5 Critical Steps to Survive AKS NGINX Ingress Retirement in 2026
Table of Contents
Navigating the AKS NGINX Ingress Retirement
The Kubernetes community officially retired the ingress-nginx project in March 2026
While Microsoft is providing a grace period, they will cease all support and critical security patches for the managed NGINX add-on on November 30, 2026
Why Istio Service Mesh is the Strategic Choice
While the Application Routing Gateway API is the successor, its current Public Preview status makes the Istio Service Mesh Add-on (GA) the preferred choice for stable, production-ready environments
Brief comparison between both:
| Feature | App Routing Gateway API (Public Preview) | Istio Service Mesh Add-on (GA) |
| Primary Goal | Ingress Only. Replaces the NGINX add-on. | Full Mesh. Internal traffic management. |
| Technology | Lightweight Istio (Control Plane only). | Full Istio (Control Plane + Sidecars). |
| Traffic Scope | External → Internal (North-South). | Service → Service (East-West) + Ingress + Egress |
| Key Features | Managed DNS/TLS, simple ingress. | mTLS, Retries, Circuit Breaking, Observability. |
| Sidecar Injection | None. No sidecars in your app pods. | Yes. Sidecars injected into every pod. |
| Management | In-place upgrades (Auto-managed). | Canary upgrades (Revision-based). |
To identify which NGINX Ingress Controller your AKS cluster is using, follow these step
kubectl get pods -A | grep -i nginx (Linux or wsl)
kubectl get pods -A | findstr -i nginx (Windows)
Output:
(Community NGINX)
ingress-nginx ingress-nginx-controller-xxxxx
(NGINX Plus)
nginx-ingress nginx-ingress-controller-xxxxx
(AGIC — Not NGINX)
agic-controller
(AKS Application Routing add-on (NGINX-based))kubectl get pods -n app-routing-systemDates to Remember
We are currently running stable workloads on a supported system. However, a transition to a modern solution is mandatory before the critical deadline of November 30, 2026.
This deadline is crucial because Microsoft will completely cease support, including vital security patches, for the managed NGINX add-on. Furthermore, community maintenance for NGINX Ingress already ended in March 2026. Failing to migrate before the November deadline will expose our workloads to significant security vulnerabilities.
Proposed Next Steps:
- Architecture Review: Evaluate a migration to the Microsoft Managed ISTIO solution.
- The evaluation will include the AKS Application Routing Gateway API (the official successor based on Istio/Envoy).
Note: Since the AKS Application Routing Gateway API is currently in public preview, the immediate focus should be planning for the Microsoft Managed ISTIO implementation.
References:
- Ingress NGINX Retirement: What You Need to Know
- Configure Static Egress Gateway in Azure Kubernetes Service (AKS)
- Configure Istio ingress with the Kubernetes Gateway API for Azure Kubernetes Service (AKS) (preview)
- Deploy egress gateways for Istio service mesh add-on for Azure Kubernetes Service
- Deploy ingress gateways for Istio service mesh add-on for Azure Kubernetes Service
My Previous AKS Related Blogs
- Create a Private Azure Kubernetes Service (AKS) Cluster – Part 1
- Azure AKS Networking Explained: Azure CNI Overlay vs Node Subnet vs Pod Subnet – Part 1
- Azure AKS FailedScheduling – Kubernetes Scheduler Failure (Insufficient CPU)
- Kubectl Cheat Sheet – 41 Unique Kubernetes Commands Every Admin Should Know
- Istio in AKS Deployment: Ingress vs Gateway API, Managed vs Self-Managed – Part 1