kubernetes-sigs/aws-load-balancer-controller v3.6.3

on GitHub

⚠️ Upgrade Notes

No CRD updates required. This is a patch release with no CRD changes. Upgrading the controller is sufficient.

If you are coming from a release older than v3.6.0, apply the CRD steps from the v3.6.0 release notes first.

🔒 Security

Controller rebuilt on Go 1.27.4 and updated golang.org/x/net
The controller is now built with the Go 1.27.4 toolchain (from 1.26.10) and golang.org/x/net v0.62.0 (from v0.60.0), picking up the security fixes in the Go standard library and x/net that those releases carry. x/net is linked into the controller binary, so the rebuild reaches the released image. Supporting golang.org/x/{crypto,sync,sys,term,text,tools} modules were bumped along with it. No change to controller behavior or configuration. (#4952, @shraddhabang)

Controller image rebuilt on a newer base image
The controller image is now built on eks-distro-minimal-base-nonroot:2026-11-10-1794337279.2023 (from 2026-10-23-1792785692.2023), picking up the latest OS-package security fixes in the EKS-D minimal base. This is an image rebuild only; there is no change to controller behavior or configuration. (#4952, @shraddhabang)

🔧 Enhancements and Fixes

Helm chart

• Add matchConditions support to the Service webhook so it only fires for the Service objects it cares about (a good default is object.spec.type == 'LoadBalancer'). This lets users create other Service objects even when the webhook is unavailable, and removes a cyclical dependency during cluster bootstrap. (#4828, @BojanZelic-DD)

Endpoints

• Populate PodEndpoint.NodeReadyTime for ready endpoints whose node is Ready, not only for not-ready endpoints admitted on a Ready node. When a node flaps Ready → NotReady → Ready, the kubelet restores the pod's Ready condition with its original LastTransitionTime, so consumers measuring target-registration latency previously saw the pod's age (hours to days) for these re-registrations. Failing to read the node leaves NodeReadyTime zero (logged at V(1)); the endpoint is still returned, and endpoint selection is unchanged. (#4941, @zac-nixon)

Security groups

• Log security group ingress authorize/revoke failures at error level, including the security group ID, in AuthorizeSGIngress/RevokeSGIngress and in the per-security-group reconcile loop. Previously these failures were invisible in the controller logs and could only be found through CloudTrail, which made a shared-backend-SG failure that stalled reconciliation of multiple TargetGroupBindings hard to diagnose. Errors still propagate exactly as before; this only makes the existing failures observable. Fixes #3809. (#4924, @avneetbansal-aws)

Misc

• docs: fix invalid YAML in ingress annotation examples (#4950, @David-Uka)
• Update OWNERS file to modify approvers and reviewers (#4942, @bobert-2)

What's Changed

• Log security group ingress authorize/revoke failures by @avneetbansal-aws in #4924
• fix(endpoint): add node ready time for pods that are ready as well by @zac-nixon in #4941
• Update OWNERS file to modify approvers and reviewers by @bobert-2 in #4942
• add support for matchConditions in the helm chart by @BojanZelic-DD in #4828
• docs: fix invalid YAML in ingress annotation examples by @David-Uka in #4950
• Bump go version and base image by @shraddhabang in #4952
• cut v3.6.3 release by @shraddhabang in #4955

New Contributors

• @avneetbansal-aws made their first contribution in #4924
• @BojanZelic-DD made their first contribution in #4828
• @David-Uka made their first contribution in #4950

Full Changelog: v3.6.2...v3.6.3