diff --git a/cmd/nginx/flags.go b/cmd/nginx/flags.go
index 1430987b1..608ef5c9a 100644
--- a/cmd/nginx/flags.go
+++ b/cmd/nginx/flags.go
@@ -27,9 +27,9 @@ import (
 
 	apiv1 "k8s.io/api/core/v1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/controller"
-	ngx_config "k8s.io/ingress-nginx/pkg/ingress/controller/config"
-	ing_net "k8s.io/ingress-nginx/pkg/net"
+	"k8s.io/ingress-nginx/internal/ingress/controller"
+	ngx_config "k8s.io/ingress-nginx/internal/ingress/controller/config"
+	ing_net "k8s.io/ingress-nginx/internal/net"
 )
 
 const (
diff --git a/cmd/nginx/main.go b/cmd/nginx/main.go
index a77418d42..245445653 100644
--- a/cmd/nginx/main.go
+++ b/cmd/nginx/main.go
@@ -39,10 +39,10 @@ import (
 	"k8s.io/client-go/tools/clientcmd"
 	clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/controller"
-	"k8s.io/ingress-nginx/pkg/k8s"
-	"k8s.io/ingress-nginx/pkg/net/ssl"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/controller"
+	"k8s.io/ingress-nginx/internal/k8s"
+	"k8s.io/ingress-nginx/internal/net/ssl"
 	"k8s.io/ingress-nginx/version"
 )
 
diff --git a/pkg/file/file.go b/internal/file/file.go
similarity index 100%
rename from pkg/file/file.go
rename to internal/file/file.go
diff --git a/pkg/file/file_test.go b/internal/file/file_test.go
similarity index 100%
rename from pkg/file/file_test.go
rename to internal/file/file_test.go
diff --git a/pkg/ingress/annotations/alias/main.go b/internal/ingress/annotations/alias/main.go
similarity index 94%
rename from pkg/ingress/annotations/alias/main.go
rename to internal/ingress/annotations/alias/main.go
index cde40e2ba..0194e72af 100644
--- a/pkg/ingress/annotations/alias/main.go
+++ b/internal/ingress/annotations/alias/main.go
@@ -19,7 +19,7 @@ package alias
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/alias/main_test.go b/internal/ingress/annotations/alias/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/alias/main_test.go
rename to internal/ingress/annotations/alias/main_test.go
diff --git a/pkg/ingress/annotations/annotations.go b/internal/ingress/annotations/annotations.go
similarity index 73%
rename from pkg/ingress/annotations/annotations.go
rename to internal/ingress/annotations/annotations.go
index d4aca392a..ff888cf84 100644
--- a/pkg/ingress/annotations/annotations.go
+++ b/internal/ingress/annotations/annotations.go
@@ -23,32 +23,32 @@ import (
 	extensions "k8s.io/api/extensions/v1beta1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/alias"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/auth"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/authreq"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/authtls"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/clientbodybuffersize"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/cors"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/defaultbackend"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/healthcheck"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/ipwhitelist"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/portinredirect"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/proxy"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/ratelimit"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/redirect"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/rewrite"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/secureupstream"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/serversnippet"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/serviceupstream"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/sessionaffinity"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/snippet"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/sslpassthrough"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/upstreamhashby"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/upstreamvhost"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/vtsfilterkey"
-	"k8s.io/ingress-nginx/pkg/ingress/errors"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/alias"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/auth"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/authreq"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/authtls"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/clientbodybuffersize"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/cors"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/defaultbackend"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/healthcheck"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/portinredirect"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/proxy"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/ratelimit"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/redirect"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/rewrite"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/secureupstream"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/serversnippet"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/serviceupstream"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/sessionaffinity"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/snippet"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/sslpassthrough"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/upstreamhashby"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/upstreamvhost"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/vtsfilterkey"
+	"k8s.io/ingress-nginx/internal/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 // DeniedKeyName name of the key that contains the reason to deny a location
diff --git a/pkg/ingress/annotations/annotations_test.go b/internal/ingress/annotations/annotations_test.go
similarity index 95%
rename from pkg/ingress/annotations/annotations_test.go
rename to internal/ingress/annotations/annotations_test.go
index 55fde07ae..114be2318 100644
--- a/pkg/ingress/annotations/annotations_test.go
+++ b/internal/ingress/annotations/annotations_test.go
@@ -24,8 +24,8 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
@@ -162,9 +162,8 @@ func TestSecureVerifyCACert(t *testing.T) {
 	for _, ann := range anns {
 		ing := buildIngress()
 		ing.SetAnnotations(ann.annotations)
-		res := ec.Extract(ing).SecureUpstream
-
-		if (res != nil && res.CACert.CAFileName != "") != ann.exists {
+		su := ec.Extract(ing).SecureUpstream
+		if (su.CACert.CAFileName != "") != ann.exists {
 			t.Errorf("Expected exists was %v on iteration %v", ann.exists, ann.it)
 		}
 	}
@@ -189,10 +188,6 @@ func TestHealthCheck(t *testing.T) {
 	for _, foo := range fooAnns {
 		ing.SetAnnotations(foo.annotations)
 		r := ec.Extract(ing).HealthCheck
-		if r == nil {
-			t.Errorf("Returned nil but expected a healthcheck.Upstream")
-			continue
-		}
 
 		if r.FailTimeout != foo.euft {
 			t.Errorf("Returned %d but expected %d for FailTimeout", r.FailTimeout, foo.euft)
@@ -273,10 +268,6 @@ func TestAffinitySession(t *testing.T) {
 		ing.SetAnnotations(foo.annotations)
 		r := ec.Extract(ing).SessionAffinity
 		t.Logf("Testing pass %v %v %v", foo.affinitytype, foo.hash, foo.name)
-		if r == nil {
-			t.Errorf("Returned nil but expected a SessionAffinity.AffinityConfig")
-			continue
-		}
 
 		if r.Cookie.Hash != foo.hash {
 			t.Errorf("Returned %v but expected %v for Hash", r.Cookie.Hash, foo.hash)
@@ -311,10 +302,6 @@ func TestCors(t *testing.T) {
 		ing.SetAnnotations(foo.annotations)
 		r := ec.Extract(ing).CorsConfig
 		t.Logf("Testing pass %v %v %v %v %v", foo.corsenabled, foo.methods, foo.headers, foo.origin, foo.credentials)
-		if r == nil {
-			t.Errorf("Returned nil but expected a Cors.CorsConfig")
-			continue
-		}
 
 		if r.CorsEnabled != foo.corsenabled {
 			t.Errorf("Returned %v but expected %v for Cors Enabled", r.CorsEnabled, foo.corsenabled)
diff --git a/pkg/ingress/annotations/auth/main.go b/internal/ingress/annotations/auth/main.go
similarity index 95%
rename from pkg/ingress/annotations/auth/main.go
rename to internal/ingress/annotations/auth/main.go
index 1b28d81d4..606b225ed 100644
--- a/pkg/ingress/annotations/auth/main.go
+++ b/internal/ingress/annotations/auth/main.go
@@ -27,10 +27,10 @@ import (
 	api "k8s.io/api/core/v1"
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/file"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/file"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/internal/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/auth/main_test.go b/internal/ingress/annotations/auth/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/auth/main_test.go
rename to internal/ingress/annotations/auth/main_test.go
diff --git a/pkg/ingress/annotations/authreq/main.go b/internal/ingress/annotations/authreq/main.go
similarity index 97%
rename from pkg/ingress/annotations/authreq/main.go
rename to internal/ingress/annotations/authreq/main.go
index 28e884892..17a997652 100644
--- a/pkg/ingress/annotations/authreq/main.go
+++ b/internal/ingress/annotations/authreq/main.go
@@ -23,8 +23,8 @@ import (
 
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/internal/ingress/errors"
 )
 
 const (
diff --git a/pkg/ingress/annotations/authreq/main_test.go b/internal/ingress/annotations/authreq/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/authreq/main_test.go
rename to internal/ingress/annotations/authreq/main_test.go
diff --git a/pkg/ingress/annotations/authtls/main.go b/internal/ingress/annotations/authtls/main.go
similarity index 94%
rename from pkg/ingress/annotations/authtls/main.go
rename to internal/ingress/annotations/authtls/main.go
index 73556bee2..7fb5eac71 100644
--- a/pkg/ingress/annotations/authtls/main.go
+++ b/internal/ingress/annotations/authtls/main.go
@@ -22,10 +22,10 @@ import (
 
 	"regexp"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
-	"k8s.io/ingress-nginx/pkg/k8s"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/internal/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/k8s"
 )
 
 const (
diff --git a/pkg/ingress/annotations/authtls/main_test.go b/internal/ingress/annotations/authtls/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/authtls/main_test.go
rename to internal/ingress/annotations/authtls/main_test.go
diff --git a/pkg/ingress/annotations/class/main.go b/internal/ingress/annotations/class/main.go
similarity index 94%
rename from pkg/ingress/annotations/class/main.go
rename to internal/ingress/annotations/class/main.go
index 1d1d6d0ba..9c0db669b 100644
--- a/pkg/ingress/annotations/class/main.go
+++ b/internal/ingress/annotations/class/main.go
@@ -20,8 +20,8 @@ import (
 	"github.com/golang/glog"
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/errors"
 )
 
 const (
diff --git a/pkg/ingress/annotations/class/main_test.go b/internal/ingress/annotations/class/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/class/main_test.go
rename to internal/ingress/annotations/class/main_test.go
diff --git a/pkg/ingress/annotations/clientbodybuffersize/main.go b/internal/ingress/annotations/clientbodybuffersize/main.go
similarity index 95%
rename from pkg/ingress/annotations/clientbodybuffersize/main.go
rename to internal/ingress/annotations/clientbodybuffersize/main.go
index 08547d1e8..c8abf2701 100644
--- a/pkg/ingress/annotations/clientbodybuffersize/main.go
+++ b/internal/ingress/annotations/clientbodybuffersize/main.go
@@ -19,7 +19,7 @@ package clientbodybuffersize
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/clientbodybuffersize/main_test.go b/internal/ingress/annotations/clientbodybuffersize/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/clientbodybuffersize/main_test.go
rename to internal/ingress/annotations/clientbodybuffersize/main_test.go
diff --git a/pkg/ingress/annotations/cors/main.go b/internal/ingress/annotations/cors/main.go
similarity index 98%
rename from pkg/ingress/annotations/cors/main.go
rename to internal/ingress/annotations/cors/main.go
index f382606fa..aa03ce035 100644
--- a/pkg/ingress/annotations/cors/main.go
+++ b/internal/ingress/annotations/cors/main.go
@@ -21,7 +21,7 @@ import (
 
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/cors/main_test.go b/internal/ingress/annotations/cors/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/cors/main_test.go
rename to internal/ingress/annotations/cors/main_test.go
diff --git a/pkg/ingress/annotations/defaultbackend/main.go b/internal/ingress/annotations/defaultbackend/main.go
similarity index 92%
rename from pkg/ingress/annotations/defaultbackend/main.go
rename to internal/ingress/annotations/defaultbackend/main.go
index 8fc6f0d4e..fa19a583d 100644
--- a/pkg/ingress/annotations/defaultbackend/main.go
+++ b/internal/ingress/annotations/defaultbackend/main.go
@@ -22,8 +22,8 @@ import (
 	"github.com/pkg/errors"
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/healthcheck/main.go b/internal/ingress/annotations/healthcheck/main.go
similarity index 94%
rename from pkg/ingress/annotations/healthcheck/main.go
rename to internal/ingress/annotations/healthcheck/main.go
index 8b29838be..ca386a296 100644
--- a/pkg/ingress/annotations/healthcheck/main.go
+++ b/internal/ingress/annotations/healthcheck/main.go
@@ -19,8 +19,8 @@ package healthcheck
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/healthcheck/main_test.go b/internal/ingress/annotations/healthcheck/main_test.go
similarity index 97%
rename from pkg/ingress/annotations/healthcheck/main_test.go
rename to internal/ingress/annotations/healthcheck/main_test.go
index d32dc8de2..31b43eb39 100644
--- a/pkg/ingress/annotations/healthcheck/main_test.go
+++ b/internal/ingress/annotations/healthcheck/main_test.go
@@ -24,7 +24,7 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 func buildIngress() *extensions.Ingress {
diff --git a/pkg/ingress/annotations/ipwhitelist/main.go b/internal/ingress/annotations/ipwhitelist/main.go
similarity index 92%
rename from pkg/ingress/annotations/ipwhitelist/main.go
rename to internal/ingress/annotations/ipwhitelist/main.go
index df2fe522c..2b4cd72aa 100644
--- a/pkg/ingress/annotations/ipwhitelist/main.go
+++ b/internal/ingress/annotations/ipwhitelist/main.go
@@ -23,11 +23,11 @@ import (
 	"github.com/pkg/errors"
 
 	extensions "k8s.io/api/extensions/v1beta1"
-	"k8s.io/ingress-nginx/pkg/net"
+	"k8s.io/ingress-nginx/internal/net"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/internal/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/ipwhitelist/main_test.go b/internal/ingress/annotations/ipwhitelist/main_test.go
similarity index 99%
rename from pkg/ingress/annotations/ipwhitelist/main_test.go
rename to internal/ingress/annotations/ipwhitelist/main_test.go
index 66899a517..a4e166608 100644
--- a/pkg/ingress/annotations/ipwhitelist/main_test.go
+++ b/internal/ingress/annotations/ipwhitelist/main_test.go
@@ -24,7 +24,7 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 func buildIngress() *extensions.Ingress {
diff --git a/pkg/ingress/annotations/parser/main.go b/internal/ingress/annotations/parser/main.go
similarity index 98%
rename from pkg/ingress/annotations/parser/main.go
rename to internal/ingress/annotations/parser/main.go
index 2ef0a81ea..cbec167a5 100644
--- a/pkg/ingress/annotations/parser/main.go
+++ b/internal/ingress/annotations/parser/main.go
@@ -21,7 +21,7 @@ import (
 
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/errors"
 )
 
 // IngressAnnotation has a method to parse annotations located in Ingress
diff --git a/pkg/ingress/annotations/parser/main_test.go b/internal/ingress/annotations/parser/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/parser/main_test.go
rename to internal/ingress/annotations/parser/main_test.go
diff --git a/pkg/ingress/annotations/portinredirect/main.go b/internal/ingress/annotations/portinredirect/main.go
similarity index 92%
rename from pkg/ingress/annotations/portinredirect/main.go
rename to internal/ingress/annotations/portinredirect/main.go
index 90386cc8f..093af7dde 100644
--- a/pkg/ingress/annotations/portinredirect/main.go
+++ b/internal/ingress/annotations/portinredirect/main.go
@@ -19,8 +19,8 @@ package portinredirect
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/portinredirect/main_test.go b/internal/ingress/annotations/portinredirect/main_test.go
similarity index 98%
rename from pkg/ingress/annotations/portinredirect/main_test.go
rename to internal/ingress/annotations/portinredirect/main_test.go
index 802e8b50a..a7454302a 100644
--- a/pkg/ingress/annotations/portinredirect/main_test.go
+++ b/internal/ingress/annotations/portinredirect/main_test.go
@@ -25,7 +25,7 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 func buildIngress() *extensions.Ingress {
diff --git a/pkg/ingress/annotations/proxy/main.go b/internal/ingress/annotations/proxy/main.go
similarity index 97%
rename from pkg/ingress/annotations/proxy/main.go
rename to internal/ingress/annotations/proxy/main.go
index ee8360d97..8dee7ce07 100644
--- a/pkg/ingress/annotations/proxy/main.go
+++ b/internal/ingress/annotations/proxy/main.go
@@ -19,8 +19,8 @@ package proxy
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/proxy/main_test.go b/internal/ingress/annotations/proxy/main_test.go
similarity index 98%
rename from pkg/ingress/annotations/proxy/main_test.go
rename to internal/ingress/annotations/proxy/main_test.go
index 8fa08ed34..749d28206 100644
--- a/pkg/ingress/annotations/proxy/main_test.go
+++ b/internal/ingress/annotations/proxy/main_test.go
@@ -24,7 +24,7 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 func buildIngress() *extensions.Ingress {
diff --git a/pkg/ingress/annotations/ratelimit/main.go b/internal/ingress/annotations/ratelimit/main.go
similarity index 97%
rename from pkg/ingress/annotations/ratelimit/main.go
rename to internal/ingress/annotations/ratelimit/main.go
index 6118e8a04..e2a21f240 100644
--- a/pkg/ingress/annotations/ratelimit/main.go
+++ b/internal/ingress/annotations/ratelimit/main.go
@@ -24,9 +24,9 @@ import (
 
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
-	"k8s.io/ingress-nginx/pkg/net"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/net"
 )
 
 const (
diff --git a/pkg/ingress/annotations/ratelimit/main_test.go b/internal/ingress/annotations/ratelimit/main_test.go
similarity index 98%
rename from pkg/ingress/annotations/ratelimit/main_test.go
rename to internal/ingress/annotations/ratelimit/main_test.go
index bf21e30dc..4437bea56 100644
--- a/pkg/ingress/annotations/ratelimit/main_test.go
+++ b/internal/ingress/annotations/ratelimit/main_test.go
@@ -24,7 +24,7 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 func buildIngress() *extensions.Ingress {
diff --git a/pkg/ingress/annotations/redirect/redirect.go b/internal/ingress/annotations/redirect/redirect.go
similarity index 96%
rename from pkg/ingress/annotations/redirect/redirect.go
rename to internal/ingress/annotations/redirect/redirect.go
index d5f46fd4e..6cd90d960 100644
--- a/pkg/ingress/annotations/redirect/redirect.go
+++ b/internal/ingress/annotations/redirect/redirect.go
@@ -23,8 +23,8 @@ import (
 
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/errors"
 )
 
 const (
diff --git a/pkg/ingress/annotations/rewrite/main.go b/internal/ingress/annotations/rewrite/main.go
similarity index 96%
rename from pkg/ingress/annotations/rewrite/main.go
rename to internal/ingress/annotations/rewrite/main.go
index d396ec8c2..2b08fe323 100644
--- a/pkg/ingress/annotations/rewrite/main.go
+++ b/internal/ingress/annotations/rewrite/main.go
@@ -19,8 +19,8 @@ package rewrite
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/rewrite/main_test.go b/internal/ingress/annotations/rewrite/main_test.go
similarity index 98%
rename from pkg/ingress/annotations/rewrite/main_test.go
rename to internal/ingress/annotations/rewrite/main_test.go
index 3ad61f6cf..8e62ec49e 100644
--- a/pkg/ingress/annotations/rewrite/main_test.go
+++ b/internal/ingress/annotations/rewrite/main_test.go
@@ -24,7 +24,7 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 const (
diff --git a/pkg/ingress/annotations/secureupstream/main.go b/internal/ingress/annotations/secureupstream/main.go
similarity index 94%
rename from pkg/ingress/annotations/secureupstream/main.go
rename to internal/ingress/annotations/secureupstream/main.go
index 60b24eb95..95439ba1a 100644
--- a/pkg/ingress/annotations/secureupstream/main.go
+++ b/internal/ingress/annotations/secureupstream/main.go
@@ -22,8 +22,8 @@ import (
 	"github.com/pkg/errors"
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 const (
diff --git a/pkg/ingress/annotations/secureupstream/main_test.go b/internal/ingress/annotations/secureupstream/main_test.go
similarity index 98%
rename from pkg/ingress/annotations/secureupstream/main_test.go
rename to internal/ingress/annotations/secureupstream/main_test.go
index 35225285e..390b38485 100644
--- a/pkg/ingress/annotations/secureupstream/main_test.go
+++ b/internal/ingress/annotations/secureupstream/main_test.go
@@ -25,7 +25,7 @@ import (
 	meta_v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"k8s.io/apimachinery/pkg/util/intstr"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
 )
 
 func buildIngress() *extensions.Ingress {
diff --git a/pkg/ingress/annotations/serversnippet/main.go b/internal/ingress/annotations/serversnippet/main.go
similarity index 95%
rename from pkg/ingress/annotations/serversnippet/main.go
rename to internal/ingress/annotations/serversnippet/main.go
index a67cae177..969c2eee5 100644
--- a/pkg/ingress/annotations/serversnippet/main.go
+++ b/internal/ingress/annotations/serversnippet/main.go
@@ -19,7 +19,7 @@ package serversnippet
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/serversnippet/main_test.go b/internal/ingress/annotations/serversnippet/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/serversnippet/main_test.go
rename to internal/ingress/annotations/serversnippet/main_test.go
diff --git a/pkg/ingress/annotations/serviceupstream/main.go b/internal/ingress/annotations/serviceupstream/main.go
similarity index 94%
rename from pkg/ingress/annotations/serviceupstream/main.go
rename to internal/ingress/annotations/serviceupstream/main.go
index 0a21fde5f..a1d9a5a9d 100644
--- a/pkg/ingress/annotations/serviceupstream/main.go
+++ b/internal/ingress/annotations/serviceupstream/main.go
@@ -18,7 +18,7 @@ package serviceupstream
 
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/serviceupstream/main_test.go b/internal/ingress/annotations/serviceupstream/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/serviceupstream/main_test.go
rename to internal/ingress/annotations/serviceupstream/main_test.go
diff --git a/pkg/ingress/annotations/sessionaffinity/main.go b/internal/ingress/annotations/sessionaffinity/main.go
similarity index 98%
rename from pkg/ingress/annotations/sessionaffinity/main.go
rename to internal/ingress/annotations/sessionaffinity/main.go
index 87a2e6f28..b32009f55 100644
--- a/pkg/ingress/annotations/sessionaffinity/main.go
+++ b/internal/ingress/annotations/sessionaffinity/main.go
@@ -23,7 +23,7 @@ import (
 
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/sessionaffinity/main_test.go b/internal/ingress/annotations/sessionaffinity/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/sessionaffinity/main_test.go
rename to internal/ingress/annotations/sessionaffinity/main_test.go
diff --git a/pkg/ingress/annotations/snippet/main.go b/internal/ingress/annotations/snippet/main.go
similarity index 95%
rename from pkg/ingress/annotations/snippet/main.go
rename to internal/ingress/annotations/snippet/main.go
index 3e37fb5a6..954c13f6d 100644
--- a/pkg/ingress/annotations/snippet/main.go
+++ b/internal/ingress/annotations/snippet/main.go
@@ -19,7 +19,7 @@ package snippet
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/snippet/main_test.go b/internal/ingress/annotations/snippet/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/snippet/main_test.go
rename to internal/ingress/annotations/snippet/main_test.go
diff --git a/pkg/ingress/annotations/sslpassthrough/main.go b/internal/ingress/annotations/sslpassthrough/main.go
similarity index 90%
rename from pkg/ingress/annotations/sslpassthrough/main.go
rename to internal/ingress/annotations/sslpassthrough/main.go
index a4fcca83e..c3752f8bd 100644
--- a/pkg/ingress/annotations/sslpassthrough/main.go
+++ b/internal/ingress/annotations/sslpassthrough/main.go
@@ -19,8 +19,8 @@ package sslpassthrough
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	ing_errors "k8s.io/ingress-nginx/pkg/ingress/errors"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	ing_errors "k8s.io/ingress-nginx/internal/ingress/errors"
 )
 
 const (
diff --git a/pkg/ingress/annotations/sslpassthrough/main_test.go b/internal/ingress/annotations/sslpassthrough/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/sslpassthrough/main_test.go
rename to internal/ingress/annotations/sslpassthrough/main_test.go
diff --git a/pkg/ingress/annotations/upstreamhashby/main.go b/internal/ingress/annotations/upstreamhashby/main.go
similarity index 95%
rename from pkg/ingress/annotations/upstreamhashby/main.go
rename to internal/ingress/annotations/upstreamhashby/main.go
index b4d898000..c29f5cbbb 100644
--- a/pkg/ingress/annotations/upstreamhashby/main.go
+++ b/internal/ingress/annotations/upstreamhashby/main.go
@@ -19,7 +19,7 @@ package upstreamhashby
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/upstreamhashby/main_test.go b/internal/ingress/annotations/upstreamhashby/main_test.go
similarity index 100%
rename from pkg/ingress/annotations/upstreamhashby/main_test.go
rename to internal/ingress/annotations/upstreamhashby/main_test.go
diff --git a/pkg/ingress/annotations/upstreamvhost/main.go b/internal/ingress/annotations/upstreamvhost/main.go
similarity index 95%
rename from pkg/ingress/annotations/upstreamvhost/main.go
rename to internal/ingress/annotations/upstreamvhost/main.go
index c7af79246..c702d621a 100644
--- a/pkg/ingress/annotations/upstreamvhost/main.go
+++ b/internal/ingress/annotations/upstreamvhost/main.go
@@ -19,7 +19,7 @@ package upstreamvhost
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/annotations/vtsfilterkey/main.go b/internal/ingress/annotations/vtsfilterkey/main.go
similarity index 95%
rename from pkg/ingress/annotations/vtsfilterkey/main.go
rename to internal/ingress/annotations/vtsfilterkey/main.go
index 04965bbf2..809187fae 100644
--- a/pkg/ingress/annotations/vtsfilterkey/main.go
+++ b/internal/ingress/annotations/vtsfilterkey/main.go
@@ -19,7 +19,7 @@ package vtsfilterkey
 import (
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 const (
diff --git a/pkg/ingress/controller/backend_ssl.go b/internal/ingress/controller/backend_ssl.go
similarity index 95%
rename from pkg/ingress/controller/backend_ssl.go
rename to internal/ingress/controller/backend_ssl.go
index 09affd0ff..a1e3b4f1e 100644
--- a/pkg/ingress/controller/backend_ssl.go
+++ b/internal/ingress/controller/backend_ssl.go
@@ -26,10 +26,10 @@ import (
 	apiv1 "k8s.io/api/core/v1"
 	extensions "k8s.io/api/extensions/v1beta1"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/net/ssl"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/class"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/net/ssl"
 )
 
 // syncSecret keeps in sync Secrets used by Ingress rules with the files on
diff --git a/pkg/ingress/controller/backend_ssl_test.go b/internal/ingress/controller/backend_ssl_test.go
similarity index 98%
rename from pkg/ingress/controller/backend_ssl_test.go
rename to internal/ingress/controller/backend_ssl_test.go
index f59cbe8f5..16892da62 100644
--- a/pkg/ingress/controller/backend_ssl_test.go
+++ b/internal/ingress/controller/backend_ssl_test.go
@@ -28,9 +28,9 @@ import (
 	cache_client "k8s.io/client-go/tools/cache"
 	"k8s.io/client-go/util/flowcontrol"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/store"
-	"k8s.io/ingress-nginx/pkg/task"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/store"
+	"k8s.io/ingress-nginx/internal/task"
 	"k8s.io/kubernetes/pkg/api"
 )
 
@@ -110,7 +110,7 @@ func buildGenericControllerForBackendSSL() *NGINXController {
 			Client: buildSimpleClientSetForBackendSSL(),
 		},
 		listers:        buildListers(),
-		sslCertTracker: newSSLCertTracker(),
+		sslCertTracker: store.NewSSLCertTracker(),
 	}
 
 	gc.syncQueue = task.NewTaskQueue(gc.syncIngress)
diff --git a/pkg/ingress/controller/checker.go b/internal/ingress/controller/checker.go
similarity index 100%
rename from pkg/ingress/controller/checker.go
rename to internal/ingress/controller/checker.go
diff --git a/pkg/ingress/controller/checker_test.go b/internal/ingress/controller/checker_test.go
similarity index 97%
rename from pkg/ingress/controller/checker_test.go
rename to internal/ingress/controller/checker_test.go
index 9620547b9..51002a5ea 100644
--- a/pkg/ingress/controller/checker_test.go
+++ b/internal/ingress/controller/checker_test.go
@@ -27,7 +27,7 @@ import (
 	"k8s.io/apiserver/pkg/server/healthz"
 	"k8s.io/kubernetes/pkg/util/filesystem"
 
-	ngx_config "k8s.io/ingress-nginx/pkg/ingress/controller/config"
+	ngx_config "k8s.io/ingress-nginx/internal/ingress/controller/config"
 )
 
 func TestNginxCheck(t *testing.T) {
diff --git a/pkg/ingress/controller/config/config.go b/internal/ingress/controller/config/config.go
similarity index 99%
rename from pkg/ingress/controller/config/config.go
rename to internal/ingress/controller/config/config.go
index 083eaf3b9..4a0586a07 100644
--- a/pkg/ingress/controller/config/config.go
+++ b/internal/ingress/controller/config/config.go
@@ -25,8 +25,8 @@ import (
 
 	apiv1 "k8s.io/api/core/v1"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 const (
diff --git a/pkg/ingress/controller/config/config_test.go b/internal/ingress/controller/config/config_test.go
similarity index 100%
rename from pkg/ingress/controller/config/config_test.go
rename to internal/ingress/controller/config/config_test.go
diff --git a/pkg/ingress/controller/controller.go b/internal/ingress/controller/controller.go
similarity index 98%
rename from pkg/ingress/controller/controller.go
rename to internal/ingress/controller/controller.go
index 0c46c85b0..2861f9f91 100644
--- a/pkg/ingress/controller/controller.go
+++ b/internal/ingress/controller/controller.go
@@ -36,17 +36,17 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 	clientset "k8s.io/client-go/kubernetes"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/healthcheck"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/proxy"
-	ngx_config "k8s.io/ingress-nginx/pkg/ingress/controller/config"
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
-	"k8s.io/ingress-nginx/pkg/k8s"
-	"k8s.io/ingress-nginx/pkg/task"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/annotations"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/class"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/healthcheck"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/proxy"
+	ngx_config "k8s.io/ingress-nginx/internal/ingress/controller/config"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/k8s"
+	"k8s.io/ingress-nginx/internal/task"
 )
 
 const (
diff --git a/pkg/ingress/controller/listers.go b/internal/ingress/controller/listers.go
similarity index 95%
rename from pkg/ingress/controller/listers.go
rename to internal/ingress/controller/listers.go
index 766a19640..bdfd5931b 100644
--- a/pkg/ingress/controller/listers.go
+++ b/internal/ingress/controller/listers.go
@@ -29,9 +29,9 @@ import (
 	"k8s.io/client-go/tools/cache"
 	cache_client "k8s.io/client-go/tools/cache"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/class"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
 )
 
 type cacheController struct {
@@ -62,9 +62,6 @@ func (c *cacheController) Run(stopCh chan struct{}) {
 }
 
 func (n *NGINXController) createListers(stopCh chan struct{}) (*ingress.StoreLister, *cacheController) {
-	// from here to the end of the method all the code is just boilerplate
-	// required to watch Ingress, Secrets, ConfigMaps and Endoints.
-	// This is used to detect new content, updates or removals and act accordingly
 	ingEventHandler := cache.ResourceEventHandlerFuncs{
 		AddFunc: func(obj interface{}) {
 			addIng := obj.(*extensions.Ingress)
@@ -98,6 +95,7 @@ func (n *NGINXController) createListers(stopCh chan struct{}) (*ingress.StoreLis
 				return
 			}
 			n.recorder.Eventf(delIng, apiv1.EventTypeNormal, "DELETE", fmt.Sprintf("Ingress %s/%s", delIng.Namespace, delIng.Name))
+			n.listers.IngressAnnotation.Delete(delIng)
 			n.syncQueue.Enqueue(obj)
 		},
 		UpdateFunc: func(old, cur interface{}) {
diff --git a/pkg/ingress/controller/metric/collector/nginx.go b/internal/ingress/controller/metric/collector/nginx.go
similarity index 100%
rename from pkg/ingress/controller/metric/collector/nginx.go
rename to internal/ingress/controller/metric/collector/nginx.go
diff --git a/pkg/ingress/controller/metric/collector/process.go b/internal/ingress/controller/metric/collector/process.go
similarity index 100%
rename from pkg/ingress/controller/metric/collector/process.go
rename to internal/ingress/controller/metric/collector/process.go
diff --git a/pkg/ingress/controller/metric/collector/scrape.go b/internal/ingress/controller/metric/collector/scrape.go
similarity index 100%
rename from pkg/ingress/controller/metric/collector/scrape.go
rename to internal/ingress/controller/metric/collector/scrape.go
diff --git a/pkg/ingress/controller/metric/collector/status.go b/internal/ingress/controller/metric/collector/status.go
similarity index 100%
rename from pkg/ingress/controller/metric/collector/status.go
rename to internal/ingress/controller/metric/collector/status.go
diff --git a/pkg/ingress/controller/metric/collector/status_test.go b/internal/ingress/controller/metric/collector/status_test.go
similarity index 100%
rename from pkg/ingress/controller/metric/collector/status_test.go
rename to internal/ingress/controller/metric/collector/status_test.go
diff --git a/pkg/ingress/controller/metric/collector/vts.go b/internal/ingress/controller/metric/collector/vts.go
similarity index 100%
rename from pkg/ingress/controller/metric/collector/vts.go
rename to internal/ingress/controller/metric/collector/vts.go
diff --git a/pkg/ingress/controller/metrics.go b/internal/ingress/controller/metrics.go
similarity index 98%
rename from pkg/ingress/controller/metrics.go
rename to internal/ingress/controller/metrics.go
index e46223444..9a311563d 100644
--- a/pkg/ingress/controller/metrics.go
+++ b/internal/ingress/controller/metrics.go
@@ -19,7 +19,7 @@ package controller
 import (
 	"github.com/prometheus/client_golang/prometheus"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/internal/ingress"
 )
 
 const (
diff --git a/pkg/ingress/controller/nginx.go b/internal/ingress/controller/nginx.go
similarity index 96%
rename from pkg/ingress/controller/nginx.go
rename to internal/ingress/controller/nginx.go
index 8b1af612d..7417e278b 100644
--- a/pkg/ingress/controller/nginx.go
+++ b/internal/ingress/controller/nginx.go
@@ -42,20 +42,20 @@ import (
 	"k8s.io/client-go/util/flowcontrol"
 	"k8s.io/kubernetes/pkg/util/filesystem"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/parser"
-	ngx_config "k8s.io/ingress-nginx/pkg/ingress/controller/config"
-	"k8s.io/ingress-nginx/pkg/ingress/controller/process"
-	ngx_template "k8s.io/ingress-nginx/pkg/ingress/controller/template"
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
-	"k8s.io/ingress-nginx/pkg/ingress/status"
-	"k8s.io/ingress-nginx/pkg/ingress/store"
-	ing_net "k8s.io/ingress-nginx/pkg/net"
-	"k8s.io/ingress-nginx/pkg/net/dns"
-	"k8s.io/ingress-nginx/pkg/net/ssl"
-	"k8s.io/ingress-nginx/pkg/task"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/annotations"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/class"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/parser"
+	ngx_config "k8s.io/ingress-nginx/internal/ingress/controller/config"
+	"k8s.io/ingress-nginx/internal/ingress/controller/process"
+	ngx_template "k8s.io/ingress-nginx/internal/ingress/controller/template"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/status"
+	"k8s.io/ingress-nginx/internal/ingress/store"
+	ing_net "k8s.io/ingress-nginx/internal/net"
+	"k8s.io/ingress-nginx/internal/net/dns"
+	"k8s.io/ingress-nginx/internal/net/ssl"
+	"k8s.io/ingress-nginx/internal/task"
 )
 
 type statusModule string
diff --git a/pkg/ingress/controller/nginx_test.go b/internal/ingress/controller/nginx_test.go
similarity index 100%
rename from pkg/ingress/controller/nginx_test.go
rename to internal/ingress/controller/nginx_test.go
diff --git a/pkg/ingress/controller/process/nginx.go b/internal/ingress/controller/process/nginx.go
similarity index 100%
rename from pkg/ingress/controller/process/nginx.go
rename to internal/ingress/controller/process/nginx.go
diff --git a/pkg/ingress/controller/process/nginx_test.go b/internal/ingress/controller/process/nginx_test.go
similarity index 100%
rename from pkg/ingress/controller/process/nginx_test.go
rename to internal/ingress/controller/process/nginx_test.go
diff --git a/pkg/ingress/controller/stat_collector.go b/internal/ingress/controller/stat_collector.go
similarity index 97%
rename from pkg/ingress/controller/stat_collector.go
rename to internal/ingress/controller/stat_collector.go
index 2ce19c1fd..ad3434d15 100644
--- a/pkg/ingress/controller/stat_collector.go
+++ b/internal/ingress/controller/stat_collector.go
@@ -20,7 +20,7 @@ import (
 	"github.com/golang/glog"
 	"github.com/prometheus/client_golang/prometheus"
 
-	"k8s.io/ingress-nginx/pkg/ingress/controller/metric/collector"
+	"k8s.io/ingress-nginx/internal/ingress/controller/metric/collector"
 )
 
 const (
diff --git a/pkg/ingress/controller/tcp.go b/internal/ingress/controller/tcp.go
similarity index 100%
rename from pkg/ingress/controller/tcp.go
rename to internal/ingress/controller/tcp.go
diff --git a/pkg/ingress/controller/template/configmap.go b/internal/ingress/controller/template/configmap.go
similarity index 97%
rename from pkg/ingress/controller/template/configmap.go
rename to internal/ingress/controller/template/configmap.go
index fa8ecbf6c..02d9bddf3 100644
--- a/pkg/ingress/controller/template/configmap.go
+++ b/internal/ingress/controller/template/configmap.go
@@ -26,8 +26,8 @@ import (
 
 	"github.com/mitchellh/mapstructure"
 
-	"k8s.io/ingress-nginx/pkg/ingress/controller/config"
-	ing_net "k8s.io/ingress-nginx/pkg/net"
+	"k8s.io/ingress-nginx/internal/ingress/controller/config"
+	ing_net "k8s.io/ingress-nginx/internal/net"
 )
 
 const (
diff --git a/pkg/ingress/controller/template/configmap_test.go b/internal/ingress/controller/template/configmap_test.go
similarity index 98%
rename from pkg/ingress/controller/template/configmap_test.go
rename to internal/ingress/controller/template/configmap_test.go
index a25d828a7..1df9eae3f 100644
--- a/pkg/ingress/controller/template/configmap_test.go
+++ b/internal/ingress/controller/template/configmap_test.go
@@ -21,7 +21,7 @@ import (
 
 	"github.com/kylelemons/godebug/pretty"
 
-	"k8s.io/ingress-nginx/pkg/ingress/controller/config"
+	"k8s.io/ingress-nginx/internal/ingress/controller/config"
 )
 
 func TestFilterErrors(t *testing.T) {
diff --git a/pkg/ingress/controller/template/template.go b/internal/ingress/controller/template/template.go
similarity index 98%
rename from pkg/ingress/controller/template/template.go
rename to internal/ingress/controller/template/template.go
index 8a8e8463a..72de61cc2 100644
--- a/pkg/ingress/controller/template/template.go
+++ b/internal/ingress/controller/template/template.go
@@ -35,11 +35,11 @@ import (
 
 	extensions "k8s.io/api/extensions/v1beta1"
 	"k8s.io/apimachinery/pkg/util/sets"
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/ratelimit"
-	"k8s.io/ingress-nginx/pkg/ingress/controller/config"
-	ing_net "k8s.io/ingress-nginx/pkg/net"
-	"k8s.io/ingress-nginx/pkg/watch"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/ratelimit"
+	"k8s.io/ingress-nginx/internal/ingress/controller/config"
+	ing_net "k8s.io/ingress-nginx/internal/net"
+	"k8s.io/ingress-nginx/internal/watch"
 )
 
 const (
@@ -115,7 +115,9 @@ func (t *Template) Write(conf config.TemplateConfig) ([]byte, error) {
 		return tmplBuf.Bytes(), nil
 	}
 
-	return outCmdBuf.Bytes(), nil
+	a := make([]byte, outCmdBuf.Len())
+	copy(a, outCmdBuf.Bytes())
+	return a, nil
 }
 
 var (
diff --git a/pkg/ingress/controller/template/template_test.go b/internal/ingress/controller/template/template_test.go
similarity index 98%
rename from pkg/ingress/controller/template/template_test.go
rename to internal/ingress/controller/template/template_test.go
index ada3f1ec3..e147a2e7b 100644
--- a/pkg/ingress/controller/template/template_test.go
+++ b/internal/ingress/controller/template/template_test.go
@@ -26,10 +26,10 @@ import (
 	"strings"
 	"testing"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/authreq"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/rewrite"
-	"k8s.io/ingress-nginx/pkg/ingress/controller/config"
+	"k8s.io/ingress-nginx/internal/ingress"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/authreq"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/rewrite"
+	"k8s.io/ingress-nginx/internal/ingress/controller/config"
 )
 
 var (
diff --git a/pkg/ingress/controller/util.go b/internal/ingress/controller/util.go
similarity index 98%
rename from pkg/ingress/controller/util.go
rename to internal/ingress/controller/util.go
index 0961c61cc..a71bb7400 100644
--- a/pkg/ingress/controller/util.go
+++ b/internal/ingress/controller/util.go
@@ -24,7 +24,7 @@ import (
 	api "k8s.io/api/core/v1"
 	"k8s.io/kubernetes/pkg/util/sysctl"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/internal/ingress"
 )
 
 // newUpstream creates an upstream without servers.
diff --git a/pkg/ingress/controller/util_test.go b/internal/ingress/controller/util_test.go
similarity index 100%
rename from pkg/ingress/controller/util_test.go
rename to internal/ingress/controller/util_test.go
diff --git a/pkg/ingress/defaults/main.go b/internal/ingress/defaults/main.go
similarity index 100%
rename from pkg/ingress/defaults/main.go
rename to internal/ingress/defaults/main.go
diff --git a/pkg/ingress/errors/errors.go b/internal/ingress/errors/errors.go
similarity index 100%
rename from pkg/ingress/errors/errors.go
rename to internal/ingress/errors/errors.go
diff --git a/pkg/ingress/errors/errors_test.go b/internal/ingress/errors/errors_test.go
similarity index 100%
rename from pkg/ingress/errors/errors_test.go
rename to internal/ingress/errors/errors_test.go
diff --git a/pkg/ingress/resolver/main.go b/internal/ingress/resolver/main.go
similarity index 97%
rename from pkg/ingress/resolver/main.go
rename to internal/ingress/resolver/main.go
index e024df933..61f91518e 100644
--- a/pkg/ingress/resolver/main.go
+++ b/internal/ingress/resolver/main.go
@@ -19,7 +19,7 @@ package resolver
 import (
 	apiv1 "k8s.io/api/core/v1"
 
-	"k8s.io/ingress-nginx/pkg/ingress/defaults"
+	"k8s.io/ingress-nginx/internal/ingress/defaults"
 )
 
 // DefaultBackend has a method that returns the backend
diff --git a/pkg/ingress/sort_ingress.go b/internal/ingress/sort_ingress.go
similarity index 100%
rename from pkg/ingress/sort_ingress.go
rename to internal/ingress/sort_ingress.go
diff --git a/pkg/ingress/sort_ingress_test.go b/internal/ingress/sort_ingress_test.go
similarity index 100%
rename from pkg/ingress/sort_ingress_test.go
rename to internal/ingress/sort_ingress_test.go
diff --git a/pkg/ingress/status/status.go b/internal/ingress/status/status.go
similarity index 98%
rename from pkg/ingress/status/status.go
rename to internal/ingress/status/status.go
index 3c3bb7d51..effdb9f7f 100644
--- a/pkg/ingress/status/status.go
+++ b/internal/ingress/status/status.go
@@ -40,10 +40,10 @@ import (
 	"k8s.io/client-go/tools/record"
 	"k8s.io/kubernetes/pkg/kubelet/util/sliceutils"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
-	"k8s.io/ingress-nginx/pkg/ingress/store"
-	"k8s.io/ingress-nginx/pkg/k8s"
-	"k8s.io/ingress-nginx/pkg/task"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/class"
+	"k8s.io/ingress-nginx/internal/ingress/store"
+	"k8s.io/ingress-nginx/internal/k8s"
+	"k8s.io/ingress-nginx/internal/task"
 )
 
 const (
diff --git a/pkg/ingress/status/status_test.go b/internal/ingress/status/status_test.go
similarity index 98%
rename from pkg/ingress/status/status_test.go
rename to internal/ingress/status/status_test.go
index f997052b1..97c0b5033 100644
--- a/pkg/ingress/status/status_test.go
+++ b/internal/ingress/status/status_test.go
@@ -28,10 +28,10 @@ import (
 	"k8s.io/client-go/tools/cache"
 	"k8s.io/kubernetes/pkg/api"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/class"
-	"k8s.io/ingress-nginx/pkg/ingress/store"
-	"k8s.io/ingress-nginx/pkg/k8s"
-	"k8s.io/ingress-nginx/pkg/task"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/class"
+	"k8s.io/ingress-nginx/internal/ingress/store"
+	"k8s.io/ingress-nginx/internal/k8s"
+	"k8s.io/ingress-nginx/internal/task"
 )
 
 func buildLoadBalancerIngressByIP() []apiv1.LoadBalancerIngress {
diff --git a/pkg/ingress/store/main.go b/internal/ingress/store/main.go
similarity index 100%
rename from pkg/ingress/store/main.go
rename to internal/ingress/store/main.go
diff --git a/pkg/ingress/type_equals_test.go b/internal/ingress/type_equals_test.go
similarity index 100%
rename from pkg/ingress/type_equals_test.go
rename to internal/ingress/type_equals_test.go
diff --git a/pkg/ingress/types.go b/internal/ingress/types.go
similarity index 95%
rename from pkg/ingress/types.go
rename to internal/ingress/types.go
index 4622860a5..d9da68b2f 100644
--- a/pkg/ingress/types.go
+++ b/internal/ingress/types.go
@@ -23,17 +23,17 @@ import (
 	extensions "k8s.io/api/extensions/v1beta1"
 	"k8s.io/apimachinery/pkg/util/intstr"
 
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/auth"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/authreq"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/authtls"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/cors"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/ipwhitelist"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/proxy"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/ratelimit"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/redirect"
-	"k8s.io/ingress-nginx/pkg/ingress/annotations/rewrite"
-	"k8s.io/ingress-nginx/pkg/ingress/resolver"
-	"k8s.io/ingress-nginx/pkg/ingress/store"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/auth"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/authreq"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/authtls"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/cors"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/ipwhitelist"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/proxy"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/ratelimit"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/redirect"
+	"k8s.io/ingress-nginx/internal/ingress/annotations/rewrite"
+	"k8s.io/ingress-nginx/internal/ingress/resolver"
+	"k8s.io/ingress-nginx/internal/ingress/store"
 )
 
 var (
diff --git a/pkg/ingress/types_equals.go b/internal/ingress/types_equals.go
similarity index 100%
rename from pkg/ingress/types_equals.go
rename to internal/ingress/types_equals.go
diff --git a/pkg/ingress/zz_generated.deepcopy.go b/internal/ingress/zz_generated.deepcopy.go
similarity index 100%
rename from pkg/ingress/zz_generated.deepcopy.go
rename to internal/ingress/zz_generated.deepcopy.go
diff --git a/pkg/k8s/main.go b/internal/k8s/main.go
similarity index 100%
rename from pkg/k8s/main.go
rename to internal/k8s/main.go
diff --git a/pkg/k8s/main_test.go b/internal/k8s/main_test.go
similarity index 100%
rename from pkg/k8s/main_test.go
rename to internal/k8s/main_test.go
diff --git a/pkg/net/dns/dns.go b/internal/net/dns/dns.go
similarity index 100%
rename from pkg/net/dns/dns.go
rename to internal/net/dns/dns.go
diff --git a/pkg/net/dns/dns_test.go b/internal/net/dns/dns_test.go
similarity index 100%
rename from pkg/net/dns/dns_test.go
rename to internal/net/dns/dns_test.go
diff --git a/pkg/net/ipnet.go b/internal/net/ipnet.go
similarity index 100%
rename from pkg/net/ipnet.go
rename to internal/net/ipnet.go
diff --git a/pkg/net/ipnet_test.go b/internal/net/ipnet_test.go
similarity index 100%
rename from pkg/net/ipnet_test.go
rename to internal/net/ipnet_test.go
diff --git a/pkg/net/net.go b/internal/net/net.go
similarity index 100%
rename from pkg/net/net.go
rename to internal/net/net.go
diff --git a/pkg/net/net_test.go b/internal/net/net_test.go
similarity index 100%
rename from pkg/net/net_test.go
rename to internal/net/net_test.go
diff --git a/pkg/net/ssl/ssl.go b/internal/net/ssl/ssl.go
similarity index 99%
rename from pkg/net/ssl/ssl.go
rename to internal/net/ssl/ssl.go
index 591b4bcb6..0b9b791ca 100644
--- a/pkg/net/ssl/ssl.go
+++ b/internal/net/ssl/ssl.go
@@ -38,8 +38,8 @@ import (
 
 	"k8s.io/apimachinery/pkg/util/sets"
 
-	"k8s.io/ingress-nginx/pkg/file"
-	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/internal/file"
+	"k8s.io/ingress-nginx/internal/ingress"
 )
 
 var (
diff --git a/pkg/net/ssl/ssl_test.go b/internal/net/ssl/ssl_test.go
similarity index 98%
rename from pkg/net/ssl/ssl_test.go
rename to internal/net/ssl/ssl_test.go
index 477444ec9..95767eeca 100644
--- a/pkg/net/ssl/ssl_test.go
+++ b/internal/net/ssl/ssl_test.go
@@ -26,7 +26,7 @@ import (
 	certutil "k8s.io/client-go/util/cert"
 	"k8s.io/client-go/util/cert/triple"
 
-	"k8s.io/ingress-nginx/pkg/ingress"
+	"k8s.io/ingress-nginx/internal/ingress"
 )
 
 // generateRSACerts generates a self signed certificate using a self generated ca
diff --git a/pkg/task/queue.go b/internal/task/queue.go
similarity index 100%
rename from pkg/task/queue.go
rename to internal/task/queue.go
diff --git a/pkg/task/queue_test.go b/internal/task/queue_test.go
similarity index 100%
rename from pkg/task/queue_test.go
rename to internal/task/queue_test.go
diff --git a/pkg/watch/file_watcher.go b/internal/watch/file_watcher.go
similarity index 100%
rename from pkg/watch/file_watcher.go
rename to internal/watch/file_watcher.go
diff --git a/pkg/watch/file_watcher_test.go b/internal/watch/file_watcher_test.go
similarity index 100%
rename from pkg/watch/file_watcher_test.go
rename to internal/watch/file_watcher_test.go