I'm confused about nginx ingress with Kubernetes. I've been able to use it with "basic nginx auth" (unable to do so with oauth2 yet).

I've installed via helm:

helm install stable/nginx-ingress --name app-name --set rbac.create=true

This creates two services, an nginx-ingress-controller and an nginx-ingress-backend.

When I create an ingress, this ingress is targeted towards one and only one nginx-ingress-controller, but I have no idea how:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: tomcat
  annotations:
    nginx.ingress.kubernetes.io/auth-type: basic
    nginx.ingress.kubernetes.io/auth-secret: basic-auth
    nginx.ingress.kubernetes.io/auth-realm: "Authentication Required - foo"
    nginx.ingress.kubernetes.io/rewrite-target: /
  namespace: kube-system
spec:
  rules:
  - host:
    http:
      paths:
      - path: /
        backend:
          serviceName: tomcat-deployment-service 
          servicePort: 8080

When I get this Ingress from the output of kubectl get ingress -n kube-system, it has a public, external IP.

What's concerning is that basic-auth DOESN'T APPLY to that external IP; it's wide open! Nginx authentication only kicks in when I try to visit the nginx-ingress-controller's IP.

I have a lot of questions.

1. How do I made an ingress created from kubectl apply -f ingress.yaml target a specific nginx-ingress-controller?
2. How do I keep this new ingress from having an external IP?
3. Why isn't nginx authentication kicking in?
4. What IP am I suppose to use (the nginx-ingress-controller or the generated one?)
5. If I'm suppose to use the generated IP, what about the one from the controller?

I have been searching for descent, working examples (and pouring over sparse, changing documentation, and github issues) for literally days.

EDIT:

In this "official" documentation, it's unclear as to weather or not http://10.2.29.4/ is the IP from the ingress or the controller. I assume the controller because when I run this, the other doesn't even authenticate (it let's me in without asking for a password). Both IP's I'm using are external IPs (publicly available) on GCP.