Why Stack Overflow Migrated from Ingress-NGINX to Istio Gateway API

How we replaced NGINX-Ingress at Stack Overflow

Stack Overflow replaced its legacy Ingress-NGINX controller with Istio to manage traffic across GKE and Azure clusters. The migration was triggered by the retirement of Ingress-NGINX, forcing a transition to the newer Kubernetes Gateway API standard.

Why This Matters

While the Gateway API provides a standardized interface for traffic routing, actual performance and feature depth vary significantly between implementations. Stack Overflow’s testing revealed that while multiple controllers are ‘conformant,’ they handle high-scale route updates differently; for instance, NGINX Gateway Fabric experienced significant latency spikes during route changes that Istio and Traefik avoided. This highlights the gap between API compliance and production readiness under high-churn environments.

Key Insights

• Istio and NGINX Gateway Fabric converged 5,000 routes in approximately 42 seconds, while Traefik timed out after 5 minutes in 2026 benchmarks.
• Standard Gateway API HTTPRoute header modifications are limited to static values, requiring vendor-specific extension points for dynamic regex-based overwrites.
• Performance testing at 10,000 RPS with 150ms simulated latency showed all three candidates—Istio, Traefik, and NGINX—performed similarly in steady states.
• NGINX Gateway Fabric displayed major latency spikes when updating a single HTTPRoute while 1,000 routes were active, a behavior not seen in Istio.
• Stack Overflow used Claude to analyze and bucket existing production Ingress objects to identify six core routing use cases for migration testing.

Working Examples

Benchmark logs showing convergence times for 5,000 HTTPRoutes across different Gateway API implementations.

=== RUN TestRoutedPaths/gw-nginx
gateway_test.go:431: all 5000 routes converged in 42.047s
=== RUN TestRoutedPaths/gw-istio
gateway_test.go:431: all 5000 routes converged in 41.981s
=== RUN TestRoutedPaths/gw-traefik
--- FAIL: TestRoutedPaths/gw-traefik (304.88s)

Practical Applications

• Use case: Stack Overflow verified dynamic header overwrites using HTTPBin’s /headers endpoint to introspect request/response cycles. Pitfall: Relying on standard Gateway API filters for dynamic logic, which often requires implementation-specific xRoute extensions.
• Use case: Enterprise multi-tenancy scaling where each customer receives multiple routes, tested up to 1,000 HTTPRoutes per gateway. Pitfall: Scaling beyond 1,000 routes on a single gateway can lead to extreme latency and client-side timeouts during heavy load.

References:

• https://stackoverflow.blog/2026/05/06/how-we-replaced-nginx-ingress-at-stack-overflow/