Migrating from NGINX Ingress

NGINX Ingress Controller retired in March 2026 — no more releases, bugfixes, or security patches. Calico Ingress Gateway, powered by Envoy Gateway, is the recommended replacement.

This migration tool converts your NGINX Ingress resources (including annotations) into Gateway API equivalents and generates a personalised migration playbook.

What it converts

• Structural Ingress fields — hosts, paths, TLS, backends → Gateway, HTTPRoute, ReferenceGrant
• NGINX annotations — CORS, timeouts, rate limiting, auth, session affinity, rewrites, and 130+ more → SecurityPolicy, BackendTrafficPolicy, ClientTrafficPolicy
• Supports both NGINX controllers — community (nginx.ingress.kubernetes.io/*) and NGINX Inc/F5 (nginx.org/*, nginx.com/*)

Annotations that can't be auto-converted are flagged with "think in Envoy terms" guidance explaining how to achieve the same behavior in Envoy Gateway.

Try it now

Paste your NGINX Ingress YAML below to generate a conversion and migration playbook — everything runs in your browser, nothing is sent to a server.

Ingress YAML

Auto-detect providerNGINX Ingress (community)NGINX Inc (F5)Try an example...Simple (TLS + redirect)Full-featured (CORS, auth, rate limit)NGINX Inc — SimpleMulti-service (2 namespaces)or

Migration playbook

The converter generates a 6-section playbook tailored to your resources:

1. Pre-Migration Assessment — what you have, what you'll get, what needs manual attention
2. Prepare — install Envoy Gateway, review and apply converted resources
3. Verify (Parallel Running) — test routes through Envoy Gateway without disrupting NGINX traffic
4. Traffic Shift — DNS-based, weighted, or canary strategies with rollback instructions
5. Cleanup — remove Ingress resources and NGINX controller
6. Post-Migration — explore Gateway API features, set up observability

Need help?

For complex migrations (hundreds of Ingress resources, custom NGINX snippets, mTLS, NGINX Plus features), talk to a Tigera engineer.