Deprecating the Managed ingress-nginx Controller
We are deprecating the managed ingress-nginx controller in AME. It remains available when creating a new cluster, but the Console shows a deprecation warning before you enable it.
This is a security-driven change. The upstream Ingress NGINX project was retired in March 2026 and its repository was archived on 24 March 2026. It no longer receives releases, bug fixes, or security fixes. Existing deployments may continue to run, but they will not receive upstream fixes for newly discovered vulnerabilities. Read the upstream retirement announcement for background.
What changes and when
| When | Change |
|---|---|
| Now | ingress-nginx remains selectable for new clusters, with a deprecation warning. |
| For the next three months | AME continues to perform compatibility checks for the managed controller. |
| After that | The controller is customer-managed. AME will no longer test or validate its compatibility with new AME releases. |
The upstream project no longer provides fixes, so the three month compatibility period does not restore upstream security maintenance. We are preparing migration guidance, but you may migrate to and operate an ingress controller of your choice.
What you need to do
We are preparing migration guidance. You can also migrate to and operate an ingress controller of your choice. Until more guidance is available, start by assessing the ingress configuration your applications rely on. After the three-month compatibility period, you are responsible for maintaining the controller and verifying its compatibility with future AME releases.
Before you migrate, review your current setup:
- Identify every Ingress resource and the
nginx.ingress.kubernetes.ioannotations it uses. - Check any controller-level customisation, such as ConfigMaps, custom snippets, TCP or UDP services, and TLS settings.
- Plan how the replacement controller will receive traffic, including load balancer addresses, DNS records, certificates, and network policies.
- Test the replacement in a non-production cluster, then validate routing, redirects, authentication, TLS, client IP handling, and observability before switching DNS or traffic.
Ingress NGINX annotations are controller-specific, so a replacement is not necessarily a drop-in change. Treat a future migration as an application networking change and test the behaviour your workloads rely on. The Kubernetes Steering and Security Response Committees explain the urgency and point to replacement options in their Ingress NGINX retirement statement.
A future managed ingress option
Separately, we are exploring a future Avisi-managed ingress offering. This work is not available today, we will publish guidance for existing managed ingress-nginx installations separately.
Need help?
If your cluster uses the managed ingress-nginx controller, begin planning now. Contact AME support with questions about the deprecation.