KubeCon + CloudNativeCon EU 2026 | Sudeep Goswami, Traefik Labs

Clips
More from KubeCon + CloudNativeCon EU 2026

Sudeep Goswami

CEO

Traefik Labs

play_circle_outline Ingress NGINX Retirement Forces Migration; Traefik Labs Offers API/AI Runtime Off‑Ramp for Half of Cloud‑Native

play_circle_outline Evaluating Migration Risks: Is Traefik a True Drop-In, Open-Source Replacement for Ingress NGINX?

play_circle_outline Move Beyond C/C++ Ingress: Memory-Safe Unified API Gateways for Auth, Rate Limiting, WAF, and AI

play_circle_outline Advice: use Ingress NGINX retirement as forcing function to choose strategic, future-proof platform.

Info
Transcript

Sudeep Goswami, Traefik Labs

Sudeep Goswami

CEO Traefik Labs

In this interview from KubeCon + CloudNativeCon EU in Amsterdam, Sudeep Goswami, chief executive officer of Traefik Labs, joins theCUBE's Rebecca Knight and Paul Nashawaty to discuss the retirement of Ingress NGINX and how enterprises can navigate the migration to a modern, AI-ready runtime governance architecture. Goswami explains why the retirement of a component installed across nearly 50% of cloud-native environments represents more than a simple swap — it exposes three distinct risks enterprises must address simultaneously: migration, security and stagna... Read more

explore Keep Exploring

Why does the retirement of Ingress NGINX matter to enterprises, and what risks should they consider when migrating to an alternative? add

Why was the project retired, what risks should organizations consider when migrating off it (e.g., migration, security, stagnation), and why are major vendors endorsing Traffic as the preferred replacement? add

Why is Ingress NGINX considered insecure, how common is that security risk among CNCF ingress-controller alternatives, and what factors should organizations consider when choosing an ingress controller to provide a secure, upgradeable path for future needs (API gateway, auth, WAF, AI/agent governance)? add

What message should CISOs, CTOs, and platform teams hear about replacing Ingress NGINX—how should they approach choosing the right platform and architecture, and what should they know about Traefik Labs' solution? add

bolt Powered by CUBE AI

Sudeep Goswami, Traefik Labs

search

>> Good morning, everyone, and welcome back to day three of theCUBE's live coverage of KubeCon + CloudNativeCon 2026. We are live in Amsterdam. I'm your host, Rebecca Knight. I'm sitting alongside Paul Nashawaty, a principal analyst here at theCUBE. It's already day three.

>> It's already day three.

>> Hard to believe.

>> It's amazing how fast that went.

>> It has. And what a show it's been.

>> It's been amazing. Yeah, it's been fast. Lots of people, lots of traffic, lots of good conversations.

>> Indeed, indeed. Well, with that, I would like to welcome our next guest to the show, he is Sudeep Goswami, CEO of Traefik Labs. Welcome, Sudeep.

>> Thank you.

>> Yeah.

>> Welcome.

>> Thank you for coming on. But for our viewers who are less familiar with your company, why don't you just tell us a little bit about Traefik Labs, what you're all about?

>> Yeah. So we provide API and AI runtime infrastructure for modern workloads. So think of an ingress controller, which has been a big buzzword here at this show. Think of an API gateway, AI gateway, MCP gateway. So essentially, the governance layer that governs all of your modern workloads.

>> So a lot of companies are just waking up to the fact that a critical piece of their infrastructure, Ingress NGINX is being retired. For those of us who are less in the weeds, can you explain why this matters so much to enterprises?

>> Yeah. Ingress NGINX has been a very important building block for modern workloads. It's used by almost in 50% of the cloud native environments. So you have millions and millions of installations of this piece of technology that everybody's using for cloud native environments. And that was retired on Tuesday, on day one of this show. And now, everybody's got to find an off-ramp and find something that's more appropriate that will have more longevity. And it's a big shock because this happened at the last KubeCon. And so people had like literally four, four and a half months to react to this. And so it's a big event and everybody's trying to figure out what their next step is.

>> So let's talk about the risks because there's a big factor here with this as being end of life or have retired. There's mitigation risks, there's security risks, there's stagnantation risks. There's all sorts of pieces that kind of come into this. What are your thoughts around the risk and why it's important to kind of get in front of this before it's too late?

>> Yeah. And the whole reason this project got retired was because of ongoing security risks and the maintainers just could not support this with their part-time bandwidth. So security was a big component of why this was retired. So now, as people kind of think of their off-ramp, I see this as three different risks that people have to deal with. There's obviously the most obvious one is the migration risk. They need to find a different partner. And everybody who came to our booth was super focused on figuring out if traffic can be that off-ramp. And we can talk more about that in a minute. But the other two risks, almost no one is really kind of talking about. And there's still security risks that you have to think through as you're doing this migration. And then there's what we call the stagnation risk or the risk of not being able to evolve this architecture over time. So the decisions you make should not only serve this first step, which is the migration, but also give you longevity to evolve the architecture over time.

>> So you really need to be thoughtful about how you do this. In terms of, you've already gotten so much approval from the industry, some of the biggest names, SUSE, Nutanix, IBM, that looks like a very big vote of confidence. What do you think is driving that level of confidence and what does it say about where the market is headed? I want to hear from you, but also your thoughts as an analyst there, Paul.

>> Yeah, absolutely. And I think you can think of it across those three risks where traffic is uniquely positioned to address all three of those risks. And I can kind of go through quickly one by one. On the migration side, we are the only drop-in replacement for Ingress NGINX today. So open source to open source, moving from one project to another, we provide the only drop-in experience. And what that really means is customers who have been using Ingress NGINX and all the configuration that they already had, when they migrate, they don't have to change the configuration, they don't have to touch the configuration. All they have to do is uninstall one piece of software, install our software in tandem, and then everything just works. And this experience really reduces the risk and gives them that time to market advantage.

>> Yeah. I would add that there's a lot of understanding of how these projects and applications are being developed, have to have that long tail journey. They have to add in the fact that you want to be able to dynamically adjust as you need to grow and go, because if you don't... I mean, we're seeing the explosion of applications with AI, right? And if those applications are not working because the plumbing underneath isn't working, that's a big problem.

>> Exactly.

>> So let's talk about the long tail risk here or the long tail journey. What does it mean? There's a migration piece, but there's also like, now that you've migrated, what happens?

>> Yeah. So there's also the security risk. The reason Ingress NGINX was deemed insecure because it is written in C or C++. And the US government, the agencies, including the CISA and NSA, have put out a best practice guidance for software manufacturers to find a path to move away from C and C++ based code to something that they consider more memory safe. And that is a big part of the risk. And there's a lot of other ingress controllers out there that have this risk. And I got a stat for you, since you love stats, 77% of the options that the CNCF community has provided as alternatives have this particular security risk inherently built in, which means you round it up, almost 80% have this risk. So you only have the 20% of the pool of ingress controllers that is a viable alternative to move to. So I think people have to be very diligent in their kind of due diligence and all of that to really pick the right vendor. So once you address that, then the next piece is really, that's the long tail that you're referring to, which is I don't want to just solve a day one problem, which is the Ingress NGINX problem. I also want to pick an architecture that gives me more mileage as my needs evolve. So ingress controller is step one, but as your application complexity grows, you're going to need to have an API gateway. That's going to need centralized authentication, rate limiting, policy control, API lifecycle management. Then your security requirements grow, you're going to need to put in a WAF. Then your AI enters the workforce. You're going to need to govern that through an AI gateway. Then you have agents and agentic workflows entering the enterprise. So now, you have to think about an MCP gateway. So these could be all different products that you may have to stitch on top of each other, which is going to create more fragmentation. So you want to pick something that gives you a seamless upgrade path. And this is what I mean by the long tail.

>> Yeah, absolutely, Sudeep. Sorry, I didn't mean to cut you off there.

>> No, no. Go ahead.

>> But I think that the other factor is the co-existence between heritage environments and new environments. So if you have VMs or containerizations, that's another factor you can take into consideration because you've got to remember that monetization's a treadmill and everyone's constantly running on it, right? But like when you still have these past or heritage applications, they still need to work with the new environment.

>> Exactly. And these are almost like there's three different mandates that enterprise is getting hit with. There's the migration mandate, there's the modernization mandate, and then there's the transformation mandate. So the migration mandate we talked about, whether you're moving from VM or you're going from one hypervisor to another hypervisor or Ingress NGINX to something else, that's the migration mandate. Now, we have the modernization mandate. And this is, like you said, it's the coexistence of VMs and containers. It's not a binary move. And then you have the transformation mandate, and this is where AI comes in. So every enterprise is going through and figuring out how do they make all of this work. And these mandates cannot happen in a linear fashion. They're almost being hit by it all at once.

>> Well, I want to ask, what is the risk if an enterprise is thinking about each of these things distinctly rather than connecting them and saying, "We need to do this all at once." It can't be, "Okay, we're going to do this for our AI. We're going to do this to move off our containers." Can you just lay out the risk in plain terms?

>> Absolutely. There are business risks and there are technical risks. On the business side, it's time to market. They don't have the luxury to do this because they will be out competed in the marketplace, simply put. On the technical risks, it's the fragmentation tax that they have to pay. So if they do the VM migration one way, then they go to the modernization and they have a different stack for that. Then they come to transformation and then they have a different stack. How do you unify them? How do you manage them at scale? You have the skill shortage that is still a real issue. You have the complexity that continues to grow. What this is going to do is increase your complexity, elongate the time that you have to execute, and you're going to pay more money and you will probably be out of business because you'll get out competed. So it's a existential question every enterprise has to figure out how do they really do all of these at once?

>> Yeah. I don't want to gloss over something that you said that was very important. You have skill gap issues, complexity, and fragmented infrastructure, right? You have the supply chain issues. These are all factors that kind of play into this. That's an important thing to kind of make sure that the audience here understands.

>> Absolutely. I mean, this is real. We have already had these problems. What you want to do with this migration as the forcing function is to take a step back and think through, do I want to do something different or I'm just going to perpetuate the same fragmentation, the same skill shortage problem, and the same kind of complexity problem?

>> So in the day-to-day, I'm just trying to get in the head of an executive or a senior leader at a company who's trying to make these decisions, trying to make sense of what you're talking about, which is exceedingly complicated and how their ingress decision today affects their AI decision tomorrow and in the future. I mean, how do you talk to senior leaders about this?

>> Yeah, you have to start with architecture, and I think that's the best way to address this, is if you have a strong foundation, if you have a modular foundation, you have to think about the end state. If you know you want to get to AI, but the first step is not AI, the first step is ingress, can you stitch a path through that gives you progressive, seamless, a day two ops friendly path to get there rather than just stitching a bunch of things together that are not unified or pre-integrated? And this is a conversation we're having almost with every DevOps platform teams, CISO, a CIO, and other executives. And it starts with architecture and ends with architecture.

>> So I want to touch on some of that, Rebecca. You said earlier, you talked about the major companies that are kind of supporting this, right? Sudeep, you mentioned in our previous conversations, you talked about this partnership that you have, and it's not just a partnership, you have multiple partnerships going on. Why don't we touch a little bit on that? Because it shows the importance of why this is in place, how these organizations are looking at it, and why the partnership works.

>> Yeah. And it dovetails nicely into the architecture conversation. We exist in an ecosystem, right? We as Traefik Labs are not a siloed product that gets deployed. We get deployed as part of a stack or a full solution. And this is where the partnerships become very important because customers are making a compute decision. They're deciding which hardware vendor they want to go with. They're deciding which hypervisor vendor they want to go with, what storage vendor they want to go with. So they are figuring out the stack, and then we need to be able to fit into that stack. And that's why these partnerships become important. So we have to make sure that we are ecosystem friendly, we are ecosystem neutral, so that once a customer decides where they want to run their workloads and on what piece of hardware or location, whether it's in the US, whether it's outside of the US, whether they want to be in a disconnected site, sovereignty matters as well, where they want to store their data, from our standpoint, because we are the runtime governance layer, we want to follow the workload. So therefore, we need to coexist in multiple places and therefore, these partnerships that we have with Nutanix, with SUSE, with IBM Cloud, with TIBCO, with OVHcloud and many more coming, it's really, really important because it's all about giving the customer the choice.

>> So as we are wrapping up here, the theme of everything you've been talking about, skillset gaps, infrastructure fragmentation, increasing complexity, supply chain pressure, is that organizations are trying to do a lot with so much less certainty. What is the message you want every CISO, CTO, platform team that you work with? What do you want them to hear about Traefik Labs and about how they should approach these questions?

>> Yeah. There's an opportunity right now because of this forcing function that is put on us by Ingress NGINX where you have to change a fundamentally critical piece of infrastructure. Let's not let this crisis go to waste. Let's take a step back, make a strategic decision on the right platform, the right architecture that will give them leverage and that will give them speed. I see many people just rushing into it because they want to find a fix, but then they're just borrowing from the future the pain that they're going to have to pay when they will not be able to adapt and grow and evolve with the AI age that we're all kind of participating in.

>> Indeed, indeed. Well, Sudeep, that was very well said. Thank you so much for coming on theCUBE. A really interesting conversation.

>> Pleasure is all mine. Thank you.

>> I'm Rebecca Knight for Paul Nashawaty. Stay tuned for more of theCUBE's live coverage of KubeCon + CloudNativeCon. You're watching theCUBE, the leader in enterprise tech news and analysis.