最新北京时间1月30日，Kubernetes 指导委员会和安全响应委员会在 kubernetes.io 再次发出公告《Ingress NGINX: Statement from the Kubernetes Steering and Security Response Committees》，强调立即迁移 Ingress NGINX，并通过 CNCF 官方微信公众号 发布中文版公告。
英文版公告：https://kubernetes.io/blog/2026/01/29/ingress-nginx-statement/
一、环境信息：
Kubernetes：1.35.0
集群中 未安装 kube-proxy（或计划替换） 我的环境已经替换
集群节点间网络三层互通
Pod CIDR 已规划（示例使用 10.244.0.0/16）
二、为什么选择 Cilium + Gateway API
维度 Nginx Ingress Cilium + Gateway API
标准化 低（annotations） 高（K8s 原生 API）
数据面 iptables / userspace eBPF + Envoy
安全能力 L4 为主 L4 + L7 原生
可观测 插件化 Hubble 原生
官方趋势 维护 重点发展
三、安装 Cilium（kube-proxy replacement 模式）
3.1 安装 Cilium CLI
curl -L –fail –remote-name-all https://github.com/cilium/cilium-cli/releases/latest/download/cilium-linux-amd64.tar.gz
sudo tar xzvf cilium-linux-amd64.tar.gz -C /usr/local/bin
cilium version
3.2 安装 Cilium（v1.18.x 推荐）
cilium install \\
–set kubeProxyReplacement=true \\
–set ipam.mode=kubernetes \\
–set routingMode=native \\
–set autoDirectNodeRoutes=true \\
–set ipam.operator.clusterPoolIPv4PodCIDRList=10.244.0.0/16 \\
–set ipam.operator.clusterPoolIPv4MaskSize=24 \\
–set ipv4NativeRoutingCIDR=10.244.0.0/16 \\
–set hubble.enabled=true \\
–set hubble.relay.enabled=true \\
–set hubble.ui.enabled=true
3.3 验证 Cilium 状态
cilium status
root@ops-test-025:~# cilium status
/¯¯\\
/¯¯\\__/¯¯\\ Cilium: OK
\\__/¯¯\\__/ Operator: OK
/¯¯\\__/¯¯\\ Envoy DaemonSet: OK
\\__/¯¯\\__/ Hubble Relay: OK
\\__/ ClusterMesh: disabled
DaemonSet cilium Desired: 2, Ready: 2/2, Available: 2/2
DaemonSet cilium-envoy Desired: 2, Ready: 2/2, Available: 2/2
Deployment cilium-operator Desired: 1, Ready: 1/1, Available: 1/1
Deployment hubble-relay Desired: 1, Ready: 1/1, Available: 1/1
Deployment hubble-ui Desired: 1, Ready: 1/1, Available: 1/1
Containers: cilium Running: 2
cilium-envoy Running: 2
cilium-operator Running: 1
clustermesh-apiserver
hubble-relay Running: 1
hubble-ui Running: 1
Cluster Pods: 4/4 managed by Cilium
Helm chart version: 1.18.3
Image versions cilium quay.io/cilium/cilium:v1.18.3@sha256:5649db451c88d928ea585514746d50d91e6210801b300c897283ea319d68de15: 2
cilium-envoy quay.io/cilium/cilium-envoy:v1.34.10-1761014632-c360e8557eb41011dfb5210f8fb53fed6c0b3222@sha256:ca76eb4e9812d114c7f43215a742c00b8bf41200992af0d21b5561d46156fd15: 2
cilium-operator quay.io/cilium/operator-generic:v1.18.3@sha256:b5a0138e1a38e4437c5215257ff4e35373619501f4877dbaf92c89ecfad81797: 1
hubble-relay quay.io/cilium/hubble-relay:v1.18.3@sha256:e53e00c47fe4ffb9c086bad0c1c77f23cb968be4385881160683d9e15aa34dc3: 1
hubble-ui quay.io/cilium/hubble-ui-backend:v0.13.3@sha256:db1454e45dc39ca41fbf7cad31eec95d99e5b9949c39daaad0fa81ef29d56953: 1
hubble-ui quay.io/cilium/hubble-ui:v0.13.3@sha256:661d5de7050182d495c6497ff0b007a7a1e379648e60830dd68c4d78ae21761d: 1
root@ops-test-025:~#
关键检查项： – Cilium: OK – Operator: OK – Envoy DaemonSet: OK – Hubble Relay: OK
四、启用 Ingress Controller（为 Gateway API 打基础）
Gateway API 与 Ingress Controller 在 Cilium 1.18 中 解耦，需要显式开启。
cilium upgrade \\
–set ingressController.enabled=true \\
–set ingressController.default=true
验证：
kubectl get ingressclass
root@ops-test-025:~# kubectl get ingressclass
NAME CONTROLLER PARAMETERS AGE
cilium cilium.io/ingress-controller <none> 51m
五、安装 Gateway API CRD（官方标准）
kubectl apply -f \\
https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.1.0/standard-install.yaml
验证：
kubectl get crd | grep gateway
root@ops-test-025:~# kubectl get crd | grep gateway
gatewayclasses.gateway.networking.k8s.io 2026-02-02T08:52:00Z
gateways.gateway.networking.k8s.io 2026-02-02T08:52:00Z
grpcroutes.gateway.networking.k8s.io 2026-02-02T08:52:00Z
httproutes.gateway.networking.k8s.io 2026-02-02T08:52:01Z
referencegrants.gateway.networking.k8s.io 2026-02-02T08:52:01Z
root@ops-test-025:~#
六、启用 Cilium Gateway API Controller（关键步骤）
cilium upgrade
–set gatewayAPI.enabled=true
验证 GatewayClass：
kubectl get gatewayclass
root@ops-test-025:~# kubectl get gatewayclass
NAME CONTROLLER ACCEPTED AGE
cilium io.cilium/gateway-controller Unknown 46m
期望看到：
cilium io.cilium/gateway-controller
注：ACCEPTED=Unknown 在 Cilium 1.18 属于正常现象，不影响使用。
七、创建 Gateway（入口边界）
7.1 创建 Gateway
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: edge-gateway
namespace: default
spec:
gatewayClassName: cilium
listeners:
– name: http
protocol: HTTP
port: 80
kubectl apply -f gateway.yaml
7.2 验证 Gateway 状态
kubectl get gateway
root@ops-test-025:~# kubectl get gateway
NAME CLASS ADDRESS PROGRAMMED AGE
edge-gateway cilium Unknown 38m
八、创建 HTTPRoute（业务路由）
假设已有 Service：demo-svc:80
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: demo-route
spec:
parentRefs:
– name: edge-gateway
rules:
– matches:
– path:
type: PathPrefix
value: /
backendRefs:
– name: demo-svc
port: 80
kubectl apply -f httproute.yaml
九、流量入口
9.1查看 Gateway Service
kubectl get svc -n kube-system | grep gateway
9.2 访问验证
http://
十、安全加固（推荐）
10.1 只允许 Gateway 作为入口
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: only-from-gateway
spec:
endpointSelector:
matchLabels:
app: demo
ingress:
– fromEntities:
– gateway
toPorts:
– ports:
– port: "80"
protocol: TCP
十一、可观测性验证（Hubble）
hubble observe –protocol http
十二、迁移建议（从 Nginx Ingress 到 Gateway API）
推荐迁移路径：
