nginx/kubernetes-ingress v5.6.0

on GitHub

What's Changed

🚀 Features

• Add external WAF bundle sources (NGINX Instance Manager, NGINX One Console, HTTPS) by @AlexFenlon in #10131
• Add HSTS Policy to VS by @spencerugbo in #10111
• Add resources support for App Protect WAF v5 containers by @jxn in #9010
• Support endpoint updates for cross-namespace upstream services by @haywoodsh in #9676
• custom error annotation by @vepatel in #10423
• update config safety by @vepatel in #10032
• Add the ability to disable X-forwarded headers via ConfigMap by @antojacob in #10539
• Add resource_namespace attribute to logs by @spencerugbo in #10373
• Add waf plm support by @vepatel in #10690
• Add new annotation nginx.org/upstream-vhost by @haywoodsh in #10557
• Add support for native OIDC module Policy for VirtualServer by @AlexFenlon in #10589

🐛 Bug Fixes

• Update oidc njs code by @vepatel in #10160
• fix oidc with config safety by @vepatel in #10232
• build OSS images from scratch by @sean-breen in #10159
• fix external auth attachment to multiple ingresses by @spencerugbo in #10251
• fix illegal keyword path validation rejecting paths containing /var or /root as substring by @hugolevino in #10176
• various validation fixes by @javorszky in #10456
• fix issues with the release docs workflow by @spencerugbo in #10315
• Reload NGINX for non-TLS secret updates regardless of -ssl-dynamic-reload by @dkulchinsky in #10390
• Update oidc.tmpl to prevent body size checks by @vepatel in #10544
• fix: skip secret lookup when tls[].secretName is empty (fixes spurious warning with wildcard TLS) by @rahulii in #10543
• fix: emit error_page 401 = "..." for ExternalAuth authSigninURI by @pdabelf5 in #10594
• Fix Plus Prometheus server zone labels for empty-host Ingress by @AlexFenlon in #10460
• update network policy template for upgrade case by @vepatel in #10714
• Remove deleted file from list of files to update in release docs workflow by @nic-create-pr[bot] in #10747

📦 Helm Chart

• feat: add NetworkPolicy template by @GabboPenna in #8052

🧪 Tests

• Tests/improve e2e failure reporting by @javorszky in #10554

🔨 Maintenance

• update nic skills by @vepatel in #10030
• Remove unused -agent images from UBI and Debian with Dos only by @AlexFenlon in #10054
• Cherry-pick remaining changes for 5.5.0 by @sean-breen in #10070
• Use Github App for helm release (#9980) main by @AlexFenlon in #10071
• Update renovate.json by @vepatel in #10076
• update skills by @vepatel in #10083
• Version Bump for 5.6.0 by @nginx-bot in #10035
• update WAF to 5.13.2 by @sean-breen in #10242
• Use CSPRNG base64url for PKCE secrets by @javorszky in #10250
• fix nginx user on OSS by @vepatel in #10317
• Add missing nginx modules to OSS images by @sean-breen in #10319
• ci: gate all public workflow jobs on main repository name by @javorszky in #10298
• chore: when renovate updates helm action, update snaps by @pdabelf5 in #10369
• Use GH App for cherry pick workflow by @pdabelf5 in #10370
• Add reviewer skill by @vepatel in #10372
• update waf to 5.13.3 by @sean-breen in #10434
• Update Community Call Dates by @AlexFenlon in #10436
• chore: redirect NGINX logs to stdout and stderr by @pdabelf5 in #10359
• test: tolerate connection drops during NGINX reloads in reload-sensitive e2e tests by @javorszky in #10443
• Improve masking of GitHub App private key in cherry-pick workflow by @pdabelf5 in #10395
• Update list of patched images by @pdabelf5 in #10485
• Fix WAF image sync workflow by @sean-breen in #10473
• Add build-push-retry action to Docker build workflows by @pdabelf5 in #10486
• Replace NGINX_PAT with Github Apps by @pdabelf5 in #10477
• Update F5 WAF to 5.13.4 by @sean-breen in #10479
• Remove NGINX Service Mesh support by @pdabelf5 in #10432
• Add telemetry support for HSTS policy by @spencerugbo in #10483
• Enhance NIC code review guidelines by @pdabelf5 in #10487
• chore: update markdownlint2 and action by @javorszky in #10506
• skip 499 from error-pages by @vepatel in #10507
• bump google.golang.org/grpc 1.81.1 -> 1.82.1 by @javorszky in #10526
• add missing build dependency to make targets by @sean-breen in #10533
• rename bundleSource objects by @vepatel in #10550
• Bump F5 WAF version to 5.14.0 by @pdabelf5 in #10563
• Use updated codeql workflow from compliance-rules by @jjngx in #10573
• adds developer documentation on github comment workflows by @javorszky in #10508
• ci: remove mend workflow and references by @javorszky in #10574
• Pin F5 WAF IP Intelligence version by @pdabelf5 in #10601
• ci: prevent binary and BuildKit cache write races by @javorszky in #10577
• update go by @vepatel in #10642
• disable renovate on release-5.5 branch by @sean-breen in #10674
• Use get-from-vault action by @pdabelf5 in #10668
• Group golang related dependency changes by @pdabelf5 in #10691
• Split release creation and publishing by @sean-breen in #10687
• [CI] use staging environment for NGINX OSS, Plus, WAF, DoS builds by @sean-breen in #10438
• [release-5.6] cherry-pick ci fixes from main by @sean-breen in #10743
• add contents write for helm publish by @sean-breen in #10778

📝 Documentation

• Add OIDCNative Policy Support to Ingress by @AlexFenlon in #10590

⬆️ Dependencies

New Contributors

• @jxn made their first contribution in #9010
• @hugolevino made their first contribution in #10176
• @dkulchinsky made their first contribution in #10390
• @rahulii made their first contribution in #10543
• @antojacob made their first contribution in #10539
• @GabboPenna made their first contribution in #8052

Full Changelog: v5.5.4...v5.6.0

Upgrade

• For NGINX, use the v5.6.0 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.6.0 images from the F5 Container registry or build your own image using the v5.6.0 source code.
• For Helm, use version 2.7.0 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.6.0/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.6.0/charts/nginx-ingress
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator