Ingress NGINX Reaches End of Life in March 2026: Migration Guide for Kubernetes Operators

The Kubernetes SIG Network team confirmed in January 2026 that the community-maintained Ingress NGINX controller (kubernetes/ingress-nginx) will reach end of life in March 2026. After that date, there will be no further releases, no bug fixes, and no security vulnerability patches. GitHub repositories will be made read-only. Existing deployments will continue to function, but any CVEs discovered after March will remain unaddressed in that codebase indefinitely.

Why Ingress NGINX Is Being Retired

The controller has been maintained by one or two individuals working in their free time. SIG Network and the Kubernetes Security Response Committee exhausted efforts to recruit additional maintainers to a level that would make the project sustainable. Faced with the choice between continued under-resourced maintenance of a security-critical component and a clean retirement with clear migration guidance, the steering committee chose retirement.

It is important to note that this affects only the Kubernetes community-maintained controller at kubernetes/ingress-nginx. The F5-maintained NGINX Ingress Controller at nginxinc/kubernetes-ingress is a separate project and continues to receive active development and support.

Migration Options

The Kubernetes project recommends migrating to the Gateway API, the next-generation replacement for the Ingress resource. Gateway API provides richer traffic management capabilities, better multi-tenancy through role-based resource separation, and is actively maintained by SIG Network with broad ecosystem support. Several conformant Gateway API implementations are available, including Envoy Gateway, Cilium Gateway API support, and the HAProxy Kubernetes Ingress Controller.

For teams that must continue using Ingress resources rather than migrating to Gateway API, the Kubernetes documentation lists alternative community-maintained Ingress controllers. Migration complexity varies significantly by deployment: simple HTTP routing rules are straightforward to translate, while deployments relying heavily on Ingress NGINX-specific annotations will require more careful mapping to Gateway API route filter equivalents. Teams should begin migration planning now, before the March deadline eliminates the option of parallel testing against a supported controller.