Ingress NGINX — the most widely deployed Kubernetes ingress controller — was officially retired in March 2026. The Kubernetes project is no longer maintaining it. If your cluster is running Ingress NGINX, you are now running unsupported software.
This doesn't mean it stops working tomorrow. But it does mean no more security patches, no more bug fixes, and a hard migration deadline before it becomes a liability.
What exactly was retired
The kubernetes/ingress-nginx project — the community-maintained ingress controller based on Nginx — reached end of life. This is distinct from:
- Nginx Inc's commercial Nginx Ingress Controller — still maintained, different project
- Nginx itself — still maintained, not affected
- Other ingress controllers (Traefik, HAProxy, Contour) — not affected
If your cluster has kubectl get ingressclass showing nginx and your ingress controller pod is from registry.k8s.io/ingress-nginx — that's the retired one.
Check if you're affected
# Check your ingress controller:
kubectl get pods -n ingress-nginx
kubectl get ingressclass
# Check which image version you're running:
kubectl get pods -n ingress-nginx -o jsonpath='{.items[*].spec.containers[*].image}'
If you see registry.k8s.io/ingress-nginx/controller — you're running the retired project.
Your migration options
Option 1 — Gateway API (recommended path)
The Kubernetes project's official successor to the Ingress resource is the Gateway API. It's more expressive, supports more traffic routing patterns, and is actively maintained.
# Install Gateway API CRDs: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/latest/download/standard-install.yaml # Install a Gateway API implementation (e.g., Nginx Gateway Fabric): kubectl apply -f https://raw.githubusercontent.com/nginxinc/nginx-gateway-fabric/main/deploy/default/deploy.yaml
The migration from Ingress resources to Gateway API HTTPRoute resources is not automatic. You'll need to rewrite your ingress manifests.
# Old Ingress resource:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: myapp
spec:
ingressClassName: nginx
rules:
- host: app.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: myapp
port:
number: 80
# Equivalent Gateway API HTTPRoute:
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: myapp
spec:
parentRefs:
- name: my-gateway
hostnames:
- app.example.com
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- name: myapp
port: 80
Option 2 — Switch to Traefik
Traefik is actively maintained, has excellent Docker and Kubernetes support, and handles certificate management automatically via Let's Encrypt. If you're running a small cluster (1-10 nodes), Traefik is the lowest-friction migration.
# Install Traefik via Helm: helm repo add traefik https://traefik.github.io/charts helm repo update helm install traefik traefik/traefik -n traefik --create-namespace
Traefik supports standard Kubernetes Ingress resources — you don't need to rewrite your manifests immediately. Change ingressClassName: nginx to ingressClassName: traefik.
Option 3 — Stay on Ingress NGINX (short term)
The retired version doesn't stop working. If you're not on a tight security compliance deadline, you have a window to migrate carefully. Pin your version, don't upgrade, and set a migration deadline for yourself within 6 months.
Don't stay indefinitely. The longer you wait, the further behind you fall on Kubernetes API compatibility as your cluster upgrades but the ingress controller doesn't.
If you're on managed Kubernetes
Hetzner Cloud, DigitalOcean, Vultr, and most managed Kubernetes providers have their own load balancer integrations. These are separate from the in-cluster ingress controller and are not affected by the retirement.
- Hetzner K3s/MKS — use Hetzner Cloud Load Balancers with the hcloud controller, not Ingress NGINX
- DigitalOcean Kubernetes — use DO Load Balancers with the DO cloud controller
- Vultr Kubernetes Engine — use Vultr Load Balancers
If you self-deployed Ingress NGINX on top of a managed cluster — you are affected and need to migrate.
Migration checklist
- Confirm you are running
registry.k8s.io/ingress-nginx/controller - Inventory all Ingress resources:
kubectl get ingress --all-namespaces - Choose replacement: Gateway API, Traefik, or HAProxy
- Set up new ingress controller in parallel (don't remove the old one yet)
- Migrate one service at a time, verify before continuing
- Update DNS or load balancer to point to new controller
- Remove old Ingress NGINX once all traffic is migrated
- Update SSL certificate management if using cert-manager with Ingress NGINX annotations
Running Nginx on self-hosted infra? Audit your reverse proxy config for dangling routes, missing SSL redirects, and Traefik migration issues.