Your ingress-nginx Fork Subscription Is a Bridge, Not a Home: Pricing the Runway Against the Gateway API Migration

Two vendors now maintain the ingress controller Kubernetes retired in March — and one of them has put an expiry date on the favor. Facets-cloud's community fork pledges maintenance only until January 1, 2027, which is 78 days from today. Chainguard's EmeritOSS fork promises best-effort CVE backports with no end date and no SLA on the free tier, and a commercial tier with an SLA whose price is not published. If your fleet still serves tenant domains from nginx.ingress.kubernetes.io annotations, you are not choosing between two vendors. You are choosing between buying calendar time and spending engineering time — and the fork side of that ledger has a cliff edge in it.

Here is the priced version of that choice, worked against one stated archetype fleet: 40 Ingress objects, roughly 120 annotations (about 15 of them configuration-snippet or server-snippet), 25 tenant domains, a single controller, no FIPS requirement. Assume a loaded engineering cost of $150/hour (about $6,000 per engineer-week) — plug in your own number; the shape of the answer survives any plausible value.

The delta that matters is not bridge-minus-migrate. It is that the bridge is additive: if the migration is inevitable — and the January joint statement says it is — you will pay the migration column eventually no matter what. The fork buys schedule, not savings. A free fork that carries you to a completed December cutover costs roughly $2–4k of drag on top of the migration. A fork subscription with no migration plan behind it is a second end-of-life cliff with a vendor logo on it. Everything below is the evidence for that table.

What the money actually buys​

Start with a correction to loose wording that floats around this market, because precision here is the whole purchase decision. Facets does not sell you anything: Facets-cloud/ingress-nginx is a free community fork whose README pledges to "extend the maintenance window until January 1st, 2027" for organizations that need a longer window to finish migrating. A dated pledge, not a product. Chainguard's EmeritOSS program is the one with two tiers: a free source fork with dependency updates and best-effort CVE fixes but no prebuilt images, and commercial container images with a remediation SLA and a FIPS variant behind a contact-sales form. Chainguard publishes no price; TechTarget's coverage of the program confirms the split — free in source form, commercial distribution for continuous maintenance — and no numbers.

What every tier sells is the same narrow thing: backported security fixes and dependency updates, not development. Chainguard is explicit: "we are not continuing the development of ingress-nginx. We are maintaining a working version based on the latest release," and the support exists to "buy users time to move to a different solution." No new features, no annotation parity work, no behavior changes. If your fleet needs a new annotation handled or a routing quirk fixed, no fork tier will build it. That is not a gap in the offering; it is the offering.

The worked example of what "maintained" has to cover is CVE-2026-4342. It is a comment-based nginx configuration injection reachable through crafted Ingress annotations, rated CVSS 8.8 (network-exploitable, low privileges, no user interaction, high impact across confidentiality, integrity, and availability), with successful exploitation leading to arbitrary code execution in the controller and disclosure of Secrets the controller can read.

The patch shipped March 19, 2026 in v1.13.9, v1.14.5, and v1.15.1 — the final releases of each branch — and the repository was archived March 24. Five days from fix to read-only. Then, on August 7, O3 Security researchers reported the bug still present in production clusters that never applied the March fix — five months after a patch existed, with no upstream left to re-cut a release for anyone who missed the window. That is the unit of work a fork sells you: the next CVE-2026-4342 gets a backport you can consume. Nothing more.

For the commercial tier, the honest pricing move given an unlisted quote is a plug-in formula, not a guess. Take the annual or term quote, divide by the runway days it covers, and compare the resulting $/day of runway against two numbers: your migration burn per week of focused engineering, and the cost of the incident you are insuring against. A quote that prices runway below one engineer-week per quarter is cheap schedule insurance for a fleet mid-migration. A quote at that level with no migration underway is just rent on the cliff edge — which brings us to what no tier can fix.

What the forks cannot fix​

The January 29 joint statement from the Steering Committee and the Security Response Committee contains the sentence that bounds every fork, paid or free: maintaining ingress-nginx is "no longer reasonable or even possible ... even if resources did materialize." Read that as a purchaser. It does not say the project lacked maintainers — a resourcing problem a sponsor could fix. It says the snippet-annotation architecture, which injects raw nginx directives from Ingress objects, made the tool unsecurable at any staffing level. A fork inherits the architecture with the code. No backport program changes the verdict, because the verdict is about the design, not the headcount.

The commercial implication sits one level down, in the word "best-effort." EmeritOSS applies fixes for vulnerabilities that can be patched safely and will not backport fixes requiring deeper refactoring — the same limitation our CVE-2026-3288 timeline traced through the retirement window, when one annotation-sanitization defect needed three successive patches. So name the exposure case plainly: the next annotation-architecture CVE that cannot be fixed without restructuring the template engine gets no backport on any fork tier, free or commercial. Your SLA covers remediation of fixable flaws; it cannot conjure a safe patch for an unfixable design. At that point the fleet faces a forced emergency migration at rush cost — context-switched engineers, skipped parallel-run, tenant-facing risk — which is the most expensive way to do the project §4 prices at $12–18k done calmly.

There is a second thing forks cannot fix: silence. The retirement documents warn that "existing deployments will continue to work, so unless you proactively check, you may not know you are affected until you are compromised." A fork subscription does not audit your clusters. If you have not run the thirty-second detection step — kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx — plus the image and Helm checks in our pre-migration audit, you may be paying to maintain controllers you have not inventoried. Buy the fork after the inventory, not instead of it.

Pricing the migration side​

The other column of the ledger is a project, not a subscription, so price it in phases. The January statement sets expectations honestly: "None of the available alternatives are direct drop-in replacements. This will require planning and engineering time." For the archetype fleet (40 Ingresses, ~15 snippet annotations, 25 domains), the phases run like this:

Added up: roughly 2–3 engineer-weeks of focused effort spread over 4–8 calendar weeks, hence $12,000–$18,000 at the stated loaded cost. The sensitivity is what makes this a range instead of a number. Heavy configuration-snippet use — Lua blocks, auth-request chains, custom error pages — doubles the convert phase, because each snippet is a small bespoke program with no mechanical translation. A fleet that is mostly plain path-and-host routing with standard TLS halves it; ingress2gateway eats that shape for breakfast. FIPS or compliance-gated change windows stretch the parallel-run, not the engineering. Tenant-domain count multiplies cutover checklists roughly linearly. If your fleet looks nothing like the archetype, re-plug these drivers rather than arguing with the total — the method is the deliverable.

Two existing guides carry the implementation detail this post deliberately does not repeat: the annotation translation walkthrough for the convert phase and the ordered pre-migration audit for everything before any tool runs. The point of pricing the project here is to put a real number on the other side of the fork ledger — and to show that the migration costs less than one quarter of a senior engineer's loaded time, which is the scale any commercial fork quote should be weighed against.

The date math: bridge or second cliff​

All of the above collapses into one decision matrix. Today is October 15, 2026. The Facets pledge expires January 1, 2027 — 78 days, spanning two holiday-frozen weeks for most teams, so roughly 60 working days of real migration capacity. The EmeritOSS free fork has no published end date, which is not better than a date: it is an unpriced date, withdrawable whenever Chainguard's priorities shift.

The flip conditions deserve emphasis because they are the actual purchase criteria. A fork subscription is a bridge when three things are true: a migration is staffed and scheduled, its cutover date precedes the fork's end date with margin, and the fleet's compliance posture tolerates best-effort patching in the interim. Lose any one — no staffed plan, a cutover drifting into Q1, a FIPS auditor asking about your SLA — and the same subscription is a second end-of-life cliff: a paid dependency on an architecture its own project declared unmaintainable, with the next deep CVE as the unknowable expiry.

Note the asymmetry that decides close calls. Starting the migration today costs the $12–18k once and the cost is capped. Buying the fork first and migrating later costs the fork drag plus the migration, with the schedule risk compounding every week the cutover slips toward January. The fork-first order is rational exactly once: when the migration cannot start this quarter for reasons outside your control — a freeze, a staffing gap, a compliance window — and you need the request path patched while you wait. Every other "we'll migrate next quarter" is the cliff-edge rent described in §2.

A bridge you cross, on a schedule you keep​

The post-retirement support market is not a resurrection; both vendors say so in their own announcements. It is a priced extension of the five-day window CVE-2026-4342 taught everyone to fear — 78 more days on the Facets pledge, an undated best-effort floor from EmeritOSS, a commercial SLA for fleets whose compliance posture needs one. That is genuinely useful, and for a fleet mid-migration it is cheap. But the January verdict stands over all of it: the architecture is unmaintainable at any staffing level, so every fork is a wasting asset by construction.

So do the date math this week. Inventory the controllers, count the snippet annotations, plug your loaded cost into the table at the top, and put a cutover date on the calendar that precedes January 1 with margin. If the date fits, take the free bridge and cross it. If it does not fit, get the commercial quote or cut scope until it does. What you cannot do — what the O3 findings from August prove fleets keep doing — is nothing. Silence is the failure mode, and it now has a January expiry.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own. Star the repo on GitHub or deploy your first app today.