Ingress-NGINX Deprecation: What to Do Next (Four Paths, Four Failure Modes)

On March 24, 2026, the kubernetes/ingress-nginx repository went read-only. No more patches. No more CVE fixes. No more releases of any kind. Half the Kubernetes clusters running in production today were routing traffic through it. The coverage that followed was immediate and mostly unhelpful — migration guides, controller comparisons, annotation checklists. All of it assumes you've already made the architectural decision. Most teams haven't. They're still looking at four realistic paths, each with a different cost structure and a different failure identity. We just watched this play out with VMware. Forced change exposes architectural assumptions most teams didn't know they had. The teams that fared worst weren't the ones who moved slowly — they were the ones who picked a direction before they understood how their choice would fail. That's what this post is about. Not which path to pick. How each path breaks. The Annotation Complexity Trap Comes First Before the four paths — one diagno