The Ingress-NGINX Project Is Retiring. Here’s How SUSE Is Handling It for RKE2.

The upstream kubernetes/ingress-nginx project will officially retire after March 2026, and the community will stop issuing security patches. If you’re running RKE2, this matters to you. But it doesn’t have to be a fire drill.

SUSE has built a phased deprecation roadmap that gives both Prime customers and community users a clear, supported path from ingress-nginx to Traefik. The transition includes continued CVE backports for Prime, a shim-based migration layer designed for near-zero downtime, and Rancher UI updates that make the switch straightforward for new clusters. This post walks through the timeline, the technical details, and what you need to do next.

SUSE Rancher Prime Customers Get Extended Coverage and a Longer Runway

For teams running SUSE Rancher Prime, the end of upstream ingress-nginx doesn’t mean the end of security coverage. SUSE will continue to maintain and backport critical and important CVEs for the ingress-nginx component across all versions up to and including RKE2 v1.36. If you’re on a Rancher Prime LTS release, that means up to 24 months of total support (18 months standard plus a 6-month LTS extension), and LTS Core customers get up to 60 months..

There will be a feature freeze on ingress-nginx after March 2026, so no new upstream enhancements will land in the component. But the security posture stays intact. Ingress-nginx images provided by SUSE after that date will be available exclusively through the Prime registry.

The bottom line for Prime customers is that you have time to plan, test, and migrate on your own schedule without sacrificing security.

A Phased Roadmap That Avoids Breaking Changes

The deprecation is structured to prevent surprises. Here’s how it rolls out for SUSE Rancher Prime customers:

Impact on Rancher open source community

For community RKE2 users, the timeline is more compressed. Traefik becomes the default at v1.36, ingress-nginx is available alongside it in that release, and it’s removed entirely in v1.37. The v1.36 release will include the final upstream patch for ingress-nginx, so you won’t hit immediate breaking changes during the upgrade.

Migration Is Designed Around Near-Zero Downtime

SUSE customers can make use of ingress-nginx shim translation layer developed by Traefik Labs. This approach is built to require almost zero downtime and available for both standalone clusters and downstream clusters managed through Rancher. SUSE provided guides are available for both standalone and downstream clusters.

• For RKE2 standalone

• For RKE2 standalone installing Rancher Manager

Starting with Rancher v2.13.5 and v2.14.0, the Rancher UI will preselect Traefik as the ingress controller for all new clusters provisioned through the GUI. These versions will also include a “dual mode” option specifically designed for testing and migrating traffic before you cut over completely. This only applies to clusters provisioned through Rancher, not standalone deployments.

RKE2 customers can already begin using Traefik today. Official support for Traefik as an ingress controller in RKE2 lands with v1.36.

Start Planning Your Migration Now

The timeline is generous, but the best time to start testing Traefik is before you need it in production. 

If you’re a Prime customer, make sure you are using the Prime Registry, review the migration guides (linked in the FAQ below) and  talk to your SUSE account team  about LTS coverage and migration timelines if needed. 

For teams that want hands-on help, SUSE Consulting offers outcome-focused engagements built for transitions like this. Whether you need an environment assessment, a migration plan tailored to your cluster topology, or a guided pilot, SUSE’s consulting team can accelerate the work and reduce the risk of doing it alone. Retirements like this don’t have to be disruptive. With the right assessment, the support of SUSE, and a measured approach, you can keep risk down and momentum up. 

Come see us at KubeCon EU in Amsterdam. 

Visit the SUSE booth, join our sessions, and experience firsthand what an AI-native cloud native platform can do for your organization.

For the latest updates, visit suse.com/kubecon and follow us on social media throughout the week.

SUSE Rancher Prime Customers: Answering the most common questions

• What exactly is retiring? Are all NGINX products going away?
  • No, these names sound similar but refer to different projects. Only the community-maintained ingress-nginx (kubernetes/ingress-nginx) is retiring.
  • The core NGINX web server and the official NGINX Ingress Controller from F5 are not retiring as far as we know.
• What does RKE2 support look like under Rancher Prime LTS?
  • We will provide security patches for critical and important CVEs for SUSE Rancher Prime RKE2 including the ingress-nginx component.
  • Note that after March 2026 there will be a feature freeze for the ingress-nginx component, meaning no new features or upstream enhancements will be added to the ingress-nginx component as part of RKE2.
  • Ingress-nginx images provided by SUSE after March 2026 are only available for Prime and LTS customers. They will reside in the Prime Registry.
• When can I start transitioning to Traefik?
  • RKE2 customers can already begin using Traefik.
  • SUSE will officially support traefik as an ingress controller in RKE2 v1.36 to ease the transition for our Prime customers.
• Is there a migration strategy or guide provided?
  • Yes, there is a supported migration path to Traefik utilizing an ingres-nginx shim translation layer. 
  • This approach is designed to require almost zero downtime, and guides are available for both standalone and downstream clusters.

• For RKE2 standalone KB

• For RKE2 standalone installing Rancher Manager KB

• What is the recommendation for managed Kubernetes services (EKS, AKS, GKE)?
  • The current recommendation is to migrate to Traefik.
  • Prime customers can leverage the benefits of the Application Collection, which includes Traefik.
• When will the Rancher UI fully support Traefik deployment?
  • Customers will need to wait until Rancher v2.13.5 and Rancher v2.14.0
  • These versions will feature a traefik option, as well as a ‘dual mode’ option, specifically designed for testing and migrating traffic.
• Will there be any impact on SUSE Security customers?
  • No impact is foreseen for SUSE Security customers.
• What about SUSE Virtualization and SUSE Storage customers?
  • No action required by SUSE Virtualization customers.
  • For SUSE Storage, there is no impact on the backend, though admins will have to reconfigure the ingress to upgrade the Longhorn UI. 
• Can we transition to another controller, like Cilium ingress, instead?
  • Customers are always at liberty to use any ingress controller they like.
  • However, please note that in support cases where an issue cannot be replicated on a supported configuration, support will ask you to revert to a supported set up.