What Silently Breaks When You Migrate from Ingress NGINX to HAProxy
Introduction ingress-nginx was retired in March 2026. There are no more releases and no more security patches. It routes traffic into roughly half of all Kubernetes clusters, which makes this a problem for a lot of teams. Installing a retired project is still completely silent. I tried it last week and got no warning at any step. Most migration guides treat this as an annotation mapping exercise. But the real problem is not the annotations. It is everything that keeps working afterwards while quietly doing the wrong thing. The environment Everything below was tested on a single-node cluster: Ubuntu 26.04 LTS (kernel 7.0.0-31) k3s v1.36.4+k3s1 Helm v3.21.4 HAProxy 3.2.9 (host, LTS branch) ingress-nginx chart 4.15.1 / app 1.15.1 (retired March 2026) HAProxy Kubernetes Ingress Controller (HAProxy 3.2.23) Traffic path: Cloudflare (proxied) → HAProxy on the host → ingress controller → pod. This is the chain I run in production, so it is the one I tested. Many teams run something close to this, with a CDN in front and a proxy on the host. Step 1: Installing a retired project produces no warning bash helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx helm repo update helm install ingress-nginx ingress-nginx/ingress-nginx \ --namespace ingress-nginx --create-namespace \ --set controller.service.type=NodePort \ --set controller.service.nodePorts.http=30080 \ --set controller.service.nodePorts.https=30443 NAME: ingress-nginx STATUS: deployed REVISION: 1 The chart repository still answers, the install succeeds, and no step mentions that the project is over. Automation makes this worse: a pipeline that installs this chart keeps working, and nobody reads the output anyway. Step 2: Three layers, three wrong IPs The test application is traefik/whoami , which prints the IP it sees and every header it receives. Request from an external machine, through Cloudflare: RemoteAddr: 10.42.0.6:36848 Cf-Connecting-Ip: 203.0.113.5 X-Forwarded-For: 10.42.0.1 X-Real-Ip: 10.4