Ingress NGINX retirement

[kasperg]

It was recently announced that Ingress NGINX is being retired. Best-effort maintenance will continue until March 2026. Afterward, there will be no further releases, no bugfixes, and no updates to resolve any security vulnerabilities that may be discovered.

Lagoon recommends ingress-nginx I wonder what your thoughts are regarding the situation and finding a replacement for Ingress NGINX for Lagoon?

[dwoods]

A big change, I'm sure, but maybe an opportune time to move to Gateway API as an option?

[shreddedbacon]

We're exploring options at the moment.

For GatewayAPI, that is a significant undertaking. The way Ingress are managed/created in Lagoon don't directly translate to models currently available in GatewayAPI, and there are some features/proposals that may make this easier in the future.

I've done some initial work to identify what will not work if using an alternative ingress controller to ingress-nginx in #4024, however, this does not mean we are choosing traefik as the supported ingress controller for Lagoon.

[kasperg]

End of maintenance for ingress-nginx has been reached. The F5 NGINX Ingress Controller (nginx/kubernetes-ingress) may be the recommended migration target. Has anyone looked into this?

[shreddedbacon]

There is nothing stopping the use of another ingress controller if you're hosting your own Lagoon, but some things that would normally be leveraged by some of the annotations Lagoon currently sets for ingress-nginx would obviously not work. The PR I linked earlier describes what some of these functionality losses would look like.

We're looking at Traefik now as it has the least changes required and offers a fairly simple migration path that we can write migration tooling for. We'll provide more information on this once the details are finalised.

Traefik allows us to retain the use of Ingress specifically, while leveraging some of the other components that Traefik offers like Middlewares.

[ITViking]

With the publication of new CVE's for Ingress Nginx I am curious as to how far you are from publishing a guide on migrating away from Ingress Nginx and onto a maintained Ingress Controller which doesn't result in lost functionality

[tobybellwood]

We've got full (caveat - for what we're aware of at amazee.io) functionality in our replacement Traefik implementation, which we've compared against the newly released native Traefik middleware remap for ingress-nginx. The main difference is that our reimplementation supports Aergia, whereas the native one doesn't support alternative default backends.

In the meantime, you can check out building images from the now-maintained ingress-nginx upstream at https://github.com/chainguard-forks/ingress-nginx/releases - it's not going to be perfect, but it will cover the time lag between now and Traefik coming online - we're just doing final middleware compatibility checks across all the sites that we're aware of

[shreddedbacon]

We're just doing more internal reviews on the tooling we've been putting together on moving to traefik with middleware support (not using the kubernetesingressnginx provider).

You can follow along on some of the progress in the linked PRs in the PR I referenced earlier.

Most of the work for supporting traefik middleware is nearing completion, and we will have a tool that will be released soon that can be used to scan existing Lagoon ingress objects and check for supported/not supported annotation migrations based on existing ingress-nginx annotations. You'll then be able to run the migration tooling to precreate traefik middleware and other resources ahead of actually doing the change over of the ingressclass.

You'll need to be aware of your current ingress controllers loadbalancer IP addresses, and whether you're using static reservations or not.

If you are using static IPs, then you can likely just shift them from one controller to the other so that DNS changes aren't required. This would be an interruption to service when the IPs are transferred. In AWS if you've provisioned loadbalancers without existing EIP allocations, you're in a bit of trouble because you can't convert the AWS assigned ones. GCP does allow converting an existing dynamic IP to static though.

However, if you're not using static IPs on your loadbalancers, you'll need to potentially coordinate mass DNS changes when you change your controller, or assign static IPs to your current ingress controller prior to the migration so you can re-use them on your traefik controller.