When you leave Ingress NGINX for Gateway API, treat GatewayClass, Gateway listeners, and route parentRefs as the cutover surface, not a one-shot YAML rewrite. Pin one controller name on the GatewayClass, keep TLS termination on a single layer (LB, Gateway listener, or upstream), and migrate Host by Host so the old IngressClass still owns leftover rules until health checks and DNS agree. Empty Endpoints or a second controller claiming the same class usually look like random 502s even when the route object itself is valid.

Ops prove-out after the first Host moves: confirm the Gateway shows programmed addresses and Accepted routes, then hit the public Host and expect the upstream status rather than a default backend. If only one path fails, check Service port names versus the backend port and that pods stayed Ready. When routes vanish after a controller upgrade, verify parentRefs still match a Ready listener and that NetworkPolicies did not start dropping node-to-pod paths — most failed cutovers are class or parentRef mismatch, not the Gateway CRD shape.