81 posts in category technical
ingress-nginx Annotation Compatibility Matrix
Why classifying ingress-nginx annotations by name is dangerous: what migrates cleanly to Gateway API or another Ingress controller, and what silently breaks.
ingress-nginx Replacement Candidates: Envoy, HAProxy, NGINX
A source-verified look at Envoy Gateway, two HAProxy controllers, F5's NGINX controller, and NGINX Gateway Fabric, scored against the Part 3 matrix.
ingress-nginx Hard Cases: Auth, Rate Limits, gRPC, Snippets
A real OVH MKS lab migrates one nasty sample app from ingress-nginx to Envoy Gateway and HAProxy Unified Gateway: ten hard cases, real bugs, real gaps.
ingress-nginx Inventory: Annotations, ConfigMaps, Flags
Before comparing replacement controllers, find out what your ingress-nginx clusters actually depend on: annotations, the global ConfigMap, and controller flags.
ingress-nginx Migration: A Field Guide
A practical field guide to migrating off the retired ingress-nginx controller: inventory, annotation compatibility, migration mechanics, and a companion lab.
ingress-nginx Migration Mechanics: ingress2gateway and Cutover
An ingress2gateway walkthrough, coexistence patterns, DNS cutover, cert-manager, external-dns, and a rollback plan for a flag-day-free ingress-nginx migration.
ingress-nginx Alternatives: Cilium, Traefik, Kong, AKS, GKE
How Cilium, Traefik, and Kong score against the Part 3 matrix, plus a survey of AKS, GKE, STACKIT, and OVH ingress and Gateway API paths on managed Kubernetes.
Istio AuthorizationPolicy & HTTP/2 Coalescing
Two Istio/Envoy pitfalls: AuthorizationPolicy IP matching (direct_remote_ip vs. remote_ip) and HTTP/2 connection coalescing across per-hostname listeners.
Who Has Access? Humans, Accounts, AI Agents
Kubernetes RBAC, OVH IAM v2, LiteLLM keys, and an AI coding agent compared on documentation, auditing, and technical enforcement of who has access. Part 3 of 6.
Legally vs. Technically Enforced
A framework for telling a legally-enforced sovereignty promise from a technically-enforced one, applied across BYOK, RBAC, and AI-agent access. Part 4 of 6.