v3.4.0

What's Changed

🚀 Features

• Allow default_server listeners to be customised by @shaun-nx in #4464
• Update use of http2 listen directive to align with deprecation by @shaun-nx in #4526
• Use Lease for leader election by @lucacome in #4276
• Remove deprecated preview policy flag by @shaun-nx in #4595
• Generate mainfests automatically from Helm by @lucacome in #4278
• Graduate TransportServer and GlobalConfiguration to v1 by @shaun-nx in #4574
• Delete the DNSEndpoint resource when VS is deleted & Ratelimit requeues on errors. by @ciarams87 in #4504
• Support weights 0 and 100 in traffic splitting by @haywoodsh in #4655
• Add support for backup directive for VS and TS by @jjngx in #4653

🐛 Bug Fixes

• prevent pip to look for dependency during install by @vepatel in #4342
• update dockerfile for debian N+ by @vepatel in #4575
• Don't throw annotation deprication warning when ingressClassName is not used in an Ingress resource by @shaun-nx in #4564
• Update vs backup service tests with retries (#4797) by @jjngx in #4799
• fix retries in tests (#4801) by @jjngx in #4806

📦 Helm Chart

• Refactor Helm Chart location by @lucacome in #4306
• Update helm readme and docs by @vepatel in #4474
• Add HPA Custom Behavior by @saedx1 in #4391
• Update docs for 3.3.1 by @lucacome in #4524
• Add single CRDs files by @lucacome in #4428
• Release 3.3.2 (#4596) by @lucacome in #4600
• Revert "Generate mainfests automatically from Helm (#4278)" by @lucacome in #4618
• Add process namespace sharing for ingress controller by @panzouh in #4559
• Add initContainerResources Helm configuration by @oseoin in #4651
• fix: update release action to use script by @pdabelf5 in #4677
• Allows multiple imagePullSecrets in the helm chart. by @AlessioCasco in #4656
• Helm and function signature refactors by @oseoin in #4758
• update helm k8s schema validation to 1.28.0 by @pdabelf5 in #4763
• Dynamic reload of SSL certificates for NGINX Plus by @oseoin in #4764
• Lazy loading OSS by @oseoin in #4788
• Re-align configurations in helm docs by @shaun-nx in #4790
• Release 3.4.0 by @nginx-bot in #4794

🧪 Tests

• Fix intermittent failing test helper by @jjngx in #4432
• Use httptest server for running healthcheck tests by @jjngx in #4461
• Update python version and test by @vepatel in #4500
• update example certs for grpc tests by @vepatel in #4586
• Update Makefile references to tests/Dockerfile by @oseoin in #4631
• update kind make targets for local & CI use by @pdabelf5 in #4704
• kind test make target to use cluster name by @pdabelf5 in #4706
• fix tls-passthrough-custom-port test cleanup by @pdabelf5 in #4717
• update prometheus exporter to 1.0.0 by @pdabelf5 in #4769
• split appProtect tests to speed up pipeline by @pdabelf5 in #4784
• Vs markers (#4793) by @oseoin in #4807

🔨 Maintenance

• Simplify release script by @lucacome in #4425
• Update NAP build step by @lucacome in #4429
• Use regexp2 pkg for path validation by @jjngx in #4465
• Bump Go to 1.21.3 by @lucacome in #4497
• Remove tests step from Updater workflow by @lucacome in #4553
• Update k8s versions in nightly by @lucacome in #4539
• Move release script to GitHub Action by @lucacome in #4592
• Move static files to scratch image by @lucacome in #4551
• Change busybox variant to musl by @lucacome in #4608
• Install QEMU for s390x by @lucacome in #4610
• realign makefile variable to be more readable by @pdabelf5 in #4783
• Add automatic push to NGINX registry by @lucacome in #4787

📝 Documentation

• Update links to templates by @jjngx in #4435
• Update operator docs for ingressClass by @haywoodsh in #4449
• Update Operator doc by @lucacome in #4459
• Update versions in docs by @lucacome in #4460
• Issue 4471: Update README linking to correct complete example by @mrajagopal in #4472
• Update gc doc with vs listeners by @vepatel in #4492
• Revert "Update gc doc with vs listeners (#4492)" by @vepatel in #4498
• Update gc doc with vs listeners by @vepatel in #4507
• implement issuance of temporary certificate when using VirtualServer cert-manager integration by @svvac in #4409
• Simplify automated changelog by @lucacome in #4525
• update documentation for -ingress-class by @vepatel in #4542
• Add string comparison functions to Go template executors by @ianyong in #4560
• Review, restructure and rewrite documentation for getting started with NGINX Ingress Controller by @ADubhlaoich in #4620
• Fix additional Helm-related chart versioning drift in documentation by @ADubhlaoich in #4645
• Fix additional Helm-related versioning issues by @ADubhlaoich in #4654
• docs: Fix Path Regex link in Advanced Configuration by @sigv in #4696
• Update README links for building NGINX Ingress Controller images by @ADubhlaoich in #4700
• Fix issue [#4679]: Incorrect default value for main-template-path and… by @opencmit2 in #4698
• Document option for installing CRDs from a single remote yaml by @shaun-nx in #4730
• Fix drift in Prometheus documentation related to ServiceMonitor by @ADubhlaoich in #4755
• Add docs for AppProtect waf bundle by @vepatel in #4757

⬆️ Dependencies

86 changes

• Bump github.com/cert-manager/cert-manager from 1.13.0 to 1.13.1 by @dependabot in #4439
• Bump github/codeql-action from 2.21.8 to 2.21.9 by @dependabot in #4441
• Bump google-auth from 2.23.0 to 2.23.2 in /tests by @dependabot in #4445
• Bump cffi from 1.15.1 to 1.16.0 in /tests by @dependabot in #4446
• Bump urllib3 from 1.26.15 to 2.0.6 in /tests by @dependabot in #4455
• Bump charset-normalizer from 3.2.0 to 3.3.0 in /tests by @dependabot in #4453
• Bump packaging from 23.1 to 23.2 in /tests by @dependabot in #4454
• Bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0 by @dependabot in #4440
• Bump grpcio-tools from 1.57.0 to 1.59.0 in /tests by @dependabot in #4456
• Bump grpcio from 1.57.0 to 1.59.0 in /tests by @dependabot in #4457
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #4463
• Bump reviewdog/action-actionlint from 1.39.0 to 1.39.1 by @dependabot in #4466
• Bump aws-actions/configure-aws-credentials from 4.0.0 to 4.0.1 by @dependabot in #4470
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #4490
• Bump google-auth from 2.23.2 to 2.23.3 in /tests by @dependabot in #4491
• Bump github.com/aws/aws-sdk-go-v2/config from 1.18.42 to 1.18.44 by @dependabot in #4483
• Bump ossf/scorecard-action from 2.2.0 to 2.3.0 by @dependabot in #4486
• Bump github.com/aws/aws-sdk-go-v2/service/marketplacemetering from 1.16.0 to 1.16.1 by @dependabot in #4482
• Bump websocket-client from 1.6.3 to 1.6.4 in /tests by @dependabot in #4488
• Bump stefanzweifel/git-auto-commit-action from 4.16.0 to 5.0.0 by @dependabot in #4484
• Bump github/codeql-action from 2.21.9 to 2.22.1 by @dependabot in #4485
• Bump protobuf from 4.24.3 to 4.24.4 in /tests by @dependabot in #4487
• Bump github/codeql-action from 2.22.1 to 2.22.2 by @dependabot in #4512
• Bump Go dependencies by @lucacome in #4513
• Update packages for CVEs by @lucacome in #4516
• Bump github/codeql-action from 2.22.2 to 2.22.3 by @dependabot in #4521
• Bump actions/checkout from 4.1.0 to 4.1.1 by @dependabot in #4527
• Bump github.com/aws/aws-sdk-go-v2/config from 1.18.44 to 1.19.0 by @dependabot in #4530
• Bump github.com/aws/aws-sdk-go-v2/service/marketplacemetering from 1.16.1 to 1.16.2 by @dependabot in #4529
• Bump k8s.io/client-go from 0.28.2 to 0.28.3 by @dependabot in #4535
• Bump k8s.io/code-generator from 0.28.2 to 0.28.3 by @dependabot in #4537
• Bump urllib3 from 2.0.6 to 2.0.7 in /tests by @dependabot in #4528
• Bump lucacome/draft-release from 1.0.0 to 1.0.1 by @dependabot in #4543
• Bump nginxinc/aws-marketplace-publish from 1.0.0 to 1.0.1 by @dependabot in #4544
• Bump github/codeql-action from 2.22.3 to 2.22.4 by @dependabot in #4552
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #4557
• Bump charset-normalizer from 3.3.0 to 3.3.1 in /tests by @dependabot in #4556
• Bump ossf/scorecard-action from 2.3.0 to 2.3.1 by @dependabot in #4561
• Bump github.com/aws/aws-sdk-go-v2/config from 1.19.0 to 1.19.1 by @dependabot in #4563
• Bump nginx from 1.25.2-alpine to 1.25.3-alpine in /build by @dependabot in #4562
• Bump nginxcontrib/nginx from 1.25.2-ubi to 1.25.3-ubi in /build by @dependabot in #4567
• Bump google.golang.org/grpc from 1.57.0 to 1.57.1 by @dependabot in #4568
• Bump opentracing/nginx-opentracing from nginx-1.25.2 to nginx-1.25.3 in /build by @dependabot in #4570
• Bump opentelemtery by @lucacome in #4571
• Bump aquasecurity/trivy-action from 0.12.0 to 0.13.0 by @dependabot in #4577
• Bump github.com/cert-manager/cert-manager from 1.13.1 to 1.13.2 by @dependabot in #4580
• Bump pytest from 7.4.2 to 7.4.3 in /tests by @dependabot in #4584
• Bump github/codeql-action from 2.22.4 to 2.22.5 by @dependabot in #4579
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #4585
• Bump cryptography from 41.0.4 to 41.0.5 in /tests by @dependabot in #4581
• Bump cachetools from 5.3.1 to 5.3.2 in /tests by @dependabot in #4583
• Bump aquasecurity/trivy-action from 0.13.0 to 0.13.1 by @dependabot in #4590
• Bump pyopenssl from 23.2.0 to 23.3.0 in /tests by @dependabot in #4582
• Bump github.com/aws/aws-sdk-go-v2/config from 1.19.1 to 1.20.0 by @dependabot in #4599
• Bump github.com/aws/aws-sdk-go-v2/service/marketplacemetering from 1.16.2 to 1.18.0 by @dependabot in #4601
• Bump github.com/aws/aws-sdk-go-v2/config from 1.20.0 to 1.22.0 by @dependabot in #4607
• Bump protobuf from 4.24.4 to 4.25.0 in /tests by @dependabot in #4612
• Bump charset-normalizer from 3.3.1 to 3.3.2 in /tests by @dependabot in #4613
• Bump google-auth from 2.23.3 to 2.23.4 in /tests by @dependabot in #4614
• Bump sigstore/cosign-installer from 3.1.2 to 3.2.0 by @dependabot in #4621
• [pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in #4619
• Bump aquasecurity/trivy-action from 0.13.1 to 0.14.0 by @dependabot in #4622
• Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.45.0 to 0.46.0 by @dependabot in #4636
• Bump urllib3 from 2.0.7 to 2.1.0 in /tests by @dependabot in #4642
• Bump actions/dependency-review-action from 3.1.0 to 3.1.3 by @dependabot in #4643
• Bump github.com/nginxinc/nginx-plus-go-client from 1.1.0 to 1.2.0 by @dependabot in #4646
• Bump grpcio-tools from 1.59.0 to 1.59.3 in /tests by @dependabot in #4685
• Bump github.com/go-jose/go-jose/v3 from 3.0.0 to 3.0.1 by @dependabot in #4694
• Bump k8s.io/api from 0.28.3 to 0.28.4 by @dependabot in #4662
• Bump actions/github-script from 6.4.1 to 7.0.1 by @dependabot in #4683
• Bump docker/build-push-action from 5.0.0 to 5.1.0 by @dependabot in #4690
• Bump github.com/aws/aws-sdk-go-v2/service/marketplacemetering from 1.18.0 to 1.18.3 by @dependabot in #4688
• Bump grpcio from 1.59.0 to 1.59.3 in /tests by @dependabot in #4686
• Bump anchore/sbom-action from 0.14.3 to 0.15.0 by @dependabot in #4691
• Bump k8s.io/client-go from 0.28.3 to 0.28.4 by @dependabot in #4692
• Bump github.com/aws/aws-sdk-go-v2/config from 1.22.0 to 1.25.5 by @dependabot in #4697
• Bump github/codeql-action from 2.22.5 to 2.22.8 by @dependabot in #4701
• Bump google-github-actions/auth from 1.1.1 to 1.2.0 by @dependabot in #4703
• consolidate dependabot updates by @pdabelf5 in #4718
• Dependabot rollup by @pdabelf5 in #4735
• Bump the actions group with 4 updates by @dependabot in #4760
• Bump the python group in /tests with 3 updates by @dependabot in #4749
• Bump the actions group with 2 updates by @dependabot in #4767
• Bump the go group with 3 updates by @dependabot in #4762
• Bump the go group with 3 updates by @dependabot in #4782
• Cherrypick go updates by @pdabelf5 in #4819

Other Changes

• Ensure /var/log/nginx is writeable by GID 0 by @sigv in #4269
• Fixed APPolicy CRD by @fabriziofiorucci in #4640
• Remove redundant newlines in generated v1 configuration by @oseoin in #4699
• Refactor virtual server listens with makeHTTP(s)Listener functions by @j1m-ryan in #4693
• fix: address security concerns by @pdabelf5 in #4681
• group dependabot changes by type by @pdabelf5 in #4746
• docs: add docker fallback for hugo and markdownlint by @nginx-jack in #4747
• Fix dashboard 2940 by @hafe in #4566
• add AppProtect version to pod label by @pdabelf5 in #4759
• cherry pick: automate kindest/node versions (#4798) by @j1m-ryan in #4812

New Contributors

• @mrajagopal made their first contribution in #4472
• @saedx1 made their first contribution in #4391
• @ianyong made their first contribution in #4560
• @oseoin made their first contribution in #4631
• @panzouh made their first contribution in #4559
• @opencmit2 made their first contribution in #4698
• @nginx-jack made their first contribution in #4747

Full Changelog: v3.3.2...v3.4.0

Upgrade

• For NGINX, use the v3.4.0 images from our DockerHub, GitHub Container, Amazon ECR Public Gallery or Quay.io.
• For NGINX Plus, use the v3.4.0 images from the F5 Container registry, the AWS Marketplace, the GCP Marketplace or build your own image using the v3.4.0 source code.
• For Helm, use version 1.1.0 of the chart.

Resources

• Documentation -- https://docs.nginx.com/nginx-ingress-controller/
• Configuration examples -- https://github.com/nginxinc/kubernetes-ingress/tree/v3.4.0/examples
• Helm Chart -- https://github.com/nginxinc/kubernetes-ingress/tree/v3.4.0/charts/nginx-ingress
• Operator -- https://github.com/nginxinc/nginx-ingress-helm-operator