NGINX Gateway Fabric 2.8: IP lists, passive health checks and sticky sessions on OSS

NGINX released version 2.8.0 of NGINX Gateway Fabric on 14 October 2026, the open-source controller that implements the Kubernetes Gateway API using NGINX as the data plane. For teams managing clusters with multiple application teams, the release adds traffic control features that previously required hand-written NGINX snippets or the commercial NGINX Plus version.

Key new features

The most operational feature is AccessPolicy: a resource that allows you to set allow or deny lists for IP addresses or CIDR blocks on a Gateway, HTTPRoute or GRPCRoute, up to 64 rules per policy. A policy at Gateway level covers all connected routes; if both the Gateway and the route set Allow rules, the route's rule can only restrict the Gateway's range, never expand it. A blocked request receives a 403 Forbidden response.

Passive health checks are also coming to UpstreamSettingsPolicy: the maxFails and failTimeout parameters correspond to NGINX directives max_fails and fail_timeout, and allow you to decide per service how many failed attempts within what time window remove a backend from rotation, and for how long it stays out.

The third feature is session persistence based on cookies for HTTPRoute and GRPCRoute routes, previously available only with NGINX Plus and now also brought to NGINX Open Source via the sticky directive, present in NGINX OSS from 1.29.6. The sessionPersistence field remains experimental and the Gateway API already considers it deprecated in favour of a new API on the Backend resource.

Other changes include: automatic creation of Prometheus ServiceMonitor for control plane and data plane, sending access logs to files or syslog servers in addition to stdout, and updates to the rolling upgrade mechanism to prevent old pods receiving configurations intended for the new version.

Considerations before upgrade

Two changes break compatibility with previous versions: support for nginx.org/htpasswd type Secrets for authentication has been removed, and NGINX Gateway Fabric no longer sets the loadBalancerClass on the Gateway Service by itself. Those upgrading from version 2.7 should check both points in the release notes before proceeding.

Compatibility

It's worth noting that NGINX Gateway Fabric should not be confused with NGINX Ingress Controller: they are two distinct projects with different configuration models and separate NGINX instances, and installing one does not automatically activate the other. Version 2.8.0 requires Kubernetes 1.32 or later and is aligned with Gateway API 1.6.3; as data plane it supports NGINX Open Source 1.31.7 or NGINX Plus R37.2.

NGINX Gateway Fabric is not a Prime Software product.