nginx/nginx-gateway-fabric v2.7.0 on GitHub

Below is the auto-generated changelog, which includes all PRs that went into the release.
For a shorter version that highlights only important changes, see CHANGELOG.md.

What's Changed

🚀 Features

38 changes

Add support for External Authentication for HTTPRoutes by @salonichf5 in #5145
Add support for disabling xforwarded base headers by @bjee19 in #5288
Support mode Terminate for protocol TLS by @sjberman in #5287
feat: add HTTP response compression support to NginxProxy (#4570) by @oyiz-michael in #5064
NGINX Plus: Add support for error_log in json format and structure access log in json format by @salonichf5 in #5302
Add support for upstream HTTP/2 by @bjee19 in #5308
Stop using deprecated externalIPs service field by @dhurley in #5294
Add server TLS domain configurable for certs and controller by @salonichf5 in #5380
Support PLM as F5 WAF Policy Source by @ciarams87 in #5405
Add pod disruption budget for control plane and data plane by @salonichf5 in #5370
make least_time LB available in OSS and update default LB methods by @yogarajalakshmi-s in #5381
Refactor port conflict resolver to reduce its cyclomatic complexity by @somaz94 in #5438
Refactor TLS certificate reference resolver by @somaz94 in #5439
Refactor deprovisionSecretsForAllGateways to reduce cyclomatic complexity by @somaz94 in #5440
Add Claim validation to JWT type AuthenticationFilters by @shaun-nx in #5387
Refactor addBackendRefsToRules to remove gocyclo nolint by @somaz94 in #5441
Refactor registerResourceInGatewayConfig to remove nolint:gocyclo by @somaz94 in #5453
Refactor getResourceVersionForObject to remove nolint:gocyclo by @somaz94 in #5454
Refactor bindL7RouteToListeners to remove nolint:gocyclo by @somaz94 in #5455
Refactor createHTTPFilters to remove gocyclo nolint by @somaz94 in #5480
Refactor gatewayExistsForResource to reduce cyclomatic complexity by @somaz94 in #5461
Refactor provisionNginx to remove nolint:gocyclo by @somaz94 in #5452
Provisional design for Gateway Link by @salonichf5 in #5489
Simplify registerSecretInGatewayConfig to reduce cyclomatic complexity by @somaz94 in #5491
Add claim validation to OIDC Auth by @shaun-nx in #5484
feat: add configurable workerProcesses to NginxProxy API by @SidharathBansal in #5519
Add Programmed status condition to ClientSettingsPolicy, UpstreamSettingsPolicy, ObservabilityPolicy, ProxySettingsPolicy, RateLimitPolicy, and SnippetsPolicy by @somaz94 in #5392
Design document for GatewayLink by @salonichf5 in #5497
feat: add UseClusterIP to UpstreamSettingsPolicy by @oyiz-michael in #5280
Support allowedListeners field in Gateway Helm values by @sgavrylenko in #5553
feat: add useClusterIP to NginxProxy by @SidharathBansal in #5557
Support v1 TCPRoute and UDPRoute by @sjberman in #5604
feat: add configurable worker_rlimit_nofile to NginxProxy and SSL session/ECDH options to Listener TLS options by @SidharathBansal in #5534
Add auto IP family detection for LoadBalancer Service by @tanayarun in #5530
Add support for GatewayLink to integrate NGINX Gateway Fabric with F5 BIG-IP via the ExternalLoadBalancer CRD by @salonichf5 in #5668
Support native client_body_buffer_size by @sjberman in #5700
Implement F5 AI Guardrails through PayloadProcessor CRD by @bjee19 in #5697
Support sending WAF Security Telemetry to NGINX Instance Manager by @shaun-nx in #5751

🐛 Bug Fixes

46 changes

Adjust timeouts for failing NFR tests and Plus API communication timeout with agent by @salonichf5 in #5230
Fix openshift and ubi issues by @ciarams87 in #5246
Fix NIM bundle fetch to select latest compilation when multiple versions exist by @ciarams87 in #5240
Update operator bundle for new requirements by @ciarams87 in #5260
Assertion job should run on production runner by @ciarams87 in #5258
Fix bundle annotations; fix operator PR by @ciarams87 in #5267
Readd AllowPrivilegeEscalation: false to containers by @ciarams87 in #5277
Fix Agent mTLS CA cert pool not refreshing after certificate rotation by @ciarams87 in #5332
Address ListenerSet gaps by @ciarams87 in #5329
Fix false-positive TargetConflict on policies when unrelated routes overlap each other by @ciarams87 in #5351
Fix ListenerSet listeners not being included in provisioned Service and container ports by @ciarams87 in #5354
Skip deprovisioning live gateways queued before leader promotion by @salonichf5 in #5388
Set a memory soft limit for nginx-agent process to enable garbage collection by @bjee19 in #5349
Extend validation and fix bugs (#5467) by @ciarams87 in #5469
Sort map-derived NGINX config for deterministic output by @ItsVigneshMurugan in #5486
Change gRPC error code from NotFound to Internal for connection or deployment not found errors by @dhurley in #5444
Fix agent startup race condition when waf is enabled by @ciarams87 in #5512
Add fix for inference pool failclose by @bjee19 in #5494
Support hostname addresses in NginxProxy dnsResolver by @mzimry in #5531
Fix failing test for UseClusterIP by @shaun-nx in #5579
Fix GatewayStaticAddress test failure and provisioning bug by @sjberman in #5576
Update GatewayInvalidParametersRef condition; fix UDP weighting by @sjberman in #5601
Fix route and policy attachment edge cases by @sjberman in #5599
Update default upstream keepalive value to NGINX default by @Morgan-P-04 in #5592
Fix config changing for same SnippetsPolicy objects by @theoilie in #5625
Prevent redundant data plane rollouts after restarts by @theoilie in #5628
Harden controller lifecycle and state handling by @sjberman in #5623
Detect conflicting route policies across overlapping hostnames by @floze-the-genius in #5605
Honor securityContext.capabilities.drop in WAF container. Always run as non-root user. by @shaun-nx in #5630
Harden agent auth and config-apply robustness by @sjberman in #5626
Fix provision/managed objs annotations and owners by @sjberman in #5631
Add validation and path escaping to log profile URL by @shaun-nx in #5633
Correctly resolve auth secrets for WAF Policies by @shaun-nx in #5646
Update UBI NGINX Plus dockerfile with correct nginx conf by @ciarams87 in #5650
fix: correct validation error diagnostics and add missing CRD schema constraints by @hsdfat in #5639
Fix duplicate NGINX Plus upstream server updates on config resend by @sjberman in #5664
helm: add hook-delete-policy + pre-upgrade to cert-generator RBAC by @sjberman in #5663
Fix status update bugs by @sjberman in #5678
Updates renovate tag for CIS version by @salonichf5 in #5677
Create helper function to improve url building logic based on port forward in tests by @Morgan-P-04 in #5683
Fix stale WAF bundle/error state after poller teardown by @locker95 in #5687
Add ZoneSize to NginxProxy resource by @john-david3 in #5708
Do not set proxy_protocol for Passthrough servers by @shaun-nx in #5707
Add configurable leader lease timeouts by @sjberman in #5761
Fix ExternalName Service updates by @sjberman in #5762
Generate unique policy and log conf bundles by @shaun-nx in #5651

📦 Helm Chart

Update docs for release 2.6.0 by @ciarams87 in #5257
helm: add automountServiceAccountToken and extraVolumes/Mounts for cert-generator by @dap0am in #5242
Update docs for release 2.6.1 by @sjberman in #5312
Update docs for release 2.6.2 by @bjee19 in #5323
helm: fix expose metrics port the Service by @Alja9 in #5326
Update docs with 2.6.3 release by @ciarams87 in #5368
Update files for 2.6.4 by @ciarams87 in #5470
Update main docs for 2.6.5 by @ciarams87 in #5477
Update main docs for 2.6.6 by @salonichf5 in #5518
helm: add missing nameOverride/fullnameOverride by @Alja9 in #5383
Update docs for release 2.6.7 by @sjberman in #5584
Update min k8s version to 1.32 by @sjberman in #5602
Release 2.7.0 by @github-actions[bot] in #5807
Remove Dataplane Secret for NIM by @nginx-bot in #5816

🧪 Tests

23 changes

NFR Test Results for NGF version 2.6.0 by @github-actions[bot] in #5237
Longevity Test Results for NGF version 2.6.0 by @github-actions[bot] in #5239
Fix TTR graph plotting in scale test by @sjberman in #5265
NFR Test Results for NGF version edge by @github-actions[bot] in #5300
Update docker/dockerfile Docker tag to v1.26 by @renovate[bot] in #5341, #5482, #5660
NFR Test Results for NGF version edge by @github-actions[bot] in #5373
Increase conformance test timeout to 20 minutes by @bjee19 in #5393
PLM integration tests by @ciarams87 in #5409
Add WAF-enabled deployment to longevity nfr test by @bjee19 in #5430
NFR Test Results for NGF version edge by @github-actions[bot] in #5450
Add telemetry collection of WAF Policy type by @bjee19 in #5473
Update curlimages/curl Docker tag to v8.21.0 by @renovate[bot] in #5498
NFR Test Results for NGF version edge by @github-actions[bot] in #5533
Update quay.io/keycloak/keycloak Docker tag to v26.7 by @renovate[bot] in #5560
Remove idle timeout to ensure seamless integration with Gateway API v1.6 by @salonichf5 in #5556
Update Helm release opentelemetry-collector to v0.170.0 by @renovate[bot] in #5547, #5613, #5689, #5725
NFR Test Results for NGF version edge by @github-actions[bot] in #5581
Run conformance tests in parallel by @sjberman in #5629
NFR Test Results for NGF version edge by @github-actions[bot] in #5662
Update dependency golangci/golangci-lint to v2.13.0 by @renovate[bot] in #5741
Update golang Docker tag to v1.27 by @renovate[bot] in #5743, #5744
Longevity Test Results for NGF version 2.7.0 (#5806) by @sjberman in #5811
NFR Test Results for NGF version 2.7.0 (#5797) by @sjberman in #5812

📝 Documentation

Update example files to use cert manager by @salonichf5 in #5255
Add step to update Inference Extension version in release process by @shaun-nx in #5278
Update proposal for JWT Claim processing by @shaun-nx in #5295
Update dependency nginx/agent to v3.10.2 by @renovate[bot] in #5337
Update NGINX Agent to v3.11.3 by @renovate[bot] in #5361, #5395, #5442, #5462, #5501, #5675
Update NGINX OSS to 1.31.2 by @ciarams87 in #5471
Bump WAF version to 5.13.2 by @shaun-nx in #5503
Update NGINX OSS to 1.31.3 by @sjberman in #5580
Add operator version to manual steps in release process by @bjee19 in #5527
Update Gateway API dependencies for 1.6.1 by @shaun-nx in #5569
Update WAF version to 5.14 by @sjberman in #5693
Add Provisional proposal for health checks by @sjberman in #5731
Enhancement Proposal: Health Checks by @sjberman in #5746
Update NGINX versions by @sjberman in #5775
Update NGINX package versions by @nginx-bot in #5835
Fix changelog versions by @sjberman in #5836

🔨 Maintenance

Add draft release context by @sjberman in #5263
Fix API doc header by @sjberman in #5261
Update dependencies by @ciarams87 in #5331
Update ngf test go.mod version to 2.6.5 by @bjee19 in #5490
Update operator dockerfile package dependency flags by @bjee19 in #5526
Add draft release context (again) by @sjberman in #5568
Fix indentation in YAML files causing pipeline errors by @sjberman in #5578
Use updated workflow from the compliance-rules repo by @jjngx in #5667
Remove Mend workflow by @sjberman in #5666
Use vault for pipeline secrets by @sjberman in #5653
Update CIS renovate tag by @sjberman in #5696
Refactor functions with nolint:gocyclo by @john-david3 in #5728
Fix nginx renovate comments by @sjberman in #5763
Fix API docs example links by @sjberman in #5736
chore: Remove direct policy marker from ELB API by @salonichf5 in #5780
Add PayloadProcessor disclaimer by @sjberman in #5785
Update alpine libraries for CVEs by @sjberman in #5786
Add additional validation to OIDC auth fields by @nginx-bot in #5821

⬆️ Dependencies

88 changes

Update module google.golang.org/grpc to v1.83.2 by @renovate[bot] in #5236, #5539, #5589, #5656, #5732, #5772
Update ghcr.io/nginx/dependencies/nginx-ubi:ubi9 Docker digest to edefd77 by @renovate[bot] in #5234, #5247
Update dependency golangci/golangci-lint to v2.13.2 by @renovate[bot] in #5233, #5742, #5790
Update module sigs.k8s.io/controller-runtime to v0.24.0 by @renovate[bot] in #5218
Update GitHub Actions by @renovate[bot] in #5232
Update actions/dependency-review-action action to v5 by @renovate[bot] in #5275
Bumps version for NGINX OSS, NGINX Plus, NGINX Agent and WAF compiler by @salonichf5 in #5289
Update dependencies and manually build OSS image by @sjberman in #5304
Update UBI base from 9 to 10 by @sjberman in #5316
Update F5 WAF to 5.13.1 and NGINX OSS to 1.31.1 by @ciarams87 in #5318
Update ghcr.io/nginx/dependencies/nginx-ubi:ubi10 Docker digest to 47060fe by @renovate[bot] in #5335, #5357, #5535, #5565, #5606, #5669, #5709, #5739, #5753, #5770, #5789
Update module github.com/nginxinc/nginx-go-crossplane to v0.4.89 by @renovate[bot] in #5338
Update dependency dadav/helm-schema to v0.23.5 by @renovate[bot] in #5336, #5390, #5755
Update dependency goreleaser/goreleaser to v2.18.0 by @renovate[bot] in #5340, #5544, #5641, #5758
Update GitHub Actions by @renovate[bot] in #5352
Update dependency redhat-openshift-ecosystem/openshift-preflight to v1.21.0 by @renovate[bot] in #5283, #5411, #5618, #5715, #5749
Update opentelemetry-go monorepo to v1.46.0 by @renovate[bot] in #5358, #5773
Update module github.com/prometheus/common to v0.70.1 by @renovate[bot] in #5371, #5385, #5463, #5564, #5636
Update module github.com/dlclark/regexp2 to v2 by @renovate[bot] in #5235
Update GitHub Actions to v6.0.3 by @renovate[bot] in #5384
Update module github.com/nginx/nginx-gateway-fabric/v2 to v2.6.7 by @renovate[bot] in #5272, #5521, #5588
Update module github.com/dlclark/regexp2/v2 to v2.7.1 by @renovate[bot] in #5394, #5398, #5457, #5566, #5594, #5611, #5685, #5719
Update codecov/codecov-action action to v7 by @renovate[bot] in #5399
Update module golang.org/x/text to v0.41.0 by @renovate[bot] in #5406, #5552, #5720
Update pre-commit hook rbubley/mirrors-prettier to v3.9.6 by @renovate[bot] in #5412, #5520, #5563, #5622
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5414
Update Testing dependencies to v2.30.0 by @renovate[bot] in #5443
Update pre-commit hook thlorenz/doctoc to v2.5.0 by @renovate[bot] in #5448
Update Kubernetes manifests by @renovate[bot] in #5459
Update Docker digests by @renovate[bot] in #5495
Update actions/checkout action to v7 by @renovate[bot] in #5483
Update kindest/node Docker tag to v1.37.0 by @renovate[bot] in #5386, #5782
Update GitHub Actions by @renovate[bot] in #5487
Update Testing dependencies by @renovate[bot] in #5460
Update kubernetes monorepo to v0.37.0 by @renovate[bot] in #5447, #5635, #5748, #5783
Update module github.com/aws/aws-sdk-go-v2/service/s3 to v1.107.0 by @renovate[bot] in #5458, #5593, #5684
Update dependency kubernetes-sigs/cloud-provider-kind to v0.11.1 by @renovate[bot] in #5499, #5504
Update npm dependencies by @renovate[bot] in #5523
Update GitHub Actions by @renovate[bot] in #5522
Lock file maintenance by @renovate[bot] in #5548, #5615, #5645, #5690, #5726, #5759
Update github/codeql-action action to v4.37.8 by @renovate[bot] in #5546, #5612, #5643, #5688, #5724, #5756
Update npm dependencies by @renovate[bot] in #5545
Update GitHub Actions by @renovate[bot] in #5538
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5536
Update DavidAnson/markdownlint-cli2-action action to v24 by @renovate[bot] in #5543
Update pre-commit hook DavidAnson/markdownlint-cli2 to v0.23.2 by @renovate[bot] in #5542, #5595, #5644
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5558
Update GitHub Actions by @renovate[bot] in #5559
Update operator commit for CVE fixes by @sjberman in #5567
Update actions/setup-node action to v7 by @renovate[bot] in #5573
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5571
Update actions/setup-go action to v7 by @renovate[bot] in #5590
Update GitHub Actions by @renovate[bot] in #5572
Update actions/setup-python action to v7 by @renovate[bot] in #5614
Update dependency prettier to v3.9.6 by @renovate[bot] in #5610, #5642
Update actions/labeler action to v7 by @renovate[bot] in #5621
Update GitHub Actions by @renovate[bot] in #5617
Update module github.com/go-logr/logr to v1.4.4 by @renovate[bot] in #5619
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5637
Update GitHub Actions by @renovate[bot] in #5638
Update module github.com/prometheus/client_golang to v1.24.1 by @renovate[bot] in #5620
Update actions/stale action to v11 by @renovate[bot] in #5649
Update docker/login-action action to v4.6.0 by @renovate[bot] in #5648, #5655
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5652
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5654
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5659
Update GitHub Actions by @renovate[bot] in #5672
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5671
Update google.golang.org/protobuf digest to 644d026 by @renovate[bot] in #5670
Update GitHub Actions by @renovate[bot] in #5682
Update module go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc to v1.45.0 by @renovate[bot] in #5673
Update rust Docker tag to v1.98 by @renovate[bot] in #5722, #5750
Update GitHub Actions by @renovate[bot] in #5711
Update ghcr.io/llm-d/llm-d-inference-sim Docker tag to v0.10.2 by @renovate[bot] in #5718
Update module github.com/onsi/ginkgo/v2 to v2.32.1 by @renovate[bot] in #5712
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5710
Update module github.com/envoyproxy/go-control-plane/envoy to v1.39.0 by @renovate[bot] in #5727
Update module google.golang.org/protobuf to v1.36.12 by @renovate[bot] in #5713
Update docker/setup-buildx-action action to v4.3.0 by @renovate[bot] in #5733
Update Gateway API Inference Extension by @renovate[bot] in #5717
Update docker/dockerfile Docker tag to v1.26 by @renovate[bot] in #5716
Update module github.com/nginx/telemetry-exporter to v0.1.6 by @renovate[bot] in #5740
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5747
Update npm dependencies to ^4.1.11 by @renovate[bot] in #5757
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5771
Update aws-sdk-go-v2 monorepo by @renovate[bot] in #5781
Update module github.com/onsi/gomega to v1.43.0 by @renovate[bot] in #5792
Update GitHub Actions by @renovate[bot] in #5791

Other Changes

Operator Bundle v1.4.0 by @nginx-bot in #5259
Operator Bundle v1.4.1 by @nginx-bot in #5313
Operator Bundle v1.4.2 by @nginx-bot in #5322
Operator Bundle v1.4.3 by @nginx-bot in #5367
Operator Bundle v1.4.6 by @nginx-bot in #5515
Operator Bundle v1.4.7 by @nginx-bot in #5585

New Contributors

@Alja9 made their first contribution in #5326
@yogarajalakshmi-s made their first contribution in #5381
@somaz94 made their first contribution in #5438
@ItsVigneshMurugan made their first contribution in #5486
@SidharathBansal made their first contribution in #5519
@mzimry made their first contribution in #5531
@theoilie made their first contribution in #5625
@floze-the-genius made their first contribution in #5605
@tanayarun made their first contribution in #5530
@hsdfat made their first contribution in #5639
@locker95 made their first contribution in #5687

Full Changelog: v2.6.8...v2.7.0