+appVersion: 1.16.0
diff --git a/3node/helm-charts/nginx-private-ingress/templates/NOTES.txt b/3node/helm-charts/nginx-private-ingress/templates/NOTES.txt
new file mode 100644
index 0000000000000000000000000000000000000000..efc095b6bffb59e6ef3422aea2c4fc6285dcab1a
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/templates/NOTES.txt
@@ -0,0 +1,21 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+ {{- range .paths }}
+ http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
+ {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+ export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "private-ingress.fullname" . }})
+ export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+ echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+ NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+ You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "private-ingress.fullname" . }}'
+ export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "private-ingress.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+ echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+ export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "private-ingress.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+ echo "Visit http://127.0.0.1:8080 to use your application"
+ kubectl port-forward $POD_NAME 8080:80
+{{- end }}
diff --git a/3node/helm-charts/nginx-private-ingress/templates/_helpers.tpl b/3node/helm-charts/nginx-private-ingress/templates/_helpers.tpl
new file mode 100644
index 0000000000000000000000000000000000000000..e910d49f35d3ece9b89b608d5b2892d797e485ef
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/templates/_helpers.tpl
@@ -0,0 +1,63 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "private-ingress.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "private-ingress.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "private-ingress.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Common labels
+*/}}
+{{- define "private-ingress.labels" -}}
+helm.sh/chart: {{ include "private-ingress.chart" . }}
+{{ include "private-ingress.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{/*
+Selector labels
+*/}}
+{{- define "private-ingress.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "private-ingress.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "private-ingress.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+ {{ default (include "private-ingress.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+ {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
diff --git a/3node/helm-charts/nginx-private-ingress/templates/configMap.yaml b/3node/helm-charts/nginx-private-ingress/templates/configMap.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..cef71c1e7be9ea5c3169fb449bd4cd678f53259f
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/templates/configMap.yaml
@@ -0,0 +1,24 @@
+apiVersion: v1
+data:
+ default.conf: |
+ server {
+ listen 80;
+ listen [::]:80;
+
+ location /learner/ {
+ rewrite ^/learner/(.*) /$1 break;
+ proxy_pass http://learner;
+ }
+ location /api/ {
+ rewrite ^/api/(.*) /$1 break;
+ proxy_pass http://apimanager-service:8000;
+ }
+ location /admin-api/ {
+ rewrite ^/admin-api/(.*) /$1 break;
+ proxy_pass http://apimanager-service:8001;
+ }
+ }
+kind: ConfigMap
+metadata:
+ creationTimestamp: null
+ name: private-ingress.conf
diff --git a/3node/helm-charts/nginx-private-ingress/templates/deployment.yaml b/3node/helm-charts/nginx-private-ingress/templates/deployment.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..6b28dc69418d0ed1e0d4d5b792c3249d72cd4998
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/templates/deployment.yaml
@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: private-ingress
+ namespace: dev
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: private-ingress
+ template:
+ metadata:
+ labels:
+ app: private-ingress
+ volumes:
+ - name: config-volume
+ configMap:
+ name: private-ingress.conf
+ spec:
+ containers:
+ - name: name
+ image: nginx
+ resources:
+ requests:
+ cpu: 100m
+ memory: 200Mi
+ ports:
+ - containerPort: 80
+ volumeMounts:
+ - mountPath: /etc/nginx/conf.d/
+ name: config-volume
+ readOnly: true
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: private-ingress
+ namespace: dev
+spec:
+ type: LoadBalancer
+ ports:
+ - port: 80
+ targetPort: 80
+ selector:
+ app: private-ingress
diff --git a/3node/helm-charts/nginx-private-ingress/templates/service.yaml b/3node/helm-charts/nginx-private-ingress/templates/service.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..d2126e459ccb2b4f0a808eca033cf35b217b85d2
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/templates/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "private-ingress.fullname" . }}
+ labels:
+ {{- include "private-ingress.labels" . | nindent 4 }}
+spec:
+ type: {{ .Values.service.type }}
+ ports:
+ - port: {{ .Values.service.port }}
+ targetPort: http
+ protocol: TCP
+ name: http
+ selector:
+ {{- include "private-ingress.selectorLabels" . | nindent 4 }}
diff --git a/3node/helm-charts/nginx-private-ingress/templates/serviceaccount.yaml b/3node/helm-charts/nginx-private-ingress/templates/serviceaccount.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..d25346fa6cce59ca73846fb178562fabcb6c1305
--- /dev/null
+++ b/3node/helm-charts/nginx-private-ingress/templates/serviceaccount.yaml
@@ -0,0 +1,8 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ include "private-ingress.serviceAccountName" . }}
+ labels:
+{{ include "private-ingress.labels" . | nindent 4 }}
+{{- end -}}