NGINX Ingress Controller 5.7: HTTP/2 to backends and Opaque Secrets

NGINX Ingress Controller reaches version 5.7.0, released on 14 October 2026 on the project's GitHub repository. For those running Kubernetes clusters and using this controller to expose services externally, the most practical improvement is HTTP/2 support on the path to upstream services.

HTTP/2 all the way to the backend

Previously, the controller always spoke HTTP/1.1 with the Services behind it, even when those Services could handle cleartext HTTP/2 (h2c). With 5.7, you can set proxy-http-version: 2 on VirtualServer, VirtualServerRoute, or use the nginx.org/proxy-http-version annotation on Ingress. If the field is left empty, the controller auto-detects it when the Service declares appProtocol: kubernetes.io/h2c, without needing to touch existing Ingress resources.

Opaque Secrets without duplication

Previously, you had to use typed Secrets (kubernetes.io/tls, nginx.org/ca, etc.), which meant duplicating whatever was created by kubectl create secret generic or external secret management tools into a separate Secret. From this version onwards, the correct keys (tls.crt/tls.key, ca.crt, htpasswd) inside an Opaque-type Secret are sufficient. The controller now validates the content rather than the declared type.

cert-manager and HTTPS redirects

Those using cert-manager with HTTP-01 challenges on a host that redirects everything to HTTPS previously had to either temporarily disable the redirect or write a snippet. With 5.7, the path /.well-known/acme-challenge/ is automatically recognised and excluded from redirects and authentication, both on VirtualServer (requires the -enable-cert-manager flag) and on Ingress.

Other release highlights

Among the changes noted in the release notes: VirtualServerRoute can now be shared by multiple VirtualServers without a fixed host, the least_time load-balancing algorithm is now available in NGINX Open Source (previously limited to NGINX Plus), topology-aware routing can keep traffic within the same zone or node as the pod, and the Helm chart supports multiple Services in front of the same controller.

It is worth noting that this project (repository nginx/kubernetes-ingress) is not the same as the community ingress-nginx maintained by the Kubernetes Community. The community project's maintenance cycle ends in March 2026—these are two separate projects often confused with one another. The NGINX/F5 controller, according to data published by the company, holds around 40% market share and has over 10 million downloads.

The project remains distributed under the Apache 2.0 licence in its open-source version; integration with NGINX Plus adds paid enterprise features but is not required to use the improvements in this release.