nginx/kubernetes-ingress v5.3.0 on GitHub

What's Changed

🚀 Features

add sslVerify for jwksUri by @vepatel in #8292
Add support for ssl ciphers related annotations by @vepatel in #8447
Implement OIDC front channel logout NGINX directives by @javorszky in #8340
Add OIDC timeout customization to ConfigMap by @AlexFenlon in #8495
Support namespaced upstream service reference in VirtualServer by @haywoodsh in #8453
add rewrite-target annotation by @vepatel in #8508
Add client-body-buffer-size directive to Ingress Annotations & Configmap by @AlexFenlon in #8548
Add client-body-buffer-size directive to VirtualServer by @AlexFenlon in #8557
Add OIDC Policy IDP TLS validation by @pdabelf5 in #8556
extend cache policy for more configurable parameters by @haywoodsh in #8533

🐛 Bug Fixes

remove type field for objects with schema ref by @vepatel in #8299
Cleanup stale socket files on startup by @AlexFenlon in #8455

📦 Helm Chart

Include metrics in the helm agent config by @dareste in #8404
Optionally create HorizontalPodAutoscaler by @pdabelf5 in #8452

🧪 Tests

Wrap oidc fclo initiated test in a while loop by @javorszky in #8460
Disable failing foreign upstream test by @pdabelf5 in #8546
Change foreign upstream resource creation order by @haywoodsh in #8535

🔨 Maintenance

Version Bump for 5.3.0 by @github-actions[bot] in #8241
update script to include statefulset yaml by @vepatel in #8259
fix dry-run logic for docs PR by @vepatel in #8261
add cache policy to telemetry by @vepatel in #8265
Use F5 self-hosted runners by @AlexFenlon in #8268
Fix helm not found in CI pipeline by @AlexFenlon in #8281
Login to dockerhub when building authenticated images by @pdabelf5 in #8293
Update Community Call dates by @AlexFenlon in #8295
Pin all NAP WAF package versions by @pdabelf5 in #8317
Pin goreleaser version & update with renovate by @pdabelf5 in #8319
Add assertions document to binary build workflow by @pdabelf5 in #8336
Only add assertion doc on release runs by @pdabelf5 in #8345
Update k8s variable syntax for minikube & kind by @pdabelf5 in #8347
Re-enable NGINX bot by @pdabelf5 in #8354
Fix Snapshots failing in Version Bump workflow by @AlexFenlon in #8357
Update k8s version fetch logic by @vepatel in #8379
Group python and actions changes into one PR of each type by @pdabelf5 in #8393
Allow easier updates to Agent versions on NAP images by @AlexFenlon in #8303
Update release with f5 runner by @vepatel in #8402
Publish helm chart to nginx-charts by @pdabelf5 in #8403
Remove assertion doc from CI by @AlexFenlon in #8422
Update goproxy logic & cleanup netrc by @pdabelf5 in #8421
Add versions to bug report template by @pdabelf5 in #8434
Split Python tests to reduce run time by @pdabelf5 in #8419
Replace discouraged PlayWright functions in our pytests by @javorszky in #8467
Remove unused pytest option by @pdabelf5 in #8531
Migrate client secret to OIDC for Azure Marketplace by @pdabelf5 in #8532
Migrate additional Github secrets to Azure Vault by @AlexFenlon in #8528
Migrate OpenShift & Plus secrets to Azure Vault by @pdabelf5 in #8515
Migrate NGINX Plus secrets to Azure Vault by @pdabelf5 in #8517
Migrate docker & nginx bot credentials to Azure Vault by @pdabelf5 in #8530
Migrate GCR secrets to Azure Vault by @pdabelf5 in #8518
Fix spacing in README tables by @AlexFenlon in #8597
Update automated release docs to match previous version by @AlexFenlon in #8591
update nginx plus waf pkg and alpine base version by @vepatel in #8600
[cherry-pick] fix git user for release wf by @nginx-bot in #8602
Fix shell variable globbing issue using quotes by @nginx-bot in #8605
Update permissions on image promotion CI by @nginx-bot in #8610

📝 Documentation

Fix foreign service example by @haywoodsh in #8516
Update README links to reflect documentation URL changes by @ADubhlaoich in #8519
Update Helm chart NOTES.txt with newer documentation links by @ADubhlaoich in #8586
update release branch docs by @vepatel in #8653

⬆️ Dependencies

87 changes

chore(deps): bump the python group with 2 updates by @dependabot[bot] in #8243
Docker image update e10758e1 by @github-actions[bot] in #8244
chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 in the actions group by @dependabot[bot] in #8249, #8263
chore(deps): bump python from d99178e to a805109 in /tests by @dependabot[bot] in #8248, #8254
Bump preflight version to v1.14.1 by @pdabelf5 in #8252
chore(deps): bump the actions group with 2 updates by @dependabot[bot] in #8269
chore(deps): bump the python group with 5 updates by @dependabot[bot] in #8270
chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 in the actions group by @dependabot[bot] in #8275
Docker image update 80954460 by @github-actions[bot] in #8279
Docker image update 11a34148 by @github-actions[bot] in #8284
chore(deps): bump the python group with 5 updates by @dependabot[bot] in #8287
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #8286, #8369, #8423, #8539, #8566
chore: Configure Renovate by @renovate[bot] in #8298
chore(deps): bump the actions group across 1 directory with 5 updates by @dependabot[bot] in #8300
Update quay.io/keycloak/keycloak Docker tag to v26.4.7 (main) by @renovate[bot] in #8308, #8459, #8510, #8565, #8576, #8595
Update docker/dockerfile Docker tag to v1.20 (main) by @renovate[bot] in #8307, #8374, #8570, #8584
Update dependency requests to v2.32.5 by @renovate[bot] in #8312
Docker image update 119a0c53 by @github-actions[bot] in #8315
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #8309
Update dependency cryptography to v46.0.2 by @renovate[bot] in #8323
Update module github.com/gkampitakis/go-snaps to v0.5.17 (main) by @renovate[bot] in #8326, #8564, #8582
Docker image update 40eeffe2 by @github-actions[bot] in #8324
Update dependency pycparser to v2.23 by @renovate[bot] in #8333
Update ossf/scorecard-action action to v2.4.3 by @renovate[bot] in #8332
Docker image update 382b3684 by @github-actions[bot] in #8334
Update dependency certifi to v2025.8.3 by @renovate[bot] in #8344
Update actions/cache action to v4.3.0 by @renovate[bot] in #8343
Update module github.com/golang-jwt/jwt/v4 to v5 by @pdabelf5 in #8337
Update k8s.io/utils digest to bc988d5 by @renovate[bot] in #8349
Update dependency grpcio to v1.75.1 by @renovate[bot] in #8355
Update peter-evans/dockerhub-description action to v5 by @renovate[bot] in #8356
Update dependency cffi to v2 by @renovate[bot] in #8350
Update examples with keycloak 26.x by @pdabelf5 in #8362
Update balabit/syslog-ng Docker tag to v4.10.2 (main) by @renovate[bot] in #8366, #8443, #8466
Update docker/login-action action to v3.6.0 by @renovate[bot] in #8375
Update Renovate configuration by @pdabelf5 in #8381
Docker image update 7502f23c by @nginx-bot in #8384
Update dependency wrapt to v1.17.3 (main) by @renovate[bot] in #8388
Update dependency pyyaml to v6.0.3 (main) by @renovate[bot] in #8387
Update golang:1.25-alpine Docker digest to 182059d (main) by @renovate[bot] in #8389, #8438, #8502
Update pre-commit hook asottile/pyupgrade to v3.21.2 (main) by @renovate[bot] in #8405, #8525, #8559
Update python Docker tag to v3.14 (main) by @renovate[bot] in #8406
Correct space in github actions, update renovate syntax by @pdabelf5 in #8397
Allow renovate to run postUpgradeTasks by @pdabelf5 in #8424
Update renovate PR's in github workflow by @pdabelf5 in #8427
Update module github.com/cert-manager/cert-manager to v1.19.0 (main) by @pdabelf5 in #8429
Update redhat/ubi9 Docker tag to v9.7-1764578509 (main) by @renovate[bot] in #8431, #8588
Update module github.com/gruntwork-io/terratest to v0.54.0 (main) by @renovate[bot] in #8396, #8476, #8572
Update redhat/ubi9-minimal Docker tag to v9.7-1764578379 (main) by @renovate[bot] in #8432, #8589
Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to aa99558 (main) by @renovate[bot] in #8437, #8449, #8461, #8491, #8501, #8550, #8563, #8580, #8598
Upgrade github.com/nginx/nginx-plus-go-client/v3 to v3.0.1 by @pdabelf5 in #8401
Update aws-sdk-go-v2 monorepo (main) by @renovate[bot] in #8440
Update redhat/ubi8 Docker digest to a444712 (main) by @renovate[bot] in #8439, #8451, #8558, #8575
Update module github.com/cert-manager/cert-manager to v1.19.1 (main) by @renovate[bot] in #8428
Update debian:12-slim Docker digest to 936abff (main) by @renovate[bot] in #8448, #8471, #8542
Update python:3.14-bookworm Docker digest to 407cd1c (main) by @renovate[bot] in #8450, #8462, #8482, #8543
Use renovate to monitor test data yaml files by @pdabelf5 in #8445
Update ghcr.io/nginx/dependencies/nginx-ubi:ubi8 Docker digest to fa931e9 (main) by @renovate[bot] in #8436, #8490, #8549, #8562, #8579, #8587, #8599
Update aws-sdk-go-v2 monorepo (main) by @renovate[bot] in #8464
Update golangci/golangci-lint Docker tag to v2.6.2 (main) by @renovate[bot] in #8474, #8551
Update module github.com/nginx/nginx-prometheus-exporter to v1.5.1 (main) by @renovate[bot] in #8465
Update renovate to bump minor go versions by @pdabelf5 in #8486
Update aws-sdk-go-v2 monorepo (main) by @renovate[bot] in #8483
Update coredns/coredns Docker tag to v1.13.1 (main) by @renovate[bot] in #8484
Update kindest/node Docker tag to v1.34.0 (main) by @renovate[bot] in #8475
Update dependency go to v1.25.4 (main) by @renovate[bot] in #8493, #8503
Update quay.io/jetstack/cert-manager-cainjector Docker tag to v1.19.1 (main) by @renovate[bot] in #8497
Update quay.io/jetstack/cert-manager-controller Docker tag to v1.19.1 (main) by @renovate[bot] in #8498
Update quay.io/jetstack/cert-manager-webhook Docker tag to v1.19.1 (main) by @renovate[bot] in #8499
Update dependency ClusterRole to rbac.authorization.k8s.io/v1 (main) by @renovate[bot] in #8492
Update registry.k8s.io/external-dns/external-dns Docker tag to v0.20.0 (main) by @renovate[bot] in #8513, #8596
Update test containers to v0.2.6 by @pdabelf5 in #8514
Update docker-registry.nginx.com/nap-dos/app_protect_dos_arb Docker tag to v1.2.0 (main) by @renovate[bot] in #8511
Update pre-commit hook psf/black-pre-commit-mirror to v25.11.0 (main) by @renovate[bot] in #8526
Update module github.com/aws/aws-sdk-go-v2/config to v1.31.18 (main) by @renovate[bot] in #8524
Update aws-sdk-go-v2 monorepo (main) by @renovate[bot] in #8544
Update kubernetes packages to v0.34.2 (main) by @renovate[bot] in #8552
Update pre-commit hook rhysd/actionlint to v1.7.9 (main) by @renovate[bot] in #8560
Bump golang.org/x/crypto from 0.42.0 to 0.45.0 in the go_modules group across 1 directory by @dependabot[bot] in #8553
Update aws-sdk-go-v2 monorepo (main) by @renovate[bot] in #8569
Update module mvdan.cc/gofumpt to v0.9.2 (main) by @renovate[bot] in #8578
Update module golang.org/x/tools to v0.39.0 (main) by @renovate[bot] in #8577
Update NGINX to 1.29.3, NGINX Agent to 3.5 by @pdabelf5 in #8494
Update python:3.14-trixie Docker digest to d88b120 (main) by @renovate[bot] in #8581
Bump WAF version to 5.10.0 by @nginx-bot in #8611
Update golang:1.25-alpine Docker digest to 2611181 (main) by @nginx-bot in #8615
Update dependency go to v1.25.5 (main) by @nginx-bot in #8616

Other Changes

fix govulncheck image promotion by @nginx-bot in #8649
Get k8s version from tests/makefile rather than dockerfile by @nginx-bot in #8651

Full Changelog: v5.2.1...v5.3.0

Upgrade

For NGINX, use the v5.3.0 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
For NGINX Plus, use the v5.3.0 images from the F5 Container registry or build your own image using the v5.3.0 source code.
For Helm, use version 2.4.0 of the chart.

Resources

Documentation -- https://docs.nginx.com/nginx-ingress-controller/
Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.0/examples
Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.3.0/deployments/helm-chart
Operator -- https://github.com/nginx/nginx-ingress-helm-operator