Why Half of All Kubernetes Clusters Are About to Become Vulnerable | Kat Cosgrove & Tabitha Sable

Why It Matters

Without a maintained ingress controller, Kubernetes workloads become a low‑hanging fruit for attackers, threatening data integrity and service continuity; proactive migration and open‑source investment are essential to safeguard business operations.

Key Takeaways

• Ingress NGINX support ends March, leaving no patches.
• Approximately 50% of Kubernetes clusters rely on Ingress NGINX.
• Migration to Gateway API or third‑party controllers is urgent.
• Lack of maintainers creates unpatchable critical security vulnerabilities.
• Contributing to open source now part of security strategy.

Summary

The Kubernetes Steering Committee announced that the Ingress NGINX controller – a core ingress solution for roughly half of cloud‑native deployments – will be officially retired at the end of March, six weeks from the announcement. After that date the project will receive no further bug fixes or security patches, leaving any remaining installations exposed.

Because Ingress NGINX powers traffic entry for about 50 % of production clusters, the shutdown creates an immediate security emergency. Existing deployments will keep running, but any newly discovered vulnerability will remain unpatched. The controller’s extensive configurability, driven by dozens of annotations, makes migration non‑trivial, especially for large enterprises that have heavily customized setups.

The speakers highlighted recent CVE‑2025‑1974 as a concrete example: a configuration‑injection flaw could grant an attacker namespace‑level secrets or, in poorly hardened clusters, full cluster‑admin rights. They also pointed to the community‑built Ingress2Gateway tool and the maturing Gateway API as practical pathways for migration, while stressing that third‑party ingress controllers are now listed in the official docs.

Businesses must begin migration immediately to avoid a potential breach that could compromise data, disrupt services, or even erase production environments. The episode also underscores a broader lesson: contributing resources to critical open‑source projects is no longer a moral choice but a core component of an organization’s security posture.

Original Description

A critical piece of infrastructure that half of all cloud-native environments rely on is being retired in just six weeks, and if you don't migrate now, you could be leaving your systems wide open to attacks. Kubernetes Ingress NGINX is being shut down due to a lack of maintainers, and roughly 50% of production Kubernetes deployments could be affected. This isn't just an inconvenience—it's a serious security emergency.

Kat Cosgrove from the Kubernetes Steering Committee and Tabitha Sable from the Kubernetes Security Response Committee break down what went wrong, your migration options, and how to protect your infrastructure before time runs out. Learn why Gateway API is the future, what can happen if you don't migrate, and why this is a wake-up call for how we maintain critical open source infrastructure.

Read the full story at www.tfir.io

#Kubernetes #CloudNative #CyberSecurity #OpenSource #DevSecOps #IngressNginx #GatewayAPI #CNCF #CloudSecurity #InfrastructureAsCode