v3.4.1 Release Notes

📚 Quick Links

Action : Please apply the latest CRD definitions

kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

Ingress Features

ECDSA/RSA Certificate Auto-Discovery (PR #4490): The controller now supports automatic discovery of both ECDSA and RSA certificates from ACM when building the certificate list for Ingress resources. This enables dual-certificate configurations for optimized TLS performance across different client types.
Gateway API Features
Shared Hostname for HTTPRoute and GRPCRoute (PR #4794): HTTPRoute and GRPCRoute resources can now share the same hostname on a Gateway listener. The overlapping hostname restriction between HTTP and gRPC routes has been removed, enabling mixed protocol configurations on the same domain.

[Bug fix] Filter EndpointSlices by IP family for target group registration — prevents IPv4 addresses from being registered to IPv6 target groups (#4783)
[Bug fix] Match hosted zones by longest suffix in GetHostedZoneID — fixes DNS validation for deeply nested subdomains and wildcard SANs (#4785)
[Bug fix] Fix non-transitive rule precedence for routes without hostnames — catch-all routes no longer intermittently sort above host-specific rules (#4809)
[Bug fix] Fix ICMP Type/Code constants (#4799)
[Bug fix] Fix render feature gates as parseable key-value pairs (#4757)
[Enhancement] Add enableCertificateManagement controller flag to Helm chart (#4726)

[fix] filter EndpointSlices by IP family for target group registration by @shuqz in #4783
[fix] doc annotation name by @shuqz in #4787
refactor ipv6 testing by @zac-nixon in #4788
add ipv6 annotations to cert generation tests by @zac-nixon in #4790
Match Route53 hosted zones by longest suffix in GetHostedZoneID by @nbr in #4785
Fix feature gates string representation by @immanuwell in #4757
add source nat setting so udp tests pass on ipv6 cluster by @zac-nixon in #4795
skip service quic tests when using ipv6 by @zac-nixon in #4796
Clarify WAF addon ownership and document IngressGroup security risks by @wweiwei-li in #4797
fix: ICMP Type/Code constants by @wweiwei-li in #4799
docs: fix stale contributor setup and invalid IAM role ARN examples by @immanuwell in #4791
Auto discovery default certificate and certificate list by @abeowlu in #4490
[Gateway API]remove overlapping check in httpRoute and GRPCRoute by @shuqz in #4794
fix(cert_management): add default-pca-arn controller flag to helm chart by @the-technat in #4726
Fix non-transitive rule precedence for routes without hostnames by @sergeylanzman in #4809
Fix incorrect enableEndpointSlices default in Helm values.yaml comment by @BobDu in #4806
cut v3.4.1 release by @shraddhabang in #4813

Full Changelog: v3.4.0...v3.4.1