nginx/kubernetes-ingress v5.7.0

on GitHub

What's Changed

🚀 Features

• Add support for least_time load balancing method in NGINX OSS by @antojacob in #10746
• Add resource block to ipIntelligence helm by @javorszky in #10848
• implement setting otel_trace_context NGINX directive via configmap by @javorszky in #10843
• Enable http2 for upstream proxying by @sean-breen in #10905
• Add opaque secret support by @vepatel @spencerugbo in #10816
• Decouple host property in VirtualServerRoute by @haywoodsh in #10925
• Add use-forwarded-headers to Ingress via ConfigMap by @AlexFenlon in #10947
• Add use-forwarded-headers support to VirtualServer via ConfigMap by @AlexFenlon in #10949
• Added commonLabels to helm chart by @pdabelf5 in #10994
• Add -latency-metrics-buckets flag to configure upstream latency histogram buckets by @bm1216 in #10282
• Allow cert-manager HTTP-01 challenges through TLS redirect and authentication by @ciarams87 in #11015
• Add Ingress and VirtualServer options to toggle HTTP/2 per server block by @sean-breen in #10989
• Support topology hints traffic distribution by @ciarams87 in #11016

🐛 Bug Fixes

• Remove deleted file from list of files to update in release docs workflow by @spencerugbo in #10745
• fix: path quoting on v1 ingress by @javorszky in #10793
• Reset updateAllConfigsOnBatch after batch mode ends by @pdabelf5 in #10813
• Sort selector-matched VirtualServerRoutes deterministically by @pdabelf5 in #10824
• Fix double-increment of splitClientsIndex for VS route-level splits by @pdabelf5 in #10825
• Match VirtualServerRoutes by namespace and name for split_clients offset by @pdabelf5 in #10830
• Cors origin port validation redo 9861 by @javorszky in #10897
• Fix keepalive annotation in master/minion Ingress by @pdabelf5 in #9836
• fix external PR workflow to update existing DO NOT MERGE PRs by @spencerugbo in #10503
• fix: synchronize namespaced informer registries by @ciarams87 in #10956
• fix: prevent F5 WAF interfering with subrequests by @pdabelf5 in #10588
• fix(api): make JWT/OIDC trustedCertSecret omit-empty so zero value is dropped by @SAY-5 in #9751
• fix(external auth): carrying the response code from the /oauth2/signin subrequest breaks oauth2 flow- #10879 by @javorszky in #10929
• Remove redundant optional marker by @haywoodsh in #10992
• Omit empty nodePort from controller Service by @spencerugbo in #10998
• Apply client-max-body-size correctly on VirtualServer routes with matches, splits and auth policies by @haywoodsh in #11042
• sync: security hardening and minor bug fixes for release-5.7 by @nic-create-pr[bot] in #11145

🧪 Tests

• test(helm): drop terratest from chart unit tests by @ciarams87 in #10898

🔨 Maintenance

• Update renovate.json by @vepatel in #10735
• Version Bump for 5.7.0 by @nic-create-pr[bot] in #10740
• [main] CI release prep fixes by @sean-breen in #10733
• add contents write for helm publish by @sean-breen in #10777
• set kic-plus runner when logging into staging registry by @sean-breen in #10780
• set kic-plus runner when logging into staging registry for LTS by @sean-breen in #10781
• assets needs tag job by @sean-breen in #10782
• Fix nap-dos download path by @sean-breen in #10801
• Add conditional export for SOURCE_NAP_WAF_DOS_IMAGE_PREFIX by @pdabelf5 in #10802
• update agentic skills by @vepatel in #10800
• Don't staticcheck generated code by @pdabelf5 in #10839
• cherry-pick release-5.6.1 to main by @vepatel in #10847
• update nginx oss by @vepatel in #10863
• update to 5.6.2 (#10867) by @vepatel in #10875
• move dynamic weight update handling to sync worker queue by @haywoodsh in #10822
• update OSS to 1.31.6 by @vepatel in #10892
• update main with 5.6.3 by @vepatel in #10893
• Delete quote-tokenizer-tests.conf by @vepatel in #10907
• chore(tests): optionally mount custom CA into test image builder by @javorszky in #10906
• Update codeql workflow to the latest from compliance repo by @jjngx in #10945
• Update examples to use opaque secrets by @vepatel in #10935
• Add .opencode to .gitignore for Opencode configuration by @pdabelf5 in #10963
• Update workflows and actions to use GHCR for test-runner images by @pdabelf5 in #10964
• Adjust permissions structure in build-test-image workflow by @pdabelf5 in #10977
• chore: cut Renovate volume and stop the stale bot discarding triaged work by @ciarams87 in #10951
• Make Helm chart snapshots independent of the helm binary version by @pdabelf5 in #10990
• update package report comment to add more details by @sean-breen in #10926
• update code-review guidelines by @vepatel in #11062
• Use Agent 3 in DoS-only images and refactor image matrices by @AlexFenlon in #11054
• chore: pin staticcheck version to a specific SHA by @pdabelf5 in #11115

📝 Documentation

• docs: Update documentation release script for new branches by @JTorreG in #10938

⬆️ Dependencies

• Update module golang.org/x/crypto to v0.56.0 (main) by @renovate[bot] in #10785
• Update debian:13-slim Docker digest to a99cfc5 (main) by @renovate[bot] in #10716, #10914
• Update pre-commit hook PyCQA/isort to v9.0.2 (main) by @renovate[bot] in #10737, #10968
• Update ghcr.io/nginx/dependencies/nginx-ubi:ubi10 Docker digest to ac24324 (main) by @renovate[bot] in #10736, #10818, #10851, #10881, #10981, #11067, #11084
• Update Kubernetes ecosystem (main) by @renovate[bot] in #10727
• Update docker/dockerfile Docker tag to v1.28 (main) by @renovate[bot] in #10784, #11075
• Update module github.com/dlclark/regexp2/v2 to v2.8.4 (main) by @renovate[bot] in #10807, #11003, #11019, #11074
• Update golang.org/x (main) by @renovate[bot] in #10819
• Update python:3.14-trixie Docker digest to 0876e54 (main) by @renovate[bot] in #10719, #10916
• Update Go toolchain (main) by @renovate[bot] in #10695
• Update dependency helm/helm to v4 (main) by @renovate[bot] in #10378, #10833
• Update module github.com/cert-manager/cert-manager to v1.21.2 (main) by @renovate[bot] in #10844
• Update Red Hat UBI images (main) by @renovate[bot] in #10767
• Update AWS SDK v2 (main) by @renovate[bot] in #10376
• Update kindest/node Docker tag to v1.37.0 (main) by @renovate[bot] in #10726
• Update redhat/ubi10 Docker digest to 7c51a89 (main) by @renovate[bot] in #10871
• Update AWS SDK v2 (main) by @renovate[bot] in #10853
• Update quay.io/skopeo/stable Docker tag to v1.22.3 (main) by @renovate[bot] in #10931
• Update debian:trixie-slim Docker digest to a99cfc5 (main) by @renovate[bot] in #10915
• Update pre-commit hook DavidAnson/markdownlint-cli2 to v0.23.3 (main) by @renovate[bot] in #10917
• Update pre-commit hook python-jsonschema/check-jsonschema to v0.38.2 (main) by @renovate[bot] in #10939
• Update alpine:3.24 Docker digest to 294b683 (main) by @renovate[bot] in #10901
• Update Kubernetes ecosystem to v0.37.1 (main) by @renovate[bot] in #10958
• Update Go toolchain (main) by @renovate[bot] in #10908
• Update AWS SDK v2 (main) by @renovate[bot] in #10930
• Update Red Hat UBI images (main) by @renovate[bot] in #10882
• Update dependency preflight to v1.21.1 (main) by @renovate[bot] in #10967
• Update module github.com/mikefarah/yq/v4 to v4.54.1 (main) by @renovate[bot] in #10982
• Update Red Hat UBI images (main) by @renovate[bot] in #11002
• Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.114.0 (main) by @renovate[bot] in #11007
• Update quay.io/oauth2-proxy/oauth2-proxy Docker tag to v7.15.5 (main) by @renovate[bot] in #11005
• Update OpenTelemetry to v1.47.0 (main) by @renovate[bot] in #11021
• Update module golang.org/x/tools to v0.51.0 (main) by @renovate[bot] in #11020
• Update pre-commit hook psf/black-pre-commit-mirror to v26.10.1 (main) by @renovate[bot] in #11047, #11106
• Update AWS SDK v2 (main) by @renovate[bot] in #11056
• Update Red Hat UBI images (main) by @renovate[bot] in #11055
• Update Red Hat UBI images (main) by @renovate[bot] in #11068
• Update Go to 1.27.2 and bump golang.org/x deps, govulncheck and gofumpt by @AlexFenlon in #11097
• Update AWS SDK v2 (main) by @renovate[bot] in #11086
• Update golang.org/x (main) by @renovate[bot] in #11099
• Update pre-commit hook asottile/pyupgrade to v3.22.0 (main) by @renovate[bot] in #11100
• Update Red Hat UBI images (main) by @renovate[bot] in #11085
• Update module github.com/prometheus/client_golang to v1.25.0 (main) by @renovate[bot] in #11089

Other Changes

• filter by only ingress controller events when updating status by @fcrespofastly in #10230
• Fix nil pointer panic when namespace is no longer watched by @abirdZendesk in #10791
• fix(helm): emit allow-empty-ingress-host when custom resources are disabled by @cestercian in #10832
• fix(k8s): report VirtualServer warnings when config is unchanged by @cestercian in #10912
• fix(helm): emit default listener ports when custom resources are disabled by @cestercian in #10874
• feat: add additional controller Services to the Helm chart by @GabboPenna in #10478
• Warn when routeSelector matches no VirtualServerRoutes by @cestercian in #10913

New Contributors

• @fcrespofastly made their first contribution in #10230
• @abirdZendesk made their first contribution in #10791
• @cestercian made their first contribution in #10832
• @SAY-5 made their first contribution in #9751
• @bm1216 made their first contribution in #10282

Full Changelog: v5.6.3...v5.7.0

Upgrade

• For NGINX, use the v5.7.0 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v5.7.0 images from the F5 Container registry or build your own image using the v5.7.0 source code.
• For Helm, use version 2.8.0 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginx/kubernetes-ingress/tree/v5.7.0/examples
• Helm Chart -- https://github.com/nginx/kubernetes-ingress/tree/v5.7.0/charts/nginx-ingress
• Operator -- https://github.com/nginx/nginx-ingress-helm-operator