NGINX Kubernetes Releases: F5 NGINX Gateway Fabric 2.8 and Ingress Controller 5.7 Now Available

Articles F5 Technical Articles
, , , ,
1

We are excited to announce the latest releases of F5 NGINX Gateway Fabric 2.8 and NGINX Ingress Controller 5.7.

These releases deliver practical improvements for Kubernetes routing, including native access policies, enterprise health checking, secure inference traffic, topology-aware routing, broader HTTP/2 support, and simpler multi-tenant configuration.

Together, they help platform teams build more secure, reliable, and flexible application delivery environments across Kubernetes and cloud-native infrastructure.

NGINX Gateway Fabric 2.8

NGINX Gateway Fabric 2.8 introduces new capabilities for access control, upstream health management, secure inference traffic, and dynamic upstream configuration.

1. Native Access Control with the AccessPolicy Resource

Gateway Fabric now supports native IP-based access control through the new AccessPolicy resource.

Access policies can define allowlists and denylists and target Gateway API resources such as Gateway and HTTPRoute. This means platform teams can apply access rules directly at the gateway or application route level without relying on custom configuration snippets.

Common use cases include:

  • Blocking known IP ranges or individual clients.
  • Restricting applications to trusted corporate networks.
  • Protecting administrative or internal endpoints.
  • Applying different access rules to different HTTP routes.
  • Managing access control declaratively alongside other Kubernetes resources.

For example, the following policy denies traffic from two IPv4 sources at the Gateway level:

apiVersion: gateway.nginx.org/v1alpha1
kind: AccessPolicy
metadata:
  name: gateway-denylist
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: gateway
  action: Deny
  rules:
  - name: blocked-range
    source:
      type: IPAddress
      ipAddress:
        address: 198.51.100.0/24
  - name: blocked-client
    source:
      type: IPAddress
      ipAddress:
        address: 203.0.113.7

---

apiVersion: gateway.nginx.org/v1alpha1
kind: AccessPolicy
metadata:
  name: coffee-allowlist
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: coffee
  action: Allow
  rules:
  - name: office-network
    source:
      type: IPAddress
      ipAddress:
        address: 192.0.2.0/24
  - name: office-network-ipv6
    source:
      type: IPAddress
      ipAddress:
        address: 2001:db8::/32

This approach makes access control easier to review, automate, and manage through standard Kubernetes workflows.

2. Enterprise Active and Passive Health Checks

Gateway Fabric 2.8 brings NGINX active (Plus only) and passive health checking into UpstreamSettingsPolicy.

Unhealthy backends can be detected and removed from rotation automatically, helping prevent traffic from being sent repeatedly to failed or degraded application instances.

Active health checks proactively test backend availability. Passive health checks observe live traffic and identify failures as requests are processed. For example:

apiVersion: gateway.nginx.org/v1alpha1
kind: UpstreamSettingsPolicy
metadata:
  name: example-grpc-hc
spec:
  targetRefs:
  - group: core
    kind: Service
    name: grpc-backend
  zoneSize: 1m
  healthCheck:
    active:
      interval: 10s
      fails: 3
      passes: 2
      grpc:
        service: my.grpc.Service

These capabilities help improve application resilience by:

  • Detecting unhealthy backend pods more quickly.
  • Removing failed backends from the NGINX pool.
  • Restoring backends when they become healthy.
  • Reducing repeated failures seen by clients.
  • Supporting health validation for gRPC services.

3. Secure Inference Traffic

Gateway Fabric 2.8 adds support for encrypted and authenticated communication between NGINX Gateway Fabric and the inference endpoint picker (EPP).

This helps protect inference-related traffic and establish trust between the gateway and the component responsible for selecting inference endpoints.

For production deployments, cert-manager is the recommended path for managing the certificates used for this communication.

The capability is designed for organizations operating AI and inference workloads that require secure service-to-service communication as part of the request path.

4. Bug Fixes and Stability Improvements

Gateway Fabric 2.8 includes more than 35 fixes and stability improvements, further improving reliability for production Kubernetes gateway deployments.

NGINX Ingress Controller 5.7

NGINX Ingress Controller 5.7 introduces enhancements to routing, protocol support, secret management, traffic distribution, and platform integration.

1. Optional Host Parameter on VirtualServerRoute

The host parameter is now optional on VirtualServerRoute resources.

Previously, teams often had to duplicate the hostname in every route resource. This could make delegated routing more complex and increase the risk of configuration breakage when hostnames changed.

With this update, teams can define routes without repeating the hostname throughout the configuration.

Benefits include:

  • Simplified multi-tenant delegation.
  • Less duplicated configuration.
  • Fewer configuration changes when hostnames are updated.
  • Easier separation of platform-owned and application-owned routing resources.

2. HTTP/2 to Upstream Applications

NGINX Ingress Controller can now use HTTP/2 when communicating with upstream backends, not only when accepting connections from clients.

This closes a long-standing protocol gap and enables end-to-end HTTP/2 scenarios where the application stack supports the protocol.

HTTP/2 to upstreams can help organizations:

  • Connect to backends that require or benefit from HTTP/2.
  • Support modern application protocols and service architectures.
  • Reduce protocol translation between clients, NGINX, and upstream applications.
  • Align frontend and backend transport capabilities.

3. Per-Ingress HTTP/2 Configuration

HTTP/2 can now be configured at the listener level for an individual Ingress, rather than only through a global ConfigMap setting.

This provides more granular control over protocol behavior in shared Kubernetes environments. Operators can enable HTTP/2 for selected Ingress resources while leaving other applications unchanged.

4. Broader Secret Format Support

NGINX Ingress Controller now accepts TLS material stored using Opaque.

Support for the Opaque format reduces friction when moving away from the community ingress-nginx project, integrating with external secret managers, certificate automation systems, and existing certificate pipelines.

5. Nutanix Kubernetes Platform Partner Catalog Certification

NGINX Ingress Controller 5.7 adds Nutanix Kubernetes Platform Partner Catalog operator certification.

The certification expands the supported-platform story for organizations running Kubernetes on Nutanix and strengthens NGINX integration across the partner ecosystem.

6. Preserve X-Forwarded-* Headers

NGINX Ingress Controller can now preserve inbound X-Forwarded-* headers through ConfigMap configuration.

This capability is available for both:

  • Ingress resources
  • VirtualServer resources

When enabled, NGINX does not overwrite the incoming forwarding headers. This is useful in environments with multiple proxies, gateways, or load-balancing layers, where forwarding metadata is established earlier in the request path.

7. Traffic Distribution and Topology-Aware Routing

NGINX Ingress Controller now provides opt-in support for Kubernetes trafficDistribution and topology-aware routing.

This allows traffic to remain within the same availability zone when possible, helping organizations improve application latency and reduce cross-zone data-transfer costs.

The behavior is best effort and depends on the available Kubernetes topology information and cluster configuration. When enabled, it can help:

  • Keep requests closer to application instances.
  • Reduce cross-zone network traffic.
  • Improve latency for distributed applications.
  • Support cost-aware service routing.

8. Bug Fixes and Stability Improvements

NGINX Ingress Controller 5.7 includes more than 30 bug fixes and stability improvements across routing, configuration processing, platform integration, and day-to-day operations.

Better Kubernetes Traffic Management with NGINX

NGINX Gateway Fabric 2.8 and NGINX Ingress Controller 5.7 address several common challenges in Kubernetes application delivery:

  • Applying declarative, gateway-native access control.
  • Detecting and removing unhealthy backends.
  • Securing inference service communication.
  • Automatically adapting upstream capacity as application topology changes.
  • Simplifying delegated routing and multi-tenant configuration.
  • Extending HTTP/2 across the client-to-upstream path.
  • Supporting more secret-management workflows.
  • Preserving forwarding metadata across proxy layers.
  • Keeping traffic within availability zones when possible.

These improvements give platform and application teams more control while reducing the amount of custom configuration and manual operational work required.

Upgrade Today

NGINX Gateway Fabric 2.8 and NGINX Ingress Controller 5.7 are available through the standard NGINX Kubernetes distribution and deployment channels.

To get started:

  • Explore the documentation: Review release details, configuration options, resource definitions, and upgrade guidance.

  • Evaluate NGINX for Kubernetes: Test NGINX Gateway Fabric and NGINX Ingress Controller in your own Kubernetes environment.

  • Review deployment guidance: Follow the installation and upgrade documentation for your chosen platform.

  • To learn more about migrating from NGINX Ingress Controller to NGINX Gateway Fabric.: K8s page

With these releases, NGINX continues to provide a flexible foundation for delivering, securing, and operating applications and APIs across Kubernetes environments.

F5 NGINX One for Kubernetes in F5’s Application Delivery & Security Platform

NGINX One for Kubernetes is part of F5’s Application Delivery & Security Platform. It helps organizations deliver, improve, and secure applications and APIs across cloud, hybrid, and edge architectures.

NGINX One is the all-in-one, subscription-based package that unifies NGINX capabilities across NGINX Plus, F5 NGINX App Protect, Kubernetes, and management solutions. NGINX Ingress Controller and NGINX Gateway Fabric, key components of NGINX One, adds enterprise-grade capabilities to open-source NGINX for performance, scalability, observability, and operational control.

1 Like