ingress-nginx retirement
The Kubernetes project has retired the community ingress-nginx controller. This page quotes the official posts and the compatibility notes those replacement projects publish. It does not pick a winner.
What was retired
ingress-nginx is the Ingress controller maintained in kubernetes/ingress-nginx (opens in a new tab). The Kubernetes blog on February 27, 2026 makes the naming distinction: Ingress-NGINX is the community controller, and NGINX Ingress is a separate controller from F5. NGINX Gateway Fabric is a third project. AddonMatrix tracks them as different add-ons.
Dates, from the posts that state them
| Date | Source | What it says |
|---|---|---|
| 2025-11-11 | Ingress NGINX Retirement (opens in a new tab) | SIG Network and the Security Response Committee announce the retirement. Best-effort maintenance continues until March 2026. After that: no further releases, no bug fixes, and no updates for security vulnerabilities. Existing deployments keep working. Helm charts and images remain available. InGate, the planned replacement, did not mature and will also be retired. |
| 2026-01-29 | Steering and Security Response statement (opens in a new tab) | Retirement remains March 2026. After retirement there are no releases for bug fixes, security patches, or any other updates. The post says none of the alternatives are direct drop-in replacements, and it tells operators to migrate to Gateway API or another Ingress controller. |
| 2026-02-27 | Before You Migrate (opens in a new tab) | Repeats the November 2025 announcement and the March 2026 retirement. Documents behavior that a literal translation can miss, and again separates ingress-nginx from F5 NGINX Ingress. |
| 2026-03-20 | Ingress2Gateway 1.0 (opens in a new tab) | Calls the retirement “scheduled for March 2026” and describes Ingress2Gateway as a translator from Ingress and ingress-nginx annotations to Gateway API, with warnings for configuration it cannot translate. |
| 2026-03-24 | Kubernetes v1.36 sneak peek, published 2026-03-30 (opens in a new tab) | The retirement section says SIG Network and the Security Response Committee retired Ingress NGINX on March 24, 2026, and that since that date there have been no further releases, bug fixes, or security updates. An earlier paragraph in the same post says the retirement was “announced by SIG-Security on March 24, 2026.” That announcement date does not match the November 11, 2025 post. AddonMatrix uses November 11, 2025 as the announcement and March 24, 2026 as the retirement date this later post states. |
| 2026-03-19 | controller-v1.15.1 (opens in a new tab) | Newest GitHub release tag when this page was checked on 2026-11-15. It is dated before the March 24 retirement date in the March 30 blog. |
The README fetched on 2026-11-15 still quotes the November announcement in the future tense (“best-effort maintenance will continue until March 2026”). It has not been edited to the past tense used in the March 30 blog. Treat the README banner as the November wording, and the March 30 post as the later statement that retirement already happened.
What keeps working
Both the November 11 post and the March 30 post say existing deployments are not shut off, and that Helm charts and container images stay available. The GitHub repositories were described in November as becoming read-only after retirement. This guide does not claim a later archive state that was not re-checked.
The November post gives this check, which needs cluster-admin rights:
kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginxWhat the project tells you to move to
The retirement posts name Gateway API (opens in a new tab) as the modern replacement for Ingress, and they say you can stay on Ingress by choosing another Ingress controller. They point at the Kubernetes documentation lists for Gateway API and Ingress. They do not name Envoy Gateway, NGINX Gateway Fabric, Contour, or Traefik as the official replacement. InGate is explicitly not a migration target: the November post says it never became a mature replacement and will be retired too.
Ingress2Gateway is the migration assistant the March 20 post describes. It translates Ingress objects and a set of ingress-nginx annotations, and it warns when it cannot translate something. The post says to review the generated resources before applying them.
Compatibility notes from the implementations themselves
These are the statements those projects publish. “Tested on Kubernetes 1.35” below uses the same cells as the add-on pages, for the current tracked release, and only where a matrix exists.
| Project | What its docs say | Kubernetes 1.35, current tracked row |
|---|---|---|
| Contour | CI-tested Kubernetes versions: Contour 1.33.8 was tested on 1.37, 1.36, and 1.35 with Gateway API 1.3.0. Contour 1.33.0 through 1.33.7 were tested on 1.34, 1.33, and 1.32. Contour 1.32 was tested on 1.33, 1.32, and 1.31. Contour 1.31 was tested on 1.32, 1.31, and 1.30. | |
| Envoy Gateway | Supported combinations: v1.10 uses Gateway API v1.6.1 and Kubernetes v1.34, v1.35, v1.36, v1.37, with end of life 2027/05/05. v1.9 uses Gateway API v1.6.1 and Kubernetes v1.33–v1.36, end of life 2027/02/14. v1.8 uses Gateway API v1.5.1 and Kubernetes v1.32–v1.35, end of life 2026/11/08. | |
| ingress-nginx | The README says supported versions mean E2E tests passed for the listed Kubernetes minors. ingress-nginx v1.15.0 and v1.15.1 list 1.35, 1.34, 1.33, 1.32, 1.31. v1.14.x lists 1.34 through 1.30. v1.13.x lists 1.33 through 1.29. v1.12.x lists 1.32 through 1.28. The project says versions may work on older Kubernetes releases and does not guarantee that. | |
| NGINX Gateway Fabric | Technical specifications say only the latest patch of each minor is shown. NGINX Gateway Fabric 2.8.1 and 2.7.2 list Kubernetes 1.32+. 2.6.8 and 2.5.1 list Kubernetes 1.31+. 2.8.1 also lists Gateway API 1.6.3. A separate page covers Gateway API feature compatibility. | |
| Traefik | Traefik’s Kubernetes requirements page says Traefik follows the Kubernetes support policy and supports at least the latest three minor versions of Kubernetes. General functionality cannot be guaranteed for older versions. The page does not list those minors, so no cells are filled in. The Ingress provider docs also say the Kubernetes Ingress API is frozen and encourage the Kubernetes Gateway provider. |
- ingress-nginx 1.15 was E2E tested, per the README, on Kubernetes 1.31, 1.32, 1.33, 1.34, and 1.35. That table is historical test coverage. The project no longer publishes security fixes for it.
- Envoy Gateway 1.10 lists Kubernetes 1.34, 1.35, 1.36, and 1.37 as a supported combination, with Gateway API v1.6.1. The install docs say to upgrade Gateway API CRDs to v1.6 before upgrading Envoy Gateway, and to move TCPRoute and UDPRoute to
gateway.networking.k8s.io/v1. On Kubernetes 1.35 the current row is Supported. - Contour 1.33.8 was CI-tested on Kubernetes 1.37, 1.36, and 1.35 with Gateway API 1.3.0. Earlier 1.33 patches were tested on 1.34, 1.33, and 1.32. The patch matters.
- NGINX Gateway Fabric 2.8.1 lists Kubernetes 1.32+ on its technical specifications page, along with Gateway API 1.6.3. That is a minimum, not a list of tested minors. 2.7.2 uses the same 1.32+ floor. 2.6.8 lists 1.31+.
- Traefik says it follows the Kubernetes support policy and supports at least the latest three minors, and that older versions are not guaranteed. The requirements page does not name those three minors, so there is no cell to mark. The Ingress provider docs also say the Ingress API is frozen.
A practical reading for a cluster still on ingress-nginx
- Confirm the pods with the selector above. A chart named something else is a different controller.
- Treat every ingress-nginx version as unmaintained, including ones whose old E2E table includes your Kubernetes minor.
- Inventory annotations, snippets, and configuration that Ingress2Gateway reports as untranslated. The February 27 post is the list of surprising behaviors the Kubernetes blog chose to highlight.
- Pick a Gateway API implementation, or another Ingress controller, from the project’s own compatibility page. Use the AddonMatrix row only as a pointer back to that page.
- If the cluster is on EKS, AKS, or GKE, check that platform’s end-of-support date on EOL Radar (opens in a new tab) separately. An add-on matrix does not extend the platform’s support window.
Checked 2026-11-15 against the pages linked above.