Documentation
Thanks to all our contributors!💜💜💜
⚠️ Action Required
Gateway API CRD Updates (All Gateway API users)
Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller.
Why: This release requires Gateway API CRDs v1.6.0. The controller is built against this version for conformance and feature support
Important: Update CRDs before upgrading the controller. If you upgrade the controller first, NLB Gateway (TCPRoute/UDPRoute/TLSRoute) will be automatically disabled until the CRDs are updated. Since the standard install no longer serves v1alpha2, you must update any existing v1alpha2 route manifests to gateway.networking.k8s.io/v1
Action: Apply v1.6 Gateway CRDs
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.0/standard-install.yaml
LBC Gateway CRD Updates (All Gateway API users)
Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller.
Why: This release adds v1 as the storage version for LBC-specific Gateway CRDs (LoadBalancerConfiguration, TargetGroupConfiguration, ListenerRuleConfiguration), with v1beta1 marked as deprecated. The controller reads v1 only, but existing v1beta1 resources are transparently converted to v1 by the API server — no immediate manifest changes required. However, v1beta1 will stop being served in a future release. We recommend updating your manifests to use gateway.k8s.aws/v1 at your earliest convenience.
Action: Apply the updated LBC Gateway CRDs:
kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml
🚀What's New
Gateway API v1 Graduation
This release graduates Gateway API support to v1 for L4 routes. TCPRoute and UDPRoute now use the stable gateway.networking.k8s.io/v1 API version (previously v1alpha2), and the controller passes Gateway API conformance v1.6.0. The AWS-vended Gateway API CRDs have been upgraded to v1 accordingly.
🔧Enhancements and Fixes
Certificate Management
- Fix ACM certificate creation for Ingresses with wildcard hosts — the character in hostname was breaking ACM tag validation Certificate list support for ECDSA/RSA use
- Add certificate management controller flag to helm chart
Route Precedence
- Unified cross-kind route precedence for HTTPRoute/GRPCRoute, single code path eliminates non-transitivity
- Fix non-transitive rule precedence for routes without hostnames
Networking
- Filter EndpointSlices by IP family for target group registration
- Match hosted zones by longest suffix in GetHostedZoneID
- Fix: ICMP Type/Code constants
- Fix: render feature gates as parseable key-value pairs
Module & Build
- Module path updated to
sigs.k8s.io/aws-load-balancer-controller/v3. Users who are importing the code base will need to adjust their imports accordingly.
Helm
- Correct enableEndpointSlices default in Helm values comment
📖 Documentation Updates
- Add guidance on migrating between services without downtime
- Clarify scheme change replacement behavior
- Fix Markdown formatting of blue/green guide
- Fix stale contributor setup and invalid IAM role ARN examples
- Fix doc annotation name
- Fix admonition indentation for ipam-ipv4-pool-id annotation
- Clarify WAF addon ownership and document IngressGroup security risks
- Remove CloudFormation link
What's Changed
- Fix Markdown formatting of blue/green guide by @Tenzer in #4835
- ci: Add GO-2026-5932 to govulncheck ignore list by @shraddhabang in #4839
- use /v3 in module name by @zac-nixon in #4770
- feat(gateway): Use Gateway API v1 for TCPRoute and UDPRoute by @nicomazzarello in #4829
- upgrade AWS vended Gateway API CRDs to v1 by @zac-nixon in #4844
- update code to use v1 crds by @zac-nixon in #4845
- Add label for accessing secrets - to support restricted access for EKS Auto LBC by @jupdec in #4838
- docs: fix admonition indentation for ipam-ipv4-pool-id annotation by @nikhilmaheshwari24 in #4837
- v1.6.0 conformance + rule refactor by @zac-nixon in #4861
- fix: handle invalid condition name for tgb by @zac-nixon in #4862
- Fix ACM certificate creation for Ingresses with wildcard hosts by @nbr in #4786
- docs: clarify scheme change replacement by @kappa8219 in #4860
- fix: use "/" separator in getCacheKey to avoid TGB cache collisions by @jupdec in #4864
- fix: subnet auto-discovery to IPv6-capable subnets for dualstack ip address type by @jupdec in #4865
- Add ipv6 check for tests by @wweiwei-li in #4868
- cut v3.5.0 release by @wweiwei-li in #4869
New Contributors
- @Tenzer made their first contribution in #4835
- @nicomazzarello made their first contribution in #4829
- @nikhilmaheshwari24 made their first contribution in #4837
- @kappa8219 made their first contribution in #4860
Full Changelog: v3.4.2...v3.5.0