Eight Years, 275 Releases: Ingress-NGINX Is Archived

▶ Watch (2:04)

Ingress-NGINX is 8 years old, 275 releases, over 1,000 contributors, 137 custom annotations. The project is now archived. James Strong pushed the archive button live on stage at this session. CVEs will still be assigned by the SRC, but they will not be fixed by the original maintainers. A fork might patch them, but there are no guarantees. James’s message: stop running Ingress-NGINX. New vulnerabilities will keep appearing in a codebase that no one is actively patching.

Migrating with ingress-to-gateway v1.0

▶ Watch (7:29)

Gateway API has been sponsoring the ingress-to-gateway project. The tool converts ingress objects, including Ingress-NGINX annotations, to Gateway API objects. It just hit version 1.0. Of Ingress-NGINX’s 137 annotations, about 45% have a Gateway API equivalent. The migration tool currently covers 27% of that feature set. Implementations have added their own sources and export support. If something is missing, the project wants to hear about it in the community meetings.

Gateway API 1.5 and the ListenerSet Resource

▶ Watch (9:40)

Gateway API 1.5 shipped a few weeks before this talk. Five features moved to stable/GA, the most ever graduated in a single release. The team also moved to a monthly release train modeled after upstream Kubernetes. ListenerSet is the headline feature: it pulls listener config out of the Gateway object into a separate resource. Application developers can now own TLS certificates without write access to the Gateway. It also lifts the 64-listener cap, a hard etcd object-size limit. Six implementations already support it.

TLSRoute Brings Non-HTTP Workloads to the Gateway

▶ Watch (13:46)

TLSRoute is now stable. It routes non-HTTP traffic, including RADIUS, MQTT, Kafka, and MongoDB, based on the SNI hostname in the TLS handshake. In terminate mode, the gateway decrypts the connection and forwards plaintext to the backend. In passthrough mode, the gateway reads the unencrypted SNI hostname from the ClientHello and forwards traffic without decryption. The gateway has no access to the private key or payload. TLSRoute is not for HTTPS; using it there risks misdirected requests because of HTTP/2 connection coalescing.

Complete MTLS and a New CORS Filter

▶ Watch (17:37)

Gateway API 1.5 completes the MTLS picture for HTTP workloads. Frontend MTLS validates client certificates against CA certificates configured at the gateway level, not the route level. That placement avoids a connection coalescing bug in HTTP/2: when two listeners share a port with overlapping wildcard certificates, a reused TLS connection bypasses per-route validation. Per-port override adds granularity. Backend MTLS lets the gateway present its own client certificate to backend services via spec.backendTLS.clientCertificateRef. A new CORS filter on HTTPRoute handles preflight requests and sets response headers directly at the gateway.

Notable Quotes

ingress engine X. There will be CVEs James Strong · ▶ 4:14

yeah, five features moved to standard. Nick Young · ▶ 10:45

In my turn I am delighted to welcome Rostislav Bobrovsky · ▶ 13:46

Key Takeaways

  • Stop running Ingress-NGINX: CVEs will be found and will not be patched by maintainers.
  • ingress-to-gateway v1.0 converts NGINX annotations to Gateway API objects, covering 27% of the 137-annotation feature set.
  • ListenerSet, TLSRoute, and full MTLS for frontend and backend connections all moved to stable in 1.5.

About the Speakers

Nick Young is a Senior Software Engineer at Isovalent at Cisco and a maintainer on the Kubernetes Gateway API project. He has worked across datacenters, clouds, and networking for 25 years, focusing on improving ingress and mesh experiences in Kubernetes.

James Strong is a Principal Solution Architect at Isovalent at Cisco and a maintainer of Ingress-NGINX. He helped build a private cloud at GE Appliances and has spent years consulting on container and Kubernetes migrations for enterprises.

Katarzyna Łach is a Software Engineer at Google on the GKE team, focused on load balancing and networking. She led the Multi Cluster Services project and now concentrates on Gateway API.

Rostislav Bobrovsky is a Tech Lead Manager at Google specializing in Cloud Load Balancing and its integration with GKE Gateway infrastructure. He co-leads Gateway API TLS enhancements as a member of Kubernetes SIG Network.

Norwin Schnyder is a Senior Cloud Software Engineer at Airlock, implementing Gateway API and contributing to the project. He also lectures at two universities of applied sciences in Switzerland.