nginx/kubernetes-ingress v3.1.0

on GitHub

What's Changed

🚀 Features

• Reseting default TLS settings and making them optional by @jasonwilliams14 in #3302
• feat: Enable keepalive-time for healthchecks in VS and VSR by @ciarams87 in #3451
• Support empty path for ImplementationSpecific pathType by @ciarams87 in #3507
• Use new NSM Spiffe and Cert rotation library by @avahahn in #3482
• feat: Add initial support for SSL termination for TransportServer by @ciarams87 in #3462
• App Policy Bundle by @jjngx in #3560
• Prometheus tls path by @shaun-nx in #3615
• Push edge Helm Chart to OCI registries by @lucacome in #3581
• Use the "runtime default" seccomp profile by @sigv in #3629
• Remove app protect agent by @jjngx in #3646

🐛 Bug Fixes

• Support non-vs created Challenge Ingress by @ciarams87 in #3463
• Move logic for -enable-leader-election flag in helm templates by @shaun-nx in #3475
• Add missing OSS internal routes by @chase-kiefer in #3481
• Ensure non-ready endpoints are not added to upstreams by @shaun-nx in #3541
• Update keyCache path for JWKs to avoid conflict with OIDC by @shaun-nx in #3583
• Update proxy cache zone name by @shaun-nx in #3604
• set Content-Length "" for jwks uri and enable test by @vepatel in #3607
• remove unwanted chars from label value by @vepatel in #3660

📦 Helm Chart

• Allow extra args to be provided to the OIDC auth endpoint by @alanwilkie-finocomp in #3034
• Correct values.schema.json nodeSelector by @coolbry95 in #3449
• Fix Helm Chart Schema for priorityClassName by @lucacome in #3448
• Add websocket protocol option to monitor directive by @pasmant in #3442
• Add support for custom environment variables on the Nginx Controller container by @AaronShiels in #3326
• fix: Add OnDelete to allowed strategy values by @ciarams87 in #3519
• fix: controller.topologySpreadConstraints schema by @marcuz in #3527
• add pod disruption budget for ingress controller by @coolbry95 in #3248
• Update schema references to k8s v1.26.1 by @lucacome in #3537
• Update docs in main for Release 3.0.2 (#3547) by @ciarams87 in #3557
• chore: Add new label and metadata to pod by @ciarams87 in #3586
• Rework port binding logic without privileges by @sigv in #3573
• Fix Helm Chart labels and templates. Move version update to labels by @lucacome in #3606
• Configure IC root filesystem as read-only by @sigv in #3548
• feat: Add access token support in the OIDC by @shawnhankim in #3474
• Update nginx.org/ca secret type & crl field to IngressMTLS to support CRL by @shaun-nx in #3632
• Move NAP DoS chart to new repo by @lucacome in #3674

🧪 Tests

• DoS Status by @pasmant in #3379
• Move test containers to separate repo by @lucacome in #3454
• Add tests for jwt jwksuri by @vepatel in #3511
• make changes to req type and parameters by @vepatel in #3528
• Format shell scripts by @lucacome in #3590
• skip jwksuri test by @vepatel in #3612
• Add SBOMs for Docker images by @lucacome in #3627
• fix: Requeue DNSEndpoint request when create fails with already exists error by @ciarams87 in #3637

🔨 Maintenance

• Update workflow for UBI image by @lucacome in #3435
• Update packages for CVEs by @lucacome in #3447
• Fix dependabot for test deps and run checks weekly by @lucacome in #3452
• Fix dependabot for test by @lucacome in #3456
• chore: Output of gofumpt and remove deprecated reference by @ciarams87 in #3464
• Remove sync with internal repo by @lucacome in #3467
• Add missing file to update IC version for release by @haywoodsh in #3438
• Update package for CVE-2022-44617 by @lucacome in #3484
• Sync only once a week by @lucacome in #3494
• Remove tests from Docker update by @lucacome in #3485
• Change flow in CI workflow by @lucacome in #3505
• Only add the test container to cache once by @lucacome in #3518
• Update packages for CVE-2023-0286 by @lucacome in #3536
• Decouple UBI images for Plus and NAP by @lucacome in #3540
• Update labels and issue docs by @lucacome in #3553
• Replace deprecated command with environment file by @jongwooo in #3576
• Add detect-private-key to pre-commit by @lucacome in #3589
• Remove libcap by @lucacome in #3616
• Remove strict permissions for Helm in CI by @lucacome in #3648
• Add workaround for using latest UBI 8 for NAP by @lucacome in #3647
• Add Contributing Guidelines to bot response by @lucacome in #3652
• Don't use blocking status check by @lucacome in #3664
• PRs with docs changes appear in their own sections in changelog by @haywoodsh in #3437

📝 Documentation

• Release 3.0.0 (#3429) by @lucacome in #3434
• Add documentation for the Helm Operator OOM issue by @haywoodsh in #3470
• Correct typo in JWKS documentation by @haywoodsh in #3466
• Document and make public new issue lifecycle by @tomasohaodha in #3465
• clarify deep service insight by @brianehlert in #3453
• Release 3.0.1 by @lucacome in #3483
• Fix helm values to match chart value by @jasonwilliams14 in #3497
• docs: Hugo theme February 23 update by @ADubhlaoich in #3532
• fix: Add missing directory to NGINX App Protect DoS Instructions by @ADubhlaoich in #3605
• feat: Fix instruction link for NGINX Ingress Helm Operator by @ADubhlaoich in #3596
• Update service-insight.md to fix helm parameter typo by @aknot242 in #3654
• Add documentation for read-only root filesystem by @vepatel in #3661
• Add WAF Bundle example by @jjngx in #3656
• Revert "Add WAF Bundle example (#3656)" by @jjngx in #3677
• Release 3.1.0 by @shaun-nx in #3685

⬆️ Dependencies

New Contributors

• @alanwilkie-finocomp made their first contribution in #3034
• @AaronShiels made their first contribution in #3326
• @marcuz made their first contribution in #3527
• @avahahn made their first contribution in #3482
• @jongwooo made their first contribution in #3576
• @sigv made their first contribution in #3573
• @shawnhankim made their first contribution in #3474

Full Changelog: v3.0.0...v3.1.0

Upgrade

• For NGINX, use the v3.1.0 image from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v3.1.0 image from the F5 Container registry or the AWS Marketplace or build your own image using the v3.1.0 source code.
• For Helm, use version 0.17.0 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginxinc/kubernetes-ingress/tree/v3.1.0/examples
• Helm Chart -- https://github.com/nginxinc/kubernetes-ingress/tree/v3.1.0/deployments/helm-chart
• Operator -- https://github.com/nginxinc/nginx-ingress-operator/