Guide to Ingress NGINX Retirement

The Kubernetes SIG Network and the Security Response Committee announced the retirement of the Ingress NGINX project. Upstream best-effort maintenance, and all associated upstream releases, bug fixes, or security updates, ended March 2026.

To support users during this transition,

SUSE provides extended support timelines and clear migration paths to Traefik.

This guide centralizes the information on how to proceed based on your specific deployment scenario.

Support and Timelines

For organizations that cannot migrate immediately, SUSE Rancher Prime LTS provides extended support for RKE2 version 1.35.

Extended support for Ingress NGINX

SUSE Rancher Prime LTS provides patches for critical and important Common Vulnerabilities and Exposures (CVEs) for the Ingress NGINX component through December 2027. No new features will be added during this period.

Migration Paths by Environment

For organizations ready to move, SUSE offers a supported path to Traefik.

Traefik includes a compatibility layer that can interpret many existing Ingress NGINX annotations. Identify your cluster environment below to find the correct migration approach.

Standalone RKE2 Clusters

For standalone or imported RKE2 clusters currently using Ingress NGINX, follow the official migration guide for standalone RKE2 clusters.

The migration process involves a four-phase strategy:

  1. Dual ingress controller setup: Enable Traefik alongside Ingress NGINX using temporary, non-conflicting ports.

  2. Parallel migration and validation: Duplicate Ingress resources and test Traefik’s handling of the existing annotations.

  3. Final switchover: Remove Ingress NGINX and configure Traefik to use the standard ports.

  4. Cleanup: Delete the legacy Ingress objects.

Rancher Server on RKE2 (Local Clusters)

When migrating a Rancher local cluster, the Rancher Ingress resource requires specific handling to prevent lockouts. Follow the specific guide for migrating the Rancher Ingress to Traefik in an RKE2 cluster. This guide builds upon the standalone migration phases but includes steps tailored to the Rancher management server.

Rancher on Managed Kubernetes (Amazon EKS, Azure AKS, Google GKE)

If you run SUSE Rancher Prime on a managed Kubernetes service such as Amazon Elastic Kubernetes Service (EKS), Azure Kubernetes Service (AKS), or Google Kubernetes Engine (GKE), the recommendation is to migrate to Traefik.

SUSE Rancher Prime customers can leverage the Application Collection to deploy and manage the Traefik proxy.

Impact on Other SUSE Products

The retirement of Ingress NGINX impacts other

SUSE products

in the following ways:

  • SUSE Storage: There is no impact on the Longhorn backend. However, administrators must reconfigure their Ingress to upgrade the Longhorn UI. For more information, refer to Create an Ingress with Basic Authentication Traefik.

  • SUSE® Rancher Prime: Continuous Delivery: Configuring a webhook service is affected. Refer to the Fleet documentation for more information.

  • Ingress NGINX references in documentation for other projects have been removed.