NGINX Ingress Controller 5.7.0: configurable HTTP version to backends per service

From NGINX Ingress Controller 5.7.0 onwards, you can decide which HTTP version the controller uses to communicate with backend pods, rather than always falling back to the HTTP/1.1 default. For those managing Kubernetes clusters with mixed backends — some already accepting cleartext HTTP/2 (h2c), others still stuck on HTTP/1.0 — the difference translates to fewer 502 Bad Gateway errors and fewer hand-crafted custom configurations to work around the limitation.

Three ways to set it

The controller offers three levers, in descending order of precedence:

1. Annotation on Ingress or field on VirtualServer: nginx.org/proxy-http-version: "1.0", "1.1" or "2" on the Ingress; native field proxy-http-version under upstreams in the VirtualServer.
2. appProtocol of the Service: if the Service port has appProtocol: kubernetes.io/h2c, the controller automatically generates proxy_http_version 2; without needing annotations.
3. Default: if nothing is set, HTTP/1.1 remains in force.

The Ingress annotation always takes precedence over what is declared by the Service, useful for temporarily forcing HTTP/1.1 during debugging without touching the Service manifest. In mergeable Ingresses (master/minion), an annotation on the master is inherited by minions that do not set their own.

Limitations to keep in mind

WebSocket requires HTTP/1.1 for the Upgrade mechanism: if a Service listed in nginx.org/websocket-services resolves to HTTP/2 or HTTP/1.0 (even by inference from appProtocol), the controller emits a warning event visible with kubectl describe ingress. gRPC backends are unaffected: they are always proxied with grpc_pass over HTTP/2, and the annotation is ignored with a corresponding warning. Headers also change: on HTTP/2 the controller omits Connection and Upgrade (forbidden by RFC 9113 §8.2.2), on HTTP/1.0 it sends Connection: close.

The context of the release

The feature is part of NGINX Ingress Controller 5.7.0, which on the official GitHub project is the current stable release. The same version, according to the official release blog, includes more than 30 bug fixes and stability improvements and addresses two external authentication bypass vulnerabilities, CVE-2026-94197 and CVE-2026-104939, a security detail worth knowing for anyone planning an upgrade. It is worth remembering that this project, developed by F5/NGINX, is distinct from the community ingress-nginx controller, which announced its retirement in March 2026 and will no longer receive updates or security patches: those still using the latter should evaluate migration.

For configuration details and complete examples, the official documentation remains the reference for the annotation and VirtualServer field.