Trade the Ingress-NGINX Retirement for up to 2 years of RKE2 support & stability

You’ve likely seen the announcement: Ingress-NGINX will retire after March 2026. Nothing will suddenly stop working on that date, but the security profile changes meaningfully: No new bug fixes and no security patches from upstream. Keeping unmaintained software at the edge of your production environment creates a compliance risk that grows every day. This is where SUSE will ensure continuity for its customers. Our job is to help you reduce risk, keep audits clean and transition without drama.

A clear planning anchor: RKE2 v1.35 support through December 2027

RKE2 supports both ingress-nginx and Traefik, and your teams can choose either per cluster. That flexibility matters, because estates differ: Some are bound by strict change windows and regulatory controls; others can move quickly if the path is clear. 

For organizations that must hold steady in the near term, we’ll help you stabilize what you have: RKE2 v1.35 targeted for release shortly after upstream is due in December 2025 and will give SUSE Rancher Prime LTS customers support for up to 24 months . That’s a practical timeline you can plan against.That means hardened baselines, continuous CVE monitoring on ingress-nginx with documented mitigations. The focus for us is simple: Keep your SLAs intact whilst allowing you to plan the next step.

A compatible path to Traefik (when you’re ready)

For organizations ready to move, we offer a path to Traefik. Where your configuration fits common patterns, we can lean on Ingress-NGINX provider  to reduce changes and cut risk. Where you’ve accumulated bespoke annotations or advanced behaviours like TLS passthrough, mutual TLS, rate limiting or custom authentication, our consulting services team can help you scope the differences, pilot safely and stage a controlled cutover. Coincidentally, switching to Traefik allows customers to start their journey to the Gateway API (more to come on this soon). 

“The retirement of Ingress-NGINX presents a clear inflection point for the Kubernetes community.” said Emile Vauge, founder and CTO, Traefik Labs. ”Our focus at Traefik Labs has been to eliminate migration risk, and we’re proud that Traefik is the only true drop-in replacement with its native NGINX compatibility approach. This seamless path, combined with SUSE’s extended RKE2 support, means teams can move confidently and securely at their own pace, transforming this retirement deadline into an immediate mitigation, and an opportunity for platform modernization with Gateway API on a longer term.”

Immediate next steps:

Navigating this transition requires a calculated approach to ensure business continuity. We recommend the following steps to minimize disruption:

• Audit your environment: Identify exactly where Ingress-NGINX is currently deployed and map out the specific annotations and features your applications rely on.
• Align on strategy with SUSE: Consult with our team to review your infrastructure and define a timeline that works for you. Whether that means stabilizing immediately, migrating when feasible, or running both tracks in parallel.
• Validate via pilot: Deploy Traefik in a non-production environment to confirm behavioral parity with your existing setup and ensure you have a tested rollback plan in place.

From there, you can sequence change windows that fit your business calendar and compliance obligations, while remaining confident in the knowledge that RKE2 v1.35’s support through November 2027 gives you the time to do it right.

Useful references

• RKE2 ingress controller options (operating ingress-NGINXand Traefik): https://documentation.suse.com/cloudnative/rke2/latest/en/networking/networking_services.html
• Traefik’s guidance on transitioning from ingress-nginx:
  • Reference Docs: https://doc.traefik.io/traefik/reference/routing-configuration/kubernetes/ingress-nginx/
  • Blog posts:
    • Introducing Traefik Ingress-NGINX Provider: https://traefik.io/blog/transition-from-ingress-nginx-to-traefik 
    • Phased Migration Approach with Traefik:  https://traefik.io/blog/migrate-from-ingress-nginx-to-traefik-now

Retirements like this don’t have to be disruptive. With the right assessment, the support of SUSE and a measured approach you can keep risk down and momentum up. If you want help getting a plan on paper or you’re ready to begin a pilot, reach out to your SUSE team . We’ll meet you where you are and make sure your ingress story stays secure, compliant, and unexciting in all the best ways.