Compatibility with nginx-ingress >= 1.12.0

[blotus]

The ingress-nginx project has removed support for plugins (PR here).

This prevents the remediation component from working, as the code is not even loaded anymore.

We are exploring options to workaround this, but in the meantime, we need to update the documentation to warn users that 1.12 is not compatible with the remediation component.

[oleghalin]

Hello.

I think its possible to bundle plugin into image and distribute it to workloads from private regitstry?

[EvilPingu]

Are here any news?

[rmdes]

any news ?

[blotus]

Hello,

We are still working on this.
We want to avoid providing the ingress image ourselves or asking the users to build it, as this comes with heavier maintenance than the current solution (although, it might comes to this if we don't find another solution).

[sixgunnar]

Hi, great to hear you are working on it. A more difficult solution is ok if there's no simpler solution.
I guess the Kubernetes team won't change their mind about Lua plugins.

[AkshayAshirvad-Affinsys]

Any Update on this ..?

[EthraZa]

Hi. Any news?
If not, I guess that drop Nginx Ingres Controller in favor of Traefik Ingress Controller is the only viable option!?

[theadzik]

At KubeCon London 2025 ingress-nginx maintainers said that in ~18 months ingress-nginx will be archived (https://youtu.be/EeegJKZ_4g0?si=HNcAMUbtxWaN1d7c&t=1380). They want to focus on InGate (https://github.com/kubernetes-sigs/ingate).

I think it's a good time to start migrating away from ingress-nginx.

[EthraZa]

Last 2 days I got CrowdSec working with Traefik Ingress. I'm migrating it from a Docker Swarm env (with Traefik Proxy).

Here are the sites I've take a look to make it happen in a K8S env:

https://github.com/traefik-workshops/traefik-workshop?tab=readme-ov-file
https://doc.traefik.io/traefik/getting-started/install-traefik/#use-the-helm-chart
https://github.com/traefik/traefik-helm-chart/blob/master/README.md
https://aqibrahman.com/set-up-traefik-kubernetes-ingress-for-http-and-https-with-redirect-to-https
https://docs.vultr.com/how-to-secure-a-vke-cluster-using-traefik-certmanager-and-lets-encrypt

https://github.com/crowdsecurity/helm-charts/blob/main/charts/crowdsec/README.md
https://docs.crowdsec.net/u/getting_started/installation/kubernetes/#traefik
https://www.crowdsec.net/blog/kubernetes-security-with-crowdsec-waf
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin?tab=readme-ov-file

---

I would like to ask Crowdsec team to think about really embrace it and pump it docs and make a new official blog doc post showing full steps to get Traefik Ingress + Crowdsec (+custom scenarios). That would make life easyer and happyer. ;)
But thank you for a great software!

[P4F1]

Any update ?

[mmetc]

You can use ingress-nginx controller 1.12.1 by changing the image, but it's from my personal fork and I don't have yet an estimate of when it will be updated to 1.12.3 and merged to the crowdsecurity org

$ cat crowdsec-ingress-bouncer.yaml 
controller:
  image:
    registry: ghcr.io
    image: mmetc/ingress-nginx/controller
    tag: "v1.12.1"
    digest: "sha256:b8cbb0d1d73e7516fe0d83d2228a16e2ada1f6a04fad61e1e345b52c7dda2705"
    digestChroot: "sha256:8c051eb30ddd22bc9e610267b5d73af6558fb842af4124d86e0b48e181c0b460"

If you can test it and report any issue, it can help

Thanks

[christopherbarnett-fivesigma]

Any update on this? I'm this close to changing to Traefik as a result of this, would be good to get some clarity, this seems like a fairly large issue and this forum is all I can find on "What now?" aside from switching to Traefik. Help us Obi Wan

[mmetc]

@christopherbarnett-fivesigma can you test the image I linked above?

Edit: to clarify - I backported plugin support to the 1.12 controller so it should works as well as the previous version. If we have positive feedback, we can release it from our main repository.

[christopherbarnett-fivesigma]

@mmetc Whilst I appreciate the effort, I'm actually behind the removal of Lua plugins, imo it's an insecure way of doing what should ideally be handled through a proper middleware or plugin interface. Relying on injected Lua in the ingress controller was always brittle, hard to audit, and a security liability.

I'd much rather see support for a clean, supported extension model (like middleware chaining) than continue down the path of patching deprecated behavior. That said, I completely respect the effort you've put in - just not a direction I'm comfortable relying on in production.