Ingress NGINX is retiring. Half of Kubernetes did not get the memo.
Best-effort maintenance ends this month, then the archive. The replacement has been ready for years, which is exactly why nobody moved.
Ingress NGINX, the most deployed way into a Kubernetes cluster for most of the project's history, reaches the end of best-effort maintenance this month and then gets archived, per the retirement plan tracked in community coverage. The designated successor, Gateway API, has been generally available upstream for years.
That gap between "successor exists" and "successor adopted" is the story. Gateway API was not rushed; it was designed in public precisely to avoid Ingress's annotation sprawl, where every controller grew its own dialect of magic strings. The replacement being ready made staying put feel safe, and staying put is what a plurality of production clusters did, right up to the deadline now arriving.
Archived does not mean broken. It means the CVE that lands next year in the thing terminating TLS at your cluster's front door gets fixed by nobody. For an internet-facing component, that is not technical debt. It is a countdown without a display.
The builder's read: inventory clusters for the controller this week; the migration is annotation archaeology and it takes longer than the deadline you will be given when the first unfixed CVE drops. Teams that move now migrate on their own calendar. Teams that wait migrate on an attacker's.