[{"data":1,"prerenderedAt":326},["ShallowReactive",2],{"blog-en-k3s-ingress-gateway-api-migration-traefik-gap":3,"blog-related-en-k3s-ingress-gateway-api-migration-traefik-gap":274,"blog-en-k3s-ingress-gateway-api-migration-traefik-gap-alt":262},{"id":4,"title":5,"author":6,"body":7,"date":256,"description":257,"extension":258,"image":259,"locale":260,"meta":261,"navigation":262,"path":263,"seo":264,"stem":265,"tags":266,"__hash__":273},"blog\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap.md","Ingress Is Ending. We Migrated to Gateway API, and K3s's Traefik Only Got Us Halfway","Kubo Team",{"type":8,"value":9,"toc":245},"minimark",[10,15,27,36,45,52,56,65,68,74,78,102,105,112,118,122,134,152,160,166,170,177,183,187,200,203,209,213,216,223,236],[11,12,14],"h2",{"id":13},"why-ingress-to-gateway-api-matters-right-now","Why \"Ingress to Gateway API\" Matters Right Now",[16,17,18,19,26],"p",{},"If you've started looking into K3s Gateway API migration, you're not alone. In November 2025, Kubernetes SIG Network and the Security Response Committee announced that best-effort maintenance of Ingress NGINX would end in March 2026 (",[20,21,25],"a",{"href":22,"rel":23},"https:\u002F\u002Fkubernetes.io\u002Fblog\u002F2025\u002F11\u002F11\u002Fingress-Nginx-retirement\u002F",[24],"nofollow","Kubernetes official blog","). After that date, there will be no new releases, no bug fixes, and no security patches. Existing deployments won't stop working overnight, but deciding on a migration path now has become the pragmatic move.",[16,28,29,30,35],{},"The officially named successor is Gateway API. It reached General Availability in October 2023 and was positioned as the successor to Ingress (",[20,31,34],{"href":32,"rel":33},"https:\u002F\u002Fkubernetes.io\u002Fblog\u002F2023\u002F10\u002F31\u002Fgateway-api-ga\u002F",[24],"Kubernetes official blog: Gateway API GA","). Unlike the Ingress era, where behavior depended on vendor-specific annotations, features like weighted routing and role separation are built directly into the API specification.",[16,37,38,39,44],{},"K3s users have one thing going for them: Traefik ships by default. It's tempting to assume that \"a K3s cluster running Traefik is already Gateway API-ready.\" Hands-on experience shows it isn't that simple. Whether you keep chasing these networking spec changes manually, or hand that burden to a managed K3s offering like ",[20,40,43],{"href":41,"rel":42},"https:\u002F\u002Fkubo.hexabase.io\u002F",[24],"Kubo",", is a question worth sitting with by the end of this article.",[16,46,47],{},[48,49],"img",{"alt":50,"src":51},"section01","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap\u002Fsection01.webp",[11,53,55],{"id":54},"the-myth-that-k3ss-built-in-traefik-is-already-migrated","The Myth That K3s's Built-in Traefik Is \"Already Migrated\"",[16,57,58,59,64],{},"Here's the short version: having Traefik installed in K3s doesn't mean Gateway API is ready to use. Traefik's official documentation states that using Gateway API requires separately installing the Gateway API CRDs (from the standard channel) plus Traefik's RBAC configuration (",[20,60,63],{"href":61,"rel":62},"https:\u002F\u002Fdoc.traefik.io\u002Ftraefik\u002Fv3.5\u002Freference\u002Finstall-configuration\u002Fproviders\u002Fkubernetes\u002Fkubernetes-gateway\u002F",[24],"Traefik official documentation","). If you installed Traefik via its Helm chart, CRDs and RBAC are managed automatically — but K3s's built-in Traefik (the simplified, non-Helm-managed setup) doesn't give you that for free.",[16,66,67],{},"In other words, there's a real gap between \"Traefik supports Gateway API\" and \"Gateway API works out of the box on K3s\": the CRD installation step. Many teams hit this first, seeing errors like \"no GatewayClass exists\" or \"the Gateway resource never reaches Programmed.\"",[16,69,70],{},[48,71],{"alt":72,"src":73},"section02","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap\u002Fsection02.webp",[11,75,77],{"id":76},"what-happened-when-we-upgraded-k3s-traefik-v40s-breaking-change","What Happened When We Upgraded K3s — Traefik v40's Breaking Change",[16,79,80,81,86,87,91,92,95,96,101],{},"There's a second practical trap. K3s's 1.36 line bumped the Traefik Helm chart to the v40 series, and the latest v1.36.5+k3s1 ships Traefik 3.7.13 (",[20,82,85],{"href":83,"rel":84},"https:\u002F\u002Fdocumentation.suse.com\u002Fcloudnative\u002Fk3s\u002Flatest\u002Fes\u002Frelease-notes\u002Fv1.36.X.html",[24],"SUSE official documentation: K3s v1.36 release notes","). Chart v40.0.0 includes a breaking change tied to the ingress-nginx migration path: the provider name changed from ",[88,89,90],"code",{},"kubernetesIngressNginx"," to ",[88,93,94],{},"kubernetesIngressNGINX"," (",[20,97,100],{"href":98,"rel":99},"https:\u002F\u002Fgithub.com\u002Ftraefik\u002Ftraefik-helm-chart\u002Freleases\u002Ftag\u002Fv40.0.0",[24],"Traefik Helm Chart v40.0.0 release notes",").",[16,103,104],{},"If your environment translates ingress-nginx annotations for Traefik, this single upgrade can produce a scenario where \"nothing in your config changed, but routing silently breaks one day.\" Because the timing of a Gateway API migration often coincides with a K3s version bump, the two need to be planned together rather than treated as separate projects.",[16,106,107,108,111],{},"Chasing down breaking changes buried in minor version bumps, one by one, is a quietly exhausting job for an infrastructure team. ",[20,109,43],{"href":41,"rel":110},[24],"'s AI-Driven Deployment lets you issue deployment instructions in natural language with these version-to-version differences already accounted for, while Captain UI keeps the actual changes visible.",[16,113,114],{},[48,115],{"alt":116,"src":117},"section03","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap\u002Fsection03.webp",[11,119,121],{"id":120},"canary-releases-dont-carry-over-the-way-they-did-under-ingress","Canary Releases Don't Carry Over the Way They Did Under Ingress",[16,123,124,125,128,129,101],{},"Teams running canary releases through Ingress NGINX annotations (like ",[88,126,127],{},"canary-weight",") hit another stumbling block during Gateway API migration. HTTPRoute supports weighted routing natively as part of the spec, but it's a fundamentally different way of writing things than Ingress annotations. Datadog's engineering blog makes the same point: Gateway API \"moves configuration out of custom annotations and into core resources\" like HTTPRoute, which is exactly why existing annotation-based setups can't be converted one-to-one (",[20,130,133],{"href":131,"rel":132},"https:\u002F\u002Fwww.datadoghq.com\u002Fblog\u002Fmigrate-to-gateway-api\u002F",[24],"Datadog official blog",[16,135,136,137,140,141,146,147,101],{},"There's also a K3s\u002FTraefik-specific wrinkle: Traefik has long had its own ",[88,138,139],{},"TraefikService"," CRD, predating Gateway API, for weighted load balancing and mirroring (",[20,142,145],{"href":143,"rel":144},"https:\u002F\u002Fdoc.traefik.io\u002Ftraefik\u002Freference\u002Frouting-configuration\u002Fkubernetes\u002Fcrd\u002Fhttp\u002Ftraefikservice\u002F",[24],"Traefik official documentation: TraefikService","). Progressive delivery tools like Argo Rollouts integrate with TraefikService to automatically adjust canary weights (",[20,148,151],{"href":149,"rel":150},"https:\u002F\u002Fargo-rollouts.readthedocs.io\u002Fen\u002Flatest\u002Ffeatures\u002Ftraffic-management\u002Ftraefik\u002F",[24],"Argo Rollouts official documentation",[16,153,154,155,159],{},"What actually happens is this: your existing canary setup runs on the combination of TraefikService and IngressRoute (Traefik's own CRDs), but migrating to Gateway API means rewriting it against a different object model — HTTPRoute. Gateway API isn't missing a feature here; ",[156,157,158],"strong",{},"the type of resource you need to replace simply changes",", and that's the part worth planning for.",[16,161,162],{},[48,163],{"alt":164,"src":165},"section04","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap\u002Fsection04.webp",[11,167,169],{"id":168},"keeping-cert-manager-certificate-renewal-in-sync","Keeping cert-manager Certificate Renewal in Sync",[16,171,172,173,176],{},"If you're running cert-manager on K3s, we've covered before on this blog how ServiceLB can steal the port needed for the HTTP-01 challenge, stalling automatic certificate renewal. Switching routing over to Gateway API changes which resource triggers certificate issuance — from Ingress to HTTPRoute\u002FGateway — so you need to re-verify which resource your cert-manager ",[88,174,175],{},"Certificate"," is actually watching during the migration. While Ingress and HTTPRoute run in parallel, TLS settings often end up applied to only one of them, leaving the newer route without working TLS.",[16,178,179,182],{},[20,180,43],{"href":41,"rel":181},[24]," ships cert-manager plus Let's Encrypt as standard, alongside Prometheus and Grafana monitoring, with this kind of certificate-consistency checking already built into day-to-day operations.",[11,184,186],{"id":185},"migrate-in-parallel-not-all-at-once","Migrate in Parallel, Not All at Once",[16,188,189,190,193,194,199],{},"Kong's migration guide recommends not finishing the Ingress-to-Gateway-API move in one shot, but moving in stages instead. Concretely: use a tool like ingress2gateway to convert existing Ingress manifests into Gateway\u002FHTTPRoute resources, confirm the new Gateway reaches the ",[88,191,192],{},"Programmed"," condition, and then cut over a subset of resources at a time (",[20,195,198],{"href":196,"rel":197},"https:\u002F\u002Fdeveloper.konghq.com\u002Fkubernetes-ingress-controller\u002Fmigrate\u002Fingress-to-gateway\u002F",[24],"Kong official migration guide","). The advice to verify incrementally rather than delete everything at once applies just as much in a K3s environment.",[16,201,202],{},"On K3s, there's an added wrinkle: K3s version upgrades and Traefik version upgrades move together. A realistic sequence looks like: (1) confirm your current K3s\u002FTraefik version and the corresponding Gateway API version, (2) install the Gateway API CRDs and RBAC, (3) convert a subset of Ingress resources to HTTPRoute and run them in parallel, and (4) finish verifying canary and certificate behavior before cutting over in stages.",[16,204,205],{},[48,206],{"alt":207,"src":208},"section05","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap\u002Fsection05.webp",[11,210,212],{"id":211},"summary","Summary",[16,214,215],{},"Because K3s ships with Traefik by default, it's easy to assume the move to Gateway API will be just as easy. In practice, there are several K3s-specific issues to work through: installing additional CRDs, breaking changes to Traefik that come bundled with K3s version bumps, a different object model for canary releases, and keeping certificate-issuance resources in sync. With the Ingress-nginx retirement forcing the timeline, now is the moment to get ahead of these pitfalls.",[16,217,218,219,222],{},"Managing this kind of migration — and keeping up with K3s version changes in general — by hand is no small burden for an infrastructure team. ",[20,220,43],{"href":41,"rel":221},[24]," is a managed Kubernetes service built on K3s; its AI-Driven Deployment and Captain UI let you push through configuration changes like this safely, using natural-language instructions and a visualized management console. It's worth considering as an option that keeps the full feature set of EKS\u002FAKS-grade Kubernetes while taking on the operational complexity for you.",[16,224,225,226,229,230,235],{},"Networking changes like a Gateway API migration carry real risk when you're experimenting directly in production. ",[20,227,43],{"href":41,"rel":228},[24]," runs on Pure Kubernetes and integrates GitOps (ArgoCD\u002FFlux) as standard, so even a staged rollout to HTTPRoute can live inside your existing Git-based workflow. If you want the full capability of Kubernetes while cutting K3s operating costs, ",[20,231,234],{"href":232,"rel":233},"https:\u002F\u002Fwww.hexabase.com\u002Fpricing\u002F",[24],"Kubo's pricing page"," has a cost comparison against AWS EKS and Azure AKS.",[16,237,238,239,244],{},"If you feel like you no longer have the bandwidth to track every K3s version detail and validate every networking change by hand, ",[20,240,243],{"href":241,"rel":242},"https:\u002F\u002Fwww.hexabase.com\u002Fcontact-us\u002F",[24],"get in touch"," about adopting Kubo.",{"title":246,"searchDepth":247,"depth":247,"links":248},"",2,[249,250,251,252,253,254,255],{"id":13,"depth":247,"text":14},{"id":54,"depth":247,"text":55},{"id":76,"depth":247,"text":77},{"id":120,"depth":247,"text":121},{"id":168,"depth":247,"text":169},{"id":185,"depth":247,"text":186},{"id":211,"depth":247,"text":212},"2026-10-10","Migrating to Gateway API on K3s sounds simple since Traefik ships by default, but it still requires installing CRDs, rebuilding canary configs, and re-checking cert-manager wiring. A practical guide grounded in the 2026 Ingress-nginx retirement and Kubernetes 1.36.","md","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap\u002Ftitle.webp","en",{},true,"\u002Fblog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap",{"title":5,"description":257},"blog\u002Fen\u002Fk3s-ingress-gateway-api-migration-traefik-gap",[267,268,269,270,271,272],"k3s","kubernetes","gateway-api","traefik","ingress","networking","KbwV90iPIWLI_pWZ54N53vbIkOKRvSJTK1HsMDWhLcQ",[275,286,295,303,310,318],{"path":276,"title":277,"description":278,"date":279,"tags":280},"\u002Fblog\u002Fen\u002Fk3s-vs-kubernetes-cni-flannel-default-comparison","K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are","K3s ships with Flannel built in, while standard Kubernetes starts with no CNI selected at all. This comparison, grounded in the official K3s, Kubernetes, Calico, and Cilium docs, explains how that difference affects NetworkPolicy enforcement and network performance.","2026-10-20",[267,268,281,282,283,284,285,272],"cni","flannel","calico","cilium","networkpolicy",{"path":287,"title":288,"description":289,"date":290,"tags":291},"\u002Fblog\u002Fen\u002Fk3s-traefik-servicelb-ingress-nginx-port-conflict","You Disabled Traefik on K3s, But ingress-nginx Still Can't Grab Port 443. Meet ServiceLB, the Roommate You Forgot About","You ran the K3s disable-traefik flag but ingress-nginx still can't bind port 443. The culprit is ServiceLB (klipper-lb), another default K3s component. Here's how to diagnose it, disable it correctly, and what changes if you're running MetalLB.","2026-09-19",[267,268,270,292,293,294],"servicelb","ingress-nginx","load-balancer",{"path":296,"title":297,"description":298,"date":299,"tags":300},"\u002Fblog\u002Fen\u002Fk3s-flannel-vxlan-overlay-mtu-troubleshooting","Ping Works, HTTP Hangs: Why K3s Flannel VXLAN Overlay Networks Break Over MTU","In a K3s cluster, ping succeeds but HTTP requests just hang — the culprit may be an MTU mismatch inside your VXLAN overlay network. This guide covers Flannel\u002FCalico MTU design, the PMTU blackhole phenomenon, and a step-by-step diagnostic process.","2026-09-01",[267,268,272,301,282,302],"vxlan","mtu",{"path":304,"title":305,"description":306,"date":307,"tags":308},"\u002Fblog\u002Fen\u002Fkubernetes-cni-overlay-network-troubleshooting-ospf","OSPF Fixes Itself in a Minute — Why Does a Kubernetes CNI Outage Take Half a Day?","Why does troubleshooting a Kubernetes overlay network take so long? This article breaks down how CNI works, the differences between Flannel VXLAN and Calico BGP, and the step-by-step process for isolating MTU mismatches that every K3s operator should know.","2026-08-16",[267,268,281,309,272],"overlay-network",{"path":311,"title":312,"description":313,"date":314,"tags":315},"\u002Fblog\u002Fen\u002Fkubevirt-calico-live-migration-networking","Moving a VM Doesn't Have to Break the Connection: Inside KubeVirt and Calico's Live Migration Magic","Why doesn't live migrating a VM (KubeVirt) between Kubernetes nodes break the connection? We break down Calico's IP persistence and BGP route convergence, and what it means for teams moving off VMware.","2026-08-07",[267,268,316,272,317],"kubevirt","managed-kubernetes",{"path":319,"title":320,"description":321,"date":322,"tags":323},"\u002Fblog\u002Fen\u002Fkubernetes-networking-cni-service-mesh-network-engineer","You Can Calculate Subnets, But Your Pods Won't Connect: The First Wall in Kubernetes Networking","You're great at subnet design, so why does Pod-to-Pod communication in Kubernetes trip you up every time? We break down the fundamentals of Kubernetes networking—CNI, Service Mesh, and NetworkPolicy—by contrasting them with traditional network design.","2026-07-22",[268,267,272,281,324,325],"service-mesh","network-policy",1792592636280]