#ingressnginx — Public Fediverse posts

Как reload ingress-nginx уронил прод. История про pids.max, threads-max и виртуалку, которая подросла

Схема входящего траффика в кластер Kubernetes простая: web → Envoy Gateway → Ingress Nginx → backend . За Ingress Nginx, помимо обычного HTTP, живут долгоживущие WebSocket-соединения. Штатная нагрузка - около 100 RPS. Ничего экзотического. В один прекрасный день всё в кластере легло. Клиенты получают 503/500. В логах Envoy - флаг UF и upstream_reset_before_response_started{connection_timeout} . То есть ingress-nginx просто перестал отвечать. Дальше - два часа разбора и довольно красивая цепочка причин, которая началась с банального reload, а закончилась на том, как ядро считает лимит потоков при старте виртуалки.

https://habr.com/ru/articles/1050478/

#kubernetes #ingressnginx #postmortem #threadsmax #pidsmax #systemd #websocket #sre

"A lot of organizations aren't going to shift away from it -- even though it's got known vulnerabilities that are being exploited -- for the same reason they didn't shut it off two or three years ago, which is that it worked two or three years ago, and it still works now. Replacing it with another technology means all your APIs need to communicate correctly. The CRDs there need to be reliable.

"[Some users] could be told today that something is incredibly insecure, it's likely to be compromised, and ignore that, and say, 'But it still works at the end of the day.' That's a serious problem." ~ Nigel Douglas, head of developer relations at #CNCF member company Cloudsmith and a former contributor to the Falco CNCF project, in an interview this week about the retirement of the #IngressNginx project and its potential impact on users who might remain unaware that the project is no longer receiving community support, including security patches, following its final release March 13.

My writeup on the discussions during #KubeConEU this week: https://www.techtarget.com/searchitoperations/news/366640683/CNCF-Ingress-Nginx-retirement-could-leave-some-users-at-risk

Kubernetes networking is evolving 🌐 with the rise of the Gateway API, offering more flexible and extensible traffic management.

CrowdSec continues to support Ingress-NGINX during its final lifecycle, while helping users migrate to modern ingress controllers like Traefik and HAProxy, or Gateway API integrations, for future-proof security 🔒.

Read our latest article for details: https://www.crowdsec.net/blog/crowdsec-support-kubernetes-ingress-nginx

#Kubernetes #IngressNGINX #GatewayAPI

Ingress NGINX Retirement

- Best-effort maintenance will continue until March 2026.
- Afterward, there will be no further releases, no bugfixes, and no updates to resolve any security vulnerabilities that may be discovered.
- Existing deployments of Ingress NGINX will not be broken.
- Existing project artifacts such as Helm charts and container images will remain available.

https://github.com/kubernetes/ingress-nginx

#kubernetes #IngressNGINX

Shit hit the fan a couple of days ago, when the #ingressnginx team announced that they're retiring the project. Ingress NGINX has been my #Kubernetes #ingress controller of choice since forever, and this came a quite a shock.

Right now, it looks like the #Traefik ingress controller is the most viable choice for an easy plug-in replacement. I'm giving it a test run on my home cluster, which is running all sorts of weird things that make up a good technical test. #Jellyfin seems like it's working well with WebSockets and all, and raw TCP to Mosquitto is working well too.

Obviously this is rather low traffic, but it looks like this could be a future replacement on the #Midgaard cluster running https://mstdn.dk - no matter what, staying on a burning ingress controller is not an option.

https://www.kubernetes.dev/blog/2025/11/12/ingress-nginx-retirement/

#ingressnginxgate

#Kubernetes overlords decide #IngressNGINX isn’t worth saving
Maintenance to end next year after ‘helpful options’ became ‘serious security flaws’
#Ingress #NGINX is an ingress controller – a class of tool that allows external HTTP/S access to clusters and the applications they run.
While popular, the tool is also problematic.
In March 2025, researchers at Wiz found Ingress NGINX had serious #vulnerabilities that could allow complete takeover of Kubernetes clusters.
https://www.theregister.com/2025/11/14/nginx_retirement/

#IngressNginx will be retiring in March 2026 😰

We knew it was coming! One year ago we learned that it was in maintenance mode.

KubeCon NA 24 (November) - Securing the Future of Ingress-Nginx: https://www.youtube.com/watch?v=KLwsV6_DntA

Still surprising:
* It will be retiring in only 4 months
* There won't be a successor, instead #ingate will be retiring, too 🤯

Now is the time to choose a new ingress controller and make migrations plans.

Which one will become the new de-facto standard?

Как работает ingress-nginx: нырнем еще глубже. Часть 2 — балансировка

В первой части мы разобрались с принципами работы Ingress-nginx контроллера . Теперь пришло время углубиться в то, как в Ingress-nginx устроен механизм обновления бэкендов и как реализована балансировка нагрузки на примере sticky sessions . Готовы узнать больше? Поехали! Напомню, если вдруг забыли, эта статья написана по мотивам выступления на DevOpsConf’25, а меня зовут Алексей Колосков, я Lead DevOps из Hilbert Team. Итак, рассмотрим, как реализовано обновление бэкендов в самом контроллере.

https://habr.com/ru/companies/oleg-bunin/articles/924512/

#ingress #ingressnginx #ingressконтроллер #lua #luanginxmodule #k8s #kubernetes

Как работает ingress-nginx: нырнем поглубже. Часть 1 — basics

Наверняка вы все работаете с Kubernetes, публикуете сервисы наружу через Ingress-контроллер. Уверен, что большинство из вас использует ingress-nginx. Создаете манифест, деплоите его в k8s, но не всегда получаете именно тот результат, который хотели бы. Или же все работает, но спустя какое-то время что-то идет не так. В этой серии статей, созданной по мотивам выступления на DevOpsConf’25, мы подробно разберемся как работает сам ingress-nginx контроллер и почему это не совсем классический nginx. Погрузимся в дебри LUA-кода чтобы понять, как реализована балансировка. А также затронем тему сниппетов, как их включить если они вам очень нужны, и почему этого делать не стоит. Меня зовут Алексей Колосков , я Lead DevOps из Hilbert Team . Больше 15 лет я в IT: за это время админил, разрабатывал, развивал on-premise инфраструктуру, инфраструктуру в облаках и даже курсы по DevOps, Security и DataTech в Yandex Cloud. Hilbert Team — провайдер IT-решений для крупного и среднего бизнеса в области облачных технологий, DevOps, DevSecOps, DataOps, MLOps и FinOps. Партнёр Yandex Cloud со специализацией Yandex Cloud Professional по направлениям DevOps и Data Platform.

https://habr.com/ru/companies/oleg-bunin/articles/923918/

#ingress #ingressnginx #luanginxmodule #lua #ingressконтроллер #k8s #kubernetes

Well, this one was unexpected: https://github.com/tarampampam/error-pages/discussions/336

I just discovered that some of my services were open to the internet, thanks to the default-backend for my ingress-nginx changing the status codes when switching from v2 to v3 of the backend container…

It's not really a vulnerability, but somehow a security issue for potentially more people. My monitoring caught it, but I didn't really understand until I looked deeper into it.

#IngressNginx #kubernetes #errorPages

Just started again playing with #Kubernetes and #ingressnginx a few days ago - now I've fun with CVE-2025-1974
Yay...

9.8 Critical Vulnerabilities in Ingress Nginx

https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities

#HackerNews #CriticalVulnerabilities #IngressNginx #Kubernetes #Security #CyberSecurity #WizBlog

Multiple vulnerabilities in ingress-Nginx (Score 9.8)

https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ

#HackerNews #ingressNginx #vulnerabilities #security #Kubernetes #9.8 #CVE

Heads up #ingressNginx users!

Controller version 1.12 / chart 4.12, contains breaking changes.

Even though a minor release, one change blocks risky annotations like the 'snippet' annotations.

These are often used to block access to specific URLs, like /metrics.

An insecure workaround is to allow these annotations via values.yaml:

```
allowSnippetAnnotations: true
config:
annotations-risk-level: Critical
```

A more secure alternative would be to get rid of the annotation.

Got #MiniKube with the #MetalLB and #Ingress plugins, all good. However, I literally cannot figure out how to access my charts, containing #ClusterIP services with ingresses. If anyone has any ideas as to what I could try, all ears!

Tried through tunnel, mapped the Minikube IP to the domain in /etc/hosts, MetalLB is configured to a free IP subrange of the MK address.

Tried using #KVM but #Podman as well, rootless and not. Nothing seems to work.

#K8S #Kubernetes #DevOps #K3S #Helm #HelmChart #KubernetesHelm #IngressNginx #NGINX

Does anyone have any experience using #k3s on #Hetzner's #HetznerCloud? Trying to use #NGINX as an #ingress with #IngressNginx but I keep getting a 403 from registry.k8s.io when pulling the images and I cannot figure out why.

#K8S #Kubernetes #Rancher #DevOps #Cloud

I‘m not sure if I should be happy that https://github.com/compumike/hairpin-proxy is the solution to my problem, or that it needs to be the solution because the underlying issue isn’t fixed by default in #k8s it’s not a super edgy edge case to have a #LoadBalancer set up using #ProxyProtocol and using #CertManager with #IngressNginx

#truenas metrics -> #ingressnginx #kubernetes -> #graphite -> #grafana