Migrating from NGINX Ingress to Envoy Gateway, One Host at a Time
Ingress NGINX was retired in March 2026. The Kubernetes Steering and Security Response Committees were blunt about what that means: "There will be no more releases for bug fixes, security patches, or any updates of any kind after the project is retired", and "choosing to remain with Ingress NGINX after its retirement leaves you and your users vulnerable to attack" (statement, January 2026). If your cluster still has Ingress objects, you have a migration you did not ask for.
The Gateway API is the destination, and converting a single workload to it is easy: its chart renders an HTTPRoute instead of an Ingress, and you are done. The migration is not the conversion. It is everything that happens between the first converted host and the last one - because the entry point in front of the cluster points at exactly one thing, and switching it happens for every host at the same moment.
This post compares the ways through that middle, then goes deep on the one that turned out to need no per-host infrastructure work at all: an HTTPRoute with no hostnames, which the Gateway API defines as the lowest-precedence match, handing everything unclaimed straight back to the ingress-nginx controller. On the cluster behind this post - roughly a hundred hosts across platform add-ons, developer environments, and teams the platform group does not own - it meant the switch was safe on day one and every remaining host migrated when its owner was ready. Every route table and log excerpt below is read from that cluster, with hostnames and namespaces replaced by generic ones.