The ingress-nginx project that we heavily rely on for handling Toolforge traffic is now in maintenance mode: https://github.com/kubernetes/ingress-nginx/issues/13002
We have several options:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T392356 Replace ingress-nginx before upstream EOL date | |||
| Resolved | taavi | T415192 Move ingress annotations to an allowlist model | |||
| Open | None | T414674 Remove remaining uses of ingress-nginx specific annotations | |||
| In Progress | Feature | bd808 | T414836 Create a reusable container to replace nginx ingress anonymizing reverse proxy setups |
https://github.com/kubernetes/ingress-nginx/issues/13002 seems to state that ingress-nginx will not enter maintenance mode until there is a stable release of InGate and that a migration path from ingress-nginx to Ingate will also be provided by the ingress-nginx project in the future. The Ingate project seems to still be soliciting requirements what makes it seem like a stable release will be a while in coming.
There are a few tools that I know of which use ingress-nginx specific features like the nginx.ingress.kubernetes.io/permanent-redirect annotation described in https://wikitech.wikimedia.org/wiki/User:BryanDavis/Kubernetes#Make_a_tool_redirect_to_another_tool_WITHOUT_running_a_webservice. We can probably figure out how to get a listing of all Ingress objects that are not managed by webservice or toolforge jobs so we can examine the potential requirements they add to the search for a replacement Ingress/Gateway service.
https://www.kubernetes.dev/blog/2025/11/12/ingress-nginx-retirement/
To prioritize the safety and security of the ecosystem, Kubernetes SIG Network and the Security Response Committee are announcing the upcoming retirement of Ingress NGINX. Best-effort maintenance will continue until March 2026. Afterward, there will be no further releases, no bugfixes, and no updates to resolve any security vulnerabilities that may be discovered.
It looks like InGate is no option:
https://github.com/kubernetes-sigs/ingate/commit/7c0f10563c6ef12e97172b8ca40e1a2006f73a35
InGate is being retired (early 2026).
SIG Network and the Security Response Committee recommend that all users begin migration to Gateway API or another Ingress controller immediately. Many options are listed in the Kubernetes documentation: Gateway API and Ingress. Additional options may be available from vendors you work with.