Back to Blog
Kubernetes
Security
Kubernetes Wants You to Move On From Ingress, Yet Gateway API Feels Like a Puzzle Nobody Asked For
April 28, 2026
4 min read read
**“Kubernetes Wants You to Move On From Ingress, Yet Gateway API Feels Like a Puzzle Nobody Asked For”**
## A Better Idea Trapped Behind a Worse Experience
There is real excitement around Gateway API. The concept clicks fast. More flexibility, cleaner abstractions, a future-facing way to manage traffic inside Kubernetes. The problem shows up the moment someone tries to use it. The experience feels heavier than expected, especially for something positioned as the next step forward .
One voice captured it perfectly. They liked the idea, even appreciated what it unlocks, yet could not ignore how difficult it feels to get running. That contrast creates friction. A feature can be technically superior, though if the path to using it feels complicated, people hesitate. That hesitation becomes the real barrier, not the technology itself.
## Ingress Worked Because It Was Just There
Ingress succeeded for a simple reason. It felt native. It existed as part of the environment people already understood. Teams only needed to plug in a controller, and everything else fell into place. Charts could assume its presence. Workflows stayed predictable.
Gateway API shifts that expectation. Now teams install controllers and manage CRDs. That extra layer introduces version concerns that charts cannot anticipate. Suddenly, something that used to feel standard becomes conditional. One developer described this as an “additional layer of version management,” which hits harder than it sounds .
That difference changes how people think about adoption. Familiarity disappears. Certainty fades. Even experienced teams start second guessing what used to be routine.
## The Argument for Staying Outside the Core
A maintainer stepped in to explain the reasoning behind this design. The explanation feels logical from a systems perspective. Keeping Gateway API outside the core allows faster iteration. Features can evolve without waiting for full Kubernetes release cycles. That speed matters in a world where infrastructure moves quickly .
There is also the issue of stability. Core Kubernetes carries a heavy responsibility. Adding more directly into it increases maintenance risk and the chance of security issues. Keeping things modular reduces that pressure. One explanation put it clearly: core needs to stay stable, even if that means moving slower.
That reasoning makes sense on paper. It aligns with how large systems tend to scale. It prioritizes long term health over short term convenience.
## The Frustration From the People Who Actually Use It
The frustration comes from a different place. Operators do not think in terms of architectural purity. They think about getting traffic into their clusters without jumping through extra steps. One reaction leaned into that frustration hard, pointing out how strange it feels to need extra setup just to “receive traffic.”
Another perspective questioned the timing. If Gateway API is not ready to be part of the core experience, why push it as the future replacement? That question lingers because it reflects a mismatch between messaging and reality.
There is also the awkward coexistence problem. Ingress still exists. Gateway API sits beside it. Teams now navigate both, which adds mental overhead. One comment called it a “usability nightmare,” capturing the feeling of juggling two overlapping systems.
## A Middle Ground That Still Feels Unfinished
Some voices try to bridge the gap. They acknowledge the current experience is not ideal while pointing out the benefits of flexibility. Running Gateway API outside the core allows faster updates without upgrading entire clusters. That advantage matters in environments where upgrades take time or carry risk.
There is also a promise of stability through versioned CRDs. The idea sounds reassuring. Install stable definitions, avoid breaking changes. That contract could smooth adoption if it holds up consistently.
Even with that reassurance, the experience still feels incomplete. One operator described challenges across multiple environments, especially in controlled setups where every dependency matters. Extra layers add friction in ways that documentation alone cannot solve.
## The Real Problem Is Not the Technology
Gateway API is not failing because of design flaws. It struggles because of experience. The idea resonates. The execution demands more effort than many expect. That gap shapes perception faster than any technical advantage.
This moment feels like a transition phase. Ingress remains simple and familiar. Gateway API represents something more powerful, though also more demanding. Teams stand in the middle, weighing convenience against future readiness.
The conversation shows something deeper than a feature debate. It highlights how difficult it is to replace something that already works well enough. Improvement alone does not drive adoption. The path to that improvement has to feel natural. Until that happens, even strong ideas move slowly.
Keep Exploring
Kubernetes’ Quiet Security Revolution Is Here—and It Might Break Everything Before It Fixes Anything
“Kubernetes’ Quiet Security Revolution Is Here—and It Might Break Everything Before It Fixes
Six Years of Silence Explodes Into One Feature That Could Quietly Rewrite Kubernetes Security Forever
“Six Years of Silence Explodes Into One Feature That Could Quietly Rewrite Kubernetes Security
CVE-2026-22039: How an admission controller vulnerability turned Kubernetes namespaces into a security illusion
Just saw this nasty Kyverno CVE that's a perfect example of why I'm skeptical of admission controllers with god-mode RBAC.
YubiHSM 2 + cert-manager. Hardware-signed TLS certificates on Kubernetes
I built a cert-manager external issuer that signs TLS certificates using a private key inside a YubiHSM 2.