Ingress NGINX is retired: what the March 2026 deadline means, and why the migration is not a YAML rename

In November 2025, Kubernetes SIG Network and the Security Response Committee announced that Ingress NGINX would be retired: best-effort maintenance until March 2026, then no further releases, no bug fixes and no updates to resolve security vulnerabilities [1]. Existing deployments keep working and the artifacts stay available [1] — which is exactly why the risk is easy to miss.

How big the exposure is

In January 2026 the Kubernetes Steering and Security Response Committees issued a joint statement calling Ingress NGINX critical infrastructure for about half of cloud native environments, citing internal Datadog research [2]. Their wording was unusually blunt: staying on Ingress NGINX after retirement leaves you and your users vulnerable to attack, and because deployments keep running, you may not know you are affected until you are compromised [2].

Why it was retired

The project's flexibility became its liability. Options once considered helpful — such as adding arbitrary NGINX configuration through the snippets annotations — came to be seen as serious security flaws, and for years the project had only one or two people doing development in their own time [1].

Why the migration is engineering work

The Steering Committee states that none of the available alternatives are direct drop-in replacements, and that migrating requires planning and engineering time [2]. The reason is behaviour, not syntax. A February 2026 Kubernetes post catalogued Ingress NGINX defaults that a correct-looking translation can break [3]:

• Regex path matches in Ingress NGINX are prefix-based and case-insensitive [3]. Popular Envoy-based Gateway API implementations do a full, case-sensitive match, so a faithful-looking HTTPRoute can start returning 404s for traffic the old controller routed [3].
• The use-regex annotation applies to all paths of a host across all Ingresses, not just the one it is set on [3].
• Ingress NGINX and F5's NGINX Ingress are separate, unrelated controllers that both use NGINX as the dataplane [3] — worth confirming which one you actually run before you plan.

What Ingress2Gateway 1.0 covers

SIG Network released Ingress2Gateway 1.0 in March 2026. It translates Ingress resources and implementation-specific annotations to Gateway API, warns about untranslatable configuration, and now supports over 30 common Ingress NGINX annotations, up from three [4]. Its authors describe it as a migration assistant, not a one-shot replacement [4].

What we ask

When we screen platform engineers for this work, we ask how they would prove a cut-over is behaviour-equivalent before switching DNS. Engineers who have done one talk about replaying real traffic against both paths; the rest talk about converting YAML.