Ingress-nginx will be retired in March 2026: What you need to know now.
The Kubernetes world is facing an important decision: the widely used ingress controller ingress-nginx is being retired by the community. Many companies run productive workloads based on this controller and are now faced with the question of how to proceed – especially in the Rancher and RKE2 environments. SUSE is responding to this development with a clear support strategy and a recommended migration path to Traefik.
#Container Platform
Background: EOL of ingress-nginx
The Kubernetes community has announced that it will transition the community controller ingress-nginx to end-of-life status by March 2026 at the latest. From this point on, no further releases, bug fixes or security patches are to be expected from the community, which increases the security and operational risk in productive clusters. It is already foreseeable that organisations with business-critical Kubernetes workloads will have to rethink their ingress strategy and switch to an alternative solution in the medium term.
What SUSE customers need to know now
For customers in the Rancher and RKE2 ecosystem, the community EOL does not mean that they will immediately be left without support. SUSE plans to extend support for NGINX as an ingress solution with its Rancher Prime solution beyond the official community period, thus providing greater planning security. Specifically, the plan is to continue providing bug fixes and security updates beyond 2026, enabling an orderly transition.
This gives teams additional time to evaluate their ingress architecture, test migration paths and plan change processes properly, instead of having to react under high time pressure.
The recommended approach: migration to Traefik
As the future standard solution in the Rancher/RKE2 context, we recommend switching from ingress-nginx to Traefik. Traefik supports the modern Kubernetes Gateway API and also offers a compatibility layer for essential NGINX annotations, meaning that many existing ingress resources can continue to be used without a complete rewrite. This significantly reduces the migration effort, as central functions such as TLS configuration, authentication, load balancing options and CORS policies continue to be mapped via the supported NGINX annotations.
At the same time, Traefik opens the way to a Gateway API-based architecture in the medium term without having to make all changes at once. Many experts recommend splitting the migration into two steps: first change the controller, then introduce the gateway API in a separate project.
Next steps for your team
To ensure your cluster is well prepared, a structured approach is recommended:
- Take stock of the current ingress-nginx configurations and annotations used
- Set up a test environment with Traefik, ideally in parallel with existing Rancher/RKE2 clusters
- Validate which NGINX annotations are already supported by Traefik and where adjustments are necessary
- Gradually migrate critical workloads with defined rollback scenarios before converting the production environment.
- Gradual migration of critical workloads with defined rollback scenarios before the production environment is converted.
The extended support period for ingress-nginx in the Rancher/RKE2 ecosystem gives you enough leeway to carefully plan and implement this migration – without compromising on security and stability.
The UMB Kubernetes team will be happy to assist you with the analysis and transition to solutions that continue to be supported.
