NGINX on Kubernetes
Your hub for NGINX's Kubernetes ecosystem: Ingress controllers, Gateway API implementations, migration tools, and conversion utilities.
The community kubernetes/ingress-nginx controller has reached end of maintenance. v1.15.1, released March 19, 2026, is its final release.
Explore the ecosystem
NGINX Ingress Controller
Production-grade Ingress controller with advanced traffic management, VirtualServer CRDs, and full observability.
Best if you run Ingress resources today or are migrating from ingress-nginx.
ProjectNGINX Gateway Fabric
Gateway API implementation powered by NGINX with control and data plane separation for future-ready traffic management.
Best if you're adopting the Kubernetes Gateway API.
ToolNGINX Ingress Migration Tool
Interactive guide for migrating from the community Ingress-NGINX controller with 130+ annotation mappings and CRD examples.
Toolingress2gateway
CLI tool to convert Ingress resources to Gateway API resources using the NGINX provider.
ToolGateway Lens
Dashboard that draws your cluster's Gateway API resources as a live topology graph and lists the problems it finds.
Featured content
Featured video
Ingress-NGINX Is Retiring, NGINX Is Not
CNCF On-Demand webinar
Featured video
Cutting Through the Kubernetes Confusion
NGINX Ingress, Gateway Fabric, and What's Next
Featured blog
NGINX Ingress Controller 5.7: HTTP/2 to your upstreams, Opaque Secrets, and cert-manager challenges behind HTTPS redirects
Upstreams can speak cleartext HTTP/2, an Opaque Secret works anywhere a TLS, CA, or htpasswd Secret does, and HTTP-01 challenges pass hosts that redirect to HTTPS or require authentication.
Read on blog.nginx.org ›
Featured blog
NGINX Gateway Fabric 2.8: IP allow and deny lists, passive health checks, and cookie-based session persistence
A new AccessPolicy allows or denies client IP ranges per Gateway or route, UpstreamSettingsPolicy tunes passive health checks, and session persistence no longer needs NGINX Plus.
Read on blog.nginx.org ›NGINX Ingress Controller
Production-grade Ingress controller built on NGINX. Advanced traffic management, TLS termination, VirtualServer CRDs, and full observability for Kubernetes.
NGINX Ingress Controller features
Advanced traffic management
Load balancing, rate limiting, circuit breaking, and blue-green deployments with fine-grained control via annotations or VirtualServer CRDs.
SSL/TLS management
TLS termination, SSL passthrough, forced redirects, and certificate management via Kubernetes Secrets.
TCP/UDP load balancing
Layer 4 load balancing for non-HTTP workloads using TransportServer and GlobalConfiguration custom resources.
VirtualServer CRDs
VirtualServer, VirtualServerRoute, Policy, TransportServer, and GlobalConfiguration custom resources for advanced routing beyond Ingress.
Snippets & customization
Server, location, and HTTP snippets for injecting custom NGINX configuration. Full control without forking the controller.
Prometheus & OpenTelemetry
Built-in Prometheus metrics endpoint and OpenTelemetry tracing for full observability of your ingress traffic.
Compatibility
| Component | Version |
|---|---|
| Kubernetes | 1.35, 1.36, 1.37 |
| NGINX | 1.31.7 |
Quick start
# Install via Helm (OCI registry)
helm install nginx-ingress \
oci://ghcr.io/nginx/charts/nginx-ingress \
--version 2.8.0 \
--namespace nginx-ingress --create-namespaceNGINX Gateway Fabric
Gateway API implementation powered by NGINX. A future-ready, standards-based approach to Kubernetes traffic management with control and data plane separation.
NGINX Gateway Fabric features
Gateway API native
First-class Kubernetes Gateway API v1.6.3 implementation with full conformance testing across HTTP, GRPC, TLS, TCP, and UDP.
Control & data plane separation
Clean architectural split with NGINX Agent dynamically managing the NGINX data plane for reliability and scale.
Multi-cloud ready
Deploy consistently across hybrid and multi-cloud Kubernetes environments with portable Gateway API resources.
TLS & mTLS
Flexible TLS termination and passthrough with automatic certificate management and mutual TLS support.
Traffic splitting
Weighted backend routing for canary deployments and A/B testing using native HTTPRoute resources.
Extensibility
SnippetsFilter, ClientSettingsPolicy, and ObservabilityPolicy custom resources for use cases beyond core Gateway API.
Key details
Compatibility
| Component | Version |
|---|---|
| Kubernetes | 1.35, 1.36, 1.37 |
| NGINX | 1.31.7 |
Quick start
# Install the Gateway API CRDs first (standard channel)
kubectl kustomize \
"https://github.com/nginx/nginx-gateway-fabric/config/crd/gateway-api/standard?ref=v2.8.0" \
| kubectl apply -f -# Install via Helm (OCI registry)
helm install nginx-gateway-fabric \
oci://ghcr.io/nginx/charts/nginx-gateway-fabric \
--version 2.8.0 \
--namespace nginx-gateway-fabric --create-namespaceNGINX Ingress Migration Tool
Migrate from the community Ingress-NGINX controller to NGINX Ingress Controller. Interactive YAML analysis, 130+ annotation mappings, and CRD migration examples.
Migration tool features
Interactive YAML analyzer
Paste your existing Ingress YAML and get an instant migration plan with converted annotations, ConfigMap mappings, and CRD suggestions.
130+ annotation mappings
Complete mapping table with community annotations, their NGINX Ingress Controller equivalents, side-by-side YAML examples, and searchable filters.
CRD migration examples
Side-by-side examples for VirtualServer, VirtualServerRoute, Policy, TransportServer, and GlobalConfiguration CRDs.
ConfigMap migration
Detailed guide for migrating ConfigMap-based global configuration between the community controller and the NGINX Ingress Controller.
Complexity assessment
The analyzer evaluates your Ingress resources and provides a migration complexity score with actionable recommendations.
Copy-ready output
Every code block and generated YAML snippet includes a one-click copy button for immediate use in your workflow.
The migration tool is a static HTML application with first-party CSS/JS and no third-party runtime dependencies. It covers every annotation and ConfigMap key from the community controller.
A companion command line tool, nic-migrate, runs the same analysis across a whole directory of manifests or a live cluster. It is in beta and lives in this site's repository.
ingress2gateway
Convert Ingress resources to Gateway API resources using the NGINX provider. Automate your migration from Ingress to the Kubernetes Gateway API.
ingress2gateway features
Automated conversion
Reads Ingress resources from your cluster or YAML files and outputs equivalent Gateway API manifests automatically.
NGINX provider
Dedicated NGINX provider that understands 14 NGINX-specific annotations and converts them to their Gateway API equivalents.
Gateway & HTTPRoute output
Produces Gateway and HTTPRoute resources ready for direct application to your cluster.
CLI tool
Simple command-line interface that fits into CI/CD pipelines. Read from files or directly from a live cluster.
9 providers
Support for NGINX, Istio, Kong, Apisix, GCE, OpenAPI3, Traefik, and more, each with provider-specific annotation handling.
File or cluster input
Read Ingress resources from local YAML files with --input-file or directly from a connected Kubernetes cluster.
nginx provider shown below reads NGINX Ingress Controller's nginx.org/ annotations. To go straight from the community kubernetes/ingress-nginx controller to Gateway API, use --providers=ingress-nginx instead. To move to NGINX Ingress Controller, use the migration tool.
Installation
# Install with Go
go install github.com/kubernetes-sigs/ingress2gateway@v1.2.0# Or install with Homebrew (macOS / Linux)
brew install ingress2gatewayUsage
# Convert from a YAML file
ingress2gateway print \
--providers=nginx \
--input-file=my-ingress.yaml# Convert from a live cluster (current context)
ingress2gateway print \
--providers=nginx# Convert and save to a file
ingress2gateway print \
--providers=nginx \
--input-file=my-ingress.yaml > gateway-resources.yamlGateway Lens
See how your Gateway API resources connect. Gateway Lens watches a cluster and draws its Gateways, routes, policies and Services as an interactive topology graph in your browser.
Gateway Lens features
Topology graph
GatewayClasses, Gateways, routes, ReferenceGrants, policies and Services, laid out with the references between them.
Issues panel
Lists every Accepted, Programmed or ResolvedRefs condition that is false, plus references to missing resources and Services with no ready endpoints. Select one to jump to it on the graph.
Resource inspector
Click a node to see its attributes, relationships, conditions, attached policies and the YAML manifest.
Live updates
The graph redraws when a resource changes in the cluster, without reloading the page.
Read-only
Gateway Lens only watches, lists and gets. Its RBAC grants no write access to anything in the cluster.
JSON API
The same topology at /api/data and the detected problems at /api/issues, for scripts and jq.
nginx-gateway-fabric provider below so Gateway Lens can read them.
Installation
# Install with Helm, including NGINX Gateway Fabric's resources
helm install gateway-lens \
oci://ghcr.io/nginx/charts/gateway-lens \
--version 0.4.1 \
--set rbac.providers={nginx-gateway-fabric}# Or apply the manifests
kubectl apply -f \
https://raw.githubusercontent.com/nginx/gateway-lens/v0.4.1/deploy/manifests-nginx-gateway-fabric.yamlUsage
# Open the dashboard at http://localhost:8080
kubectl port-forward svc/gateway-lens 8080:80# Or run the release binary locally (uses your kubeconfig)
./gateway-lens# List the detected problems as JSON
curl http://localhost:8080/api/issues | jq .