https://www.theregister.com/2025/12/02/ingress_nginx_opinion/ # # Sign in / up The Register # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal TechCxOPublic Sector (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features The Future of the Datacenter AWS Re:invent SC25 Supercomputing Month Cloud Infrastructure Month Datacenter Networking Nexus The State of Storage European Supercomputing AI Infrastructure Month Spotlight on RSAC AI Software Development Week Disaster Recovery Week Nvidia GTC Ransomware in Focus Cybersecurity Month VMware Explore Vendor Voice Vendor Voice Vendor Voice All Vendor Voice ZTE Nutanix: Scale Kubernetes. Not Chaos. Money Movement Hub The BigQuery Difference AWS Global Partner Security Initiative Amazon Web Services (AWS) New Horizon in Cloud Computing (X) Resources Resources Whitepapers Webinars & Events Newsletters [front] Software 74 comment bubble on white Another open source project dies of neglect, leaving thousands scrambling 74 comment bubble on white Paying Ingress NGINX maintainers for their work might have avoided this outcome icon Steven J. Vaughan-Nichols Tue 2 Dec 2025 // 09:30 UTC # Opinion There were lots of announcements about Kubernetes at KubeCon North America in Atlanta. I should know, I was there from beginning to end. But the biggest Kubernetes story of all didn't get much attention. Kubernetes is retiring its popular Ingress NGINX controller. Ingress NGINX goes to that big bit farm in the sky in March 2026. After that, "there will be no further releases, no bugfixes, and no updates to resolve any security vulnerabilities that may be discovered." Ingress NGINX, for those who don't know it, is an ingress controller in Kubernetes clusters that manages and routes external HTTP and HTTPS traffic to the cluster's internal services based on configurable Ingress rules. It acts as a reverse proxy, ensuring that requests from clients outside the cluster are forwarded to the correct backend services within the cluster according to path, domain, and TLS configuration. As such, it's vital for network traffic management and load balancing. You know, the important stuff. Now this longstanding project, once celebrated for its flexibility and breadth of features, will soon be "abandonware." So what? After all, it won't be the first time a once-popular program shuffled off the stage. Off the top of my head, dBase, Lotus 1-2-3, and VisiCalc spring to my mind. [front] What's different is that there are still thousands of Ingress NGINX controllers in use. [front] [front] Why is it being put down, then, if it's so popular? Well, there is a good reason. As Tabitha Sable, a staff engineer at Datadog who is also co-chair of the Kubernetes special interest group for security, pointed out: "Ingress NGINX has always struggled with insufficient or barely sufficient maintainership. For years, the project has had only one or two people doing development work, on their own time, after work hours, and on weekends. Last year, the Ingress NGINX maintainers announced their plans to wind down Ingress NGINX and develop a replacement controller together with the Gateway API community. Unfortunately, even that announcement failed to generate additional interest in helping maintain Ingress NGINX or develop InGate to replace it." The final nail in the coffin was when security company Wix found a killer Ingress NGINX security hole. How bad was it? Wix declared: "Exploiting this flaw allows an attacker to execute arbitrary code and access all cluster secrets across namespaces, which could lead to complete cluster takeover." [front] What's upsetting people is, as one Reddit Kubernetes user cried: " Retirement of a service of this magnitude should be at minimum of a year. Hell, it's going to take longer than four months to get all the documentation rewritten." He's not wrong. However, Kubernetes maintainer Tim Hockin replied: "I understand your feelings here. But I am going to ask you once to please drop the entitlement. The people who currently work on ingress-nginx do so FOR FREE. They have been doing it largely because they feel a sense of duty. They do not need to be berated. In the two years this has been a topic, almost nobody has stepped up to help. There are no new maintainers in the pipeline. Shuttering this project is necessary." He's right too. You see, the real problem isn't that Ingress NGINX has a major security problem. Heck, hardly a month goes by without another stop-the-presses Windows bug being uncovered. No, the real issue is that here we have yet another example of a mission-critical open source program no one pays to support. * Why Elon Musk won't ever realize the shareholder-approved Tesla payout * Canonical CEO says no to IPO in current volatile market * The Chinese Box and Turing Test: AI has no intelligence at all * We're all going to be paying AI's Godzilla-sized power bills William Morgan, CEO of Buoyant, creators of Linkerd, nailed it in his LinkedIn post: "The CNCF ecosystem does not really allow for volunteer work. This community has a very specific relationship to open source, and it's one of consumption, not contribution." This is no way for a corporate community to work with open source. Morgan has two proposed solutions: "1. Be funded by a company that is making money by directly selling the project, e.g., Buoyant selling Linkerd. 2. Be funded by a company that is making money by indirectly selling the project, e.g., Google funding Kubernetes to sell GCP." The bottom-line answer is simple: "Pay the maintainers." [front] This is not a unique problem. Just take the kerfuffle between FFmpeg's volunteer developers and Google. There, the maintainers and programmers are being buried by demands for security fixes that no one is paying for. Now, some of you may be wondering what the big deal is. Most of you have probably never heard of FFmpeg. That's a pity because every last one of you reading this article has used this program today. It's the video format converter that all of you use to watch videos on all web browsers, all video streaming services, and televisions. It's everywhere, it's vital, and, at the moment, there's no organized support for its maintenance. This can't continue. We've all seen the xkcd cartoon of the entire internet depending on a single programmer in Nebraska. It's not a joke, it's reality, and that person is getting older, more tired, and, oh yeah, he'd like to make a living too. It's time for open source consumers to get serious about paying open source builders. If we don't, you can kiss the open source free ride goodbye. (r) Get our Tech Resources # Share More about * FOSS * Open Source * Software More like these x More about * FOSS * Open Source * Software Narrower topics * AdBlock Plus * App * Application Delivery Controller * Audacity * Confluence * Database * Digital Public Goods * FOSDEM * Grab * Graphics Interchange Format * IDE * Image compression * Jenkins * Legacy Technology * LibreOffice * Linux * Map * Microsoft 365 * Microsoft Office * Microsoft Teams * Mobile Device Management * MySQL * One Way Forward * OpenInfra * OpenOffice * OpenStack * Programming Language * Proxmox * QR code * Retro computing * Search Engine * Software bug * Software License * Text Editor * User interface * Visual Studio * Visual Studio Code * WebAssembly * Web Browser * Wikipedia * WordPress * WPF Broader topics * Richard Stallman More about # Share 74 comment bubble on white COMMENTS More about * FOSS * Open Source * Software More like these x More about * FOSS * Open Source * Software Narrower topics * AdBlock Plus * App * Application Delivery Controller * Audacity * Confluence * Database * Digital Public Goods * FOSDEM * Grab * Graphics Interchange Format * IDE * Image compression * Jenkins * Legacy Technology * LibreOffice * Linux * Map * Microsoft 365 * Microsoft Office * Microsoft Teams * Mobile Device Management * MySQL * One Way Forward * OpenInfra * OpenOffice * OpenStack * Programming Language * Proxmox * QR code * Retro computing * Search Engine * Software bug * Software License * Text Editor * User interface * Visual Studio * Visual Studio Code * WebAssembly * Web Browser * Wikipedia * WordPress * WPF Broader topics * Richard Stallman TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like AWS admits AI coding tools cause problems, reckons its three new agents fix 'em Re:Invent Autonomous AI triages DevOps issues and pushes code to repositories, while checking security. AWS Re:invent2 Dec 2025 | Two Android 0-day bugs disclosed and fixed, plus 105 more to patch Christmas comes early for attackers this year Patches2 Dec 2025 | 2 NASA nominee 'committed' to uprooting Shuttle Discovery for Houston trophy piece Isaacman backs Texas relocation amid warnings that costs could top $150M Public Sector2 Dec 2025 | 19 Bring complexity under control with enterprise-grade Kubernetes No, it'll probably never be a doddle - but you don't have to take the hard way when deploying Kubernetes, says Nutanix Sponsored Feature [front] University of Pennsylvania joins list of victims from Clop's Oracle EBS raid Ivy League school warns more than 1,400 people after attackers siphon data via zero-day Cyber-crime2 Dec 2025 | 1 Microsoft mops up Mesh after another metaverse misfire Dreams of a virtual world linger on in Teams Software2 Dec 2025 | 4 HPE backs AMD's Helios AI rack with Juniper's scale-up switch Hardware bundle ties next-gen accelerators to an Ethernet fabric arriving in 2026 The Future of the Datacenter2 Dec 2025 | Apple swaps one ex-Google AI chief for another Amar Subramanya spent mere months at Microsoft before replacing John Giannandrea AI + ML2 Dec 2025 | 2 MongoDB talks up its AI chops by talking down PostgreSQL CEO touts win from 'super-high growth' customer that couldn't scale on rival system Databases2 Dec 2025 | 5 French AI shop Mistral rolls out full suite of Apache-licensed models Lineup spans 3B to 14B parameters, from edge devices to multi-GPU rigs AI + ML2 Dec 2025 | 1 Europol nukes Cryptomixer laundering hub, seizing EUR25M in Bitcoin Operation Olympia pulls Swiss servers offline and scoops up 12TB of data in latest crime infrastructure crackdown Cyber-crime2 Dec 2025 | 3 AWS joins Microsoft, Google in the security AI agent race Re:Invent Preview tool promises quicker reviews and faster flaw-finding for cloud apps AWS Re:invent2 Dec 2025 | 1 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * Ts & Cs * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2025 no-js