⚠️ Upgrade Notes
No CRD updates required. This is a patch release with no CRD changes. Upgrading the controller is sufficient.
If you are coming from a release older than v3.6.0, apply the CRD steps from the v3.6.0 release notes first.
🔒 Security
Go toolchain and golang.org/x/net updated to clear 18 CVEs
The controller image is now built with Go 1.26.10 (from 1.26.6) and golang.org/x/net v0.60.0 (from v0.58.0), resolving 18 vulnerabilities reported against the controller binary — 4 HIGH, 13 MEDIUM, 1 LOW. The Go patch covers 13 stdlib findings including CVE-2026-78667 (DoS via crafted HTTP Range headers), CVE-2026-78669 (DoS via excessive HTTP/2 SETTINGS frames) and CVE-2026-97031 (crypto/tls DoS via ECH outer extension references). The x/net bump covers 5 HTTP/2 findings (CVE-2026-78669, -78659, -78660, -78663, -97032) spanning flow-control bypass, trailer handling and HPACK encoder DoS. (#4933, @shraddhabang)
No API, CRD or behavioral change — the go directive in go.mod remains at 1.26.5, so the minimum version for module consumers is unchanged.
🚀 What's New
Per-resource reconcile condition metric
A new awslbc_controller_reconcile_condition gauge reports whether the last reconcile of each individual resource succeeded (1) or failed (0), labelled by controller, namespace and name. Wired across the Ingress, Service, Gateway, TargetGroupBinding and GlobalAccelerator reconcilers. (#4812, @gurpalw)
Node Ready time exposed on pod endpoints
PodEndpoint now carries NodeReadyTime, the LastTransitionTime of the pod's node Ready condition. (#4932, @zac-nixon)
🔧 Enhancements and Fixes
Networking
- Treat
InvalidGroup.NotFoundas success when releasing the auto-generated backend security group — a group already deleted out-of-band no longer fails the reconcile, it is logged and the cached ID cleared (#4928)
Mutual authentication
- Move the mTLS config parsing helpers out of the Ingress listener model builder into
pkg/shared_utils, so Gateway and Ingress share one implementation (ParseMtlsConfigEntries). Pure refactor, no behavior change (#4918)
📖 Documentation Updates
- Document the new
awslbc_controller_reconcile_conditiongauge in the Prometheus metrics guide, with an example query for finding resources that are failing to reconcile (#4812)
What's Changed
- fix(scripts): eks-charts sync gh CLI compat + docs version bump by @shraddhabang in #4922
- fix(networking): treat InvalidGroup.NotFound as success in releaseSG by @nakshah87 in #4928
- Move mutual auth helpers to shared utils by @bobert-2 in #4918
- feat(metrics): add per-resource reconcile condition gauge by @gurpalw in #4812
- feat(backend): expose node Ready time on pod endpoints by @zac-nixon in #4932
- build(deps): bump go to 1.26.10 and golang.org/x/net to v0.60.0 by @shraddhabang in #4933
- cut v3.6.1 release by @shraddhabang in #4934
New Contributors
- @nakshah87 made their first contribution in #4928
- @gurpalw made their first contribution in #4812
Full Changelog: v3.6.0...v3.6.1