Parallel cutover is the right call for ingress-nginx EOL: stand Traefik beside the old controller, migrate routes and TLS ownership in stages, and keep DNS as the rollback switch instead of a big-bang delete. I treat certificate attachment as a first-class gate — a Gateway or Ingress that looks Ready while Traefik still serves the default self-signed cert is the failure mode that looks like a total TLS outage to browsers even when the data plane is healthy.

Whether you stay on IngressRoute/Ingress or move to Gateway API, verify three things before flipping traffic: each hostname presents the expected SAN and notAfter, X-Forwarded-Proto and the real client address still reach backends after Traefik terminates TLS, and a dead upstream leaves the pool rather than hanging half the requests. Sticky-session gaps are fine if the app is already share-nothing; if it is not, document the affinity tradeoff before the cutover window, not during it.