惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
罗磊的独立博客
B
Blog RSS Feed
C
Check Point Blog
Project Zero
Project Zero
D
Docker
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
P
Palo Alto Networks Blog
L
LINUX DO - 热门话题
Scott Helme
Scott Helme
NISL@THU
NISL@THU
L
LangChain Blog
C
Cisco Blogs
Engineering at Meta
Engineering at Meta
Know Your Adversary
Know Your Adversary
雷峰网
雷峰网
S
Schneier on Security
MyScale Blog
MyScale Blog
博客园_首页
博客园 - 三生石上(FineUI控件)
C
CERT Recently Published Vulnerability Notes
美团技术团队
V
Visual Studio Blog
T
The Exploit Database - CXSecurity.com
Recent Announcements
Recent Announcements
G
GRAHAM CLULEY
T
Tor Project blog
V
Vulnerabilities – Threatpost
U
Unit 42
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
Stack Overflow Blog
Stack Overflow Blog
P
Privacy International News Feed
Security Latest
Security Latest
W
WeLiveSecurity
aimingoo的专栏
aimingoo的专栏
Hugging Face - Blog
Hugging Face - Blog
Google Online Security Blog
Google Online Security Blog
V2EX - 技术
V2EX - 技术
The Last Watchdog
The Last Watchdog
博客园 - Franky
T
Tenable Blog
云风的 BLOG
云风的 BLOG
D
DataBreaches.Net
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
Latest news
Latest news
N
News and Events Feed by Topic
Cloudbric
Cloudbric
Schneier on Security
Schneier on Security
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
Blog — PlanetScale
Blog — PlanetScale

NGINX Community Blog

External Authentication Policy in NGINX Ingress Controller: A Real World Use Case – NGINX Community Blog External Authentication Policy in NGINX Ingress Controller: Patterns for VirtualServer and Ingress – NGINX Community Blog mTLS Policies in NGINX Ingress Controller – NGINX Community Blog Optimising NGINX Ingress Controller Startup Performance – NGINX Community Blog Meet With Us: NGINX Gateway Fabric & NGINX Ingress Controller Community Calls  – NGINX Community Blog Security, Performance, and Easier Migration – NGINX Community Blog Strengthening the NGINX Community – NGINX Community Blog F5 WAF for NGINX Comes to the Gateway API – NGINX Community Blog Cache Policy in NGINX Ingress Controller: A Practical Guide for VirtualServer – NGINX Community Blog Access Control Policy in NGINX Ingress Controller: Patterns for Ingress – NGINX Community Blog Enterprise-Grade Features and Gateway API 1.5 Conformance – NGINX Community Blog NGINX OSS 1.29.6 and 1.29.7: Open-sourced Session Persistence, Multipath TCP and More – NGINX Community Blog Keep-alive to upstreams is now default in NGINX 1.29.7 – NGINX Community Blog CORS Policy in NGINX Ingress Controller v5.4.0: Patterns for VirtualServer and Ingress – NGINX Community Blog A Community Hub for NGINX on Kubernetes, Including a New Ingress-NGINX Migration Tool – NGINX Community Blog
How NGINX Ingress Controller and NGINX Gateway Fabric Handle Kubernetes Backend Changes Natively – NGINX Community Blog
Micheál Kingston · 2026-04-29 · via NGINX Community Blog

Kubernetes applications are designed to change constantly. Pods scale out, roll forward, restart, and disappear, so the traffic layer has to keep pace with a backend set that is never truly static.

That is the backdrop for both NGINX Ingress Controller (NIC) and NGINX Gateway Fabric (NGF). In both cases, Kubernetes is the source of truth for backend membership, and the controller layer translates backend changes into active NGINX configuration.

The Real Goal

For platform teams, the goal is simple: when a Deployment scales in or out, upstream membership should change automatically, without anyone manually editing NGINX configuration.

That is the core value of the Kubernetes-native model used by both products. Kubernetes keeps track of which backends belong behind a Service, and the controller keeps NGINX aligned with that current backend set.

Not a Manual Config Problem

It is easy to think of backend discovery as a DNS problem, but for normal in-cluster routing the more important fact is that Kubernetes already knows which pods sit behind a Service. NGINX Ingress Controller and NGINX Gateway Fabric are built to consume that Kubernetes state and turn it into an upstream configuration that NGINX can use.

The practical result is that upstream changes caused by scaling events are handled natively by the product rather than by a human updating server lists in configuration files. When the backend set changes, the controller updates what NGINX should send traffic to based on Kubernetes state.

NGINX Ingress Controller and NGINX Gateway Fabric in Practice

For NGINX Ingress Controller, the behavior is straightforward. The NGINX Ingress Controller watches Kubernetes resources related to backend reachability and translates those changes into NGINX upstream updates. With NGINX Plus, those upstream changes can be applied dynamically. With NGINX Open Source, the controller still follows Kubernetes changes automatically, but the update path relies on regenerating configuration and reloading NGINX.

NGINX Gateway Fabric follows the same Kubernetes-native model. The NGINX Gateway Fabric control plane watches cluster state, translates Gateway API intent into NGINX configuration, and pushes those changes into the data plane. The result is the same from an operator perspective: upstream membership is maintained by the product as the backend set evolves.

Example: The Cafe App

Consider a cafe application exposed through a Kubernetes Service named cafe. At 9:00 a.m., the cafe Deployment is running with 2 pod replicas, so the cafe Service has two live backend endpoints.

If NGINX Ingress Controller is fronting that application, NGINX Ingress Controller sees the backend endpoints associated with the cafe Service and builds an upstream with those two pod IPs. If NGINX Gateway Fabric is fronting the same application through Gateway API resources, NGF does the equivalent thing through its control plane and data plane model.

Now imagine a traffic spike during lunch. The cafe Deployment scales from 2 replicas to 10 replicas. Kubernetes updates the endpoint data for the cafe Service to reflect the 10 running pods.

At that point, nobody should need to open an NGINX config file and add eight new upstream servers by hand. NGINX Ingress Controller and NGINX Gateway Fabric are expected to absorb that change natively: they observe the updated Kubernetes backend state and keep the active upstream aligned with the current set of 10 pod IPs.

That is the operational outcome that matters most. Scaling the application changes the Kubernetes backend set, and the ingress or gateway layer follows automatically.

Why it Matters

This matters because autoscaling, rolling deployments, and pod replacement are normal operating conditions in Kubernetes. A traffic layer that requires manual config edits every time a backend set changes would not fit how modern clusters actually run.

The better model is for upstream changes to be handled as a native part of Kubernetes traffic management. That is the common story across NGINX Ingress Controller and NGINX Gateway Fabric: backend changes originate in Kubernetes, the controller observes them, and NGINX is kept aligned with the current set of running application backends.

NGINX Community Forum