The chroot release :)
If you want to take full advantage of the security improvements in this release, and also want to take a look into the chroot feature, change the image in your manifest to use controller-chroot:v1.2.0 image and add the SYS_CHROOT capability.
We are going to release soon a blog post about this release!
Images:
- k8s.gcr.io/ingress-nginx/controller:v1.2.0@sha256:d8196e3bc1e72547c5dec66d6556c0ff92a23f6d0919b206be170bc90d5f9185
- k8s.gcr.io/ingress-nginx/controller-chroot:v1.2.0@sha256:fb17f1700b77d4fcc52ca6f83ffc2821861ae887dbb87149cf5cbc52bea425e5
This new release contains the following changes that need attention:
- A new deep inspector for objects. Now every time an object gets to be reconciled/added, it will pass entirely through a validation (this may lead to some CPU increase)
- The NGINX process now can be chrooted/jailed inside the ingress container, for security reasons. This option is disabled by default and will be enabled in future releases. This new option requires the SYS_CHROOT capability to be added to the Pod
What's Changed
- Upstream keepalive time by @sskserk in #8319
- update base images and protobuf gomod by @rikatz in #8478
- added new auth-tls-match-cn annotation by @chrisshino in #8434
- changed nginx base img tag to img built with alpine3.14.6 by @longwuyuan in #8479
- change tag to v120beta1 by @longwuyuan in #8480
- Fix log creation in chroot script by @rikatz in #8481
- Release chart v1.2.0-beta.1 by @rikatz in #8484
- Fallback to ngx.var.scheme for redirectScheme with use-forward-headers when X-Forwarded-Proto is empty by @phidlipus in #8468
- force helm release to artifact hub by @strongjz in #8417
- fix change log changes list by @strongjz in #8421
- kubectl-plugin code overview info by @kundan2707 in #8405
- Darwin arm64 by @jsoref in #8399
- Add dependency review enforcement by @rikatz in #8443
- Bump github.com/prometheus/common from 0.32.1 to 0.33.0 by @dependabot in #8426
- replace deprecated topology key in example with current one by @froblesmartin in #8444
- typo fixing by @chienfuchen32 in #8447
- Fix suggested annotation-value-word-blocklist by @sathieu in #8446
- Add keepalive support for auth requests by @leki75 in #8219
- Jail/chroot nginx process inside controller container by @rikatz in #8337
- Update index.md by @ndunks in #8454
- Update dependencies by @rikatz in #8455
- Implement object deep inspector by @rikatz in #8456
- Fix for buggy ingress sync with retries by @davideshay in #8325
- Improve req handling dashboard by @naseemkullah in #8322
- Prepare v1.2.0-beta.0 release by @rikatz in #8464
- chore: v1.2.0-beta.0 release by @tao12345666333 in #8465
New Contributors
- @chrisshino made their first contribution in #8434
- @phidlipus made their first contribution in #8468
- @froblesmartin made their first contribution in #8444
- @chienfuchen32 made their first contribution in #8447
- @ndunks made their first contribution in #8454
- @davideshay made their first contribution in #8325
Full Changelog: controller-v1.1.3...controller-v1.2.0
Thank you all for our amazing community!