The community Ingress-NGINX controller stopped receiving releases and security fixes in March 2026. Your cluster still works; it just will not be patched. The replacements on EKS (the AWS Load Balancer Controller with Gateway API, Envoy-based gateways, F5's NGINX) and the routing quirks that cause outages when you translate rules literally.
In November 2025 Kubernetes SIG Network and the Security Response Committee announced the retirement of Ingress-NGINX, citing years of insufficient maintainers. Best-effort maintenance ended in March 2026 and the repository was archived on March 24. Images and Helm charts remain available and existing deployments keep running, but there will be no more releases and no fixes for new vulnerabilities.
This is the internet-facing component of most clusters, and it has had critical vulnerabilities before. Running it unpatched for long is not a reasonable plan.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
For most EKS clusters we recommend the AWS Load Balancer Controller with Gateway API. One ALB per Gateway, routes owned by each team's namespace, TLS from ACM and WAF attached to the load balancer. No proxy fleet to scale or patch. The tradeoff is ALB's feature set: if you depend on custom NGINX configuration or Lua, an in-cluster proxy will be closer.
The Kubernetes project published a list of Ingress-NGINX defaults that are probably in your cluster today and that a correct-looking Gateway API translation will not reproduce:
Regex matches are prefix-based and case-insensitive. A pattern written for three uppercase letters also matches /uuid. Envoy-based gateways do full, case-sensitive matches, so traffic that used to route returns 404.
use-regex applies to every path of a host, across every Ingress for that host. One annotation on one Ingress turns another team's Exact and Prefix paths into regex.
rewrite-target implies regex, with the same side effects, even when nobody set use-regex.
Requests missing a trailing slash are redirected to the same path with one.
URLs are normalized before matching.
Inventory every Ingress, its annotations and its hosts. Flag regex, rewrite and snippet annotations; they carry most of the risk.
Capture real traffic paths from access logs for each host. The test is whether the new routes send the same requests to the same backends, not whether the YAML looks equivalent.
Stand up the new controller alongside the old one with a separate load balancer, and replay or mirror traffic against it.
Cut over per host with DNS weighting, watching 404 and 5xx rates per route.
Remove Ingress-NGINX and its admission webhook once nothing routes through it.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
An EKS Reference Architecture for 2026, With Diagrams: The Small-Team Version and the Regulated Version
What a production EKS setup looks like in 2026, layer by layer: edge, entry, cluster, platform add-ons, data, security and observability. A lean version for a small team on Auto Mode, and a regulated version with separate node pools, network policies and audit logging, with the choices behind each box.
Read
EKS Network Policies With the VPC CNI: Default Deny, Admin Policies, and the Limits to Know
The VPC CNI enforces Kubernetes network policies natively, and from version 1.21 adds cluster-wide admin policies that namespace owners can't override. How the tiers are evaluated, a default-deny setup, and the limits: EC2 Linux nodes only, 24 port-protocol combinations per CIDR, and pods without an owner.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.