Nginx ingress controller retirement

[oleva]

Hello,

As Kubero currently relies on the Kubernetes-maintained Ingress-NGINX controller (rather than the F5 NGINX Ingress Controller), are there any plans for an upgrade or alternative to ensure continued support following the announced retirement?

https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/

[nr-b]

I think it would make sense to switch to traefik ingress for now. Gateway API support is still experimental in cert-manager and it's probably a lot more changes. Small steps.

From a few quick tests, I think it won't be too hard to switch to traefik if we stay with Ingress for now. Quick and likely incomplete collection of todos in this regard:

• replace nginx.ingress.kubernetes.io annotations with their traefik equivalent
  • for basic auth, we need a middleware CRD
• adjust kubero prometheus queries to traefik
• adjust kubero cli to deploy traefik ingress

Question is how to migrate over old installs which are still on nginx ingress, maybe we should add a check in the UI or the operator and refuse to start if nginx ingress is present but traefik isn't. Basic authentication is configured with ingress-specific annotations so if users just upgrade kubero without switching their ingress, they may end up with configured basic auth not working, even though everything else is fine.

Alternatively, we can support both traefik ingress and nginx ingress for a while and then eventually deprecate nginx ingress but that sounds like it would be more work.

[nr-b]

Just learned that traefik can unterstand nginx annotations: https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/

[nr-b]

OK further investigation shows that we have a few annotations the nginx compat layer of traefik doesn't support. Here's the list of annoations that I found in the codebase:

nginx	traefik compat
nginx.ingress.kubernetes.io/whitelist-source-range	unsupported see traefik/traefik#12423
nginx.ingress.kubernetes.io/denylist-source-range	unsupported
nginx.ingress.kubernetes.io/force-ssl-redirect	https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/#opt-nginx-ingress-kubernetes-ioforce-ssl-redirect
nginx.ingress.kubernetes.io/ssl-redirect	yes, see force-ssl-redirect
nginx.ingress.kubernetes.io/proxy-buffer-size	unsupported
nginx.ingress.kubernetes.io/enable-cors	partial support
nginx.ingress.kubernetes.io/cors-allow-origin	yes
nginx.ingress.kubernetes.io/cors-allow-headers	yes
nginx.ingress.kubernetes.io/cors-expose-headers	?
nginx.ingress.kubernetes.io/cors-allow-credentials	yes
nginx.ingress.kubernetes.io/cors-max-age	yes
nginx.ingress.kubernetes.io/cors-allow-methods	yes
nginx.ingress.kubernetes.io/auth-secret	yes
nginx.ingress.kubernetes.io/auth-type	yes
nginx.ingress.kubernetes.io/auth-realm	yes

[nr-b]

support for whitelist-source-range was merged just a week ago: traefik/traefik#12423

[nr-b]

denylist-source-range will be more difficult since as far as I can see traefik only supports denylist via plugin