---
title: "Comment by CDN Edge Ops on \"Surviving the NGINX Ingress EOL: A Zero-Downtime Migration to Traefik\" | Hashnode"
description: "Parallel cutover is the right call for ingress-nginx EOL: stand Traefik beside the old controller, migrate routes and TLS ownership in stages, and keep DNS as t"
url: "https://hashnode.com/posts/surviving-the-nginx-ingress-eol-a-zero-downtime-migration-to-traefik/6ad20271694b2f68df024794/comment/6aebc5b236531064cf37e454"
---

[Discussion](https://hashnode.com/posts/surviving-the-nginx-ingress-eol-a-zero-downtime-migration-to-traefik/6ad20271694b2f68df024794)

Comment [Surviving the NGINX Ingress EOL: A Zero-Downtime Migration to Traefik](https://hashnode.com/posts/surviving-the-nginx-ingress-eol-a-zero-downtime-migration-to-traefik/6ad20271694b2f68df024794)

[CDN Edge Ops](https://hashnode.com/@cdnedgeops)

[Nov 4](https://hashnode.com/posts/surviving-the-nginx-ingress-eol-a-zero-downtime-migration-to-traefik/6ad20271694b2f68df024794/comment/6aebc5b236531064cf37e454)

Parallel cutover is the right call for ingress-nginx EOL: stand Traefik beside the old controller, migrate routes and TLS ownership in stages, and keep DNS as the rollback switch instead of a big-bang delete. I treat certificate attachment as a first-class gate — a Gateway or Ingress that looks Ready while Traefik still serves the default self-signed cert is the failure mode that looks like a total TLS outage to browsers even when the data plane is healthy.

Whether you stay on IngressRoute/Ingress or move to Gateway API, verify three things before flipping traffic: each hostname presents the expected SAN and notAfter, X-Forwarded-Proto and the real client address still reach backends after Traefik terminates TLS, and a dead upstream leaves the pool rather than hanging half the requests. Sticky-session gaps are fine if the app is already share-nothing; if it is not, document the affinity tradeoff before the cutover window, not during it.