Kubernetes ingress-nginx - How can I disable listening on https if no TLS configured?

I'm not aware of an ingress-nginx configmap value or ingress annotation to easily disable TLS.

You could remove port 443 from your ingress controllers service definition.

Remove the https entry from the spec.ports array

apiVersion: v1
kind: Service
metadata:
  name: mingress-nginx-ingress-controller
spec:
  ports:
  - name: https
    nodePort: NNNNN
    port: 443
    protocol: TCP
    targetPort: https

nginx will still be listening on a TLS port, but no clients outside the cluster will be able to connect to it.

Redirection is not involved in your problem.

ingress-controller is listening on both port, 80 and 443. When you configure an ingress with only 80 port, if you reach the 443 port you are redirected to the default backend, which is expected behaviour.

A solution is to add an other nginx-controller, that will only listen on 80 port. And then you can configure your ingresses with kubernetes.io/ingress.class: myingress. When creating the new nginx-controller, change the command --ingress-class=myingress of the daemonset. It will then handle only ingress annotated with this class.

If you use helm to deploy it, simply override the controller.ingressClass value.