NGINX

We chose to use the existing certificates triggered by ingress-nginx via annotations: However, the certificates have an owner reference to the Ingress object. This means deleting an Ingress would cascade delete the Certificate and its Secret. Below one-liner, removes the ownerReference from all Certificates that reference an Ingress:

With ingress-nginx entering retirement, platform teams face a choice: keep a critical control-plane component without upstream maintenance, or move to an actively supported alternative. The Kubernetes community has aligned on the Gateway API as the long-term standard for traffic management. That direction shapes your two primary migration paths: Move to another ingress controller (such as Cilium Ingress, Traefik, or HAProxy Ingress). Adopt the Kubernetes Gateway API, the next-generation standard for ingress and traffic management, using a controller like Cilium Gateway API. Cilium offers both

Most teams start with Cilium Ingress to remove the maintenance risk immediately, then move to the Gateway API as their routing and organizational needs evolve. If your platform already separates infrastructure and application teams, Gateway API will feel natural from the start. If your environment is smaller or less complex, Cilium Ingress offers the fastest path to replace ingress-nginx with minimal change. A practical migration plan: Document current behaviour: Capture hosts, paths, TLS, health checks, and any NGINX annotations. Select a target: Choose Cilium Ingress for quick replacement,