Unless you want/have to use identity aware proxy, I think the nginx ingress is the much simpler path.