The Death and Resurrection of Kubernetes Networking: 5 Changes You Must Know Before March 2026

  ┌─────────────────────────────────────────────────────────────────┐
  │              2026 Kubernetes Networking Transition Roadmap       │
  ├──────────┬──────────┬──────────┬──────────┬──────────┬──────────┤
  │ 2025.03  │ 2025.11  │ 2026.03  │ 2026.06  │ 2026.11  │ 2027+   │
  │          │          │          │          │          │          │
  │ Ingress  │ Official │ ■ EOL ■  │ Gateway  │ AKS/GKE  │ Ingress │
  │ Nightmare│ Retire   │ Security │ API v1.5 │ Extended │ API     │
  │ CVE      │ Announce │ Patches  │ (Est.)   │ Support  │ Residual│
  │          │          │ End      │          │ Ends     │ Low     │
  │ GW API   │ GW API   │          │          │          │          │
  │ v1.2     │ v1.4 GA  │          │          │          │          │
  └──────────┴──────────┴──────────┴──────────┴──────────┴──────────┘
         ▲                    ▲                    ▲
         │                    │                    │
    CVE-2025-1974        Community Support    Cloud Vendor
    CVSS 9.8             Fully Ends          Extended Support Ends

  ┌─────────────────────────────────────────────────────────┐
  │                  Retirement Scope Clarification          │
  │                                                         │
  │  ✗ Retiring:   kubernetes/ingress-nginx controller      │
  │               (Community-maintained project)             │
  │                                                         │
  │  ✓ Continuing: Ingress API (networking.k8s.io/v1)       │
  │               F5 NGINX Ingress Controller (Commercial)   │
  │               Other third-party Ingress implementations  │
  │                                                         │
  │  ★ New Standard: Gateway API (gateway.networking.k8s.io)│
  └─────────────────────────────────────────────────────────┘

  Attacker (with Pod network access)
       │
       ▼
  ┌──────────────────────────┐
  │  Admission Webhook       │  ← Accessible without authentication
  │  (port 8443)             │
  └──────────┬───────────────┘
             │ Send malicious Ingress object
             ▼
  ┌──────────────────────────┐
  │  NGINX Config Injection  │  ← Inject arbitrary NGINX directives
  │  (Leveraging CVE-2025-   │
  │   1097/1098/24514)       │
  └──────────┬───────────────┘
             │ Achieve RCE via crafted config
             ▼
  ┌──────────────────────────┐
  │  Controller Pod Takeover │  ← CVE-2025-1974
  │  (CVSS 9.8)             │
  └──────────┬───────────────┘
             │ Steal ServiceAccount token
             ▼
  ┌──────────────────────────┐
  │  Access All Cluster      │  ← Can view Secrets from
  │  Secrets & Cluster       │     all namespaces
  │  Takeover                │
  └──────────────────────────┘

# Can you spot the typos?
metadata:
  annotations:
    # Typo: "rewrite-target" → "rewrite-traget"
    nginx.ingress.kubernetes.io/rewrite-traget: /$2
    # Type error: should be a number but string passed
    nginx.ingress.kubernetes.io/proxy-read-timeout: 'sixhundred'
    # Wrong prefix: "nginx.ingress.kubernetes.io" → "nginx.kubernetes.io"
    nginx.kubernetes.io/ssl-redirect: 'true'

# ingress-nginx specific
nginx.ingress.kubernetes.io/canary: 'true'
nginx.ingress.kubernetes.io/canary-weight: '20'

# Traefik specific
traefik.ingress.kubernetes.io/router.middlewares: default-rate-limit@kubernetescrd

# HAProxy specific
haproxy.org/rate-limit-requests: '100'

# AWS ALB specific
alb.ingress.kubernetes.io/target-type: ip

# Dangerous: Allows injection of arbitrary NGINX configuration
metadata:
  annotations:
    nginx.ingress.kubernetes.io/configuration-snippet: |
      # Intended normal use: add custom headers
      more_set_headers "X-Custom-Header: value";

      # Malicious use: exfiltrate server information
      # proxy_pass http://internal-service.kube-system.svc.cluster.local;

      # Malicious use: bypass authentication
      # satisfy any;
      # allow all;

# Ingress approach: relies on annotations
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: 'true'
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/proxy-read-timeout: '600'
    nginx.ingress.kubernetes.io/proxy-send-timeout: '600'
    nginx.ingress.kubernetes.io/proxy-body-size: '100m'
    nginx.ingress.kubernetes.io/cors-allow-origin: 'https://example.com'
    nginx.ingress.kubernetes.io/cors-allow-methods: 'GET, POST, PUT'
    nginx.ingress.kubernetes.io/cors-allow-headers: 'Content-Type, Authorization'
    nginx.ingress.kubernetes.io/enable-cors: 'true'
    nginx.ingress.kubernetes.io/limit-rps: '100'
    nginx.ingress.kubernetes.io/canary: 'true'
    nginx.ingress.kubernetes.io/canary-weight: '20'
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - app.example.com
      secretName: app-tls
  rules:
    - host: app.example.com
      http:
        paths:
          - path: /api(/|$)(.*)
            pathType: ImplementationSpecific
            backend:
              service:
                name: api-service
                port:
                  number: 80

# Gateway API approach: structured spec
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-app
spec:
  parentRefs:
    - name: production-gateway
  hostnames:
    - app.example.com
  rules:
    # Rule 1: HTTPS redirect (expressed via spec, not annotations)
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301
      matches:
        - headers:
            - name: X-Forwarded-Proto
              value: http
    # Rule 2: API routing
    - matches:
        - path:
            type: PathPrefix
            value: /api
      filters:
        - type: URLRewrite
          urlRewrite:
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /
      backendRefs:
        - name: api-service
          port: 80
          weight: 80
        - name: api-service-canary
          port: 80
          weight: 20

# Timeout policy: managed as a separate resource
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: BackendLBPolicy
metadata:
  name: api-timeout-policy
spec:
  targetRefs:
    - group: ''
      kind: Service
      name: api-service
  sessionPersistence:
    sessionName: my-session
    type: Cookie
---
# TLS policy: backend TLS config separated into its own resource
apiVersion: gateway.networking.k8s.io/v1alpha3
kind: BackendTLSPolicy
metadata:
  name: api-backend-tls
spec:
  targetRefs:
    - group: ''
      kind: Service
      name: api-service
  validation:
    caCertificateRefs:
      - name: backend-ca-cert
        group: ''
        kind: ConfigMap
    hostname: api-internal.example.com

# Ingress: infrastructure and application settings mixed
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-app
  # Who manages these annotations? Infra team? Dev team?
  annotations:
    nginx.ingress.kubernetes.io/ssl-redirect: 'true' # Infrastructure concern
    nginx.ingress.kubernetes.io/proxy-body-size: '50m' # Infrastructure concern
    nginx.ingress.kubernetes.io/rewrite-target: /$1 # Application concern
    nginx.ingress.kubernetes.io/canary-weight: '10' # Application concern
spec:
  ingressClassName: nginx # Infrastructure concern
  tls:
    - hosts:
        - app.example.com
      secretName: production-tls-cert # Infrastructure concern (secret management)
  rules:
    - host: app.example.com # Mixed concern
      http:
        paths:
          - path: /api/(.*) # Application concern
            pathType: ImplementationSpecific
            backend:
              service:
                name: api-service # Application concern
                port:
                  number: 80

  ┌─────────────────────────────────────────────────────────────┐
  │  Layer 1: GatewayClass                                      │
  │  ─────────────────────                                      │
  │  Owner: Infrastructure Provider (Cloud vendor, Platform team)│
  │  Role: Define data plane implementation                      │
  │  Example: "nginx", "envoy", "gke-l7-global"                │
  │  RBAC: cluster-admin level                                  │
  ├─────────────────────────────────────────────────────────────┤
  │  Layer 2: Gateway                                           │
  │  ─────────────────                                          │
  │  Owner: Cluster Operator (Platform/Infra Engineer)           │
  │  Role: Listeners, TLS, IP addresses, ports, allowed NS      │
  │  Example: Port 443 HTTPS listener, wildcard certificate      │
  │  RBAC: namespace-admin level (infra namespace)              │
  ├─────────────────────────────────────────────────────────────┤
  │  Layer 3: HTTPRoute / GRPCRoute / TCPRoute                  │
  │  ───────────────────────────────────────────                 │
  │  Owner: Application Developer (Service developer)            │
  │  Role: Routing rules, backend service mapping, traffic weight│
  │  Example: /api → api-service, canary 20%                    │
  │  RBAC: namespace-editor level (application namespace)       │
  └─────────────────────────────────────────────────────────────┘

# GatewayClass defined by the infrastructure provider
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: nginx-gateway-fabric
spec:
  controllerName: gateway.nginx.org/nginx-gateway-controller
  parametersRef:
    group: gateway.nginx.org
    kind: NginxProxy
    name: production-proxy-config

# Gateway managed by the cluster operator
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: production-gateway
  namespace: gateway-infra # Infrastructure-only namespace
spec:
  gatewayClassName: nginx-gateway-fabric
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: wildcard-tls-cert
            kind: Secret
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway-access: 'true' # Only allowed namespaces
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: Same
---
# Cross-namespace reference grant
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-gateway-to-app-secrets
  namespace: app-team-a
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: Gateway
      namespace: gateway-infra
  to:
    - group: ''
      kind: Service

# HTTPRoute managed by developers in their namespace
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: api-routes
  namespace: app-team-a # Application namespace
spec:
  parentRefs:
    - name: production-gateway
      namespace: gateway-infra # Reference Gateway in infra namespace
      sectionName: https
  hostnames:
    - api.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /v1
      backendRefs:
        - name: api-v1
          port: 8080
          weight: 80
        - name: api-v2
          port: 8080
          weight: 20 # Canary deployment: 20% traffic to v2

# Developer Role: Can only create/modify HTTPRoutes
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: route-editor
  namespace: app-team-a
rules:
  - apiGroups: ['gateway.networking.k8s.io']
    resources: ['httproutes', 'grpcroutes']
    verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']
  - apiGroups: ['gateway.networking.k8s.io']
    resources: ['gateways']
    verbs: ['get', 'list'] # Gateway is read-only
---
# Infrastructure operator Role: Can manage Gateway, cannot create Routes
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: gateway-admin
  namespace: gateway-infra
rules:
  - apiGroups: ['gateway.networking.k8s.io']
    resources: ['gateways', 'referencegrants']
    verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']
  - apiGroups: ['']
    resources: ['secrets']
    verbs: ['get', 'list', 'watch', 'create', 'update']

  ┌─────────────────────────────────────────────────────────────┐
  │                Ingress API Portability Limitations           │
  │                                                             │
  │  Ingress spec (Standard)    Annotations (Non-standard)       │
  │  ┌───────────────────┐   ┌──────────────────────────────┐   │
  │  │ host: app.com     │   │ nginx.ingress.k8s.io/...     │   │
  │  │ path: /api        │   │ traefik.ingress.k8s.io/...   │   │
  │  │ tls: cert         │   │ alb.ingress.k8s.io/...       │   │
  │  │                   │   │ haproxy.org/...               │   │
  │  │ (Portable)        │   │ (Non-portable - Vendor-locked)│   │
  │  └───────────────────┘   └──────────────────────────────┘   │
  │         20%                        80%                      │
  │    Only 20% of actual          The remaining 80% depends    │
  │    config is portable          on vendor-specific annotations│
  └─────────────────────────────────────────────────────────────┘

# This HTTPRoute works identically on any Gateway API implementation
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: portable-route
spec:
  parentRefs:
    - name: my-gateway
  hostnames:
    - app.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix # Core: path matching
            value: /api
        - headers: # Core: header matching
            - name: X-Version
              value: v2
      filters:
        - type: RequestHeaderModifier # Core: header manipulation
          requestHeaderModifier:
            add:
              - name: X-Gateway
                value: production
      backendRefs:
        - name: api-service
          port: 8080

# Extended features: supported by most implementations but verify
rules:
  - filters:
      - type: RequestRedirect # Extended: HTTP redirect
        requestRedirect:
          scheme: https
          statusCode: 301
      - type: URLRewrite # Extended: URL rewriting
        urlRewrite:
          path:
            type: ReplacePrefixMatch
            replacePrefixMatch: /v2
    backendRefs:
      - name: api-v1
        port: 8080
        weight: 90 # Extended: traffic weighting (canary)
      - name: api-v2
        port: 8080
        weight: 10

  ┌─────────────────────────────────────────────────────────────┐
  │               Conformance Test Process                       │
  │                                                             │
  │  1. Run Gateway API test suite                               │
  │     └─> Deploy standard Gateway/HTTPRoute resources          │
  │                                                             │
  │  2. Send actual traffic and verify behavior                  │
  │     └─> Path matching, header filtering, redirects, etc.     │
  │                                                             │
  │  3. Generate results report                                  │
  │     └─> Core 100%, Extended features list                    │
  │                                                             │
  │  4. Official certification (Conformance Profile)             │
  │     └─> Listed in official Gateway API implementations       │
  └─────────────────────────────────────────────────────────────┘

  ┌──────────────────┐     ┌──────────────────┐
  │   AWS EKS        │     │   Azure AKS      │
  │                  │     │                  │
  │  GatewayClass:   │     │  GatewayClass:   │
  │  aws-gateway     │     │  azure-gateway   │
  │  (change impl)   │     │  (change impl)   │
  │                  │     │                  │
  │  Gateway: ───────┼─────┼─ Gateway: ──────┐│
  │  (minimal edits) │     │  (minimal edits) ││
  │                  │     │                  ││
  │  HTTPRoute: ─────┼─────┼─ HTTPRoute: ────┘│
  │  (reuse as-is)   │     │  (reuse as-is)   │
  └──────────────────┘     └──────────────────┘
           │                        │
           └───────┬────────────────┘
                   │
        Same HTTPRoute manifests reused
        by only changing GatewayClass

  HTTP/2 over TCP Head-of-Line Blocking:

  TCP Connection
  ┌─────────────────────────────────────────────────┐
  │  Stream 1: [Pkt1][Pkt2][  Lost  ][Pkt4]        │
  │  Stream 2: [PktA][PktB]  ← Wait  [PktD]        │  ← Blocked!
  │  Stream 3: [PktX][PktY]  ← Wait  [PktZ]        │  ← Blocked!
  └─────────────────────────────────────────────────┘
               Pkt3 lost → All streams wait

  HTTP/3 over QUIC Independent Streams:

  QUIC Connection
  ┌─────────────────────────────────────────────────┐
  │  Stream 1: [Pkt1][Pkt2][  Lost  ][Pkt4]        │  ← Only this stream affected
  │  Stream 2: [PktA][PktB][PktC]   [PktD]         │  ← Proceeds normally!
  │  Stream 3: [PktX][PktY][PktZ]                   │  ← Proceeds normally!
  └─────────────────────────────────────────────────┘
               Pkt3 lost → Only Stream 1 affected

apiVersion: gateway.nginx.org/v1alpha1
kind: NginxProxy
metadata:
  name: http3-enabled-proxy
spec:
  config:
    http:
      http3: true
      http3MaxConcurrentStreams: 128
      altSvcHeader: true # Automatically add Alt-Svc header

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: http3-gateway
  namespace: gateway-infra
spec:
  gatewayClassName: nginx-gateway-fabric
  listeners:
    # HTTPS (TCP) + HTTP/3 (UDP) simultaneous listening
    - name: https-tcp
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - name: wildcard-tls-cert
    - name: https-udp
      protocol: HTTPS # HTTP/3 declared as HTTPS protocol
      port: 443 # Same port, QUIC handled over UDP
      tls:
        mode: Terminate
        certificateRefs:
          - name: wildcard-tls-cert

apiVersion: v1
kind: Service
metadata:
  name: nginx-gateway-fabric
  namespace: gateway-infra
spec:
  type: LoadBalancer
  ports:
    - name: https-tcp
      port: 443
      targetPort: 443
      protocol: TCP
    - name: https-udp
      port: 443
      targetPort: 443
      protocol: UDP # UDP port required for QUIC

  ┌─────────────────────────────────────────────────────────┐
  │              HTTP/3 Network Requirements                 │
  │                                                         │
  │  UDP 443 must be added to inbound rules:                 │
  │                                                         │
  │  Before (HTTP/2 only):                                  │
  │  ┌──────────────────────────────────────┐               │
  │  │ TCP 80   ← HTTP                     │               │
  │  │ TCP 443  ← HTTPS (TLS over TCP)     │               │
  │  └──────────────────────────────────────┘               │
  │                                                         │
  │  After adding HTTP/3:                                   │
  │  ┌──────────────────────────────────────┐               │
  │  │ TCP 80   ← HTTP                     │               │
  │  │ TCP 443  ← HTTPS (TLS over TCP)     │               │
  │  │ UDP 443  ← QUIC (HTTP/3 over UDP)   │  ← Must add   │
  │  └──────────────────────────────────────┘               │
  │                                                         │
  │  Note: Many enterprise firewalls and cloud security     │
  │  groups block UDP 443 by default.                       │
  └─────────────────────────────────────────────────────────┘

Alt-Svc: h3=":443"; ma=86400

# Enable eBPF-based QUIC routing in nginx.conf
quic_bpf on;  # Requires Linux 5.7+

  ┌──────────────────────────────────────────────────────────────┐
  │              Progressive Migration Strategy                   │
  │                                                              │
  │  Phase 1: Inventory and Assessment (1-2 weeks)               │
  │  ├─ Catalog all Ingress resources                            │
  │  ├─ Classify annotations in use                              │
  │  ├─ Identify snippets usage (priority: security risk removal)│
  │  └─ Map dependencies (cert-manager, external-dns, etc.)      │
  │                                                              │
  │  Phase 2: Build Gateway API Infrastructure (1-2 weeks)       │
  │  ├─ Install Gateway API CRDs                                 │
  │  ├─ Deploy NGINX Gateway Fabric or alternative controller    │
  │  ├─ Create GatewayClass, Gateway resources                   │
  │  └─ Validate in non-production environment                   │
  │                                                              │
  │  Phase 3: Progressive Routing Transition (2-4 weeks)         │
  │  ├─ Initial conversion with ingress2gateway tool             │
  │  ├─ Manual review & annotation → filter/policy conversion    │
  │  ├─ Sequential per-service transition (non-critical → critical)│
  │  └─ Parallel operation period (Ingress + Gateway API)        │
  │                                                              │
  │  Phase 4: Full Transition and Cleanup (1-2 weeks)            │
  │  ├─ Confirm all traffic routes through Gateway API           │
  │  ├─ Remove Ingress resources                                 │
  │  ├─ Remove ingress-nginx controller                          │
  │  └─ Reconfigure monitoring and alerts                        │
  └──────────────────────────────────────────────────────────────┘

# List all Ingress resources across all namespaces
kubectl get ingress -A -o wide

# Extract all annotations in use
kubectl get ingress -A -o json | \
  jq -r '.items[].metadata.annotations // {} | keys[]' | \
  sort | uniq -c | sort -rn

# Urgent check for snippets annotations (security risk)
kubectl get ingress -A -o json | \
  jq -r '.items[] | select(.metadata.annotations["nginx.ingress.kubernetes.io/configuration-snippet"] != null or .metadata.annotations["nginx.ingress.kubernetes.io/server-snippet"] != null) | .metadata.namespace + "/" + .metadata.name'

# Check IngressClass
kubectl get ingressclass

# With Go environment
go install github.com/kubernetes-sigs/ingress2gateway@latest

# Or download binary from GitHub Releases
# https://github.com/kubernetes-sigs/ingress2gateway/releases

# Auto-convert Ingress resources from the cluster
ingress2gateway print --all-namespaces

# Convert specific namespace only
ingress2gateway print --namespace production

# File-based conversion
ingress2gateway print --input-file ingress-resources.yaml

# Specify ingress-nginx provider (annotation conversion support)
ingress2gateway print --providers ingress-nginx --all-namespaces

# Save results to file
ingress2gateway print --providers ingress-nginx --all-namespaces > gateway-resources.yaml

# Install Gateway API CRDs
kubectl kustomize \
  "https://github.com/kubernetes-sigs/gateway-api/config/crd?ref=v1.2.1" \
  | kubectl apply -f -

# Install NGINX Gateway Fabric
helm install ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric \
  --create-namespace \
  --namespace nginx-gateway \
  --set service.type=LoadBalancer

# Check GatewayClass after installation
kubectl get gatewayclass
# NAME            CONTROLLER                                    ACCEPTED
# nginx           gateway.nginx.org/nginx-gateway-controller     True

# Apply Gateway resource
kubectl apply -f gateway.yaml

# Check Gateway status
kubectl get gateway -n gateway-infra
# NAME                  CLASS   ADDRESS         PROGRAMMED   AGE
# production-gateway    nginx   203.0.113.10    True         5m

# Apply HTTPRoute
kubectl apply -f httproute.yaml

# Check HTTPRoute status
kubectl get httproute -n app-team-a
# NAME          HOSTNAMES           AGE
# api-routes    ["api.example.com"] 2m

# Test with actual traffic
curl -H "Host: api.example.com" https://203.0.113.10/v1/health

# Execute this right now
kubectl get ingress -A -o json | \
  jq -r '[.items[] | {
    namespace: .metadata.namespace,
    name: .metadata.name,
    annotations: (.metadata.annotations // {} | keys | length),
    has_snippets: ((.metadata.annotations // {}) |
      has("nginx.ingress.kubernetes.io/configuration-snippet") or
      has("nginx.ingress.kubernetes.io/server-snippet"))
  }]'

go install github.com/kubernetes-sigs/ingress2gateway@latest
ingress2gateway print --providers ingress-nginx -A > gateway-migration.yaml

# Test on a non-production cluster
kubectl kustomize \
  "https://github.com/kubernetes-sigs/gateway-api/config/crd?ref=v1.2.1" \
  | kubectl apply -f -

helm install ngf oci://ghcr.io/nginx/charts/nginx-gateway-fabric \
  --create-namespace --namespace nginx-gateway