Kubernetes Without Ingress NGINX: Which Ingress Controller Should You Pick?

A critical bug landed in the NGINX rewrite module on 13 May 2026. CVE-2026-42945, dubbed NGINX Rift, scored 9.2 on the CVSS scale, and a working exploit was public within days. The flaw itself was nothing new: the vulnerable code had shipped since 2008. What made the disclosure newsworthy was the response gap. F5 patched NGINX, NGINX Plus, and every commercial product built on it inside a week. The community ingress controller that had been routing traffic for roughly half the Kubernetes install base got no patch at all, because its maintainers had already shut the project down.

That gap is the whole story in one sentence: Ingress NGINX is gone, the software running clusters everywhere is not, and teams now have to pick its successor under time pressure. Below is a rundown of what stopped shipping and how seven current options stack up on the things that matter for a production cutover.

The Retirement Timeline, and Why It Happened So Fast

Kubernetes SIG Network floated the retirement at KubeCon North America in the autumn of 2025 and made it official on 11 November. Things escalated in January 2026: the Steering Committee and the Security Response Committee published a joint notice warning operators in plain terms that continuing to run the controller after end of life would leave both them and their users exposed, and that nothing on the market was a straight swap. The repository stopped accepting changes on 24 March, went fully unsupported a week later on 31 March.

Two structural problems drove the decision. Staffing was one: for the last several years the project ran on one or two volunteers, and public calls for more hands went nowhere. The design was the other. It let cluster users inject raw NGINX configuration through annotations, on the assumption that anyone who could create an Ingress object was trustworthy, an assumption that falls apart the moment a cluster is shared across teams.

The clearest illustration was IngressNightmare in March 2025, headlined by CVE-2025-1974 at CVSS 9.8, which let an attacker with access to the admission webhook run arbitrary code with no login required and pull every secret in the cluster. Wiz estimated close to 43% of cloud environments were exposed. A successor project called InGate was floated but never shipped a stable release and was shelved too. Datadog’s own telemetry put overall reliance on the controller at close to half of all cloud native deployments, which is why the shutdown made headlines rather than passing quietly.

Three Similarly Named Things, Only One of Them Dead

Confusion about naming is the single biggest reason teams think they’ve migrated when they haven’t. Here’s the disambiguation.

• kubernetes/ingress-nginx — the SIG Network project. This is the one that’s retired and archived.
• nginxinc/kubernetes-ingress — F5’s own controller, a completely separate codebase with open source and paid tiers, shipping regular releases.
• NGINX — the web server binary itself, still one of the most widely deployed pieces of infrastructure software on the internet, unrelated to the retirement decision.

A fourth thing worth clarifying: the Ingress resource type built into Kubernetes hasn’t gone anywhere, still GA, but frozen — no new fields land there, and all active development happens against Gateway API instead. Whether a given cluster is exposed is a one-liner to check, run with admin rights:

kubectl get pods –all-namespaces –selector app.kubernetes.io/name=ingress-nginx

The uncomfortable part is that a cluster running the retired controller looks completely normal from the outside: requests still route, pods still restart on schedule, dashboards stay green. Teams that skip the inventory step tend to find out about exposure from an incident report rather than a planned audit.

Annotations Are the Reason Nobody Ships a True Drop-In Replacement

Kubernetes’ own committees were explicit that no alternative controller is a direct substitute, and the practical reason comes down to annotations. A bare Ingress object only defines the essentials: a host, a path, a target service, and TLS settings. Every behavioral tweak beyond that got bolted on through implementation-specific annotation keys, and years of production use tend to accumulate a fairly consistent set:

• authentication hooks such as auth-url, auth-signin, and auth-response-headers
• backend behavior flags like backend-protocol and the x-forwarded-* family
• CORS controls, e.g. enable-cors and cors-allow-origin
• buffering and timeout tuning, e.g. proxy-body-size and proxy-read-timeout
• URL rewriting via rewrite-target
• raw configuration injection through configuration-snippet and server-snippet

That last category is where migrations stall hardest. A snippet is arbitrary NGINX syntax pasted into a manifest, and there’s no mechanical way to translate arbitrary syntax into a different proxy’s config language, so it has to be rebuilt by hand.

The implication is sequencing: run the annotation audit before shopping for a controller, not after. Teams that skip straight to a bake-off tend to pick whichever product tops a synthetic benchmark, then spend the following weeks discovering which services silently broke.

From Ingress to Gateway API: What the New Model Actually Changes

A classic Ingress crams host rules, TLS, and every custom behavior into a single flat object. That’s fine with a handful of services. It stops being fine once hundreds of services and several teams are all editing the same kind of resource, because there’s no way to carve out ownership boundaries inside one object type.

Gateway API fixes that by splitting responsibility across three resource kinds:

• GatewayClass, which names the implementation handling traffic — owned by the platform team or cloud provider
• Gateway, which defines the entry point itself (ports, protocols, TLS termination) — owned by cluster operators
• Route (HTTPRoute, GRPCRoute, TCPRoute, UDPRoute), which defines how requests get to a service — owned by whoever built the service

Mapped to NGINX vocabulary, a Gateway is roughly a server block and a Route is roughly a location block. Features that used to require vendor-specific annotations are now ordinary spec fields: weighted traffic splits, header rewriting, cross-namespace routing gated by an explicit ReferenceGrant. As of Gateway API 1.6.0, released 30 June 2026, TCPRoute and UDPRoute graduated into the Standard channel under v1, giving portable routing to non-HTTP workloads like databases and game servers.

New clusters can go straight to Gateway API. Existing clusters do better splitting the work: swap the controller first with minimal manifest changes, then move to Gateway API on a separate timeline. Bundling both changes into one window multiplies the blast radius if something goes wrong.

Seven Controllers Worth Evaluating

Five things mattered in putting this list together: how much of an existing annotation set survives untouched, whether Gateway API support is real or bolted-on, how active and well-resourced the project is, how it behaves under sustained load, and whether there’s an accountable party who’ll ship a fix fast if the next critical CVE lands. None of the seven wins on all five, and rank here tracks how often each scenario shows up in practice rather than a single performance number.

#1 Traefik — the closest thing to a compatibility layer that exists

Rating: 5/5

Traefik is the only project that shipped an actual translation layer for the retired controller’s annotations. Its kubernetesIngressNGINX provider reads most common annotation keys and reproduces the equivalent behavior internally, so existing Ingress manifests keep functioning with essentially no edits. One instance serves classic Ingress and Gateway API resources at the same time, turning the API migration into something gradual. SUSE making Traefik the default in RKE2 from version 1.36 is a useful signal of how far that compatibility work is trusted in production.

Strengths: near-zero manifest changes for existing setups, dual API support in one binary, certificate handling built in, large ecosystem.

Weaknesses: coverage isn’t complete — external auth forwarding behaves differently under the hood, session caching isn’t there, and sticky sessions are limited to the persistent mode only.

Fits best: organizations sitting on a large, aging body of Ingress configuration who need the retirement risk closed on a short timeline.

#2 HAProxy Kubernetes Ingress — built for the tail of the latency curve

Rating: 4.5/5

HAProxy’s engine has decades of tuning behind it for high-concurrency workloads, and the controller reloads configuration without dropping live connections. It handles HTTP/3, sophisticated layer 4 routing, and validated custom annotations that approximate old behavior during a cutover. In HAProxy Technologies’ own benchmark it pushed roughly 42,000 requests per second against 19,000 for Traefik and 18,500 for Envoy, using less CPU — though that’s a vendor test on default configurations, so treat it as a directional signal.

Strengths: strong raw throughput, tight p99/p999 latency, lower CPU footprint under load.

Weaknesses: its configuration approach is genuinely its own thing, meaning real rewrite work rather than a translation exercise, and the pool of community how-tos is thinner than Traefik’s.

Fits best: trading systems, payment processors, and other services where the 99th percentile is the number that matters.

#3 Envoy Gateway — the standard, implemented straight

Rating: 4.5/5

A CNCF project born from folding several competing Envoy-based controllers into one. Operationally it’s hands-off: create a Gateway resource and it provisions the Envoy deployment, service, and autoscaler behind the scenes. What ships free stands out — OIDC, global rate limiting, mTLS, and JWT validation are all in the open source build, where competitors often gate the same features behind a paid tier.

Strengths: fully open, no license tier gating features, strong spec conformance, no single vendor controlling the roadmap.

Weaknesses: zero legacy annotation support, meaning a full rewrite of routing rules from scratch, and it’s the youngest project on this list.

Fits best: greenfield clusters and teams ready to do a one-time rewrite rather than carry old config forward.

#4 F5 NGINX Ingress Controller — same brand, different codebase, still shipping

Rating: 4/5

The controller most often confused with the retired one, which is exactly why it belongs here with a clear explanation. It’s F5’s own separately maintained project, and version 5.3.0 was built with an eye toward teams arriving from the community controller. F5 also offers NGINX Gateway Fabric for Gateway API, though its control plane is still catching up — CPU spikes have been reported when unrelated cluster changes trigger reconfiguration. One fact worth remembering about NGINX Rift: both F5 products were on the affected list and both got patched, while the community controller carries that bug forever.

Strengths: familiar mental model for teams already deep in NGINX config, commercial SLA available, active roadmap.

Weaknesses: its annotation syntax diverges from the old one, so it’s not copy-paste compatible, and some capabilities require the paid edition.

Fits best: teams whose procurement or support requirements tie them to staying inside the NGINX brand.

#5 Cilium Gateway — raw throughput, with real operational trade-offs

Rating: 4/5

Cilium starts from the CNI layer and pushes layer 4 handling into the kernel via eBPF, skipping the usual copy into userspace, so throughput ends up bounded mostly by the NIC. It’s hybrid, though: layer 7 traffic still gets handed off to a shared Envoy process on the node, so one noisy workload can degrade that shared proxy for everything colocated on the box. Upgrading the gateway often forces a CNI upgrade too, a heavier operation than most teams expect.

Strengths: unmatched raw L4 throughput, deep network-level observability that comes free with the CNI.

Weaknesses: eBPF debugging requires specialized skills, noisy-neighbor risk on shared L7 proxies, upgrades carry more blast radius than peers.

Fits best: streaming platforms, game servers, and telecom-adjacent workloads where layer 4 dominates the traffic mix.

#6 Istio Ambient — one control plane for ingress and service-to-service traffic

Rating: 4/5

Istio has fully embraced Gateway API as its primary interface. The Ambient data plane removed the old per-pod sidecar: a ~12 MB agent runs per node handling mTLS and TCP routing, with layer 7 offloaded to dedicated waypoint proxies only where needed. Independent measurements show Istio’s control plane propagating route changes in single-digit milliseconds, where competitors take full seconds.

Strengths: fastest-converging control plane in this comparison, one unified policy model covering both external and internal traffic.

Weaknesses: substantial overkill if the only requirement is exposing a handful of services to the internet.

Fits best: organizations already running, or actively planning, a service mesh alongside their ingress layer.

#7 Kong — an API platform with a gateway attached

Rating: 3.5/5

Kong treats Gateway API as a standardized entry point into a broader API management product. Its differentiator is the plugin architecture: transforms, rate limiting, logging, and custom logic attach as independent resources, and because routes live in memory, config changes apply without a process reload.

Strengths: mature plugin ecosystem, dedicated API management tooling, a built-in developer portal.

Weaknesses: the widest gap between free and paid tiers of anything on this list — the admin UI, analytics, and OIDC support all sit behind the commercial license.

Fits best: companies where the API itself is a monetized product, not just internal plumbing.

Side-by-Side Comparison

The migration effort rating below reflects how much rework is required specifically to move off the retired community controller, not a general difficulty score.

Buying Time: Paid Support and Platform Defaults

Not every team can finish a migration on the schedule the retirement imposed, and a few options exist for closing the security gap meanwhile. Chainguard maintains a status-quo fork under its EmeritOSS programme, applying CVE-level fixes without new features. HeroDevs sells a supported drop-in for the final v1.15.1 release with SLA-backed patches and VEX statements for audit trails. Both are stopgaps, not destinations.

Platform vendors moved too. SUSE committed to supporting Ingress NGINX for Rancher Prime LTS customers through November 2027, buying those clusters an extra eighteen months, and RKE2 switched its default to Traefik from v1.36. On managed Kubernetes the picture is less comfortable: if you installed the controller yourself through Helm on EKS, GKE or AKS, no provider migrates it for you. OpenShift users have a smoother path, since Gateway API support ships alongside the traditional route model.

There is also a non-technical dimension. An end-of-life component in the request path generates findings under SOC 2, PCI DSS, HIPAA and ISO 27001, and those block production promotions and surface in customer security reviews long before anyone exploits a specific CVE.

Migrating Without Downtime

The sequence comes down to five stages.

Step 1. Inventory. Collect every Ingress resource across every namespace and determine which annotations are genuinely in use. By hand this takes days, so reach for tooling: SIG Network’s ingress2gateway hit 1.0 in March 2026 and converts common annotations into Gateway API resources, while ing-switch covers 119 annotations and rates the impact of each one it cannot translate.

Step 2. Run in parallel. Bring the new controller up alongside the old one on non-conflicting ports. Nothing switches yet. The goal is confirming it starts and can see cluster resources.

Step 3. Duplicate and verify. Let both controllers serve the same Ingress objects, compare routing, headers, TLS, authentication and body size limits, then run a load test.

Step 4. Shift traffic gradually. Move services in batches starting with the least critical, keeping rollback available throughout.

Step 5. Decommission. Remove the old controller along with leftover annotations, RBAC roles and network policies.

Rehearsing this on a production cluster is a bad idea. A scaled-down copy of the environment running the same manifests is enough, and renting a VPS takes a few minutes. A full dry run including rollback surfaces most surprises in advance.

Five Common Situations and What Fits Each

A legacy cluster with hundreds of Ingress objects. Years of annotations plus snippets nobody remembers adding. Traefik with its compatibility layer closes the security gap in weeks, and Gateway API becomes a separate project later.

A latency-sensitive service. Advertising, analytics, trading. Take HAProxy, budget time for rewriting configuration, and measure the upper percentiles against your own traffic profile.

A cluster being built from scratch. No legacy to preserve, so go straight to Gateway API with Envoy Gateway. One migration instead of two.

A regulated environment. Finance, healthcare, public sector. You need a vendor accountable for patch timelines and able to supply audit documentation: OpenShift, F5’s commercial edition, or paid extended support while you migrate.

A small team running its own infrastructure. Ingress controllers usually get dedicated nodes with static addresses so external traffic stays isolated from application workloads. NVMe-backed VPS instances suit those nodes well.

Eight Mistakes That Turn a Migration Into an Incident

• Confusing the community project with F5’s controller. Similar names, different repositories. The team “migrates” and ends up exactly where it started.
• Assuming that working traffic means everything is fine. Nothing breaks on its own, which makes the problem easy to defer until an incident forces it.
• Waiting for a drop-in replacement. There isn’t one, and the Kubernetes committees said so explicitly.
• Choosing a controller before the inventory. The decision gets made from comparison posts, then half the services turn out to depend on capabilities the winner lacks.
• Cutting over in a single release. Without a parallel deployment, rollback becomes incident response under pressure.
• Porting snippets verbatim. Raw NGINX directives have no equivalent elsewhere, so their intent has to be re-expressed in the new platform’s own primitives.
• Forgetting the surrounding stack. cert-manager, external-dns, Helm charts and alerting are all wired to the old controller, and plenty of popular charts still only speak classic Ingress.
• Skipping load testing. Functional checks pass while production traffic exposes differences in buffering and timeout behaviour.

Conclusion and What to Do This Week

The choice reduces to two questions: how much accumulated configuration you need to preserve, and how soon you want to be on Gateway API. Traefik offers the gentlest transition, HAProxy wins where latency matters, Envoy Gateway suits a clean start, F5 keeps you inside a familiar ecosystem.

Three steps to start with:

1. Audit every cluster with the command from the beginning of this article and list where the controller is still running.
2. Export the annotations in active use and flag the ones that will not translate.
3. Stand up a candidate in parallel on a test environment and rehearse the cutover along with the rollback. A dedicated VPS server for that rig costs less than an hour of unplanned downtime.

Public benchmarks point in a direction. The decision gets made against your own traffic profile and your own annotation set.