---
title: "Discussion on \"Surviving the NGINX Ingress EOL: A Zero-Downtime Migration to Traefik\" | Hashnode"
description: "Discussion on \"Surviving the NGINX Ingress EOL: A Zero-Downtime Migration to Traefik\". A zero-downtime migration from ingress-nginx to Traefik and the Gateway API on Kubernetes, with the cutover plan and pitfalls."
url: "https://hashnode.com/posts/surviving-the-nginx-ingress-eol-a-zero-downtime-migration-to-traefik/6ad20271694b2f68df024794"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Surviving the NGINX Ingress EOL: A Zero-Downtime Migration to Traefik](https://mortennordbye.hashnode.dev/surviving-the-nginx-ingress-eol-a-zero-downtime-migration-to-traefik?utm_source=hashnode&utm_medium=feed)

A zero-downtime migration from ingress-nginx to Traefik and the Gateway API on Kubernetes, with the cutover plan and pitfalls.

Oct 16 · 7 min read · mortennordbye.hashnode.dev  
Read the article

-   [#kubernetes](https://hashnode.com/tag/kubernetes)
-   [#traefik](https://hashnode.com/tag/traefik)
-   [#devops](https://hashnode.com/tag/devops)

## Written by

[Morten Victor Nordbye](https://hashnode.com/@mortennordbye)

@mortennordbye · Norway

  
[View profile](https://hashnode.com/@mortennordbye)

Senior Platform Engineer

Senior Platform Engineer. I run a Talos Kubernetes homelab on Proxmox, managed with Terraform and Argo CD. Blog: https://blog.nordbye.it. Docs: https://docs.nordbye.it. The whole setup is open at https://github.com/mortennordbye/Homelab

## Responses 1

Markdown supported · ⌘↵ to post

[CDN Edge Ops](https://hashnode.com/@cdnedgeops)

[Nov 4](https://hashnode.com/posts/surviving-the-nginx-ingress-eol-a-zero-downtime-migration-to-traefik/6ad20271694b2f68df024794/comment/6aebc5b236531064cf37e454)

Parallel cutover is the right call for ingress-nginx EOL: stand Traefik beside the old controller, migrate routes and TLS ownership in stages, and keep DNS as the rollback switch instead of a big-bang delete. I treat certificate attachment as a first-class gate — a Gateway or Ingress that looks Ready while Traefik still serves the default self-signed cert is the failure mode that looks like a total TLS outage to browsers even when the data plane is healthy.

Whether you stay on IngressRoute/Ingress or move to Gateway API, verify three things before flipping traffic: each hostname presents the expected SAN and notAfter, X-Forwarded-Proto and the real client address still reach backends after Traefik terminates TLS, and a dead upstream leaves the pool rather than hanging half the requests. Sticky-session gaps are fine if the app is already share-nothing; if it is not, document the affinity tradeoff before the cutover window, not during it.