After the ingress-NGINX retirement, what your migration plan owes production

Short summary

As of March 2026, Kubernetes SIG Network stopped maintaining ingress-nginx, leaving clusters with unpatched CVEs and no feature updates. The CNCF recommends either a lateral swap to Contour (Envoy-based) or modernization to the Gateway API using ingress2gateway for automated translation. Key migration risks include annotation incompatibilities, TLS behavior differences, and rewrite rule regressions. Teams should run the new controller in parallel and cut over by IngressClass, not by cluster.

• •ingress-nginx is no longer maintained as of March 2026 — unpatched CVEs and no feature work
• •Two migration paths: lateral swap to Contour, or modernize to Gateway API with ingress2gateway
• •Annotation dialects, TLS behavior, and rewrite rules don't port cleanly — test before cutover

Generated with AI, which can make mistakes.