Ingress NGINX Is EOL: What the K8s Gateway API Migration Actually Requires
Enterprise Developer PlatformsIngress NGINX went end-of-life in March 2026. It is not receiving security patches. Three critical CVEs — IngressNightmare, CVE-2026-24512, and CVE-2026-3288 — are currently unaddressed in production clusters running the controller. The Kubernetes project’s designated successor is Gateway API, and the migration is not a configuration swap — it’s an architectural shift that changes how routing responsibility is divided across teams.
Context
Ingress NGINX has been the default ingress controller for Kubernetes clusters across most of the industry for the better part of a decade. Its annotation-based configuration model made it accessible and flexible, but that same model embedded routing logic in a way that didn’t scale well as multi-team Kubernetes operations matured. The Ingress API itself remains supported by Kubernetes, but it is feature-frozen — no new capabilities will land there. The future of Kubernetes networking is Gateway API, and EOL makes the migration timeline no longer optional.
The security exposure is immediate. Clusters running Ingress NGINX are exposed to known, unpatched vulnerabilities that can affect entire cluster security boundaries. Attackers with access to the ingress layer can escalate privileges and access secrets across namespaces — the same attack surface that Datadog’s CI/CD threat matrix maps for pipeline environments applies here at the network layer.
The Detail
Gateway API replaces the annotation-heavy Ingress model with explicit, typed resources: GatewayClass, Gateway, HTTPRoute, and GRPCRoute. The structural change reflects an intentional role separation — infrastructure teams own Gateways (the entry points, with attachment constraints), and application teams own Routes (the routing rules). This maps more cleanly to how platform and development teams actually divide responsibility in mature Kubernetes organizations.
Datadog documents a 7-phase migration approach: controller selection, performance baseline capture, parallel deployment of Gateway API alongside the existing Ingress controller, resource translation using the Ingress2Gateway tool, route acceptance verification, synthetic traffic validation, and DNS cutover with monitoring guardrails. The parallel operation phase is the practical key — migration does not require a hard cutover, which gives teams the ability to validate Gateway API routing behavior under real traffic before committing.
What breaks in the migration is specific and worth understanding before starting. Cross-namespace backends — a common pattern where services in one namespace receive traffic routed from another — now require explicit ReferenceGrant authorization rather than the default cross-namespace access Ingress NGINX allowed. Non-HTTP protocols require controllers that explicitly support them, which narrows the field of Gateway API implementations. Custom annotations that teams built workflows around become controller-specific policy attachments — the logic doesn’t transfer automatically, it requires translation.
Controller selection is the first and most consequential decision. NGINX Gateway Fabric, Istio, Envoy Gateway, and cloud-provider managed implementations each support the Gateway API specification with different trade-offs in operational complexity, feature coverage, and vendor relationship. Teams standardized on a specific cloud provider will find the managed gateway options simplest operationally; teams requiring cross-cloud consistency will lean toward Envoy Gateway or Istio.
Datadog’s monitoring tooling maps directly to the migration phases: Network Map for verifying traffic flows during cutover, Watchdog for surfacing anomalies in error rates, APM for pinpointing latency changes at the edge versus backend services, and SLOs for expressing pre-migration performance targets as explicit success criteria. The observability instrumentation is the difference between a migration that surfaces problems in staging and one that surfaces them in production.
The So What
Platform teams running Ingress NGINX need an active migration plan, not a watch-and-wait posture. Unpatched critical CVEs in a component that sits at the edge of every cluster request is not a risk to defer. The 7-phase approach Datadog documents is practical and de-risks the migration with parallel operation and synthetic validation — but it requires lead time. Starting the controller evaluation and parallel deployment phases now preserves the option to validate thoroughly before cutting over DNS.
For teams approaching this migration cold, the most useful first step is the controller selection decision. Everything downstream — the policy attachment model, the protocol support, the cloud integration — follows from which implementation you choose. That decision takes longer than the technical migration itself.
Photo by Brett Sayles on Pexels
Source: Datadog
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →