Hey everyone! Our team is planning to switch from Ingress as we're approaching the end of support for ingress-nginx next month. This feels like a great opportunity to move to the Gateway API to take advantage of its richer feature set and more standardized configuration model, moving away from our reliance on heavy annotations.
Currently, our ingress-nginx setup uses a variety of complex annotations, such as regex usage, SSL settings, external authentication with mTLS, and several timeout configurations. I'm particularly struggling to find a Gateway API controller that offers equivalents for all of these features. I've tried using Envoy-based controllers but found limitations especially around external auth scenarios. Also, we have an nginx sidecar that's part of our application pod which needs to stay accessible, but that has posed challenges, too.
So, I'm looking for insights on a few points:
* Are there any Gateway API controllers that can support most or all of these features like regex rewrites, external auth with mTLS, header injections, timeouts, and HTTPS backends?
* How are other developers managing complex nginx authentication annotations when switching to Gateway API?
* Do you have any recommended approaches for migrating from a heavily annotated ingress-nginx setup like ours?
Any practical tips or controller suggestions from anyone who has made a similar transition would be really helpful. Thanks a lot!
2 Answers
Have you considered using Istio? I know you touched on Envoy-based controllers, but Istio supports a lot of the features you need. It's worth mentioning that it has a reputation for a learning curve. What's your experience like with it so far? Is it really as complex as they say?
You might want to explore using Contour or Istio. Both handle external auth and mTLS quite well, but be prepared to restructure those nginx annotations into separate policies or filters. From what I've seen, many teams approach this as more of a redesign instead of a direct migration, moving authentication logic into a service mesh or dedicated services. The Gateway API is cleaner in many respects, but you could encounter some gaps in features during the process.
Related Questions
How To: Running Codex CLI on Windows with Azure OpenAI
Set Wordpress Featured Image Using Javascript
How To Fix PHP Random Being The Same
Why no WebP Support with Wordpress
Replace Wordpress Cron With Linux Cron
Customize Yoast Canonical URL Programmatically