Kubernetes announces the retirement of Ingress NGINX, with best-effort maintenance until March 2026

2025-11-11 · Publisher : Kubernetes · Domain : Cloud & DevOps

On 11 November 2025, Kubernetes SIG Network and the Security Response Committee announce the retirement of Ingress NGINX: best-effort maintenance until March 2026, then no further fixes, security ones included.

What changes

  • Announced on 11 November 2025 by SIG Network and the Security Response Committee.
  • Best-effort maintenance until March 2026, then no more updates, security ones included.
  • Migration recommended to Gateway API or another Ingress controller.
  • Cause: one or two maintainers and technical debt that became insurmountable.

### Background On 11 November 2025, **Kubernetes SIG Network** and the **Security Response Committee** (SRC) announce the upcoming retirement of **Ingress NGINX**, one of the most widely used Ingress controllers. Best-effort maintenance continues until March 2026; afterward, no more releases, no bug fixes and no updates for any vulnerability that may be discovered. ### Key facts - Existing deployments keep working and installation artifacts (Helm charts, container images) remain available. - The project recommends migrating to one of the many alternatives, first of all Gateway API, presented as the modern replacement for Ingress. - Reason given: Ingress NGINX has only ever had one or two people developing it, outside working hours, and the technical debt is deemed insurmountable. - Flexibility that was once useful has become a flaw: the ability to add arbitrary NGINX directives through "snippets" annotations is cited as a serious security defect. - The maintainers had announced the previous year their plan to wind down the project and develop a replacement controller with the Gateway API community. ### Why it matters For CIOs and IT services firms, this is a migration workstream to inventory without waiting: many clusters, including on managed Kubernetes offerings, ship this controller. Staying on it after the deadline means running an Internet-facing component without security patches. Migrating to Gateway API or another controller requires routing, certificate and annotation testing specific to each application. ### Takeaway Ingress NGINX will be retired in March 2026: any cluster using it must plan its migration now.

Links

Tags : Kubernetes, Cloud natif, Sécurité, Open Source, Conteneurs