--- title: ingress-nginx hits end of life, Cloudflare runs Kimi... description: A curated roundup of infrastructure and platform news: ingress-nginx reached end of life in March 2026 with no further security patches, and teams are advised... canonical: https://daily.dev/posts/ingress-nginx-hits-end-of-life-cloudflare-runs-kimi-k2-5-at-frontier-scale-arw8vabr6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ingress-nginx hits end of life, Cloudflare runs Kimi K2.5 at frontier scale | daily.dev og:description: A curated roundup of infrastructure and platform news: ingress-nginx reached end of life in March 2026 with no further security patches, and teams are advised... og:url: https://daily.dev/posts/ingress-nginx-hits-end-of-life-cloudflare-runs-kimi-k2-5-at-frontier-scale-arw8vabr6 og:image: https://api.daily.dev/og/posts/aRw8vAbR6.png og:image:alt: ingress-nginx hits end of life, Cloudflare runs Kimi K2.5 at frontier scale og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ingress-nginx hits end of life, Cloudflare runs Kimi K2.5 at frontier scale **[Backend Digest](https://daily.dev/sources/backend_digest)** · 4 min read · 1 upvotes · 0 comments ## Summary A curated roundup of infrastructure and platform news: ingress-nginx reached end of life in March 2026 with no further security patches, and teams are advised to migrate to Kubernetes Gateway API. Cloudflare added frontier-scale model support to Workers AI with Kimi K2.5, reporting 77% cost reduction on internal agentic workloads via custom inference infrastructure. Databricks shipped real-time mode for Spark Structured Streaming into GA, with early adopters hitting sub-100ms P99 latency on fraud detection pipelines. A survey of 5,200+ MCP servers found only 8.5% use OAuth, with documented CVEs and serious security risks from long-lived credentials in agent contexts. Additional items cover DynamoDB internals, Docker build cache optimization, distributed tracing sampling pitfalls, and Kubernetes GPU resource allocation changes. ## Content **TLDR:** The ingress-nginx controller was officially retired in March 2026, leaving clusters without security patches unless teams migrate. Cloudflare added frontier-scale model support to Workers AI, launching with Kimi K2.5 and reporting a 77% cost reduction on internal agentic workloads. Databricks shipped real-time mode for Spark Structured Streaming into GA, with early adopters hitting sub-100ms P99 latency. MCP server auth remains a mess — only 8.5% of analyzed servers use OAuth, and the CVEs are starting to pile up. --- ## ingress-nginx officially retired The ingress-nginx controller reached end of life in March 2026. No more security patches, no bug fixes. If you're still running it, you're accumulating unpatched CVEs with no upstream remediation path. The migration target is Kubernetes Gateway API — on EKS specifically, the AWS Load Balancer Controller routes directly to pod IPs, eliminating the NGINX proxy hop and the single-pod OOM failure risk that anyone who's run ingress-nginx in production has hit at least once. Watch the controllerName gotcha: it's `gateway.k8s.aws/alb`, not `eks.amazonaws.com/alb`, and that mistake will cost you time. ## Cloudflare Workers AI now runs frontier-scale models Cloudflare launched Kimi K2.5 on Workers AI — 256k context, multi-turn tool calling, vision inputs. To support models at this scale, they built custom kernels on their Infire inference engine with disaggregated prefill and tensor/expert parallelism. Internally, they ran it on a security review agent processing 7 billion tokens per day and reported 77% lower cost versus mid-tier proprietary models. Two new platform features ship alongside: prefix caching with session affinity headers to cut TTFT on multi-turn conversations, and a pull-based async API for high-volume non-real-time workloads. ## Databricks Spark Structured Streaming real-time mode goes GA Databricks is calling this millisecond-level latency without leaving the Spark ecosystem. Real-time mode replaces microbatching with continuous data flow and requires a single config flag on Databricks Runtime 16.4+. Coinbase, DraftKings, and MakeMyTrip are listed as early adopters, reporting 80%+ latency reductions and sub-100ms P99s on fraud detection and ML feature pipelines. The pitch is Flink-comparable latency without the operational cost of running a separate streaming engine. ## MCP server auth is still largely broken A survey of 5,200+ MCP servers found only 8.5% use OAuth. The rest rely on static API keys or PATs — which means long-lived, broadly scoped credentials sitting in agent contexts. Real incidents are already documented, including CVEs in Anthropic's own reference implementation. The right architecture separates resource servers from authorization servers, uses per-tool scopes, and treats agents as distinct identities with short-lived tokens. This isn't a nice-to-have; agents with persistent credentials and broad access are a serious blast radius problem. --- ## Also notable - **Outbox pattern in Go/PostgreSQL:** Solid walkthrough covering transactional outbox with pgx, `FOR UPDATE SKIP LOCKED` for concurrent relay processing, and PostgreSQL WAL-based logical replication as a lower-latency alternative. - **DynamoDB internals deep dive:** Covers the full request path through five internal services, quorum-based writes, lease-based leader failover, log replicas for fast quorum restoration, and the MEMSDS metadata cache that prevents thundering herd on partition lookups. - **Slack notification system rebuild:** Unified three-option preference model replaced four conflicting legacy models; migration used read-time fallbacks instead of database changes for safe rollback. Settings engagement increased 5x post-launch. - **Databricks RTM vs. Flink:** The GA announcement positions RTM as a direct Flink alternative — worth watching whether the operational simplicity claim holds at the tail of the latency distribution. - **AKS adds DRA-backed NVIDIA vGPU support:** Dynamic Resource Allocation replaces static GPU device plugins; physical GPUs partitioned at the hypervisor into fixed slices (1/6, 1/3, 1/2). GKE and EKS are moving the same direction — static device plugins are on their way out. - **Morgan Stanley at QCon London:** First API deployment time dropped from two years to one or two weeks after adopting FINOS CALM for architecture-as-code with auto-generated deployment configs and Spectral-based compliance validation. - **Distributed tracing sampling:** Good reminder that accurate RED metrics cannot be reconstructed from sampled traces — metrics must be materialized before sampling discards spans, and SDK-level metric emission is inconsistent enough that pipelines often have to own this. - **Durable migrates to Vercel with 6 engineers:** 3 million customers, 360 billion tokens per year, 3-4x infrastructure cost reduction. The interesting detail is per-customer cost attribution at that scale, not the migration itself. - **Proactive Kubernetes scaling at the edge:** Default reactive HPA struggles with sudden traffic spikes; proactive approaches that anticipate demand smooth out instance churn on resource-constrained edge nodes. - **Docker build cache optimization:** Dependency-first layer ordering, BuildKit mount caches, and registry-backed CI cache backends. Claimed 85% improvement on code-only changes, 98% on warm builds. ## Similar posts on daily.dev - [Ingress NGINX is EOL: A practical guide for migrating to Kubernetes Gateway API](https://daily.dev/posts/ingress-nginx-is-eol-a-practical-guide-for-migrating-to-kubernetes-gateway-api-fj854bzvi) · Datadog · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#cloudflare](https://daily.dev/tags/cloudflare), [#apache-spark](https://daily.dev/tags/apache-spark), [#mcp](https://daily.dev/tags/mcp) [View this post on daily.dev](https://daily.dev/posts/ingress-nginx-hits-end-of-life-cloudflare-runs-kimi-k2-5-at-frontier-scale-arw8vabr6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/ingress-nginx-hits-end-of-life-cloudflare-runs-kimi-k2-5-at-frontier-scale-arw8vabr6","headline":"ingress-nginx hits end of life, Cloudflare runs Kimi K2.5 at frontier scale","text":"A curated roundup of infrastructure and platform news: ingress-nginx reached end of life in March 2026 with no further security patches, and teams are advised to migrate to Kubernetes Gateway API. Cloudflare added frontier-scale model support to Workers AI with Kimi K2.5, reporting 77% cost reduction on internal agentic workloads via custom inference infrastructure. Databricks shipped real-time mode for Spark Structured Streaming into GA, with early adopters hitting sub-100ms P99 latency on fraud detection pipelines. A survey of 5,200+ MCP servers found only 8.5% use OAuth, with documented CVEs and serious security risks from long-lived credentials in agent contexts. Additional items cover DynamoDB internals, Docker build cache optimization, distributed tracing sampling pitfalls, and Kubernetes GPU resource allocation changes.","url":"https://daily.dev/posts/ingress-nginx-hits-end-of-life-cloudflare-runs-kimi-k2-5-at-frontier-scale-arw8vabr6","datePublished":"2026-03-20T04:18:37.496Z","dateModified":"2026-03-20T04:19:01.554Z","author":{"@type":"Organization","name":"Backend Digest","logo":"https://media.daily.dev/image/upload/s--9uCSrsAb--/f_auto,q_auto/v1773839398/logos/backend_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/backend_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/backend_digest","name":"Backend Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Backend Digest","item":"https://daily.dev/sources/backend_digest"},{"@type":"ListItem","position":3,"name":"ingress-nginx hits end of life, Cloudflare runs Kimi K2.5 at frontier scale"}]} ```