Teams Still Running ingress-nginx
Your cluster edge runs a controller that no longer gets security fixes. We plan the move to Gateway API around your annotations and certificates, and cut over host by host without a maintenance window.
The Network Under Your Cluster,
Done Properly.
CNI, network policies, egress and the edge: the layers below the service mesh. Including the move off ingress-nginx, which no longer gets security fixes.
Trusted across Europe
Industries we serve.
Engineering teams in regulated, mission-critical industries — every engagement audited, documented, and production-grade.
Banking & Payments
FinTech
PCI-DSS compliant payments and core banking infrastructure — sub-100ms p99 latency, end-to-end audit trail, and tokenization at the edge.
PCI-DSS · ISO 27001
Patient Data
Healthcare
HIPAA-aware patient data pipelines
HIPAA · SOC2
5G & Networks
Telecom
5G core network observability at scale
NFV · ETSI MANO
Retail & Marketplaces
E-Commerce
99.99% uptime during peak traffic events
PCI-DSS · GDPR
Sovereign & Public
Government
Sovereign cloud with full audit trails
eIDAS · FIPS 140-2
Fleet & IoT
Logistics
Real-time fleet tracking & IoT ingestion
MQTT · OPC-UA
Gateway APIThe successor to Ingress
Default-denyNetwork policy baseline
EgressAllowlisted, not open
eBPFData plane and flow visibility
What we deliver
Networking below the mesh
Everything between the node and your services: how packets get in, move between pods and leave the cluster.
Ingress-NGINX stopped getting releases and security fixes after March 2026. We inventory every Ingress and its annotations, choose a Gateway API implementation, convert the routes, run both side by side and move traffic host by host.
Side-by-side cutover · rollback per hostCilium, Calico, or keeping what you have. Some CNIs, Flannel among them, do not enforce NetworkPolicy at all, so the policies you wrote may be doing nothing. We test your CNI against your requirements and, when it has to change, migrate node pool by node pool.
Node pool by node pool · no big bangKubernetes allows all pod-to-pod traffic until a policy says otherwise. We record the traffic you actually have, write allow rules from it, then switch each namespace to default-deny, one at a time, with a rollback ready.
Observe first · enforce per namespaceA compromised pod that can reach the whole internet is an exfiltration channel. We restrict egress to the destinations each workload needs, by IP or by DNS name where the CNI supports it, and tune cluster DNS so lookups stop adding latency.
Allowlisted egress · DNS that scalesOn bare metal there is no cloud load balancer, so we set up BGP or layer 2 announcement of service IPs. Across clusters we connect pod networks at L3 with consistent policies, and leave L7 traffic management to a mesh where you need one.
Bare-metal service IPs · L3 across clustersWhen something times out, the first question is whether it is the network. Flow logs and dropped-packet visibility answer it in minutes instead of a war room: which pod, which policy, which hop.
Flow logs · a reason for every dropFree assessment
Get a free Cloud Native Networking assessment
Our engineers review your current setup and deliver a prioritized roadmap — no strings attached.
Who we help
Teams whose network grew by accident
The three situations where this work usually pays back fastest.
Teams with a Flat Cluster Network
Every pod can reach every other pod, and an audit or a NIS2 assessment is coming. We get you to default-deny without breaking production, and leave the policies in Git with tests.
Bare-Metal and Multi-Cluster Platforms
No cloud load balancer, several clusters, pods that need to reach each other. We build service IP announcement on your own network and L3 connectivity between clusters.
Real Project
Cilium eBPF Network for a FinTech
01 / 02
A FinTech platform was hitting kube-proxy bottlenecks at scale with no visibility into pod-to-pod traffic, putting both performance and compliance at risk.
Tech stack
CiliumeBPFKubernetesHubble
Kube-proxy bottleneck at 50K connections/sec, no network visibility.
Cilium with eBPF for dataplane, Hubble for observability.
200K connections/sec, full L7 visibility, 40% latency reduction.
Outcomes & method
Networking you can audit
Most cluster networks grew by accident: a default CNI, a few policies nobody tested, an ingress controller installed years ago. We turn that into a design you can explain to an auditor and change without fear, starting with the parts that no longer get security fixes.
Business outcomes
- 01
A network that enforces what you wrote
Policies applied by a CNI that actually enforces them and tested against real traffic, so lateral movement stops at the namespace boundary.
- 02
An edge that still gets security fixes
Ingress traffic on a maintained Gateway API implementation instead of a controller that no longer receives patches.
- 03
Answers instead of guesses
Flow visibility that shows which policy dropped which packet, so the question of whether it is the network takes minutes.
How we implement
- 01
Inventory & design
We map your CNI, every Ingress and its annotations, existing policies, egress paths and DNS, and agree the target design and the order of work.
- 02
Migrate in small steps
Gateway API side by side with the old controller, policies observed before they are enforced, CNI changes node pool by node pool, each step with a rollback.
- 03
Hand over & monitor
Runbooks, policy tests in CI and flow dashboards your team owns, plus alerts on unexpected drops.
Engagement model
How we work
From first call to production — a proven 4-step engagement model that keeps the conversation transparent and the velocity honest.
- 01
Discovery
We audit your current stack, identify gaps, and align on business goals.
- 02
Assessment
A detailed roadmap with priorities, effort estimates, and quick wins.
- 03
Delivery
Our engineers embed with your team and execute sprint by sprint.
- 04
Support
Ongoing monitoring, optimization, and knowledge transfer to your team.
Related disciplines
Related services
Adjacent practices that pair well with this one — most engagements blend two or three.
Common questions
Frequently asked questions
Practical answers about scope, timelines, and how engagements with our Cloud Native Networking team usually look.
The Kubernetes project ended best-effort maintenance of ingress-nginx in March 2026: no more releases, bug fixes or security patches. Existing installations keep running, which is exactly the risk. The recommended path is Gateway API. No implementation is a drop-in replacement, so the work is in the annotations: rewrites, timeouts, authentication and rate limits each need an equivalent. We inventory them, run the new gateway alongside the old controller and move hosts one at a time.
Network policies decide which pods may talk to each other, at the IP and port level, and are enough for most clusters. A service mesh adds L7: mutual TLS with workload identity, retries, timeouts and traffic shifting between versions. Start with default-deny policies, and add a mesh when you need encrypted service identity or per-request traffic control. Our service mesh practice covers that layer.
Both enforce network policy well. Cilium suits teams that want an eBPF data plane, DNS-aware egress rules and built-in flow visibility. Calico has a long track record in hybrid and BGP-heavy environments. If your current CNI does not enforce policy at all, that decides the question. We test against your requirements before recommending either.
Record first, enforce later. We collect flow data over a representative period, generate allow rules from what actually happens, review them with the owning teams, then enforce one namespace at a time, starting with the least critical. Policies live in Git and are tested in CI, so a new service ships with its rules.
A review of your CNI, your ingress controller and its annotations, your network policies, egress paths and DNS. You receive a written report with the risks we found, starting with anything that no longer gets security fixes, and a prioritized migration plan.
Talk to engineering
Let's talk about your Cloud Native Networking strategy
Whether you're starting from scratch or scaling what you have, our engineers are ready to help.