In a significant shift for the Kubernetes ecosystem, the widely-used NGINX Ingress Controller is officially being retired. As announced by Kubernetes SIG Network and the Security Response Committee in November 2025, best-effort maintenance will continue only until March 2026. After that deadline, there will be no further releases, bug fixes, or security patches.
Why Is NGINX Ingress Being Deprecated?
The deprecation stems from several critical concerns:
- Security Vulnerabilities: Recent security issues revealed that annotation-based configuration in NGINX Ingress opens significant attack vectors for malicious actors.
- NGINX Not Kubernetes-Native: NGINX configuration reloads cause service interruptions and downtime. Modern proxies like Envoy perform hot reloads with zero downtime.
- Maintenance Burden: The community maintainers have struggled to keep up with security patches and feature development while maintaining backward compatibility.
- Evolution to Gateway API: Kubernetes networking has evolved beyond the limitations of the legacy Ingress resource model.
Introducing Kubernetes Gateway API: The Modern Replacement
Gateway API is the next-generation replacement for Ingress, offering a more robust, extensible, and standardized approach to managing ingress traffic in Kubernetes clusters.
Key Advantages of Gateway API Over Ingress
1. Protocol Support
- Ingress: Limited to Layer 7 (HTTP/HTTPS only)
- Gateway API: Supports both L4 (TCP, UDP) and L7 (HTTP, gRPC) protocols natively
2. Role-Oriented Design
- Clear separation between infrastructure admins (GatewayClass, Gateway) and application developers (HTTPRoute)
- Multi-tenant architecture with role-based access control
3. Advanced Traffic Management
- Built-in support for traffic splitting, A/B testing, and canary deployments
- Request mirroring and header manipulation
- Fine-grained metrics and observability
4. Portability
- Standardized specification works consistently across all compliant controllers
- No vendor lock-in or proprietary annotations
- Future-proof against controller changes
Understanding Gateway API Core Components
Gateway API introduces a more expressive resource model with clearly defined responsibilities:
GatewayClass: Defines a set of gateways with common configuration, similar to IngressClass but with more capabilities.
Gateway: Represents the actual load balancer configuration, handling infrastructure-level settings like listeners, addresses, and TLS.
HTTPRoute: Defines HTTP-specific routing rules, replacing the routing functionality of Ingress with more powerful matching and filtering options.
TLSRoute & TCPRoute: Enable advanced routing for non-HTTP protocols, which was impossible with traditional Ingress.
ReferenceGrant: Provides secure cross-namespace references, solving a major security limitation of Ingress.
Side-by-Side Comparison: Ingress vs Gateway API
ReturnFeature: Protocol Support
Ingress: HTTP/HTTPS only
Gateway API: HTTP, HTTPS, TCP, UDP, gRPC, WebSocket
Feature: Resource Model
Ingress: Single resource type with limited expressiveness
Gateway API: Multiple resources (GatewayClass, Gateway, Route) with role-based separation
Feature: Traffic Routing
Ingress: Basic path and host-based routing
Gateway API: Advanced routing with header matching, query parameter matching, traffic splitting, mirroring
Feature: Security
Ingress: Limited namespace isolation, annotation-based configuration
Gateway API: Built-in RBAC, ReferenceGrant for secure cross-namespace routing, policy attachment
Feature: Extensibility
Ingress: Vendor-specific annotations create compatibility issues
Gateway API: Standardized extension points, consistent across implementations
Migration Timeline and Critical Dates
The NGINX Ingress Controller retirement follows this timeline:
November 2025: Deprecation announcement
March 2026: End of support for NGINX Ingress Controller
Post-March 2026: No security updates or bug fixes
Organizations still using NGINX Ingress Controller should prioritize migration planning immediately to avoid running unsupported infrastructure.
Step-by-Step Migration Guide
1. Assess Your Current Ingress Configuration
Start by auditing all existing Ingress resources:
Document all custom annotations, TLS configurations, and routing rules currently in use. ### 2. Install Gateway API CRDs Install the Gateway API custom resource definitions: ``` kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.0.0/standard-install.yaml ``` kubectl get ingress --all-namespaces kubectl get ingressclass
3. Choose a Gateway Controller Implementation
Select a Gateway API controller that fits your needs. Popular options include:
NGINX Gateway Fabric: Official NGINX implementation for Gateway API
Istio Gateway: Service mesh with Gateway API support
Kong Gateway: Enterprise-grade API gateway with Gateway API
Envoy Gateway: CNCF project based on Envoy proxy
4. Create Gateway Resources
Convert your Ingress configurations to Gateway API resources. Here’s an example transformation:
Old Ingress:
**New Gateway API:**
```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: example-route
spec:
parentRefs:
- name: example-gateway
hostnames:
- "example.com"
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: web-service
port: 80
```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name:### 5. Test in Parallel
Run both Ingress and Gateway API configurations in parallel to validate behavior before fully cutting over. Monitor traffic patterns, latency, and error rates.
### 6. Complete the Migration
Once validated:
1. Switch DNS or load balancer to point to Gateway resources
2. Monitor for any issues for 24-48 hours
3. Decommission old Ingress resources
4. Uninstall NGINX Ingress Controller
## Best Practices for a Smooth Transition
example-ingress
spec:
rules:
- hos**Start Small**: Begin with non-production environments or less critical applications to build confidence and expertise with Gateway API.
**Document Everything**: Maintain detailed documentation of your current Ingress configurations, migration mappings, and Gateway API setups.
**Leverage Automation Tools**: Use tools like `ingress2gateway` to assist with converting Ingress resources to Gateway API format.
**Implement Gradual Rollout**: Use traffic splitting features in Gateway API to gradually shift traffic from old to new configurations.
**Monitor Comprehensively**: Set up detailed monitoring and alerting for both old and new systems during the transition period.
**Plan for Rollback**: Maintain the ability to quickly revert to Ingress if critical issues arise during migration.
t: example.com
http:
paths:
-## Conclusion: The Future is Gateway API
The retirement of NGINX Ingress Controller by March 2026 marks a significant milestone in Kubernetes networking evolution. While the migration to Gateway API requires effort, the benefits are substantial:
- **Enhanced Security**: Built-in RBAC and policy controls
- **Greater Flexibility**: Support for multiple protocols and advanced routing
- **Better Performance**: Optimized traffic management and load balancing
- **Future-Proof Architecture**: Standardized API that won't lock you into vendor-specific implementations
Don't wait until the March 2026 deadline. Start your migration planning today to ensure a smooth transition without service disruptions. Organizations that begin early will have time to test thoroughly, train teams, and leverage the full capabilities of Gateway API.
The Kubernetes ecosystem is moving forward, and Gateway API represents the modern, production-ready standard for managing ingress traffic. Embrace this change as an opportunity to modernize your infrastructure and gain capabilities that will serve your applications for years to come.
path: /
pathType: Prefix
backend:
service:
name: web-service
port:
number: 80