Table of Contents
Key takeaways
- Follow the main steps in Ingress NGINX Is Retired: Kubernetes Migration Guide 2026 in order; skipping prerequisites is the most common source of errors.
- Prioritize official packages, backups, and rollback paths when the guide touches servers, security, or production tools.
- Use the Next Read links at the end to continue with related setup, performance, or protection tasks.
Approximately 50% of cloud-native environments still run Ingress NGINX — a tool that reached official end-of-life on March 24, 2026. As of that date, there are no new releases, no security patches, and no bug fixes. For Kubernetes teams that have not migrated, every CVE discovered from this point forward is now a permanent, unfixable risk in your inbound traffic path.
Ingress NGINX kubernetes deployments have powered production clusters since 2017, handling HTTP and HTTPS routing, TLS termination, and load balancing for a vast share of cloud-native applications. But after years running on one or two volunteer maintainers with no dedicated vendor backing, SIG Network officially retired the project — with final maintenance ending March 24, 2026.
In this guide, you will learn exactly what the retirement means for your cluster, how to assess your exposure, and the concrete steps to migrate to a supported alternative — including the new ingress2gateway 1.0 tool released March 20, 2026 that automates the bulk of the conversion work.
Why Ingress NGINX Was Retired in 2026
The Ingress NGINX controller was one of the first — and for years, the most widely deployed — ingress solutions in the Kubernetes ecosystem. Despite its reach, the project had a fundamental structural problem: it never attracted enough contributors to sustain maintenance at scale.
The Maintainer Crisis Behind the Decision
For several years, the entire kubernetes/ingress-nginx project was maintained by one or two individuals working in their spare time. Internal Datadog research found that roughly half of all cloud-native environments depended on this single tool — yet no major vendor had committed dedicated engineering resources to support it.
The Kubernetes Steering Committee and Security Response Committee announced the retirement in November 2025, committing to best-effort maintenance through March 24, 2026. That deadline has passed. No further releases, security patches, or bug fixes will be issued. Existing deployments will continue to function, but the project is permanently frozen at its last released state.
Two important clarifications: the Kubernetes Ingress API specification itself is not deprecated and remains available. And the F5/NGINX Inc. maintained project (nginxinc/kubernetes-ingress) is a separate product that remains actively supported in both open-source and commercial forms — it is not affected by this retirement.
Is Your Kubernetes Cluster Affected?
If your cluster runs the community ingress-nginx controller, you are affected. One command confirms your exposure:
kubectl get pods -n ingress-nginx -l app.kubernetes.io/name=ingress-nginxIf that returns running pods, the retired controller is installed. Here is what the retirement means in practice:
- No security patches. Ingress NGINX had multiple critical CVEs in recent years, including a CVSS 9.8 vulnerability discovered in 2025. Future vulnerabilities will not be remediated.
- No bug fixes. Production issues that arise have no upstream fix path.
- No Kubernetes version updates. As Kubernetes 1.36 releases on April 22, 2026, ingress-nginx will not be updated for forward compatibility.
- Compliance exposure. Running software with unaddressed CVEs may trigger non-compliance findings under SOC 2, PCI-DSS, and ISO 27001 audit frameworks.
- No new capabilities. Advanced routing features like traffic splitting, header manipulation, and request mirroring are available natively in Gateway API but inaccessible via the frozen controller.
For more on the tools and patterns shaping Kubernetes operations today, explore the Dev/IT Ops news and guides at Hubkub.
How to Migrate: Your 5-Step Path to Gateway API
On March 20, 2026, the Kubernetes project released ingress2gateway 1.0 — a CLI tool that automates converting existing Ingress resources to the Gateway API format. Version 1.0 now supports over 30 common Ingress NGINX annotations, including CORS, TLS configuration, regex path matching, path rewrites, and backend protocol settings.
According to the official Kubernetes retirement announcement, Gateway API is the recommended migration target for most teams. Here are the five migration steps:
Step 1: Audit your Ingress resources. Run kubectl get ingress --all-namespaces -o yaml and export the full output. Document every annotation your deployments rely on — especially nginx.ingress.kubernetes.io/rewrite-target, configuration-snippet, and any custom Lua plugins. These are areas that require manual review after automated conversion.
Step 2: Choose a Gateway API implementation. Your options include NGINX Gateway Fabric (familiar technology for teams already on NGINX, with dedicated ingress2gateway support), Traefik (lightweight, widely adopted, strong plugin ecosystem), Envoy Gateway (CNCF-backed, designed for high-throughput workloads), and cloud-native options such as AWS Load Balancer Controller or Azure Application Gateway for Containers.
Step 3: Run ingress2gateway. Install the ingress2gateway CLI and run it against your exported Ingress YAML. It outputs the corresponding Gateway and HTTPRoute resources. Always review the output before applying it to the cluster — complex regex rewrites and Lua-based configurations require manual adjustment.
ingress2gateway print --input-file ingress.yaml --provider nginxStep 4: Deploy in parallel. Install your chosen Gateway API implementation alongside the existing ingress-nginx controller. Each receives a separate external IP. Route test traffic to the new Gateway and validate routing, TLS termination, and application behavior before touching production DNS records.
Step 5: Cut over and decommission. Once validation passes, update DNS records to point to the new Gateway IP. Monitor traffic for 24 to 48 hours, then remove the ingress-nginx pods and associated RBAC resources from the cluster.
Common Questions — Ingress NGINX Kubernetes
Q: Is Ingress NGINX the same as the F5 NGINX Ingress Controller?
A: No — these are two separate projects that are frequently confused. The retired community project lives at kubernetes/ingress-nginx on GitHub. The F5/NGINX Inc. project lives at nginxinc/kubernetes-ingress. To confirm which version you are running, check your pod image tag: registry.k8s.io/ingress-nginx/controller is the retired community version. nginx/nginx-ingress is the actively supported F5 version. If you installed via the NGINX Inc. Helm chart or documentation, you are on the supported product.
Q: What happens if I keep running Ingress NGINX after end-of-life?
A: Your cluster will continue to route traffic normally — the software does not stop working. The risk is that any security vulnerability discovered after March 24, 2026 will never be patched. Ingress NGINX has had several critical CVEs in recent years. Organizations under SOC 2, PCI-DSS, or ISO 27001 frameworks risk audit findings for running unsupported software with known unaddressed vulnerabilities. The risk compounds over time as CVEs accumulate.
Q: What is the Kubernetes Gateway API and how does it differ from Ingress?
A: Gateway API is the modern successor to the Kubernetes Ingress resource. Where Ingress combined load balancer and routing rules into a single resource, Gateway API separates responsibilities: a GatewayClass and Gateway define how traffic enters the cluster (managed by cluster operators), while HTTPRoute resources define how traffic is routed to services (managed by application developers). This role-based design reduces configuration conflicts in multi-team environments and supports advanced features — traffic splitting, header modification, request mirroring — as first-class API primitives rather than NGINX-specific annotations.
Q: How long does migration from Ingress NGINX to Gateway API take?
A: For clusters using standard Ingress rules and common annotations, the automated migration with ingress2gateway can complete in one to two days. Clusters with heavy use of configuration-snippet annotations, custom Lua scripts, or ModSecurity configurations require manual conversion work. For complex environments, plan a structured migration over one or two sprints, running the new and old controllers in parallel throughout testing and validation.
Conclusion
Three facts define where Kubernetes teams stand today: Ingress NGINX is permanently retired with no further security support. Roughly 50% of cloud-native Kubernetes deployments were running it at end-of-life. And the migration tooling — especially ingress2gateway 1.0 released just three weeks ago — is now mature enough for even complex clusters to begin migrating systematically.
The steps are clear: confirm your exposure with one kubectl command, run the ingress2gateway audit to understand scope, choose your Gateway API implementation, and migrate incrementally using parallel deployments. Every week of delay adds more unpatched CVE exposure to the component that handles all inbound traffic to your cluster.
For the latest Kubernetes vulnerability disclosures and cloud-native security news, follow our Security section. Explore more Kubernetes guides and DevOps tooling in our Dev/IT Ops section.
Last Updated: April 13, 2026
