The NGINX Ingress retirement deadline and Traefik compatibility

The Ingress NGINX project maintainers announced the retirement of the Ingress NGINX Controller on November 12, 2025, which leaves organizations only four months to migrate before they run unmaintained software without security updates. Organizations face a brutal 120-day deadline. They must move away from a controller that previously faced critical vulnerabilities like the #IngressNightmare malicious configuration injection attacks. While cloud providers like AWS, GKE, and AKS provide their own controllers, Traefik is the most realistic choice for these teams because its NGINX Provider handles 80% of the most common custom annotations. While F5 NGINX Ingress or HAProxy Ingress require manual conversion of every custom annotation, Traefik handles most nginx.ingress.kubernetes.io annotations natively. You might find that your Ingress objects work unchanged after the switch, if you already know how to use Kubernetes manifests. Moving to the Gateway API is an alternative, but that requires learning new resource types like Gateway, GatewayClass, HTTPRoute, and TLSRoute. While NGINX remains a stable choice for high-traffic applications due to its low resource consumption, it lacks the dynamic flexibility of newer tools. Will the NGINX Provider eventually support the remaining 20% of custom annotations?

Technical Observability and Performance

Traefik v3.3, codenamed "saint-nectaire", expands observability through extended OpenTelemetry integration. This release adds experimental support for logs and access logs alongside existing metrics and tracing. Engineers can now define behaviors at the entryPoint level or enable or disable tracing and metrics on a per-router basis. This granularity reduces unnecessary data collection for specific services while ensuring critical services remain observable. NGINX is an industry standard with a large user base, but its reload model shows its age during high configuration churn. Traefik watches providers and updates routing dynamically to handle changes. This difference is important when your team manages high-churn environments with frequent route changes. Traefik has over 3.4 billion downloads and 58,000 GitHub stars. While Envoy Proxy excels in dynamic service discovery, Traefik provides a more accessible experience for mid-scale platforms. Kong provides authentication and rate limiting on top of NGINX, whereas Traefik includes built-in support for these functions. Regarding resource usage, TLS connection negotiation is CPU intensive, and TLS certificates use a lot of memory. For 10 routes and a few certificates, 100MB of RAM is often enough, but some users deploy Traefik with 10GB of RAM. The reorganized documentation now targets three personas: beginners, advanced operators, and advanced developers.

Enterprise Scalability and API Management

Traefik provides a path to modern networking through its Gateway API support and Traefik Hub. Traefik v3.6 includes full v1.4 support for the Gateway API, and this allows teams to manage traffic without heavy configuration rewrites. Traefik Hub allows for GitOps workflows using Custom Resource Definitions like EdgeIngress and AccessControlPolicy to automate deployment. Users deploy a lightweight agent that serves as a tunnel endpoint, which allows Traefik Hub to deploy containers without exposing servers to the internet. Traefik Hub creates DNS names for services and makes advanced RBAC possible without specialized cloud-native networking skills. For users with one cluster, a free tier is available. Traefik Enterprise Edition uses a distributed architecture with a control plane and a data plane. The control plane uses the Raft consensus to safely store and replicate configurations and TLS certificates across nodes without an external Key-Value Store. Users can deploy and operate a cluster with several nodes using the "traefikeectl" CLI. Traefik Enterprise includes commercial support where the engineering team investigates and resolves critical issues. Traefik Enterprise is built on top of Traefik, which means that Traefik continues to evolve and stay open source.