Ingress NGINX Is Retired: Migrate to Gateway API

This is for you if

• You run ingress-nginx in production and need a safe, supported way off it
• You own a platform and must pick a Gateway API implementation your teams can live with
• You're the one who gets paged if the migration breaks a redirect, a certificate or a canary
• You're preparing for platform, SRE or DevOps interviews where this migration comes up

What's inside

• The official retirement timeline and what it means for your risk, plus an inventory script for your clusters
• GatewayClass, Gateway, HTTPRoute, GRPCRoute, ReferenceGrant and ListenerSet explained through status conditions
• Policy attachment and a scored way to choose between Envoy Gateway, Istio, Cilium, NGINX Gateway Fabric and cloud options
• Annotation-by-annotation mapping tables, including the hidden ingress-nginx defaults that cause outages
• A review workflow for ingress2gateway output and its warnings, with and without emitters
• TLS with cert-manager on Gateways, BackendTLSPolicy, and the HTTP-01 parallel-run trap
• Canary weights, header and query matching, mirroring and gRPC routing
• A six-phase zero-downtime runbook with parity testing, weighted DNS and rollback at every step
• Troubleshooting table, production checklists, 25 interview Q&As, cheat sheet and a 30-day plan

After this guide you can

• Inventory any ingress-nginx footprint and turn it into a prioritized migration backlog
• Build and debug Gateway API routing by reading status conditions instead of guessing
• Translate ingress-nginx annotations, snippets and defaults into Gateway API resources and policies
• Issue and verify certificates for Gateways with cert-manager without depending on DNS cutover
• Run a parallel edge, prove parity and cut over with weighted DNS and a tested rollback
• Answer senior-level interview questions about Gateway API and ingress migrations

Contents

1. The retirement, and the mental model you needp. 4
2. The core resources, hands-onp. 11
3. Policy attachment and choosing an implementationp. 23
4. Mapping ingress-nginx annotations to Gateway APIp. 29
5. The ingress2gateway toolp. 38
6. TLS with cert-managerp. 42
7. Canary, header matching and gRPCp. 48
8. The zero-downtime migration runbookp. 54
9. Troubleshooting playbookp. 60
10. Production checklist and design decisionsp. 64
11. Interview questionsp. 66
12. Cheat sheetp. 75
13. Your 30-day practice planp. 79