Traefik’s rise as teams migrate from retired Ingress NGINX

The Ingress NGINX Controller retired in March 2026, leaving production clusters without security updates or bug fixes. This forced a rapid migration for teams running one of the most widely deployed ingress controllers. Traefik Labs responded by adding an NGINX compatibility layer to its proxy, creating a drop-in replacement that handles 85+ native annotations. Other options like F5 NGINX Ingress and HAProxy require manual configuration rewrites. I view this as the defining infrastructure event of the year because it eliminated the default choice for many Kubernetes users. The deadline was brutal, with only four months to move workloads before the software became unmaintained.

Why Traefik won the migration war

Traefik’s primary advantage is its "NGINX Provider," which processes standard nginx.ingress.kubernetes.io annotations natively. Your existing Ingress objects work unchanged, avoiding the need to rebuild the entire ingress layer from scratch. This contrasts sharply with alternatives that offer only migration guides or annotation mappings. Security architecture also matters here; Traefik uses Go and static linking to prevent the memory safety flaws seen in C-based solutions. The #IngressNightmare vulnerabilities demonstrated how attackers could compromise clusters through malicious configuration injection in older systems. Traefik’s structured parsing approach mitigates these specific risks by design.

With over 3.4 billion downloads and 58,000 GitHub stars, the project has proven stability across startups and enterprises. It ships with full Gateway API v1.4 support in version 3.6, positioning teams for the future of Kubernetes networking. However, performance benchmarks tell a different story for high-load environments. In tests at 1,000 concurrent connections, Traefik recorded a p99 latency of 22.5ms, compared to 15.2ms for NGINX and 12.8ms for HAProxy. If your workload demands maximum throughput, HAProxy consistently delivers 15-25% higher requests per second. For most mid-scale SaaS platforms, though, the operational simplicity outweighs the latency penalty. You get zero-downtime configuration changes and built-in Let’s Encrypt integration without external dependencies.

The Caddy alternative and long-term strategy

Some developers are moving away from Traefik entirely toward Caddy for simpler deployments. Caddy handles HTTPS automatically with zero configuration, issuing and renewing certificates via Let’s Encrypt without cron jobs. Its Caddyfile syntax is 3-5 times shorter than equivalent NGINX configurations. For small teams running 5 to 50 services on a single server, Caddy’s minimal memory footprint of approximately 30 MB beats Traefik’s 50 MB idle usage. The trade-off is service discovery; Caddy does not natively detect new Docker services unless you use third-party tools like caddy-docker-proxy. Traefik discovers services dynamically from labels and Kubernetes annotations out of the box.

I would skip Caddy if you operate a multi-team Kubernetes cluster where engineers deploy services independently. The label-based automation in Traefik eliminates the need for a central proxy management process. Each team configures their own routing via annotations, reducing coordination overhead. Caddy remains the superior choice for static sites or simple VPS setups where complexity is the enemy. But for dynamic microservice environments, the provider architecture of Traefik is essential. It watches providers and updates routing dynamically without classical config reload patterns that interrupt long-lived connections.

The path forward involves two distinct phases. First, decommission Ingress NGINX immediately using the compatibility layer to ensure security. Second, plan Gateway API adoption on your own timeline rather than under deadline pressure. Trying to solve both crises simultaneously is a mistake that leads to operational instability. Assess readiness during normal sprint cycles and implement when business conditions are optimal. The immediate problem is retirement, not modernization. Solve one crisis at a time. Does your current annotation set cover 100% of your traffic rules, or are you relying on undocumented edge cases?