Ingress controller migration: up ctx fails or control plane unreachable after switching ingress controllers

Symptoms

After migrating the ingress controller fronting Spaces (e.g. NGINX Ingress Controller → Traefik or similar), the up CLI fails, even though the ingress and spaces-router backend otherwise look healthy:

up: error: failed to get server groups: the server was unable to return a response in the time allotted, but may still be processing the request

up: error: Get "https:///api/v1/namespaces/upbound-system/configmaps/ingress-public": context deadline exceeded

Root cause

ingress.host isn't set in the Spaces Helm values. Spaces uses this value to populate:

• The PUBLIC_HOST environment variable on the Spaces Router

• The ingress-public ConfigMap in upbound-system, which the up CLI reads to discover the Spaces endpoint

Without it, both default to proxy.upbound-127.0.0.1.nip.io, a local dev placeholder that won't work outside a local cluster. This surfaces during ingress migrations because that's usually when people are touching this part of the values file, but it isn't specific to any particular ingress controller.

Fix

Set ingress.host explicitly in the Spaces Helm values, both before and after any ingress controller migration:

ingress:
  host: "<your-public-hostname>"

If your CNI enforces network policies, also set the controller-specific ingress.podLabels and ingress.namespaceLabels for whichever controller now fronts Spaces, so traffic is allowed into the Spaces Router.

ingress:
  podLabels:
    app.kubernetes.io/name: "traefik"
  namespaceLabels:
    kubernetes.io/metadata.name: "traefik"

Don't manually patch ingress-public

It's tempting to patch the ConfigMap directly as a quick fix. Don't rely on this: it doesn't survive chart upgrades and won't propagate to other places that read ingress.host (like PUBLIC_HOST). Set the Helm value instead.

Choosing and configuring your new ingress controller

Spaces needs end-to-end TLS passthrough to spaces-router, not TLS termination and re-encryption. For controller-specific setup (including the Traefik path, annotation mappings, and running old/new controllers side by side for a zero-downtime cutover), see the ingress-nginx migration guide.