Ingress NGINX

Ingress NGINX is retired. It was the Kubernetes project's own ingress controller: the piece that takes outside web traffic and routes it to the right service in your cluster, using NGINX and rules you write in YAML. Kubernetes stopped maintaining it in March 2026 and made the repo read-only on March 24, 2026. Still free under Apache 2.0.

Existing deployments keep running, and charts and images stay available. What's gone is patching: no releases, no bug fixes, no security fixes. The final release, v1.15.1, bundles NGINX 1.27.1. Chainguard keeps a free fork that has been backporting NGINX CVE fixes on a best-effort basis, and sells patched images with a remediation SLA.

Everyone should migrate. Kubernetes points you to Gateway API, the newer routing standard, through a controller like Envoy Gateway, Traefik or NGINX Gateway Fabric. The ingress2gateway tool converts existing Ingress objects. Solo and small teams: do it now. Medium and large teams: Chainguard's fork buys time while you test.

The catch: its 2026 CVEs shared one shape. A crafted Ingress injects config into NGINX, giving code execution and, in the default install, every Secret in the cluster. The last fix shipped days before the archive. The next one won't.