Release controller v1.11.2 & chart v4.11.2. (#11814)

Co-authored-by: Marco Ebert <marco_ebert@icloud.com>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -37,7 +37,7 @@ This questions are the first thing we need to know to understand the context.
 <!-- What do you think went wrong? -->
 
 
-**NGINX Ingress controller version** (exec into the pod and run `/nginx-ingress-controller --version`):
+**NGINX Ingress controller version** (exec into the pod and run nginx-ingress-controller --version.):
 <!--
 POD_NAMESPACE=ingress-nginx
 POD_NAME=$(kubectl get pods -n $POD_NAMESPACE -l app.kubernetes.io/name=ingress-nginx --field-selector=status.phase=Running -o jsonpath='{.items[0].metadata.name}')

.github/ISSUE_TEMPLATE/cve_report.md

@@ -5,6 +5,7 @@ title: ''
 labels: kind/bug
 assignees:
     - Gacko
+    - rikatz
     - strongjz
 ---
 

.github/dependabot.yml

@@ -1,7 +1,33 @@
+---
 version: 2
 updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "area/dependency"
+      - "release-note-none"
+      - "ok-to-test"
+    groups:
+      all:
+        update-types:
+          - "patch"
   - package-ecosystem: "github-actions"
     directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "area/dependency"
+      - "release-note-none"
+      - "ok-to-test"
+    groups:
+      all:
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "docker"
+    directory: "/images"
     schedule:
       interval: "weekly"
     labels:
@@ -13,31 +39,3 @@ updates:
         update-types:
           - "minor"
           - "patch"
-  - package-ecosystem: "docker"
-    directories:
-      - "**/rootfs"
-    schedule:
-      interval: "weekly"
-    labels:
-      - "area/dependency"
-      - "release-note-none"
-      - "ok-to-test"
-    groups:
-      docker:
-        update-types:
-          - "minor"
-          - "patch"
-  - package-ecosystem: "gomod"
-    directories:
-      - "/"
-      - "**/rootfs"
-    schedule:
-      interval: "weekly"
-    labels:
-      - "area/dependency"
-      - "release-note-none"
-      - "ok-to-test"
-    groups:
-      go:
-        update-types:
-          - "patch"

.github/workflows/chart.yaml

@@ -1,64 +0,0 @@
-name: Chart
-
-on:
-  push:
-    branches:
-      - main
-      - release-*
-    paths:
-      - charts/ingress-nginx/Chart.yaml
-  
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  release:
-    name: Release
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: write
-
-    steps:
-      - name: Set up Python
-        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
-        with:
-          python-version: 3.x
-
-      - name: Set up Helm
-        uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
-
-      - name: Set up Helm Chart Testing
-        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
-
-      - name: Set up Artifact Hub
-        run: |
-          curl --fail --location https://github.com/artifacthub/hub/releases/download/v1.20.0/ah_1.20.0_linux_amd64.tar.gz --output /tmp/ah.tar.gz
-          echo "9027626f19ff9f3ac668f222917130ac885e289e922e1428bfd2e7f066324e31  /tmp/ah.tar.gz" | shasum --check
-          sudo tar --extract --file /tmp/ah.tar.gz --directory /usr/local/bin ah
-
-      - name: Set up Git
-        run: |
-          git config --global user.name "${GITHUB_ACTOR}"
-          git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com"
-
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Lint chart
-        run: |
-          ct lint --config .ct.yaml
-          ah lint --path charts/ingress-nginx
-
-      - name: Release chart
-        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0
-        env:
-          CR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CR_RELEASE_NAME_TEMPLATE: helm-chart-{{ .Version }}
-          CR_SKIP_EXISTING: true
-        with:
-          charts_dir: charts

.github/workflows/ci.yaml

@@ -9,7 +9,7 @@ on:
       - 'deploy/**'
       - '**.md'
       - 'images/**' # Images changes should be tested on their own workflow
-      - '!images/nginx/**'
+      - '!images/nginx-1.25/**'
 
   push:
     branches:
@@ -47,7 +47,7 @@ jobs:
     steps:
 
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
@@ -68,25 +68,7 @@ jobs:
               - 'NGINX_BASE'
             baseimage:
               - 'NGINX_BASE'
-              - 'images/nginx/**'
-            docs:
-              - '**/*.md'
-            lua:
-              - '**/*.lua'
-
-  lua-lint:
-    runs-on: ubuntu-latest
-    needs: changes
-    if: |
-      (needs.changes.outputs.lua == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      
-      - name: Lint Lua
-        uses: lunarmodules/luacheck@v1
-        with:
-          args: --codes --globals lua_ingress --globals configuration --globals balancer --globals monitor --globals certificate --globals tcp_udp_configuration --globals tcp_udp_balancer --no-max-comment-line-length -q rootfs/etc/nginx/lua/
+              - 'images/nginx-1.25/**'
 
   test-go:
     runs-on: ubuntu-latest
@@ -95,14 +77,14 @@ jobs:
       (needs.changes.outputs.go == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Get go version
         run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
 
       - name: Set up Go
         id: go
-        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: ${{ env.GOLANG_VERSION }}
           check-latest: true
@@ -110,27 +92,6 @@ jobs:
       - name: Run test
         run: make test
 
-        
-  verify-docs:
-    name: Verify Doc generation
-    runs-on: ubuntu-latest
-    needs: changes
-    if: |
-      (needs.changes.outputs.go == 'true') || (needs.changes.outputs.docs == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - name: Get go version
-        run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
-      - name: Set up Go
-        id: go
-        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
-        with:
-          go-version: ${{ env.GOLANG_VERSION }}
-          check-latest: true
-      - name: Verify Docs
-        run: make verify-docs
-
   build:
     name: Build
     runs-on: ubuntu-latest
@@ -144,7 +105,7 @@ jobs:
         PLATFORMS: linux/amd64
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Get go version
         id: golangversion
@@ -153,17 +114,17 @@ jobs:
 
       - name: Set up Go
         id: go
-        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: ${{ steps.golangversion.outputs.version }}
           check-latest: true
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3.4.0
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
 
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
         with:
           version: latest
 
@@ -172,7 +133,7 @@ jobs:
 
       - name: Prepare Host
         run: |
-          curl -LO https://dl.k8s.io/release/v1.32.2/bin/linux/amd64/kubectl
+          curl -LO https://dl.k8s.io/release/v1.27.3/bin/linux/amd64/kubectl
           chmod +x ./kubectl
           sudo mv ./kubectl /usr/local/bin/kubectl
 
@@ -180,8 +141,8 @@ jobs:
         if: |
           needs.changes.outputs.baseimage == 'true'
         run: |
-            export TAG=$(cat images/nginx/TAG)
-            cd images/nginx/rootfs && docker buildx build --platform=${{ env.PLATFORMS }} --load -t registry.k8s.io/ingress-nginx/nginx:${TAG} .
+            export TAG=$(cat images/nginx-1.25/TAG)
+            cd images/nginx-1.25/rootfs && docker buildx build --platform=${{ env.PLATFORMS }} --load -t registry.k8s.io/ingress-nginx/nginx-1.25:${TAG} .
 
       - name: Build images
         env:
@@ -190,8 +151,8 @@ jobs:
           REGISTRY: ingress-controller
         run: |
           echo "building images..."
-          export TAGNGINX=$(cat images/nginx/TAG)
-          make BASE_IMAGE=registry.k8s.io/ingress-nginx/nginx:${TAGNGINX} clean-image build image image-chroot
+          export TAGNGINX=$(cat images/nginx-1.25/TAG)
+          make BASE_IMAGE=registry.k8s.io/ingress-nginx/nginx-1.25:${TAGNGINX} clean-image build image image-chroot
           make -C test/e2e-image image
 
           echo "creating images cache..."
@@ -202,94 +163,118 @@ jobs:
             | gzip > docker.tar.gz
 
       - name: cache
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
         with:
           name: docker.tar.gz
           path: docker.tar.gz
           retention-days: 5
 
-  chart-lint:
-    name: Chart / Lint
+  helm-lint:
+    name: Helm chart lint
     runs-on: ubuntu-latest
     needs:
       - changes
-
-    if: fromJSON(needs.changes.outputs.charts) || fromJSON(needs.changes.outputs.baseimage) || fromJSON(github.event.workflow_dispatch.run_e2e)
+    if: |
+      (needs.changes.outputs.charts == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
 
     steps:
-      - name: Set up Python
-        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
-          python-version: 3.x
+          fetch-depth: 0
 
       - name: Set up Helm
         uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
 
-      - name: Set up Helm Chart Testing
-        uses: helm/chart-testing-action@0d28d3144d3a25ea2cc349d6e59901c4ff469b3b # v2.7.0
-
-      - name: Set up Artifact Hub
-        run: |
-          curl --fail --location https://github.com/artifacthub/hub/releases/download/v1.20.0/ah_1.20.0_linux_amd64.tar.gz --output /tmp/ah.tar.gz
-          echo "9027626f19ff9f3ac668f222917130ac885e289e922e1428bfd2e7f066324e31  /tmp/ah.tar.gz" | shasum --check
-          sudo tar --extract --file /tmp/ah.tar.gz --directory /usr/local/bin ah
-
-      - name: Set up Helm Docs
-        uses: gabe565/setup-helm-docs-action@d5c35bdc9133cfbea3b671acadf50a29029e87c2 # v1.0.4
-
-      - name: Set up Helm Unit Test
-        run: helm plugin install https://github.com/helm-unittest/helm-unittest
-
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
         with:
-          fetch-depth: 0
+          python-version: '3.x'
 
-      - name: Lint chart
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
+
+      - name: Install Helm Unit Test Plugin
         run: |
-          ct lint --config .ct.yaml
-          ah lint --path charts/ingress-nginx
+          helm plugin install https://github.com/helm-unittest/helm-unittest
 
-      - name: Check docs
+      - name: Run Helm Unit Tests
         run: |
-          helm-docs --chart-search-root charts
-          git diff --exit-code charts/ingress-nginx/README.md
+          helm unittest charts/ingress-nginx -d
 
-      - name: Run tests
-        run: helm unittest charts/ingress-nginx --file "tests/**/*_test.yaml"
+      - name: Run chart-testing (lint)
+        run: ct lint --config ./.ct.yaml
 
-  chart-test:
-    name: Chart / Test
+      - name: Run helm-docs
+        run: |
+          GOBIN=$PWD GO111MODULE=on go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0
+          ./helm-docs --chart-search-root=${GITHUB_WORKSPACE}/charts
+          DIFF=$(git diff ${GITHUB_WORKSPACE}/charts/ingress-nginx/README.md)
+          if [ ! -z "$DIFF" ]; then
+            echo "Please use helm-docs in your clone, of your fork, of the project, and commit a updated README.md for the chart. https://github.com/kubernetes/ingress-nginx/blob/main/RELEASE.md#d-edit-the-valuesyaml-and-run-helm-docs"
+          fi
+          git diff --exit-code
+          rm -f ./helm-docs
+
+      - name: Run Artifact Hub lint
+        run: |
+          wget https://github.com/artifacthub/hub/releases/download/v1.5.0/ah_1.5.0_linux_amd64.tar.gz
+          echo 'ad0e44c6ea058ab6b85dbf582e88bad9fdbc64ded0d1dd4edbac65133e5c87da *ah_1.5.0_linux_amd64.tar.gz' | shasum -c
+          tar -xzvf ah_1.5.0_linux_amd64.tar.gz ah
+          ./ah lint -p charts/ingress-nginx || exit 1
+          rm -f ./ah ./ah_1.5.0_linux_amd64.tar.gz
+
+  helm-test:
+    name: Helm chart testing
     runs-on: ubuntu-latest
     needs:
       - changes
       - build
-      - chart-lint
-
-    if: fromJSON(needs.changes.outputs.charts) || fromJSON(needs.changes.outputs.baseimage) || fromJSON(github.event.workflow_dispatch.run_e2e)
+      - helm-lint
+    if: |
+      (needs.changes.outputs.charts == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
 
     strategy:
       matrix:
-        k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
+        k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
-      - name: Download cache
+      - name: Setup Go
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
+        with:
+          go-version: ${{ needs.build.outputs.golangversion }}
+          check-latest: true
+
+      - name: cache
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: docker.tar.gz
 
-      - name: Load cache
-        run: gzip --decompress --stdout docker.tar.gz | docker load
-
-      - name: Run tests
-        env:
-          K8S_VERSION: ${{ matrix.k8s }}
-          SKIP_IMAGE_CREATION: true
+      - name: fix permissions
         run: |
-          sudo mkdir -pm 777 "${HOME}/.kube"
+          sudo mkdir -p $HOME/.kube
+          sudo chmod -R 777 $HOME/.kube
+
+      - name: Create Kubernetes ${{ matrix.k8s }} cluster
+        id: kind
+        run: |
+          kind create cluster --image=kindest/node:${{ matrix.k8s }}
+
+      - name: Load images from cache
+        run: |
+          echo "loading docker images..."
+          gzip -dc docker.tar.gz | docker load
+
+      - name: Test
+        env:
+          KIND_CLUSTER_NAME: kind
+          SKIP_CLUSTER_CREATION: true
+          SKIP_IMAGE_CREATION: true
+          SKIP_INGRESS_IMAGE_CREATION: true
+        run: |
+          kind get kubeconfig > $HOME/.kube/kind-config-kind
           make kind-e2e-chart-tests
 
   kubernetes:
@@ -301,11 +286,26 @@ jobs:
       (needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
     strategy:
       matrix:
-        k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
+        k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
     uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
     with:
       k8s-version: ${{ matrix.k8s }}
 
+  kubernetes-validations:
+    name: Kubernetes with Validations
+    needs:
+      - changes
+      - build
+    if: |
+      (needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
+    strategy:
+      matrix:
+        k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
+    uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
+    with:
+      k8s-version: ${{ matrix.k8s }}
+      variation: "VALIDATIONS"
+
   kubernetes-chroot:
     name: Kubernetes chroot
     needs:
@@ -315,7 +315,7 @@ jobs:
       (needs.changes.outputs.go == 'true') || (needs.changes.outputs.baseimage == 'true') || ${{ github.event.workflow_dispatch.run_e2e == 'true' }}
     strategy:
       matrix:
-        k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
+        k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
     uses: ./.github/workflows/zz-tmpl-k8s-e2e.yaml
     with:
       k8s-version: ${{ matrix.k8s }}

.github/workflows/depreview.yaml

@@ -9,6 +9,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3675e383bb1769c019 # v4.5.0
+        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

.github/workflows/docs.yaml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
@@ -47,7 +47,7 @@ jobs:
 
     steps:
       - name: Checkout master
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Deploy
         uses: ./.github/actions/mkdocs

.github/workflows/golangci-lint.yml

@@ -15,20 +15,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Get go version
         run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
 
       - name: Set up Go
         id: go
-        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: ${{ env.GOLANG_VERSION }}
           check-latest: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 # v6.5.0
+        uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
         with:
-          version: v1.62
-          only-new-issues: true
+          version: v1.56

.github/workflows/helm.yaml

@@ -0,0 +1,88 @@
+name: Helm
+
+on:
+  push:
+    branches:
+      - main
+      - release-*
+  
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+
+  changes:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read  # for dorny/paths-filter to fetch a list of changed files
+
+    if: github.repository == 'kubernetes/ingress-nginx'
+
+    outputs:
+      docs: ${{ steps.filter.outputs.docs }}
+      charts: ${{ steps.filter.outputs.charts }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - name: Run Artifact Hub lint
+        run: |
+          wget https://github.com/artifacthub/hub/releases/download/v1.5.0/ah_1.5.0_linux_amd64.tar.gz
+          echo 'ad0e44c6ea058ab6b85dbf582e88bad9fdbc64ded0d1dd4edbac65133e5c87da *ah_1.5.0_linux_amd64.tar.gz' | shasum -c
+          tar -xzvf ah_1.5.0_linux_amd64.tar.gz ah
+          ./ah lint -p charts/ingress-nginx || exit 1
+          rm -f ./ah ./ah_1.5.0_linux_amd64.tar.gz
+
+      - name: Set up chart-testing
+        uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
+
+      - name: Run chart-testing (lint)
+        run: ct lint --target-branch ${{ github.ref_name }} --config ./.ct.yaml
+
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          filters: |
+            charts:
+              - 'charts/ingress-nginx/Chart.yaml'
+              - 'charts/ingress-nginx/values.yaml'
+
+  chart:
+    name: Release Chart
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write # needed to write releases
+
+    needs:
+      - changes
+
+    if: ${{ needs.changes.outputs.charts == 'true' }}
+
+    steps:
+      - name: Checkout master
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          # Fetch entire history. Required for chart-releaser; see https://github.com/helm/chart-releaser-action/issues/13#issuecomment-602063896
+          fetch-depth: 0
+          ref: ${{ github.ref_name }} 
+
+      - name: Setup
+        shell: bash
+        run: |
+          git config --global user.name "$GITHUB_ACTOR"
+          git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
+
+      - name: Helm Chart Releaser
+        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
+        env:
+          CR_SKIP_EXISTING: true
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          CR_RELEASE_NAME_TEMPLATE: "helm-chart-{{ .Version }}"
+        with:
+          charts_dir: charts

.github/workflows/images.yaml

@@ -36,10 +36,12 @@ jobs:
       kube-webhook-certgen: ${{ steps.filter.outputs.kube-webhook-certgen }}
       ext-auth-example-authsvc: ${{ steps.filter.outputs.ext-auth-example-authsvc }}
       nginx: ${{ steps.filter.outputs.nginx }}
+      nginx125: ${{ steps.filter.outputs.nginx125 }}
+      opentelemetry: ${{ steps.filter.outputs.opentelemetry }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
@@ -63,6 +65,10 @@ jobs:
               - 'images/ext-auth-example-authsvc/**'
             nginx:
               - 'images/nginx/**'
+            opentelemetry:
+              - 'images/opentelemetry/**'
+            nginx125:
+              - 'images/nginx-1.25/TAG'
 
   #### TODO: Make the below jobs 'less dumb' and use the job name as parameter (the github.job context does not work here)
   cfssl:
@@ -135,17 +141,17 @@ jobs:
       (needs.changes.outputs.kube-webhook-certgen == 'true')
     strategy:
       matrix:
-        k8s: [v1.28.15, v1.29.12, v1.30.8, v1.31.4, v1.32.0]
+        k8s: [v1.26.15, v1.27.13, v1.28.9, v1.29.4, v1.30.0]
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Get go version
       run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
 
     - name: Set up Go
       id: go
-      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
         go-version: ${{ env.GOLANG_VERSION }}
         check-latest: true
@@ -160,24 +166,41 @@ jobs:
       run: |
         cd images/ && make NAME=kube-webhook-certgen test test-e2e
 
-  nginx:
+  opentelemetry:
+    runs-on: ubuntu-latest
+    env:
+      PLATFORMS: linux/amd64,linux/arm,linux/arm64
+    needs: changes
+    if: |
+      (needs.changes.outputs.opentelemetry == 'true')
+    strategy:
+      matrix:
+        nginx: ['1.25.3', '1.21.6']
+    steps:
+    - name: Checkout
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - name: image build
+      run: |
+        cd images/opentelemetry && make NGINX_VERSION=${{ matrix.nginx }} build
+
+  nginx125:
     permissions:
       contents: write
       packages: write
     runs-on: ubuntu-latest
     needs: changes
     if: |
-      (github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.nginx == 'true')
+      (github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.nginx125 == 'true')
     env:
-      PLATFORMS: linux/amd64,linux/arm,linux/arm64
+      PLATFORMS: linux/amd64,linux/arm,linux/arm64,linux/s390x
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3.4.0
+        uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
         with:
           version: latest
           platforms: ${{ env.PLATFORMS }}
@@ -188,5 +211,5 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: build-image
         run: |
-          export TAG=$(cat images/nginx/TAG)
-          cd images/nginx/rootfs && docker buildx build --platform=${{ env.PLATFORMS }} --push -t ingressnginx/nginx:${TAG} .
+          export TAG=$(cat images/nginx-1.25/TAG)
+          cd images/nginx-1.25/rootfs && docker buildx build --platform=${{ env.PLATFORMS }} --push -t ingressnginx/nginx-1.25:${TAG} .

.github/workflows/junit-reports.yaml

@@ -5,10 +5,6 @@ on:
     workflows: ['CI']                     # runs after CI workflow
     types:
       - completed
-
-permissions:
-  checks: write
-
 jobs:
   report:
     runs-on: ubuntu-latest

.github/workflows/perftest.yaml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Install K6
         run: |

.github/workflows/plugin.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
 
@@ -20,31 +20,31 @@ jobs:
         run: echo "GOLANG_VERSION=$(cat GOLANG_VERSION)" >> $GITHUB_ENV
 
       - name: Set up Go
-        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: ${{ env.GOLANG_VERSION }}
           check-latest: true
 
       - name: Run GoReleaser Snapshot
         if: ${{ ! startsWith(github.ref, 'refs/tags/') }}
-        uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1
+        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
         with:
-          version: "~> v2"
+          version: latest
           args: release --snapshot --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run GoReleaser
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6.2.1
+        uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
         with:
-          version: "~> v2"
+          version: latest
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Update new version in krew-index
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        uses: rajatjindal/krew-release-bot@3d9faef30a82761d610544f62afddca00993eef9 # v0.0.47
+        uses: rajatjindal/krew-release-bot@df3eb197549e3568be8b4767eec31c5e8e8e6ad8 # v0.0.46
         with:
           krew_template_file: cmd/plugin/krew.yaml

.github/workflows/scorecards.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
 
@@ -51,7 +51,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
         with:
           name: SARIF file
           path: results.sarif
@@ -59,6 +59,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
+        uses: github/codeql-action/upload-sarif@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
         with:
           sarif_file: results.sarif

.github/workflows/stale.yaml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           stale-issue-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack."
           stale-pr-message: "This is stale, but we won't close it automatically, just bare in mind the maintainers may be busy with other tasks and will reach your issue ASAP. If you have any question or request to prioritize this, please reach `#ingress-nginx-dev` on Kubernetes Slack."

.github/workflows/vulnerability-scans.yaml

@@ -22,7 +22,7 @@ jobs:
       versions: ${{ steps.version.outputs.TAGS }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
 
@@ -52,7 +52,7 @@ jobs:
         versions: ${{ fromJSON(needs.version.outputs.versions) }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - shell: bash
         id: test
@@ -60,7 +60,7 @@ jobs:
 
       - name: Scan image with AquaSec/Trivy
         id: scan
-        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
+        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
         with:
           image-ref: registry.k8s.io/ingress-nginx/controller:${{ matrix.versions }}
           format: 'sarif'
@@ -75,7 +75,7 @@ jobs:
 
       # This step checks out a copy of your repository.
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
+        uses: github/codeql-action/upload-sarif@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
         with:
           token: ${{ github.token }}
           # Path to SARIF file relative to the root of the repository

.github/workflows/zz-tmpl-images.yaml

@@ -1,5 +1,5 @@
 #### THIS IS A TEMPLATE ####
-# This workflow is created to be a template for every time an e2e test is required,
+# This workflow is created to be a template for every time an e2e teest is required,
 
 on:
   workflow_call:
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
@@ -48,7 +48,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Build
         run: |
@@ -67,7 +67,7 @@ jobs:
       PLATFORMS: ${{ inputs.platforms-publish }}
     steps:
     - name: Checkout
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
     - name: Login to GitHub Container Registry
       uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0

.github/workflows/zz-tmpl-k8s-e2e.yaml

@@ -1,5 +1,5 @@
 #### THIS IS A TEMPLATE ####
-# This workflow is created to be a template for every time an e2e test is required,
+# This workflow is created to be a template for every time an e2e teest is required,
 
 on:
   workflow_call:
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: cache
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -43,13 +43,14 @@ jobs:
           SKIP_CLUSTER_CREATION: true
           SKIP_INGRESS_IMAGE_CREATION: true
           SKIP_E2E_IMAGE_CREATION: true
+          ENABLE_VALIDATIONS: ${{ inputs.variation == 'VALIDATIONS' }}
           IS_CHROOT: ${{ inputs.variation == 'CHROOT' }}
         run: |
           kind get kubeconfig > $HOME/.kube/kind-config-kind
           make kind-e2e-test
 
       - name: Upload e2e junit-reports ${{ inputs.variation }}
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
         if: success() || failure()
         with:
           name: e2e-test-reports-${{ inputs.k8s-version }}${{ inputs.variation }}

.gitignore

@@ -1,3 +1,4 @@
+helm-docs
 # OSX
 ._*
 .DS_Store

.golangci.yml

@@ -2,7 +2,6 @@ run:
   timeout: 10m
   allow-parallel-runners: true
 
-issues:
   # Maximum issues count per one linter. Set to 0 to disable. Default is 50.
   max-issues-per-linter: 0
 
@@ -23,6 +22,7 @@ linters:
     - errcheck
     - errchkjson
     - errname
+    - execinquery
     - ginkgolinter
     - gocheckcompilerdirectives
     - goconst
@@ -227,6 +227,9 @@ linters-settings:
   nolintlint:
     # Enable to ensure that nolint directives are all used. Default is true.
     allow-unused: false
+    # Disable to ensure that nolint directives don't have a leading space. Default is true.
+    # TODO(lint): Enforce machine-readable `nolint` directives
+    allow-leading-space: true
     # Exclude following linters from requiring an explanation.  Default is [].
     allow-no-explanation: []
     # Enable to require an explanation of nonzero length after each nolint directive. Default is false.

.luacheckrc

@@ -1,6 +1,6 @@
 std = 'ngx_lua'
 max_line_length = 100
-exclude_files = {'./rootfs/etc/nginx/lua/test/**/*.lua'}
+exclude_files = {'./rootfs/etc/nginx/lua/test/**/*.lua', './rootfs/etc/nginx/lua/plugins/**/test/**/*.lua'}
 files["rootfs/etc/nginx/lua/lua_ingress.lua"] = {
   ignore = { "122" },
   -- TODO(elvinefendi) figure out why this does not work

Changelog.md

@@ -2,7 +2,7 @@
 
 All New change are in [Changelog](./changelog)
 
-### 1.5.1
+### 1.5.1 
 
 * Upgrade NGINX to 1.21.6
 * Upgrade Golang 1.19.2
@@ -102,18 +102,18 @@ Images:
 ### Community Updates
 
 We will discuss the results of our Community Survey, progress on the stabilization project, and ideas going
-forward with the project at
-[Kubecon NA 2022 in Detroit](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/). Come join us
+forward with the project at 
+[Kubecon NA 2022 in Detroit](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/). Come join us 
 and let us hear what you'd like to see in the future for ingress-nginx.
 
 https://kccncna2022.sched.com/event/18lgl?iframe=no
 
 [**Kubernetes Registry change notice**](https://twitter.com/BenTheElder/status/1575898507235323904)
-The [@kubernetesio](https://twitter.com/kubernetesio) container image host http://k8s.gcr.io is
-*actually* getting redirected to the community controlled http://registry.k8s.io starting with a small portion of
+The [@kubernetesio](https://twitter.com/kubernetesio) container image host http://k8s.gcr.io is 
+*actually* getting redirected to the community controlled http://registry.k8s.io starting with a small portion of 
 traffic on October 3rd.
 
-If you notice any issues, *please* ping [Ben Elder](https://twitter.com/BenTheElder),
+If you notice any issues, *please* ping [Ben Elder](https://twitter.com/BenTheElder), 
 [@thockin](https://twitter.com/thockin), [@ameukam](https://twitter.com/ameukam),or report issues in slack to
 [sig-k8s-infra slack channel](https://kubernetes.slack.com/archives/CCK68P2Q2).
 
@@ -123,7 +123,7 @@ If you notice any issues, *please* ping [Ben Elder](https://twitter.com/BenTheEl
 [8890](https://github.com/kubernetes/ingress-nginx/pull/8890)
 * Update to Prometheus metric names, more information [available here]( https://github.com/kubernetes/ingress-nginx/pull/8728
 )
-* Deprecated Kubernetes versions 1.20-1.21, Added support for, 1.25, currently supported versions v1.22, v1.23, v1.24, v1.25
+* Deprecated Kubernetes versions 1.20-1.21, Added support for, 1.25, currently supported versions v1.22, v1.23, v1.24, v1.25  
 
 ADDED
 * `_request_duration_seconds` Histogram
@@ -203,11 +203,11 @@ Images:
 
 ### 1.3.1
 
-In v1.3.1 leader elections will be done entirely using the Lease API and no longer using configmaps.
+In v1.3.1 leader elections will be done entirely using the Lease API and no longer using configmaps. 
 v1.3.0 is a safe transition version, using v1.3.0 can automatically complete the merging of election locks, and then you can safely upgrade to v1.3.1.
 
-Also, *important note*, with the Release of Kubernetes v1.25 we are dropping support for the legacy branches,
-Also, *important note*, with the release of Kubernetes v1.25, we are dropping support for the legacy edition,
+Also, *important note*, with the Release of Kubernetes v1.25 we are dropping support for the legacy branches, 
+Also, *important note*, with the release of Kubernetes v1.25, we are dropping support for the legacy edition, 
 that means all version <1.0.0 of the ingress-nginx-controller.
 
 ## Image:
@@ -277,11 +277,11 @@ All other Changes
 
 ### 1.3.0
 
-Image:
+Image: 
 - registry.k8s.io/ingress-nginx/controller:v1.3.0@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5
 - registry.k8s.io/ingress-nginx/controller-chroot:v1.3.0@sha256:0fcb91216a22aae43b374fc2e6a03b8afe9e8c78cbf07a09d75636dc4ea3c191
 
-_IMPORTANT CHANGES:_
+_IMPORTANT CHANGES:_ 
 * This release removes support for Kubernetes v1.19.0
 * This release adds support for Kubernetes v1.24.0
 * Starting with this release, we will need permissions on the `coordination.k8s.io/leases` resource for leaderelection lock
@@ -352,11 +352,11 @@ _Changes:_
 
 ### 1.2.0
 
-Image:
+Image: 
 - k8s.gcr.io/ingress-nginx/controller:v1.2.0@sha256:d8196e3bc1e72547c5dec66d6556c0ff92a23f6d0919b206be170bc90d5f9185
 - k8s.gcr.io/ingress-nginx/controller-chroot:v1.2.0@sha256:fb17f1700b77d4fcc52ca6f83ffc2821861ae887dbb87149cf5cbc52bea425e5
 
-This minor version release, introduces 2 breaking changes. For the first time, an option to jail/chroot the nginx process, inside the controller container, is being introduced. This provides an additional layer of security, for sensitive information like K8S serviceaccounts. This release also brings a special new feature of deep inspection into objects. The inspection is a walk through of all the spec, checking for possible attempts to escape configs. Currently such an inspection only occurs for `networking.Ingress`.  Additionally there are fixes for the recently announced CVEs on busybox & ssl_client. And there is a fix to a recently introduced redirection related bug, that was setting the protocol on URLs to "nil".
+This minor version release, introduces 2 breaking changes. For the first time, an option to jail/chroot the nginx process, inside the controller container, is being introduced.. This provides an additional layer of security, for sensitive information like K8S serviceaccounts. This release also brings a special new feature of deep inspection into objects. The inspection is a walk through of all the spec, checking for possible attempts to escape configs. Currently such an inspection only occurs for `networking.Ingress`.  Additionally there are fixes for the recently announced CVEs on busybox & ssl_client. And there is a fix to a recently introduced redirection related bug, that was setting the protocol on URLs to "nil".
 
 _Changes:_
 
@@ -419,7 +419,7 @@ _Changes:_
 **Image:**
 - k8s.gcr.io/ingress-nginx/controller:v1.1.3@sha256:31f47c1e202b39fadecf822a9b76370bd4baed199a005b3e7d4d1455f4fd3fe2
 
-This release upgrades Alpine to 3.14.4 and nginx to 1.19.10
+This release upgrades Alpine to 3.14.4 and nginx to 1.19.10 
 
 Patches [OpenSSL CVE-2022-0778](https://github.com/kubernetes/ingress-nginx/issues/8339)
 
@@ -460,7 +460,7 @@ _Changes:_
 
 ### 1.1.2
 
-**Image:**
+**Image:** 
 - k8s.gcr.io/ingress-nginx/controller:v1.1.2@sha256:28b11ce69e57843de44e3db6413e98d09de0f6688e33d4bd384002a44f78405c
 
 This release bumps grpc version to 1.44.0 & runc to version 1.1.0. The release also re-introduces the ingress.class annotation, which was previously declared as deprecated. Besides that, several bug fixes and improvements are listed below.
@@ -502,7 +502,7 @@ _Changes:_
 
 ### 1.1.1
 
-**Image:**
+**Image:** 
 - k8s.gcr.io/ingress-nginx/controller:v1.1.1@sha256:0bc88eb15f9e7f84e8e56c14fa5735aaa488b840983f87bd79b1054190e660de
 
 This release contains several fixes and improvements. This image is now built using Go v1.17.6 and gRPC v1.43.0. See detailed list below.
@@ -571,9 +571,9 @@ _Changes:_
 
 _Possible Breaking Change_
 We now implement string sanitization in annotation values. This means that words like "location", "by_lua" and
-others will drop the reconciliation of an Ingress object.
+others will drop the reconciliation of an Ingress object. 
 
-Users from mod_security and other features should be aware that some blocked values may be used by those features
+Users from mod_security and other features should be aware that some blocked values may be used by those features 
 and must be manually unblocked by the Ingress Administrator.
 
 For more details please check [https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#annotation-value-word-blocklist]
@@ -592,7 +592,7 @@ _Changes:_
 - k8s.gcr.io/ingress-nginx/controller:v1.0.4@sha256:545cff00370f28363dad31e3b59a94ba377854d3a11f18988f5f9e56841ef9ef
 
 _Possible Breaking Change_
-We have disabled the builtin ssl_session_cache due to possible memory fragmentation. This should not impact the majority of users, but please let us know
+We have disabled the builtin ssl_session_cache due to possible memory fragmentation. This should not impact the majority of users, but please let us know 
 if you face any problem
 
 _Changes:_
@@ -608,7 +608,7 @@ _Changes:_
 - k8s.gcr.io/ingress-nginx/controller:v1.0.3@sha256:4ade87838eb8256b094fbb5272d7dda9b6c7fa8b759e6af5383c1300996a7452
 
 **Known Issues**
-* Ingress controller now (starting from v1.0.0) mandates cluster scoped access to IngressClass. This leads to problems when updating old Ingress controller to newest version, as described [here](https://github.com/kubernetes/ingress-nginx/issues/7510). We plan to fix it in v1.0.4, see [this](https://github.com/kubernetes/ingress-nginx/pull/7578).
+* Ingress controller now (starting from v1.0.0) mandates cluster scoped access to IngressClass. This leads to problems when updating old Ingress controller to newest version, as described [here](https://github.com/kubernetes/ingress-nginx/issues/7510). We plan to fix it in v1.0.4, see [this](https://github.com/kubernetes/ingress-nginx/pull/7578). 
 
 _New Features:_
 
@@ -624,7 +624,7 @@ _Changes:_
 - k8s.gcr.io/ingress-nginx/controller:v1.0.2@sha256:85b53b493d6d658d8c013449223b0ffd739c76d76dc9bf9000786669ec04e049
 
 **Known Issues**
-* Ingress controller now (starting from v1.0.0) mandates cluster scoped access to IngressClass. This leads to problems when updating old Ingress controller to newest version, as described [here](https://github.com/kubernetes/ingress-nginx/issues/7510). We plan to fix it in v1.0.3, see [this](https://github.com/kubernetes/ingress-nginx/pull/7578).
+* Ingress controller now (starting from v1.0.0) mandates cluster scoped access to IngressClass. This leads to problems when updating old Ingress controller to newest version, as described [here](https://github.com/kubernetes/ingress-nginx/issues/7510). We plan to fix it in v1.0.3, see [this](https://github.com/kubernetes/ingress-nginx/pull/7578). 
 
 _New Features:_
 
@@ -640,7 +640,7 @@ _Changes:_
 - k8s.gcr.io/ingress-nginx/controller:v1.0.1@sha256:26bbd57f32bac3b30f90373005ef669aae324a4de4c19588a13ddba399c6664e
 
 **Known Issues**
-* Ingress controller now (starting from v1.0.0) mandates cluster scoped access to IngressClass. This leads to problems when updating old Ingress controller to newest version, as described [here](https://github.com/kubernetes/ingress-nginx/issues/7510). We plan to fix it in v1.0.2, see [this](https://github.com/kubernetes/ingress-nginx/pull/7578).
+* Ingress controller now (starting from v1.0.0) mandates cluster scoped access to IngressClass. This leads to problems when updating old Ingress controller to newest version, as described [here](https://github.com/kubernetes/ingress-nginx/issues/7510). We plan to fix it in v1.0.2, see [this](https://github.com/kubernetes/ingress-nginx/pull/7578). 
 
 _New Features:_
 
@@ -883,7 +883,7 @@ _Changes:_
   test #7255 
 - [X] [#7216](https://github.com/kubernetes/ingress-nginx/pull/7216) Admission: Skip validation checks if an ingress 
   is marked as deleted #7216
-
+  
 ### 1.0.0-beta.3
 ** This is a breaking change**
 
@@ -2057,7 +2057,7 @@ _Breaking Changes:_
 
   ```
   Due to upcoming data privacy regulations, we are making significant changes to how you access free GeoLite2 databases starting December 30, 2019.
-  Learn more on our blog https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/
+  Learn more on our blog https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases/
   ```
 
   Because of this change, it is not clear we can provide the databases directly from the docker image.
@@ -2193,7 +2193,7 @@ _New Features:_
 
   If the active connections end before that, the pod will terminate gracefully at that time.
 
-  To effectively take advantage of this feature, the Configmap feature [worker-shutdown-timeout](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-shutdown-timeout) new value is `240s` instead of `10s`.
+  To efectively take advantage of this feature, the Configmap feature [worker-shutdown-timeout](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#worker-shutdown-timeout) new value is `240s` instead of `10s`.
 
   **IMPORTANT:** this value has a side effect during reloads, consuming more memory until the old NGINX workers are replaced.
 
@@ -2603,7 +2603,7 @@ _New Features:_
 _Breaking changes:_
 
 - The NGINX server listening in port 18080 was removed. It was replaced by a server using an unix socket as port [#3684](https://github.com/kubernetes/ingress-nginx/pull/3684)
-  This server was internal to the ingress controller. In case this was being acceded from the outside, you can restore the old server using the `http-snippet` feature in the configuration configmap like:
+  This server was internal to the ingress controller. In case this was being acceded from the outside, you can restore the old server using the `http-snipet` feature in the configuration configmap like:
 
   ```yaml
   http-snippet: |

GOLANG_VERSION

@@ -1 +1 @@
-1.23.6
+1.22.6

MANUAL_RELEASE.md

@@ -93,7 +93,7 @@ Promoting the images basically means that images, that were pushed to staging co
 
   ```
   ...
-  pushing manifest for us-central1-docker.pkg.dev/k8s-staging-images/ingress-nginx/controller:v1.0.2@sha256:e15fac6e8474d77e1f017edc33d804ce72a184e3c0a30963b2a0d7f0b89f6b16
+  pushing manifest for gcr.io/k8s-staging-ingress-nginx/controller:v1.0.2@sha256:e15fac6e8474d77e1f017edc33d804ce72a184e3c0a30963b2a0d7f0b89f6b16
   ...
   ```
 
@@ -113,7 +113,7 @@ Promoting the images basically means that images, that were pushed to staging co
 
 - For making, it easier, you can edit your branch directly in the browser. But be careful about making any mistake.
 
-- Insert the sha(s) & the tag(s), in a new line, in this file [Project kubernetes/k8s.io Ingress-Nginx-Controller Images](https://github.com/kubernetes/k8s.io/blob/main/registry.k8s.io/images/k8s-staging-ingress-nginx/images.yaml)  Look at this [example PR and the diff](https://github.com/kubernetes/k8s.io/pull/2536) to see how it was done before
+- Insert the sha(s) & the tag(s), in a new line, in this file [Project kubernetes/k8s.io Ingress-Nginx-Controller Images](https://github.com/kubernetes/k8s.io/blob/main/k8s.gcr.io/images/k8s-staging-ingress-nginx/images.yaml)  Look at this [example PR and the diff](https://github.com/kubernetes/k8s.io/pull/2536) to see how it was done before
 
 - Save and commit
 
@@ -177,21 +177,21 @@ Promoting the images basically means that images, that were pushed to staging co
             ```
             - The -L 38 was used for 2 reasons.
               - Default number of results is 30 and there were more than 30 PRs merged while releasing v1.1.1. If you see the current/soon-to-be-old changelog, you can look at the most recent PR number that has been accounted for already, and start from after that last accounted for PR.
-              -  The other reason to use -L 38 was to omit the 39th, the 40th and the 41st line in the resulting list. These were non-relevant PRs.
+              -  The other reason to use -L 38 was to ommit the 39th, the 40th and the 41st line in the resulting list. These were non-relevant PRs.
             - If you save the output of above command to a file called prlist.txt. It looks somewhat like this ;
 
               ```
-              % cat ~/Downloads/prlist.txt
+              % cat ~/Downloads/prlist.txt 
               8129    fix syntax in docs for multi-tls example
               8120    Update go in runner and release v1.1.1
               8119    Update to go v1.17.6
               8118    Remove deprecated libraries, update other libs
               8117    Fix codegen errors
-              8115    chart/ghaction: set the correct permission to have access to push a release
+              8115    chart/ghaction: set the correct permission to have access to push a release 
               ....
               ```
               You can delete the lines, that refer to PRs of the release process itself. We only need to list the feature/bugfix PRs. You can also delete the lines that are housekeeping or not really worth mentioning in the changelog.
-          -  you use some easy automation in bash/python/other, to get the PR-List that can be used in the changelog. For example, it's possible to use a bash scripty way, seen below, to convert those plaintext PR numbers into clickable links.
+          -  you use some easy automation in bash/python/other, to get the PR-List that can be used in the changelog. For example, its possible to use a bash scripty way, seen below, to convert those plaintext PR numbers into clickable links. 
 
             ```
             #!/usr/bin/bash
@@ -205,7 +205,7 @@ Promoting the images basically means that images, that were pushed to staging co
             done <$file
 
             ```
-          - There was a parsing issue and path issue on MacOS, so above script had to be modified and MacOS monterey compatible script is below ;
+          - There was a parsing issue and path issue on MacOS, so above scrpt had to be modified and MacOS monterey compatible script is below ;
 
             ```
             #!/bin/bash
@@ -226,18 +226,19 @@ Promoting the images basically means that images, that were pushed to staging co
           ```
 
 ### d. Edit the values.yaml and run helm-docs
-
   - [Fields to edit in values.yaml](https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/values.yaml)
 
     - tag
     - digest
 
-  - [helm-docs](https://github.com/norwoodj/helm-docs) is a tool that generates the README.md for a Helm chart automatically. In the CI pipeline workflow of GitHub actions (.github/workflows/ci.yaml), you can see how helm-docs is used. The CI pipeline is not designed to make commits back into the project, so we need to run helm-docs manually and commit the resulting generated README.md. You can obtain a recent version of the helm-docs binary here: https://github.com/norwoodj/helm-docs/releases.
+  - [helm-docs](https://github.com/norwoodj/helm-docs) is a tool that generates the README.md for a helm-chart automatically. In the CI pipeline workflow of github actions (/.github/workflows/ci.yaml), you can see how helm-docs is used. But the CI pipeline is not designed to make commits back into the project. So we need to run helm-docs manually, and check in the resulting autogenerated README.md at the path /charts/ingress-nginx/README.md 
     ```
-    helm-docs --chart-search-root charts
-    git diff charts/ingress-nginx/README.md
+          GOBIN=$PWD GO111MODULE=on go install github.com/norwoodj/helm-docs/cmd/helm-docs@v1.11.0
+          ./helm-docs --chart-search-root=${GITHUB_WORKSPACE}/charts
+          git diff --exit-code
+          rm -f ./helm-docs
     ```
-    Take care of not leaving the helm-docs executable in your clone workspace or not committing the new README.md.
+    Watchout for mistakes like leaving the helm-docs executable in your clone workspace or not checking the new README.md manually etc.
 
 ### e. Edit the static manifests
 
@@ -273,7 +274,7 @@ Promoting the images basically means that images, that were pushed to staging co
 
 ### h. Update README.md
 
-- Update the table in README.md in the root of the project to reflect the support matrix. Add the new release version and details in there.
+- Update the table in README.md in the root of the projet to reflect the support matrix. Add the new release version and details in there.
 
 ## 5. RELEASE new version
 
@@ -290,7 +291,7 @@ Promoting the images basically means that images, that were pushed to staging co
  - `helm repo update`
  - `helm search repo ingress-nginx`
 
-## 6. GitHub release
+## 6. Github release
 
 - Release to github
 

Makefile

@@ -58,7 +58,7 @@ ifneq ($(PLATFORM),)
 	PLATFORM_FLAG="--platform"
 endif
 
-REGISTRY ?= us-central1-docker.pkg.dev/k8s-staging-images/ingress-nginx
+REGISTRY ?= gcr.io/k8s-staging-ingress-nginx
 
 BASE_IMAGE ?= $(shell cat NGINX_BASE)
 
@@ -110,7 +110,7 @@ clean-chroot-image: ## Removes local image
 
 .PHONY: build
 build:  ## Build ingress controller, debug tool and pre-stop hook.
-	E2E_IMAGE=golang:$(GO_VERSION)-alpine3.21 USE_SHELL=/bin/sh build/run-in-docker.sh \
+	E2E_IMAGE=golang:$(GO_VERSION)-alpine3.20 USE_SHELL=/bin/sh build/run-in-docker.sh \
 		MAC_OS=$(MAC_OS) \
 		PKG=$(PKG) \
 		ARCH=$(ARCH) \
@@ -124,9 +124,6 @@ build:  ## Build ingress controller, debug tool and pre-stop hook.
 clean: ## Remove .gocache directory.
 	rm -rf bin/ .gocache/ .cache/
 
-.PHONY: verify-docs
-verify-docs: ## Verify doc generation
-	hack/verify-annotation-docs.sh
 
 .PHONY: static-check
 static-check: ## Run verification script for boilerplate, codegen, gofmt, golint, lualint and chart-lint.

NEW_CONTRIBUTOR.md

@@ -20,14 +20,14 @@ It all starts with the OSI model...
 ### Approaching the problem
 
 
-Not everybody knows everything. But the factors that help are a love/passion for this to begin. But to move forward, it's the approach and not the knowledge that sustains prolonged joy, while working on issues. If the approach is simple and powered by good-wishes-for-community, then info & tools are forthcoming and easy.
+Not everybody knows everything. But the factors that help are a love/passion for this to begin. But to move forward, its the approach and not the knowledge that sustains prolonged joy, while working on issues. If the approach is simple and powered by good-wishes-for-community, then info & tools are forthcoming and easy.
 
 Here we take a bird's eye-view of the hops in the network plumbing, that a packet takes, from source to destination, when we run `curl`, from a laptop to a nginx webserver process, running in a container, inside a pod, inside a Kubernetes cluster, created using `kind` or `minikube` or any other cluster-management tool.
 
 ### [Kind](https://kind.sigs.k8s.io/) cluster example on a Linux Host
 
 #### TL;DR
-The destination of the packet from the curl command, is looked up, in the `routing table`. Based on the route, the packet first travels to the virtual bridge `172.18.0.1` interface, created by docker, when we created the kind cluster on a laptop. Next the packet is forwarded to `172.18.0.2`(See below on how we got this IP address), within the kind cluster. The `kube-proxy` container creates iptables rules that make sure the packet goes to the correct pod ip in this case `10.244.0.5`
+The destination of the packet from the curl command, is looked up, in the `routing table`. Based on the route, the the packet first travels to the virtual bridge `172.18.0.1` interface, created by docker, when we created the kind cluster on a laptop. Next the packet is forwarded to `172.18.0.2`(See below on how we got this IP address), within the kind cluster. The `kube-proxy` container creates iptables rules that make sure the packet goes to the correct pod ip in this case `10.244.0.5`
 
 Command:
 ```
@@ -325,9 +325,9 @@ minikube start
 🐳  Preparing Kubernetes v1.23.3 on Docker 20.10.12 ...
     ▪ kubelet.housekeeping-interval=5m
 🔎  Verifying Kubernetes components...
-    ▪ Using image registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1
-    ▪ Using image registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1
-    ▪ Using image registry.k8s.io/ingress-nginx/controller:v1.2.1
+    ▪ Using image k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.1.1
+    ▪ Using image k8s.gcr.io/ingress-nginx/kube-webhook-certgen:v1.1.1
+    ▪ Using image k8s.gcr.io/ingress-nginx/controller:v1.2.1
     ▪ Using image gcr.io/k8s-minikube/storage-provisioner:v5
 🔎  Verifying ingress addon...
 🌟  Enabled addons: ingress, storage-provisioner, default-storageclass
@@ -435,7 +435,7 @@ virbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
 ```
 Output Relevance: From the above output you can see there are two Virtual Bridges created by minikube when we created the cluster on the network. Here, `virbr0` is the default NAT network bridge while `virbr2` is a isolated network bridge on which the pods run.
 
-Minikube creates a Virtual Machine, to enter the virtual machine we can simply do:
+Minikube creates a Virtual Machine, to enter the virtual machine we can simple do:
 ```
 # minikube ssh
 ```
@@ -707,7 +707,7 @@ NAME    TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
 httpd   ClusterIP   10.104.111.0   <none>        80/TCP    13s
 ```
 
-Once we have this we can now create an ingress using the following
+Once we have this we can now create a n ingress using the following
 ```
 kubectl -n httpd create ingress httpd --class nginx --rule httpd.dev.leonnunes.com/"*"=httpd:80
 ```
@@ -771,7 +771,7 @@ Hypertext Transfer Protocol
     [Response in frame: 6]
 
 ```
-The above output shows the information that the `httpd` pod receives. The `curl` command sends the host header, `Host: httpd.dev.leonnunes.com`, to the nginx controller, that then matches the rule and sends the information to the right controller
+The above output shows the information that the `httpd` pod recieves. The `curl` command sends the host header, `Host: httpd.dev.leonnunes.com`, to the nginx controller, that then matches the rule and sends the information to the right controller
 
 The following output shows what is sent via the laptop.
 ```

NGINX_BASE

@@ -1 +1 @@
-registry.k8s.io/ingress-nginx/nginx:v2.0.0@sha256:3e7bda4cf5111d283ed1e4ff5cc9a2b5cdc5ebe62d50ba67473d3e25b1389133
+registry.k8s.io/ingress-nginx/nginx-1.25:v0.0.12@sha256:2d471b3a34dc43d10c3f3d7f2a6e8a2ecf7654a4197e56374261c1c708b16365

OWNERS

@@ -10,4 +10,3 @@ emeritus_approvers:
 - aledbf # 2020-04-02
 - bowei # 2022-10-12
 - ElvinEfendi # 2023-04-23
-- rikatz # 2024-12-15

OWNERS_ALIASES

@@ -1,17 +1,40 @@
 # See the OWNERS docs: https://www.kubernetes.dev/docs/guide/owners
 
 aliases:
+  sig-network-leads:
+  - caseydavenport
+  - dcbw
+  - thockin
+
+  ingress-nginx-admins:
+  - Gacko
+  - rikatz
+  - strongjz
+
   ingress-nginx-maintainers:
   - cpanato
   - Gacko
+  - puerco
+  - rikatz
   - strongjz
   - tao12345666333
 
   ingress-nginx-reviewers:
   - cpanato
   - Gacko
+  - puerco
+  - rikatz
   - strongjz
   - tao12345666333
 
+  ingress-nginx-helm-maintainers:
+  - ubergesundheit
+
+  ingress-nginx-helm-reviewers:
+  - ubergesundheit
+
   ingress-nginx-docs-maintainers:
   - longwuyuan
+
+  ingress-nginx-kube-webhook-certgen-reviewers:
+  - invidian

README.md

@@ -17,8 +17,6 @@ balancer.
 
 See the [Getting Started](https://kubernetes.github.io/ingress-nginx/deploy/) document.
 
-Do not use in multi-tenant Kubernetes production installations. This project assumes that users that can create Ingress objects are administrators of the cluster. See the [FAQ](https://kubernetes.github.io/ingress-nginx/faq/#faq) for more.
-
 ## Troubleshooting
 
 If you encounter issues, review the [troubleshooting docs](docs/troubleshooting.md),
@@ -39,20 +37,12 @@ the versions listed. Ingress-Nginx versions **may** work on older versions, but
 
 | Supported | Ingress-NGINX version | k8s supported version         | Alpine Version | Nginx Version | Helm Chart Version |
 | :-------: | --------------------- | ----------------------------- | -------------- | ------------- | ------------------ |
-|    🔄     | **v1.12.0**           | 1.32, 1.31, 1.30, 1.29, 1.28  | 3.21.0         | 1.25.5        | 4.12.0             |
-|    🔄     | **v1.12.0-beta.0**    | 1.32, 1.31, 1.30, 1.29, 1.28  | 3.20.3         | 1.25.5        | 4.12.0-beta.0      |
-|    🔄     | **v1.11.4**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.21.0         | 1.25.5        | 4.11.4             |
-|    🔄     | **v1.11.3**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.3         | 1.25.5        | 4.11.3             |
 |    🔄     | **v1.11.2**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.0         | 1.25.5        | 4.11.2             |
 |    🔄     | **v1.11.1**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.0         | 1.25.5        | 4.11.1             |
 |    🔄     | **v1.11.0**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.0         | 1.25.5        | 4.11.0             |
-|           | **v1.10.6**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.21.0         | 1.25.5        | 4.10.6             |
-|           | **v1.10.5**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.3         | 1.25.5        | 4.10.5             |
-|           | **v1.10.4**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.0         | 1.25.5        | 4.10.4             |
-|           | **v1.10.3**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.0         | 1.25.5        | 4.10.3             |
-|           | **v1.10.2**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.0         | 1.25.5        | 4.10.2             |
-|           | **v1.10.1**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.19.1         | 1.25.3        | 4.10.1             |
-|           | **v1.10.0**           | 1.29, 1.28, 1.27, 1.26        | 3.19.1         | 1.25.3        | 4.10.0             |
+|    🔄     | **v1.10.2**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.20.0         | 1.25.5        | 4.10.2             |
+|    🔄     | **v1.10.1**           | 1.30, 1.29, 1.28, 1.27, 1.26  | 3.19.1         | 1.25.3        | 4.10.1             |
+|    🔄     | **v1.10.0**           | 1.29, 1.28, 1.27, 1.26        | 3.19.1         | 1.25.3        | 4.10.0             |
 |           | v1.9.6                | 1.29, 1.28, 1.27, 1.26, 1.25  | 3.19.0         | 1.21.6        | 4.9.1              |
 |           | v1.9.5                | 1.28, 1.27, 1.26, 1.25        | 3.18.4         | 1.21.6        | 4.9.0              |
 |           | v1.9.4                | 1.28, 1.27, 1.26, 1.25        | 3.18.4         | 1.21.6        | 4.8.3              |

SECURITY_CONTACTS

@@ -10,4 +10,5 @@
 # DO NOT REPORT SECURITY VULNERABILITIES DIRECTLY TO THESE NAMES, FOLLOW THE
 # INSTRUCTIONS AT https://kubernetes.io/security/
 Gacko
+rikatz
 strongjz

TAG

@@ -0,0 +1 @@
+v1.11.2

build/dev-env.sh

@@ -64,7 +64,7 @@ echo "[dev-env] building image"
 make build image
 docker tag "${REGISTRY}/controller:${TAG}" "${DEV_IMAGE}"
 
-export K8S_VERSION=${K8S_VERSION:-v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027}
+export K8S_VERSION=${K8S_VERSION:-v1.29.2@sha256:51a1434a5397193442f0be2a297b488b6c919ce8a3931be0ce822606ea5ca245}
 
 KIND_CLUSTER_NAME="ingress-nginx-dev"
 

build/run-in-docker.sh

@@ -26,11 +26,14 @@ set -o nounset
 set -o pipefail
 
 # temporal directory for the /etc/ingress-controller directory
-if [[ "$OSTYPE" == darwin* ]]; then
+if [[ "$OSTYPE" == darwin* ]] && [[ "$RUNTIME" == podman ]]; then
   mkdir -p "tmp"
   INGRESS_VOLUME=$(pwd)/$(mktemp -d tmp/XXXXXX)
 else
   INGRESS_VOLUME=$(mktemp -d)
+  if [[ "$OSTYPE" == darwin* ]]; then
+    INGRESS_VOLUME=/private$INGRESS_VOLUME
+  fi
 fi
 
 # make sure directory for SSL cert storage exists under ingress volume
@@ -41,7 +44,7 @@ function cleanup {
 }
 trap cleanup EXIT
 
-E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20250112-a188f4eb@sha256:043038b1e30e5a0b64f3f919f096c5c9488ac3f617ac094b07fb9db8215f9441}
+E2E_IMAGE=${E2E_IMAGE:-registry.k8s.io/ingress-nginx/e2e-test-runner:v20240812-3f0129aa@sha256:95c2aaf2a66e8cbbf7a7453046f3b024383c273a0988efab841cd96116afd1a9}
 
 if [[ "$RUNTIME" == podman ]]; then
   # Podman does not support both tag and digest
@@ -79,7 +82,7 @@ if [[ "$DOCKER_IN_DOCKER_ENABLED" == "true" ]]; then
   echo "..reached DIND check TRUE block, inside run-in-docker.sh"
   echo "FLAGS=$FLAGS"
   #go env
-  go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.22.2
+  go install -mod=mod github.com/onsi/ginkgo/v2/ginkgo@v2.20.0
   find / -type f -name ginkgo 2>/dev/null
   which ginkgo
   /bin/bash -c "${FLAGS}"

build/run-ingress-controller.sh

@@ -49,7 +49,7 @@ fi
 SSL_VOLUME=$(mktemp -d)
 
 function cleanup {
-    echo -e "${BGREEN}Stopping kubectl proxy${NC}"
+    echo -e "${BGREEN}Stoping kubectl proxy${NC}"
     rm -rf "${SSL_VOLUME}"
     kill "$proxy_pid"
 }

changelog/controller-1.10.3.md

@@ -1,37 +0,0 @@
-# Changelog
-
-### controller-v1.10.3
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.10.3@sha256:b5a5082f8e508cc1aac1c0ef101dc2f87b63d51598a5747d81d6cf6e7ba058fd
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.3@sha256:9033e04bd3cd01f92414f8d5999c5095734d4caceb4923942298152a38373d4b
-
-### All changes:
-
-* Images: Trigger `controller` v1.10.3 build. (#11648)
-* Tests: Bump `test-runner` to v20240717-1fe74b5f. (#11646)
-* Images: Re-run `test-runner` build. (#11643)
-* Images: Trigger `test-runner` build. (#11639)
-* Images: Bump `NGINX_BASE` to v0.0.10. (#11637)
-* Images: Trigger NGINX build. (#11631)
-* bump testing runner (#11626)
-* remove modsecurity coreruleset test files from nginx image (#11619)
-* unskip the ocsp tests and update images to fix cfssl bug (#11615)
-* Fix indent in YAML for example pod (#11609)
-* Images: Bump `test-runner`. (#11604)
-* Images: Bump `NGINX_BASE` to v0.0.9. (#11601)
-* revert module upgrade (#11595)
-* README: Fix support matrix. (#11593)
-* Mage: Stop mutating release notes. (#11582)
-* Images: Bump `kube-webhook-certgen`. (#11583)
-
-### Dependency updates:
-
-* Bump github.com/prometheus/common from 0.54.0 to 0.55.0 (#11622)
-* Bump the all group with 5 updates (#11613)
-* Bump golang.org/x/crypto from 0.24.0 to 0.25.0 (#11579)
-* Bump google.golang.org/grpc from 1.64.0 to 1.65.0 (#11577)
-* Bump the all group with 4 updates (#11574)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.2...controller-v1.10.3

changelog/controller-1.10.4.md

@@ -1,53 +0,0 @@
-# Changelog
-
-### controller-v1.10.4
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.10.4@sha256:505b9048c02dde3d6c8667bf0b52aba7b36adf7b03da34c47d5fa312d2d4c6fc
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.4@sha256:bf71acf6e71830a4470e2183e3bc93c4f006b954f8a05fb434242ef0f8a24858
-
-### All changes:
-
-* Chart: Bump Kube Webhook CertGen & OpenTelemetry. (#11811)
-* Images: Trigger controller build. (#11808)
-* Tests & Docs: Bump images. (#11804)
-* Images: Trigger failed builds. (#11801)
-* Images: Trigger other builds. (#11797)
-* Controller: Fix panic in alternative backend merging. (#11793)
-* Tests: Bump `e2e-test-runner` to v20240812-3f0129aa. (#11791)
-* Images: Trigger `test-runner` build. (#11786)
-* Images: Bump `NGINX_BASE` to v0.0.12. (#11783)
-* Images: Trigger NGINX build. (#11780)
-* Cloud Build: Add missing config, remove unused ones. (#11776)
-* Generate correct output on NumCPU() when using cgroups2 (#11775)
-* Cloud Build: Tweak timeouts. (#11762)
-* Cloud Build: Fix substitutions. (#11759)
-* Cloud Build: Some chores. (#11756)
-* Go: Bump to v1.22.6. (#11748)
-* Images: Bump `NGINX_BASE` to v0.0.11. (#11744)
-* Images: Trigger NGINX build. (#11736)
-* docs: update OpenSSL Roadmap link (#11734)
-* Go: Bump to v1.22.5. (#11731)
-* Docs: Fix typo in AWS LB Controller reference (#11724)
-* Perform some cleaning operations on line breaks. (#11722)
-* Missing anchors in regular expression. (#11718)
-* Docs: Fix `from-to-www` redirect description. (#11715)
-* Chart: Remove `isControllerTagValid`. (#11714)
-* Tests: Bump `e2e-test-runner` to v20240729-04899b27. (#11704)
-* Docs: Clarify `from-to-www` redirect direction. (#11692)
-* added real-client-ip faq (#11665)
-* Docs: Format NGINX configuration table. (#11660)
-
-### Dependency updates:
-
-* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 (#11772)
-* Bump the all group with 2 updates (#11770)
-* Bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#11768)
-* Bump the all group with 3 updates (#11729)
-* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group (#11700)
-* Bump the all group with 2 updates (#11697)
-* Bump the all group with 4 updates (#11676)
-* Bump the all group with 2 updates (#11674)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.3...controller-v1.10.4

changelog/controller-1.10.5.md

@@ -1,90 +0,0 @@
-# Changelog
-
-### controller-v1.10.5
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.10.5@sha256:c84d11b1f7bd14ebbf49918a7f0dc01b31c0c6e757e0129520ea93453096315c
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.5@sha256:030a43bdd5f0212a7e135cc4da76b15a6706ef65a6824eb4cc401f87a81c2987
-
-### All changes:
-
-* Images: Trigger controller build. (#12133)
-* Tests & Docs: Bump `e2e-test-echo` to v1.0.1. (#12146)
-* Images: Trigger `e2e-test-echo` build. (#12142)
-* Images: Drop `s390x`. (#12139)
-* Images: Build `s390x` controller. (#12128)
-* Chart: Bump Kube Webhook CertGen. (#12122)
-* Tests & Docs: Bump images. (#12120)
-* Cloud Build: Bump `gcb-docker-gcloud` to v20240718-5ef92b5c36. (#12116)
-* Images: Trigger other builds. (#12111)
-* Tests: Bump `e2e-test-runner` to v20241004-114a6abb. (#12104)
-* Images: Trigger `test-runner` build. (#12101)
-* Docs: Add a multi-tenant warning. (#12098)
-* Go: Bump to v1.22.8. (#12093)
-* Images: Bump `NGINX_BASE` to v0.1.0. (#12079)
-* Images: Trigger NGINX build. (#12077)
-* Images: Remove NGINX v1.21. (#12057)
-* GitHub: Improve Dependabot. (#12037)
-* Chart: Improve CI. (#12029)
-* Chart: Extend image tests. (#12026)
-* Docs: Add health check annotations for AWS. (#12021)
-* Docs: Convert `opentelemetry.md` from CRLF to LF. (#12007)
-* Chart: Test `controller.minAvailable` & `controller.maxUnavailable`. (#12001)
-* Chart: Align default backend `PodDisruptionBudget`. (#11998)
-* Metrics: Fix namespace in `nginx_ingress_controller_ssl_expire_time_seconds`. (#11985)
-* Chart: Improve default backend service account. (#11973)
-* Go: Bump to v1.22.7. (#11969)
-* Images: Bump OpenTelemetry C++ Contrib. (#11950)
-* Docs: Add note about `--watch-namespace`. (#11948)
-* Images: Use latest Alpine 3.20 everywhere. (#11945)
-* Fix minor typos (#11940)
-* Chart: Implement `controller.admissionWebhooks.service.servicePort`. (#11933)
-* Tests: Bump `e2e-test-runner` to v20240829-2c421762. (#11920)
-* Images: Trigger `test-runner` build. (#11918)
-* Chart: Add tests for `PrometheusRule` & `ServiceMonitor`. (#11888)
-* Annotations: Allow commas in URLs. (#11886)
-* CI: Grant checks write permissions to E2E Test Report. (#11884)
-* Update maxmind post link about geolite2 license changes (#11880)
-* Go: Sync `go.work.sum`. (#11876)
-* Replace deprecated queue method (#11858)
-* Auto-generate annotation docs (#11835)
-
-### Dependency updates:
-
-* Bump the actions group with 3 updates (#12150)
-* Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12108)
-* Bump the actions group with 3 updates (#12096)
-* Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12088)
-* Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12086)
-* Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12084)
-* Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12082)
-* Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12054)
-* Bump the go group across 1 directory with 3 updates (#12052)
-* Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12048)
-* Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12044)
-* Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12045)
-* Bump the all group with 2 updates (#12035)
-* Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12015)
-* Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12013)
-* Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12011)
-* Bump the all group with 2 updates (#11979)
-* Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11978)
-* Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11960)
-* Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11959)
-* Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11956)
-* Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11929)
-* Bump the all group with 2 updates (#11924)
-* Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11912)
-* Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11907)
-* Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11906)
-* Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11905)
-* Bump the all group with 2 updates (#11870)
-* Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11869)
-* Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11848)
-* Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11847)
-* Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11846)
-* Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11841)
-* Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11833)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.4...controller-v1.10.5

changelog/controller-1.10.6.md

@@ -1,92 +0,0 @@
-# Changelog
-
-### controller-v1.10.6
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.10.6@sha256:b6fbd102255edb3ba8e5421feebe14fd3e94cf53d199af9e40687f536152189c
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.10.6@sha256:44ceedafc0e04a75521b5d472c1b6b5cc08afb8038b5bbfd79c21d066ccf300e
-
-### All changes:
-
-* Images: Trigger controller build. (#12611)
-* Chart: Bump Kube Webhook CertGen. (#12608)
-* Tests & Docs: Bump images. (#12605)
-* Images: Trigger other builds (2/2). (#12598)
-* Images: Trigger other builds (1/2). (#12597)
-* Tests: Bump `e2e-test-runner` to v20241224-68ed4e7b. (#12592)
-* Images: Trigger `test-runner` build. (#12586)
-* Images: Bump `NGINX_BASE` to v0.2.0. (#12584)
-* Images: Trigger NGINX build. (#12578)
-* Go: Clean `go.work.sum`. (#12575)
-* Repository: Update owners. (#12570)
-* Images: Bump `gcb-docker-gcloud` to v20241217-ff46a068cd. (#12563)
-* CI: Update KIND images. (#12559)
-* Images: Bump Alpine to v3.21. (#12530)
-* Docs: Add guide on how to set a Maintenance Page. (#12527)
-* rikatz is stepping down (#12518)
-* rikatz is stepping down (#12497)
-* Go: Bump to v1.23.4. (#12485)
-* Plugin: Bump `goreleaser` to v2. (#12442)
-* GitHub: Fix `exec` in issue template. (#12389)
-* CI: Update KIND images. (#12368)
-* Images: Bump `gcb-docker-gcloud` to v20241110-72bb0b1665. (#12341)
-* Go: Bump to v1.23.3. (#12339)
-* Auth TLS: Add `_` to redirect RegEx. (#12328)
-* Auth TLS: Improve redirect RegEx. (#12321)
-* Tests: Bump `e2e-test-runner` to v20241104-02a3933e. (#12314)
-* Images: Trigger `test-runner` build. (#12307)
-* Config: Fix panic on invalid `lua-shared-dict`. (#12282)
-* Docs: fix limit-rate-after references (#12280)
-* Chart: Rework ServiceMonitor. (#12268)
-* Chart: Add ServiceAccount tests. (#12266)
-* CI: Fix chart testing. (#12260)
-* [fix] fix nginx temp configs cleanup (#12224)
-* Chart: Suggest `matchLabelKeys` in Topology Spread Constraints. (#12204)
-* Docs: Add Pod Security Admission. (#12198)
-* Docs: Clarify external & service port in TCP/UDP services explanation. (#12194)
-
-### Dependency updates:
-
-* Bump k8s.io/apiextensions-apiserver from 0.31.3 to 0.32.0 (#12565)
-* Bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 (#12557)
-* Bump k8s.io/code-generator from 0.31.3 to 0.32.0 (#12552)
-* Bump k8s.io/cli-runtime from 0.31.3 to 0.32.0 (#12549)
-* Bump k8s.io/apiserver from 0.31.3 to 0.32.0 (#12546)
-* Bump the actions group with 2 updates (#12543)
-* Bump google.golang.org/grpc from 1.68.1 to 1.69.2 (#12540)
-* Bump k8s.io/client-go from 0.31.3 to 0.32.0 (#12514)
-* Bump github.com/opencontainers/runc from 1.2.2 to 1.2.3 in the go group across 1 directory (#12511)
-* Bump the actions group with 3 updates (#12508)
-* Bump k8s.io/kube-aggregator from 0.31.3 to 0.32.0 in /images/kube-webhook-certgen/rootfs (#12504)
-* Bump k8s.io/apimachinery from 0.31.3 to 0.32.0 in /images/ext-auth-example-authsvc/rootfs (#12501)
-* Bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#12478)
-* Bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /magefiles (#12473)
-* Bump github.com/prometheus/common from 0.60.1 to 0.61.0 (#12466)
-* Bump github/codeql-action from 3.27.5 to 3.27.6 in the actions group (#12463)
-* Bump the go group across 1 directory with 2 updates (#12459)
-* Bump github.com/onsi/ginkgo/v2 from 2.21.0 to 2.22.0 (#12425)
-* Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#12416)
-* Bump the go group across 3 directories with 10 updates (#12414)
-* Bump the actions group with 3 updates (#12410)
-* Bump github.com/opencontainers/runc from 1.2.1 to 1.2.2 in the go group across 1 directory (#12382)
-* Bump github/codeql-action from 3.27.1 to 3.27.4 in the actions group (#12375)
-* Bump golangci-lint on actions and disable deprecated linters (#12363)
-* Bump google.golang.org/grpc from 1.67.1 to 1.68.0 (#12356)
-* Bump the actions group with 3 updates (#12353)
-* Bump golang.org/x/crypto from 0.28.0 to 0.29.0 (#12351)
-* Bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 (#12297)
-* Bump github.com/opencontainers/runc from 1.2.0 to 1.2.1 in the go group across 1 directory (#12294)
-* Bump github.com/onsi/ginkgo/v2 from 2.20.2 to 2.21.0 (#12290)
-* Bump actions/dependency-review-action from 4.3.5 to 4.4.0 in the actions group (#12275)
-* Bump the go group across 3 directories with 11 updates (#12246)
-* Bump github.com/opencontainers/runc from 1.1.15 to 1.2.0 (#12241)
-* Bump the actions group with 5 updates (#12243)
-* Bump github.com/ncabatoff/process-exporter from 0.8.3 to 0.8.4 in the go group across 1 directory (#12219)
-* Bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 in the actions group (#12215)
-* Bump github/codeql-action from 3.26.12 to 3.26.13 in the actions group (#12191)
-* Bump the go group across 2 directories with 1 update (#12189)
-* Bump the actions group with 2 updates (#12185)
-* Bump github.com/opencontainers/runc from 1.1.14 to 1.1.15 in the go group across 1 directory (#12184)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.10.5...controller-v1.10.6

changelog/controller-1.11.0.md

@@ -94,7 +94,7 @@ Images:
 * Chart: Improve IngressClass documentation. (#11104)
 * Chart: Deploy `PodDisruptionBudget` with KEDA. (#11032)
 * Undo #11062 since it breaks the nginx config (#11082)
-* [mTLS] Fix acme verification when mTLS and Client CN verification is enabled (#11062)
+* [mTLS] Fix acme verfication when mTLS and Client CN verification is enabled (#11062)
 * golangci-lint update, ci cleanup, group dependabot updates (#11071)
 * bump golang (#11070)
 * feature(leader_election): flag to disable leader election feature on controller (#11064)

changelog/controller-1.11.3.md

@@ -1,91 +0,0 @@
-# Changelog
-
-### controller-v1.11.3
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.11.3@sha256:d56f135b6462cfc476447cfe564b83a45e8bb7da2774963b00d12161112270b7
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.11.3@sha256:22701f0fc0f2dd209ef782f4e281bfe2d8cccd50ededa00aec88e0cdbe7edd14
-
-### All changes:
-
-* Images: Trigger controller build. (#12134)
-* Tests & Docs: Bump `e2e-test-echo` to v1.0.1. (#12145)
-* Images: Trigger `e2e-test-echo` build. (#12141)
-* Images: Drop `s390x`. (#12138)
-* Images: Build `s390x` controller. (#12127)
-* Chart: Bump Kube Webhook CertGen. (#12123)
-* Tests & Docs: Bump images. (#12121)
-* Cloud Build: Bump `gcb-docker-gcloud` to v20240718-5ef92b5c36. (#12117)
-* Images: Trigger other builds. (#12112)
-* Tests: Bump `e2e-test-runner` to v20241004-114a6abb. (#12105)
-* Images: Trigger `test-runner` build. (#12102)
-* Docs: Add a multi-tenant warning. (#12099)
-* Go: Bump to v1.22.8. (#12094)
-* Images: Bump `NGINX_BASE` to v0.1.0. (#12080)
-* Images: Trigger NGINX build. (#12076)
-* Images: Remove NGINX v1.21. (#12058)
-* GitHub: Improve Dependabot. (#12038)
-* Chart: Improve CI. (#12030)
-* Chart: Extend image tests. (#12027)
-* Docs: Add health check annotations for AWS. (#12020)
-* Docs: Convert `opentelemetry.md` from CRLF to LF. (#12006)
-* Chart: Test `controller.minAvailable` & `controller.maxUnavailable`. (#12002)
-* Chart: Align default backend `PodDisruptionBudget`. (#11999)
-* Metrics: Fix namespace in `nginx_ingress_controller_ssl_expire_time_seconds`. (#11986)
-* Chart: Improve default backend service account. (#11974)
-* Go: Bump to v1.22.7. (#11970)
-* Images: Bump OpenTelemetry C++ Contrib. (#11951)
-* Docs: Add note about `--watch-namespace`. (#11949)
-* Images: Use latest Alpine 3.20 everywhere. (#11946)
-* Fix minor typos (#11941)
-* Chart: Implement `controller.admissionWebhooks.service.servicePort`. (#11934)
-* Tests: Bump `e2e-test-runner` to v20240829-2c421762. (#11921)
-* Images: Trigger `test-runner` build. (#11917)
-* Chart: Add tests for `PrometheusRule` & `ServiceMonitor`. (#11889)
-* Annotations: Allow commas in URLs. (#11887)
-* CI: Grant checks write permissions to E2E Test Report. (#11885)
-* Chart: Use generic values for `ConfigMap` test. (#11879)
-* Update maxmind post link about geolite2 license changes (#11881)
-* Go: Sync `go.work.sum`. (#11875)
-* Replace deprecated queue method (#11859)
-* Auto-generate annotation docs (#11831)
-
-### Dependency updates:
-
-* Bump the actions group with 3 updates (#12149)
-* Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12109)
-* Bump the actions group with 3 updates (#12097)
-* Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12089)
-* Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12087)
-* Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12085)
-* Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12083)
-* Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12055)
-* Bump the go group across 1 directory with 3 updates (#12053)
-* Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12049)
-* Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12047)
-* Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12046)
-* Bump the all group with 2 updates (#12036)
-* Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12016)
-* Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12014)
-* Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12012)
-* Bump the all group with 2 updates (#11981)
-* Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11980)
-* Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11961)
-* Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11958)
-* Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11957)
-* Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11930)
-* Bump the all group with 2 updates (#11925)
-* Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11913)
-* Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11910)
-* Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11909)
-* Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11908)
-* Bump the all group with 2 updates (#11871)
-* Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11868)
-* Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11840)
-* Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11839)
-* Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11837)
-* Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11836)
-* Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11834)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.11.2...controller-v1.11.3

changelog/controller-1.11.4.md

@@ -1,94 +0,0 @@
-# Changelog
-
-### controller-v1.11.4
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.11.4@sha256:981a97d78bee3109c0b149946c07989f8f1478a9265031d2d23dea839ba05b52
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.11.4@sha256:f29d0f9e7a9ef4947eda59ed0c09ec13380b13639d1518cf1ab8ec09c3e22ef8
-
-### All changes:
-
-* Images: Trigger controller build. (#12610)
-* Chart: Bump Kube Webhook CertGen. (#12607)
-* Tests & Docs: Bump images. (#12604)
-* Images: Trigger other builds (2/2). (#12600)
-* Images: Trigger other builds (1/2). (#12596)
-* Tests: Bump `e2e-test-runner` to v20241224-68ed4e7b. (#12591)
-* Images: Trigger `test-runner` build. (#12588)
-* Images: Bump `NGINX_BASE` to v0.2.0. (#12583)
-* Images: Trigger NGINX build. (#12577)
-* Go: Clean `go.work.sum`. (#12574)
-* Repository: Update owners. (#12569)
-* Images: Bump `gcb-docker-gcloud` to v20241217-ff46a068cd. (#12562)
-* CI: Update KIND images. (#12558)
-* Images: Bump Alpine to v3.21. (#12529)
-* Docs: Add guide on how to set a Maintenance Page. (#12526)
-* rikatz is stepping down (#12517)
-* rikatz is stepping down (#12495)
-* Go: Bump to v1.23.4. (#12484)
-* Plugin: Bump `goreleaser` to v2. (#12441)
-* GitHub: Fix `exec` in issue template. (#12388)
-* CI: Update KIND images. (#12365)
-* Images: Bump `gcb-docker-gcloud` to v20241110-72bb0b1665. (#12343)
-* Go: Bump to v1.23.3. (#12338)
-* Auth TLS: Add `_` to redirect RegEx. (#12327)
-* Auth TLS: Improve redirect RegEx. (#12322)
-* Update custom headers annotation documentation (#12319)
-* Tests: Bump `e2e-test-runner` to v20241104-02a3933e. (#12313)
-* Images: Trigger `test-runner` build. (#12306)
-* Config: Fix panic on invalid `lua-shared-dict`. (#12284)
-* Docs: fix limit-rate-after references (#12279)
-* Chart: Rework ServiceMonitor. (#12270)
-* Chart: Add ServiceAccount tests. (#12264)
-* CI: Fix chart testing. (#12259)
-* [fix] fix nginx temp configs cleanup (#12223)
-* Chart: Suggest `matchLabelKeys` in Topology Spread Constraints. (#12203)
-* Docs: Add Pod Security Admission. (#12197)
-* Docs: Clarify external & service port in TCP/UDP services explanation. (#12193)
-* Docs: Goodbye, v1.10. (#12159)
-
-### Dependency updates:
-
-* Bump k8s.io/apiextensions-apiserver from 0.31.3 to 0.32.0 (#12567)
-* Bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 (#12556)
-* Bump k8s.io/code-generator from 0.31.3 to 0.32.0 (#12551)
-* Bump k8s.io/cli-runtime from 0.31.3 to 0.32.0 (#12548)
-* Bump k8s.io/apiserver from 0.31.3 to 0.32.0 (#12545)
-* Bump the actions group with 2 updates (#12542)
-* Bump google.golang.org/grpc from 1.68.1 to 1.69.2 (#12539)
-* Bump k8s.io/client-go from 0.31.3 to 0.32.0 (#12513)
-* Bump github.com/opencontainers/runc from 1.2.2 to 1.2.3 in the go group across 1 directory (#12510)
-* Bump the actions group with 3 updates (#12507)
-* Bump k8s.io/kube-aggregator from 0.31.3 to 0.32.0 in /images/kube-webhook-certgen/rootfs (#12503)
-* Bump k8s.io/apimachinery from 0.31.3 to 0.32.0 in /images/ext-auth-example-authsvc/rootfs (#12500)
-* Bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#12477)
-* Bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /magefiles (#12475)
-* Bump github.com/prometheus/common from 0.60.1 to 0.61.0 (#12465)
-* Bump github/codeql-action from 3.27.5 to 3.27.6 in the actions group (#12462)
-* Bump the go group across 1 directory with 2 updates (#12458)
-* Bump github.com/onsi/ginkgo/v2 from 2.21.0 to 2.22.0 (#12427)
-* Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#12417)
-* Bump the go group across 3 directories with 10 updates (#12415)
-* Bump the actions group with 3 updates (#12411)
-* Bump github.com/opencontainers/runc from 1.2.1 to 1.2.2 in the go group across 1 directory (#12381)
-* Bump github/codeql-action from 3.27.1 to 3.27.4 in the actions group (#12374)
-* Bump golangci-lint on actions and disable deprecated linters (#12362)
-* Bump google.golang.org/grpc from 1.67.1 to 1.68.0 (#12355)
-* Bump the actions group with 3 updates (#12352)
-* Bump golang.org/x/crypto from 0.28.0 to 0.29.0 (#12350)
-* Bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 (#12298)
-* Bump github.com/opencontainers/runc from 1.2.0 to 1.2.1 in the go group across 1 directory (#12295)
-* Bump github.com/onsi/ginkgo/v2 from 2.20.2 to 2.21.0 (#12289)
-* Bump actions/dependency-review-action from 4.3.5 to 4.4.0 in the actions group (#12274)
-* Bump the go group across 3 directories with 11 updates (#12245)
-* Bump github.com/opencontainers/runc from 1.1.15 to 1.2.0 (#12239)
-* Bump the actions group with 5 updates (#12240)
-* Bump github.com/ncabatoff/process-exporter from 0.8.3 to 0.8.4 in the go group across 1 directory (#12220)
-* Bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 in the actions group (#12216)
-* Bump github/codeql-action from 3.26.12 to 3.26.13 in the actions group (#12190)
-* Bump the go group across 2 directories with 1 update (#12187)
-* Bump the actions group with 2 updates (#12181)
-* Bump github.com/opencontainers/runc from 1.1.14 to 1.1.15 in the go group across 1 directory (#12179)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.11.3...controller-v1.11.4

changelog/controller-1.12.0-beta.0.md

@@ -1,216 +0,0 @@
-# Changelog
-
-### controller-v1.12.0-beta.0
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.12.0-beta.0@sha256:9724476b928967173d501040631b23ba07f47073999e80e34b120e8db5f234d5
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.12.0-beta.0@sha256:6e2f8f52e1f2571ff65bc4fc4826d5282d5def5835ec4ab433dcb8e659b2fbac
-
-### All changes:
-
-* Images: Trigger controller build. (#12154)
-* ⚠️ Metrics: Disable by default. (#12153) ⚠️
-
-  This changes the default of the following CLI arguments:
-
-  * `--enable-metrics` gets disabled by default.
-
-* Tests & Docs: Bump `e2e-test-echo` to v1.0.1. (#12147)
-* Images: Trigger `e2e-test-echo` build. (#12140)
-* ⚠️ Images: Drop `s390x`. (#12137) ⚠️
-
-  Support for the `s390x` architecture has already been removed from the controller image. This also removes it from the NGINX base image and CI relevant images.
-
-* Images: Build `s390x` controller. (#12126)
-* Chart: Bump Kube Webhook CertGen. (#12119)
-* Tests & Docs: Bump images. (#12118)
-* Cloud Build: Bump `gcb-docker-gcloud` to v20240718-5ef92b5c36. (#12113)
-* Images: Trigger other builds. (#12110)
-* Tests: Bump `e2e-test-runner` to v20241004-114a6abb. (#12103)
-* Images: Trigger `test-runner` build. (#12100)
-* Docs: Add a multi-tenant warning. (#12091)
-* Go: Bump to v1.22.8. (#12069)
-* Images: Bump `NGINX_BASE` to v1.0.0. (#12066)
-* Images: Trigger NGINX build. (#12063)
-* Images: Remove NGINX v1.21. (#12031)
-* Chart: Add `controller.metrics.service.enabled`. (#12056)
-* GitHub: Improve Dependabot. (#12033)
-* Chart: Add `global.image.registry`. (#12028)
-* ⚠️ Images: Remove OpenTelemetry. (#12024) ⚠️
-
-  OpenTelemetry is still supported, but since the module is built into the controller image since v1.10, we hereby remove the init container and image which were used to install it upon controller startup.
-
-* Chart: Improve CI. (#12003)
-* Chart: Extend image tests. (#12025)
-* Chart: Add `controller.progressDeadlineSeconds`. (#12017)
-* Docs: Add health check annotations for AWS. (#12018)
-* Docs: Convert `opentelemetry.md` from CRLF to LF. (#12005)
-* Chart: Implement `unhealthyPodEvictionPolicy`. (#11992)
-* Chart: Add `defaultBackend.maxUnavailable`. (#11995)
-* Chart: Test `controller.minAvailable` & `controller.maxUnavailable`. (#12000)
-* Chart: Align default backend `PodDisruptionBudget`. (#11993)
-* Metrics: Fix namespace in `nginx_ingress_controller_ssl_expire_time_seconds`. (#10274)
-* ⚠️ Chart: Remove Pod Security Policy. (#11971) ⚠️
-
-  This removes Pod Security Policies and related resources from the chart.
-
-* Chart: Improve default backend service account. (#11972)
-* Go: Bump to v1.22.7. (#11943)
-* NGINX: Remove inline Lua from template. (#11806)
-* Images: Bump OpenTelemetry C++ Contrib. (#11629)
-* Docs: Add note about `--watch-namespace`. (#11947)
-* Images: Use latest Alpine 3.20 everywhere. (#11944)
-* Fix minor typos (#11935)
-* Chart: Implement `controller.admissionWebhooks.service.servicePort`. (#11931)
-* Allow any protocol for cors origins (#11153)
-* Tests: Bump `e2e-test-runner` to v20240829-2c421762. (#11919)
-* Images: Trigger `test-runner` build. (#11916)
-* Chart: Add `controller.metrics.prometheusRule.annotations`. (#11849)
-* Chart: Add tests for `PrometheusRule` & `ServiceMonitor`. (#11883)
-* Annotations: Allow commas in URLs. (#11882)
-* CI: Grant checks write permissions to E2E Test Report. (#11862)
-* Chart: Use generic values for `ConfigMap` test. (#11877)
-* Security: Follow-up on recent changes. (#11874)
-* Lua: Remove plugins from `.luacheckrc` & E2E docs. (#11872)
-* Dashboard: Remove `ingress_upstream_latency_seconds`. (#11878)
-* Metrics: Add `--metrics-per-undefined-host` argument. (#11818)
-* Update maxmind post link about geolite2 license changes (#11861)
-* ⚠️ Remove global-rate-limit feature (#11851) ⚠️
-
-  This removes the following configuration options:
-
-  * `global-rate-limit-memcached-host`
-  * `global-rate-limit-memcached-port`
-  * `global-rate-limit-memcached-connect-timeout`
-  * `global-rate-limit-memcached-max-idle-timeout`
-  * `global-rate-limit-memcached-pool-size`
-  * `global-rate-limit-status-code`
-
-  It also removes the following annotations:
-
-  * `global-rate-limit`
-  * `global-rate-limit-window`
-  * `global-rate-limit-key`
-  * `global-rate-limit-ignored-cidrs`
-
-* Revert "docs: Add deployment for AWS NLB Proxy." (#11857)
-* Add custom code handling for temporal redirect (#10651)
-* Add native histogram support for histogram metrics (#9971)
-* Replace deprecated queue method (#11853)
-* ⚠️ Enable security features by default (#11819) ⚠️
-
-  This changes the default of the following CLI arguments:
-
-  * `--enable-annotation-validation` gets enabled by default.
-
-  It also changes the default of the following configuration options:
-
-  * `allow-cross-namespace-resources` gets disabled by default.
-  * `annotations-risk-level` gets lowered to "High" by default.
-  * `strict-validate-path-type` gets enabled by default.
-
-* docs: Add deployment for AWS NLB Proxy. (#9565)
-* ⚠️ Remove 3rd party lua plugin support (#11821) ⚠️
-
-  This removes the following configuration options:
-
-  * `plugins`
-
-  It also removes support for user provided Lua plugins in the `/etc/nginx/lua/plugins` directory.
-
-* Auto-generate annotation docs (#11820)
-* ⚠️ Metrics: Remove `ingress_upstream_latency_seconds`. (#11795) ⚠️
-
-  This metric has already been deprecated and is now getting removed.
-
-* Release controller v1.11.2/v1.10.4 & chart v4.11.2/v4.10.4. (#11816)
-* Chart: Bump Kube Webhook CertGen & OpenTelemetry. (#11809)
-* Tests & Docs: Bump images. (#11803)
-* Images: Trigger failed builds. (#11800)
-* Images: Trigger other builds. (#11796)
-* Controller: Fix panic in alternative backend merging. (#11789)
-* Tests: Bump `e2e-test-runner` to v20240812-3f0129aa. (#11788)
-* Images: Trigger `test-runner` build. (#11785)
-* Images: Bump `NGINX_BASE` to v0.0.12. (#11782)
-* Images: Trigger NGINX build. (#11779)
-* Cloud Build: Add missing config, remove unused ones. (#11774)
-* Cloud Build: Tweak timeouts. (#11761)
-* Cloud Build: Fix substitutions. (#11758)
-* Cloud Build: Some chores. (#11633)
-* Go: Bump to v1.22.6. (#11747)
-* Images: Bump `NGINX_BASE` to v0.0.11. (#11741)
-* Images: Trigger NGINX build. (#11735)
-* docs: update OpenSSL Roadmap link (#11730)
-* Go: Bump to v1.22.5. (#11634)
-* Docs: Fix typo in AWS LB Controller reference (#11723)
-* Perform some cleaning operations on line breaks. (#11720)
-* Missing anchors in regular expression. (#11717)
-* Docs: Fix `from-to-www` redirect description. (#11712)
-* Chart: Remove `isControllerTagValid`. (#11710)
-* Tests: Bump `e2e-test-runner` to v20240729-04899b27. (#11702)
-* Chart: Explicitly set `runAsGroup`. (#11679)
-* Docs: Clarify `from-to-www` redirect direction. (#11682)
-* added real-client-ip faq (#11663)
-* Docs: Format NGINX configuration table. (#11659)
-* Release controller v1.11.1/v1.10.3 & chart v4.11.1/v4.10.3. (#11654)
-* Tests: Bump `test-runner` to v20240717-1fe74b5f. (#11645)
-* Images: Trigger `test-runner` build. (#11636)
-* Images: Bump `NGINX_BASE` to v0.0.10. (#11635)
-* remove modsecurity coreruleset test files from nginx image (#11617)
-* unskip the ocsp tests and update images to fix cfssl bug (#11606)
-* Fix indent in YAML for example pod (#11598)
-* Images: Bump `test-runner`. (#11600)
-* Images: Bump `NGINX_BASE` to v0.0.9. (#11599)
-* revert module upgrade (#11594)
-* README: Fix support matrix. (#11586)
-* Repository: Add changelogs from `release-v1.10`. (#11587)
-
-### Dependency updates:
-
-* Bump the actions group with 3 updates (#12152)
-* Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12107)
-* Bump the actions group with 3 updates (#12092)
-* Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12062)
-* Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12060)
-* Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12059)
-* Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12061)
-* Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12051)
-* Bump the go group across 1 directory with 3 updates (#12050)
-* Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12043)
-* Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12041)
-* Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12040)
-* Bump the all group with 2 updates (#12032)
-* Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12010)
-* Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12009)
-* Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12008)
-* Bump the all group with 2 updates (#11977)
-* Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11976)
-* Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11954)
-* Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11955)
-* Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11953)
-* Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11928)
-* Bump the all group with 2 updates (#11922)
-* Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11901)
-* Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11902)
-* Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11903)
-* Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11904)
-* Bump the all group with 2 updates (#11865)
-* Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11867)
-* Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11832)
-* Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11823)
-* Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11822)
-* Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11825)
-* Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11826)
-* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 (#11766)
-* Bump the all group with 2 updates (#11767)
-* Bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#11765)
-* Bump the all group with 3 updates (#11727)
-* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group (#11696)
-* Bump the all group with 2 updates (#11695)
-* Bump the all group with 4 updates (#11673)
-* Bump the all group with 2 updates (#11672)
-* Bump github.com/prometheus/common from 0.54.0 to 0.55.0 (#11522)
-* Bump the all group with 5 updates (#11611)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.11.0...controller-v1.12.0-beta.0

changelog/controller-1.12.0.md

@@ -1,294 +0,0 @@
-# Changelog
-
-### controller-v1.12.0
-
-Images:
-
-* registry.k8s.io/ingress-nginx/controller:v1.12.0@sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa
-* registry.k8s.io/ingress-nginx/controller-chroot:v1.12.0@sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3
-
-### All changes:
-
-* Images: Trigger controller build. (#12609)
-* Chart: Bump Kube Webhook CertGen. (#12606)
-* Tests & Docs: Bump images. (#12603)
-* Images: Trigger other builds (2/2). (#12599)
-* Images: Trigger other builds (1/2). (#12595)
-* Tests: Bump `e2e-test-runner` to v20241224-68ed4e7b. (#12590)
-* Images: Trigger `test-runner` build. (#12587)
-* Images: Bump `NGINX_BASE` to v1.1.0. (#12582)
-* Images: Trigger NGINX build. (#12579)
-* Go: Clean `go.work.sum`. (#12573)
-* Repository: Update owners. (#12568)
-* Images: Bump `gcb-docker-gcloud` to v20241217-ff46a068cd. (#12561)
-* CI: Update KIND images. (#12560)
-* Images: Bump Alpine to v3.21. (#12528)
-* Docs: Add guide on how to set a Maintenance Page. (#12525)
-* rikatz is stepping down (#12516)
-* rikatz is stepping down (#12494)
-* Go: Bump to v1.23.4. (#12483)
-* Plugin: Bump `goreleaser` to v2. (#12440)
-* GitHub: Fix `exec` in issue template. (#12387)
-* CI: Update KIND images. (#12367)
-* Images: Bump `gcb-docker-gcloud` to v20241110-72bb0b1665. (#12342)
-* Go: Bump to v1.23.3. (#12337)
-* Auth TLS: Add `_` to redirect RegEx. (#12326)
-* Auth TLS: Improve redirect RegEx. (#12323)
-* Update custom headers annotation documentation (#12318)
-* Tests: Bump `e2e-test-runner` to v20241104-02a3933e. (#12312)
-* Docs: Add CPU usage note for `--metrics-per-undefined-host`. (#12310)
-* Images: Trigger `test-runner` build. (#12308)
-* Config: Fix panic on invalid `lua-shared-dict`. (#12283)
-* Docs: fix limit-rate-after references (#12278)
-* Chart: Rework ServiceMonitor. (#12269)
-* Chart: Add ServiceAccount tests. (#12263)
-* CI: Fix chart testing. (#12258)
-* [fix] fix nginx temp configs cleanup (#12225)
-* Chart: Suggest `matchLabelKeys` in Topology Spread Constraints. (#12202)
-* Docs: Add Pod Security Admission. (#12195)
-* Docs: Clarify external & service port in TCP/UDP services explanation. (#12192)
-* Images: Trigger controller build. (#12154)
-* ⚠️ Metrics: Disable by default. (#12153) ⚠️
-
-  This changes the default of the following CLI arguments:
-
-  * `--enable-metrics` gets disabled by default.
-
-* Tests & Docs: Bump `e2e-test-echo` to v1.0.1. (#12147)
-* Images: Trigger `e2e-test-echo` build. (#12140)
-* ⚠️ Images: Drop `s390x`. (#12137) ⚠️
-
-  Support for the `s390x` architecture has already been removed from the controller image. This also removes it from the NGINX base image and CI relevant images.
-
-* Images: Build `s390x` controller. (#12126)
-* Chart: Bump Kube Webhook CertGen. (#12119)
-* Tests & Docs: Bump images. (#12118)
-* Cloud Build: Bump `gcb-docker-gcloud` to v20240718-5ef92b5c36. (#12113)
-* Images: Trigger other builds. (#12110)
-* Tests: Bump `e2e-test-runner` to v20241004-114a6abb. (#12103)
-* Images: Trigger `test-runner` build. (#12100)
-* Docs: Add a multi-tenant warning. (#12091)
-* Go: Bump to v1.22.8. (#12069)
-* Images: Bump `NGINX_BASE` to v1.0.0. (#12066)
-* Images: Trigger NGINX build. (#12063)
-* Images: Remove NGINX v1.21. (#12031)
-* Chart: Add `controller.metrics.service.enabled`. (#12056)
-* GitHub: Improve Dependabot. (#12033)
-* Chart: Add `global.image.registry`. (#12028)
-* ⚠️ Images: Remove OpenTelemetry. (#12024) ⚠️
-
-  OpenTelemetry is still supported, but since the module is built into the controller image since v1.10, we hereby remove the init container and image which were used to install it upon controller startup.
-
-* Chart: Improve CI. (#12003)
-* Chart: Extend image tests. (#12025)
-* Chart: Add `controller.progressDeadlineSeconds`. (#12017)
-* Docs: Add health check annotations for AWS. (#12018)
-* Docs: Convert `opentelemetry.md` from CRLF to LF. (#12005)
-* Chart: Implement `unhealthyPodEvictionPolicy`. (#11992)
-* Chart: Add `defaultBackend.maxUnavailable`. (#11995)
-* Chart: Test `controller.minAvailable` & `controller.maxUnavailable`. (#12000)
-* Chart: Align default backend `PodDisruptionBudget`. (#11993)
-* Metrics: Fix namespace in `nginx_ingress_controller_ssl_expire_time_seconds`. (#10274)
-* ⚠️ Chart: Remove Pod Security Policy. (#11971) ⚠️
-
-  This removes Pod Security Policies and related resources from the chart.
-
-* Chart: Improve default backend service account. (#11972)
-* Go: Bump to v1.22.7. (#11943)
-* NGINX: Remove inline Lua from template. (#11806)
-* Images: Bump OpenTelemetry C++ Contrib. (#11629)
-* Docs: Add note about `--watch-namespace`. (#11947)
-* Images: Use latest Alpine 3.20 everywhere. (#11944)
-* Fix minor typos (#11935)
-* Chart: Implement `controller.admissionWebhooks.service.servicePort`. (#11931)
-* Allow any protocol for cors origins (#11153)
-* Tests: Bump `e2e-test-runner` to v20240829-2c421762. (#11919)
-* Images: Trigger `test-runner` build. (#11916)
-* Chart: Add `controller.metrics.prometheusRule.annotations`. (#11849)
-* Chart: Add tests for `PrometheusRule` & `ServiceMonitor`. (#11883)
-* Annotations: Allow commas in URLs. (#11882)
-* CI: Grant checks write permissions to E2E Test Report. (#11862)
-* Chart: Use generic values for `ConfigMap` test. (#11877)
-* Security: Follow-up on recent changes. (#11874)
-* Lua: Remove plugins from `.luacheckrc` & E2E docs. (#11872)
-* Dashboard: Remove `ingress_upstream_latency_seconds`. (#11878)
-* Metrics: Add `--metrics-per-undefined-host` argument. (#11818)
-* Update maxmind post link about geolite2 license changes (#11861)
-* ⚠️ Remove global-rate-limit feature (#11851) ⚠️
-
-  This removes the following configuration options:
-
-  * `global-rate-limit-memcached-host`
-  * `global-rate-limit-memcached-port`
-  * `global-rate-limit-memcached-connect-timeout`
-  * `global-rate-limit-memcached-max-idle-timeout`
-  * `global-rate-limit-memcached-pool-size`
-  * `global-rate-limit-status-code`
-
-  It also removes the following annotations:
-
-  * `global-rate-limit`
-  * `global-rate-limit-window`
-  * `global-rate-limit-key`
-  * `global-rate-limit-ignored-cidrs`
-
-* Revert "docs: Add deployment for AWS NLB Proxy." (#11857)
-* Add custom code handling for temporal redirect (#10651)
-* Add native histogram support for histogram metrics (#9971)
-* Replace deprecated queue method (#11853)
-* ⚠️ Enable security features by default (#11819) ⚠️
-
-  This changes the default of the following CLI arguments:
-
-  * `--enable-annotation-validation` gets enabled by default.
-
-  It also changes the default of the following configuration options:
-
-  * `allow-cross-namespace-resources` gets disabled by default.
-  * `annotations-risk-level` gets lowered to "High" by default.
-  * `strict-validate-path-type` gets enabled by default.
-
-* docs: Add deployment for AWS NLB Proxy. (#9565)
-* ⚠️ Remove 3rd party lua plugin support (#11821) ⚠️
-
-  This removes the following configuration options:
-
-  * `plugins`
-
-  It also removes support for user provided Lua plugins in the `/etc/nginx/lua/plugins` directory.
-
-* Auto-generate annotation docs (#11820)
-* ⚠️ Metrics: Remove `ingress_upstream_latency_seconds`. (#11795) ⚠️
-
-  This metric has already been deprecated and is now getting removed.
-
-* Release controller v1.11.2/v1.10.4 & chart v4.11.2/v4.10.4. (#11816)
-* Chart: Bump Kube Webhook CertGen & OpenTelemetry. (#11809)
-* Tests & Docs: Bump images. (#11803)
-* Images: Trigger failed builds. (#11800)
-* Images: Trigger other builds. (#11796)
-* Controller: Fix panic in alternative backend merging. (#11789)
-* Tests: Bump `e2e-test-runner` to v20240812-3f0129aa. (#11788)
-* Images: Trigger `test-runner` build. (#11785)
-* Images: Bump `NGINX_BASE` to v0.0.12. (#11782)
-* Images: Trigger NGINX build. (#11779)
-* Cloud Build: Add missing config, remove unused ones. (#11774)
-* Cloud Build: Tweak timeouts. (#11761)
-* Cloud Build: Fix substitutions. (#11758)
-* Cloud Build: Some chores. (#11633)
-* Go: Bump to v1.22.6. (#11747)
-* Images: Bump `NGINX_BASE` to v0.0.11. (#11741)
-* Images: Trigger NGINX build. (#11735)
-* docs: update OpenSSL Roadmap link (#11730)
-* Go: Bump to v1.22.5. (#11634)
-* Docs: Fix typo in AWS LB Controller reference (#11723)
-* Perform some cleaning operations on line breaks. (#11720)
-* Missing anchors in regular expression. (#11717)
-* Docs: Fix `from-to-www` redirect description. (#11712)
-* Chart: Remove `isControllerTagValid`. (#11710)
-* Tests: Bump `e2e-test-runner` to v20240729-04899b27. (#11702)
-* Chart: Explicitly set `runAsGroup`. (#11679)
-* Docs: Clarify `from-to-www` redirect direction. (#11682)
-* added real-client-ip faq (#11663)
-* Docs: Format NGINX configuration table. (#11659)
-* Release controller v1.11.1/v1.10.3 & chart v4.11.1/v4.10.3. (#11654)
-* Tests: Bump `test-runner` to v20240717-1fe74b5f. (#11645)
-* Images: Trigger `test-runner` build. (#11636)
-* Images: Bump `NGINX_BASE` to v0.0.10. (#11635)
-* remove modsecurity coreruleset test files from nginx image (#11617)
-* unskip the ocsp tests and update images to fix cfssl bug (#11606)
-* Fix indent in YAML for example pod (#11598)
-* Images: Bump `test-runner`. (#11600)
-* Images: Bump `NGINX_BASE` to v0.0.9. (#11599)
-* revert module upgrade (#11594)
-* README: Fix support matrix. (#11586)
-* Repository: Add changelogs from `release-v1.10`. (#11587)
-
-### Dependency updates:
-
-* Bump k8s.io/apiextensions-apiserver from 0.31.3 to 0.32.0 (#12566)
-* Bump github.com/onsi/ginkgo/v2 from 2.22.0 to 2.22.1 (#12555)
-* Bump k8s.io/code-generator from 0.31.3 to 0.32.0 (#12550)
-* Bump k8s.io/cli-runtime from 0.31.3 to 0.32.0 (#12547)
-* Bump k8s.io/apiserver from 0.31.3 to 0.32.0 (#12544)
-* Bump the actions group with 2 updates (#12541)
-* Bump google.golang.org/grpc from 1.68.1 to 1.69.2 (#12538)
-* Bump k8s.io/client-go from 0.31.3 to 0.32.0 (#12512)
-* Bump github.com/opencontainers/runc from 1.2.2 to 1.2.3 in the go group across 1 directory (#12509)
-* Bump the actions group with 3 updates (#12506)
-* Bump k8s.io/kube-aggregator from 0.31.3 to 0.32.0 in /images/kube-webhook-certgen/rootfs (#12505)
-* Bump k8s.io/apimachinery from 0.31.3 to 0.32.0 in /images/ext-auth-example-authsvc/rootfs (#12502)
-* Bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#12476)
-* Bump golang.org/x/crypto from 0.21.0 to 0.31.0 in /magefiles (#12472)
-* Bump github.com/prometheus/common from 0.60.1 to 0.61.0 (#12464)
-* Bump github/codeql-action from 3.27.5 to 3.27.6 in the actions group (#12461)
-* Bump the go group across 1 directory with 2 updates (#12460)
-* Bump github.com/onsi/ginkgo/v2 from 2.21.0 to 2.22.0 (#12426)
-* Bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#12418)
-* Bump the go group across 3 directories with 10 updates (#12413)
-* Bump the actions group with 3 updates (#12412)
-* Bump github.com/opencontainers/runc from 1.2.1 to 1.2.2 in the go group across 1 directory (#12380)
-* Bump github/codeql-action from 3.27.1 to 3.27.4 in the actions group (#12373)
-* Bump golangci-lint on actions and disable deprecated linters (#12361)
-* Bump google.golang.org/grpc from 1.67.1 to 1.68.0 (#12357)
-* Bump the actions group with 3 updates (#12354)
-* Bump golang.org/x/crypto from 0.28.0 to 0.29.0 (#12349)
-* Bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 (#12299)
-* Bump github.com/opencontainers/runc from 1.2.0 to 1.2.1 in the go group across 1 directory (#12296)
-* Bump github.com/onsi/ginkgo/v2 from 2.20.2 to 2.21.0 (#12288)
-* Bump actions/dependency-review-action from 4.3.5 to 4.4.0 in the actions group (#12273)
-* Bump the go group across 3 directories with 11 updates (#12244)
-* Bump github.com/opencontainers/runc from 1.1.15 to 1.2.0 (#12242)
-* Bump the actions group with 5 updates (#12236)
-* Bump github.com/ncabatoff/process-exporter from 0.8.3 to 0.8.4 in the go group across 1 directory (#12218)
-* Bump aquasecurity/trivy-action from 0.27.0 to 0.28.0 in the actions group (#12217)
-* Bump github/codeql-action from 3.26.12 to 3.26.13 in the actions group (#12188)
-* Bump the go group across 2 directories with 1 update (#12186)
-* Bump the actions group with 2 updates (#12180)
-* Bump github.com/opencontainers/runc from 1.1.14 to 1.1.15 in the go group across 1 directory (#12178)
-* Bump the actions group with 3 updates (#12152)
-* Bump golang.org/x/crypto from 0.27.0 to 0.28.0 (#12107)
-* Bump the actions group with 3 updates (#12092)
-* Bump sigs.k8s.io/mdtoc from 1.1.0 to 1.4.0 (#12062)
-* Bump github.com/prometheus/common from 0.59.1 to 0.60.0 (#12060)
-* Bump google.golang.org/grpc from 1.67.0 to 1.67.1 in the go group across 1 directory (#12059)
-* Bump k8s.io/cli-runtime from 0.30.0 to 0.31.1 (#12061)
-* Bump github/codeql-action from 3.26.9 to 3.26.10 in the actions group (#12051)
-* Bump the go group across 1 directory with 3 updates (#12050)
-* Bump k8s.io/kube-aggregator from 0.29.3 to 0.31.1 in /images/kube-webhook-certgen/rootfs (#12043)
-* Bump k8s.io/apimachinery from 0.23.1 to 0.31.1 in /images/ext-auth-example-authsvc/rootfs (#12041)
-* Bump github.com/prometheus/client_golang from 1.11.1 to 1.20.4 in /images/custom-error-pages/rootfs (#12040)
-* Bump the all group with 2 updates (#12032)
-* Bump github/codeql-action from 3.26.7 to 3.26.8 in the all group (#12010)
-* Bump google.golang.org/grpc from 1.66.2 to 1.67.0 (#12009)
-* Bump github.com/prometheus/client_golang from 1.20.3 to 1.20.4 in the all group (#12008)
-* Bump the all group with 2 updates (#11977)
-* Bump github/codeql-action from 3.26.6 to 3.26.7 in the all group (#11976)
-* Bump github.com/prometheus/common from 0.57.0 to 0.59.1 (#11954)
-* Bump golang.org/x/crypto from 0.26.0 to 0.27.0 (#11955)
-* Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.3 in the all group (#11953)
-* Bump github.com/opencontainers/runc from 1.1.13 to 1.1.14 (#11928)
-* Bump the all group with 2 updates (#11922)
-* Bump github.com/onsi/ginkgo/v2 from 2.20.1 to 2.20.2 in the all group (#11901)
-* Bump google.golang.org/grpc from 1.65.0 to 1.66.0 (#11902)
-* Bump github.com/prometheus/common from 0.55.0 to 0.57.0 (#11903)
-* Bump github/codeql-action from 3.26.5 to 3.26.6 in the all group (#11904)
-* Bump the all group with 2 updates (#11865)
-* Bump github/codeql-action from 3.26.2 to 3.26.5 in the all group (#11867)
-* Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.1 (#11832)
-* Bump sigs.k8s.io/controller-runtime from 0.18.4 to 0.19.0 (#11823)
-* Bump dario.cat/mergo from 1.0.0 to 1.0.1 in the all group (#11822)
-* Bump k8s.io/component-base from 0.30.3 to 0.31.0 (#11825)
-* Bump github/codeql-action from 3.26.0 to 3.26.2 in the all group (#11826)
-* Bump github.com/onsi/ginkgo/v2 from 2.19.1 to 2.20.0 (#11766)
-* Bump the all group with 2 updates (#11767)
-* Bump golang.org/x/crypto from 0.25.0 to 0.26.0 (#11765)
-* Bump the all group with 3 updates (#11727)
-* Bump github.com/onsi/ginkgo/v2 from 2.19.0 to 2.19.1 in the all group (#11696)
-* Bump the all group with 2 updates (#11695)
-* Bump the all group with 4 updates (#11673)
-* Bump the all group with 2 updates (#11672)
-* Bump github.com/prometheus/common from 0.54.0 to 0.55.0 (#11522)
-* Bump the all group with 5 updates (#11611)
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/controller-v1.11.0...controller-v1.12.0

changelog/controller-1.6.4.md

@@ -83,7 +83,7 @@ Images:
 * ModSecurity dependencies update to avoid Memory Leaks (#9330)
 * fix(hpa): deprecated api version, bump to v2 (#9348)
 * fix(typo): pluralize provider (#9346)
-* removed deprecation message for ingressClass annotation (#9357)
+* removed deprecation messsage for ingressClass annotation (#9357)
 * added ginkgo junit reports (#9350)
 * Fix typos found by codespell (#9353)
 * bumped ginkgo to v2.5.1 in testrunner (#9340)

changelog/controller-1.7.1.md

@@ -15,7 +15,7 @@ Images:
 * Add support for --container flag (#9703)
 * Fix typo in OpenTelemetry (#9903)
 * ensure make lua-test runs locally (#9902)
-* update k8s.io dependencies to v0.26.4 (#9893)
+* update k8s.io dependecies to v0.26.4 (#9893)
 * Adding resource type to default HPA configuration to resolve issues with Terraform helm chart usage (#9803)
 * I have not been able to fulfill my maintainer responsibilities for a while already, making it official now. (#9883)
 * Update k8s versions (#9879)

changelog/controller-1.8.0.md

@@ -39,7 +39,7 @@ on our new [ingress-nginx-dev mailing list](https://groups.google.com/a/kubernet
 * Correct annotations in monitoring docs (#9976)
 * fix: avoid builds and tests for changes to markdown (#9962)
 * Validate path types (#9967)
-* HPA: Use capabilities & align manifests. (#9521)
+* HPA: Use capabilites & align manifests. (#9521)
 * Use dl.k8s.io instead of hardcoded GCS URIs (#9946)
 * add option for annotations in PodDisruptionBudget (#9843)
 * chore: update httpbin to httpbun (#9919)

changelog/controller-1.9.0-beta.0.md

@@ -26,7 +26,7 @@ Images:
 * Add golangci github action and replace the deprecated golint (#10187)
 * BUGFIX incorrect indentation (#10254)
 * Upgrade OpenTelemetry to v1.11.0 and gRPC to v1.57.0 (#10352)
-* fix: path with special characters warning #10281 #10308 (#10330)
+* fix: path with sepecial characters warning #10281 #10308 (#10330)
 * Fix golangci-lint errors (#10196)
 * chore(build): Fix Run make dev-env syntax error (#10294)
 * Add firewall configuration to quick start documentation (#10357)

changelog/controller-1.9.0.md

@@ -26,7 +26,7 @@ Images:
 * Add golangci github action and replace the deprecated golint (#10187)
 * BUGFIX incorrect indentation (#10254)
 * Upgrade OpenTelemetry to v1.11.0 and gRPC to v1.57.0 (#10352)
-* fix: path with special characters warning #10281 #10308 (#10330)
+* fix: path with sepecial characters warning #10281 #10308 (#10330)
 * Fix golangci-lint errors (#10196)
 * chore(build): Fix Run make dev-env syntax error (#10294)
 * Add firewall configuration to quick start documentation (#10357)

charts/ingress-nginx/Chart.yaml

@@ -1,10 +1,9 @@
 annotations:
   artifacthub.io/changes: |
-    - 'CI: Fix chart testing. (#12258)'
-    - Update Ingress-Nginx version controller-v1.12.0
+    - Update Ingress-Nginx version controller-v1.11.2
   artifacthub.io/prerelease: "false"
 apiVersion: v2
-appVersion: 1.12.0
+appVersion: 1.11.2
 description: Ingress controller for Kubernetes using NGINX as a reverse proxy and
   load balancer
 home: https://github.com/kubernetes/ingress-nginx
@@ -16,9 +15,11 @@ kubeVersion: '>=1.21.0-0'
 maintainers:
 - name: cpanato
 - name: Gacko
+- name: puerco
+- name: rikatz
 - name: strongjz
 - name: tao12345666333
 name: ingress-nginx
 sources:
 - https://github.com/kubernetes/ingress-nginx
-version: 4.12.0
+version: 4.11.2

charts/ingress-nginx/OWNERS

@@ -1,4 +1,10 @@
 # See the OWNERS docs: https://www.kubernetes.dev/docs/guide/owners
 
+approvers:
+- ingress-nginx-helm-maintainers
+
+reviewers:
+- ingress-nginx-helm-reviewers
+
 labels:
 - area/helm

charts/ingress-nginx/README.md

@@ -2,7 +2,7 @@
 
 [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Ingress controller for Kubernetes using NGINX as a reverse proxy and load balancer
 
-![Version: 4.12.0](https://img.shields.io/badge/Version-4.12.0-informational?style=flat-square) ![AppVersion: 1.12.0](https://img.shields.io/badge/AppVersion-1.12.0-informational?style=flat-square)
+![Version: 4.11.2](https://img.shields.io/badge/Version-4.11.2-informational?style=flat-square) ![AppVersion: 1.11.2](https://img.shields.io/badge/AppVersion-1.11.2-informational?style=flat-square)
 
 To use, add `ingressClassName: nginx` spec field or the `kubernetes.io/ingress.class: nginx` annotation to your Ingress resources.
 
@@ -229,24 +229,6 @@ Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13
 
 As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered.
 
-### Pod Security Admission
-
-You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels).
-
-Example:
-
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ingress-nginx
-  labels:
-    kubernetes.io/metadata.name: ingress-nginx
-    name: ingress-nginx
-    pod-security.kubernetes.io/enforce: restricted
-    pod-security.kubernetes.io/enforce-version: v1.31
-```
-
 ## Values
 
 | Key | Type | Default | Description |
@@ -260,8 +242,9 @@ metadata:
 | controller.admissionWebhooks.certificate | string | `"/usr/local/certificates/cert"` |  |
 | controller.admissionWebhooks.createSecretJob.name | string | `"create"` |  |
 | controller.admissionWebhooks.createSecretJob.resources | object | `{}` |  |
-| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers |
+| controller.admissionWebhooks.createSecretJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for secret creation containers |
 | controller.admissionWebhooks.enabled | bool | `true` |  |
+| controller.admissionWebhooks.existingPsp | string | `""` | Use an existing PSP instead of creating one |
 | controller.admissionWebhooks.extraEnvs | list | `[]` | Additional environment variables to set |
 | controller.admissionWebhooks.failurePolicy | string | `"Fail"` | Admission Webhook failure policy to use |
 | controller.admissionWebhooks.key | string | `"/usr/local/certificates/key"` |  |
@@ -270,10 +253,11 @@ metadata:
 | controller.admissionWebhooks.namespaceSelector | object | `{}` |  |
 | controller.admissionWebhooks.objectSelector | object | `{}` |  |
 | controller.admissionWebhooks.patch.enabled | bool | `true` |  |
-| controller.admissionWebhooks.patch.image.digest | string | `"sha256:0de05718b59dc33b57ddfb4d8ad5f637cefd13eafdec0e1579d782b3483c27c3"` |  |
+| controller.admissionWebhooks.patch.image.digest | string | `"sha256:a320a50cc91bd15fd2d6fa6de58bd98c1bd64b9a6f926ce23a600d87043455a3"` |  |
 | controller.admissionWebhooks.patch.image.image | string | `"ingress-nginx/kube-webhook-certgen"` |  |
 | controller.admissionWebhooks.patch.image.pullPolicy | string | `"IfNotPresent"` |  |
-| controller.admissionWebhooks.patch.image.tag | string | `"v1.5.1"` |  |
+| controller.admissionWebhooks.patch.image.registry | string | `"registry.k8s.io"` |  |
+| controller.admissionWebhooks.patch.image.tag | string | `"v1.4.3"` |  |
 | controller.admissionWebhooks.patch.labels | object | `{}` | Labels to be added to patch job resources |
 | controller.admissionWebhooks.patch.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
 | controller.admissionWebhooks.patch.nodeSelector."kubernetes.io/os" | string | `"linux"` |  |
@@ -289,7 +273,7 @@ metadata:
 | controller.admissionWebhooks.patch.tolerations | list | `[]` |  |
 | controller.admissionWebhooks.patchWebhookJob.name | string | `"patch"` |  |
 | controller.admissionWebhooks.patchWebhookJob.resources | object | `{}` |  |
-| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsGroup":65532,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers |
+| controller.admissionWebhooks.patchWebhookJob.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65532,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for webhook patch containers |
 | controller.admissionWebhooks.port | int | `8443` |  |
 | controller.admissionWebhooks.service.annotations | object | `{}` |  |
 | controller.admissionWebhooks.service.externalIPs | list | `[]` |  |
@@ -320,14 +304,15 @@ metadata:
 | controller.dnsPolicy | string | `"ClusterFirst"` | Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. |
 | controller.electionID | string | `""` | Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' |
 | controller.electionTTL | string | `""` | Duration a leader election is valid before it's getting re-elected, e.g. `15s`, `10m` or `1h`. (Default: 30s) |
-| controller.enableAnnotationValidations | bool | `true` |  |
+| controller.enableAnnotationValidations | bool | `false` |  |
 | controller.enableMimalloc | bool | `true` | Enable mimalloc as a drop-in replacement for malloc. # ref: https://github.com/microsoft/mimalloc # |
 | controller.enableTopologyAwareRouting | bool | `false` | This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" Defaults to false |
+| controller.existingPsp | string | `""` | Use an existing PSP instead of creating one |
 | controller.extraArgs | object | `{}` | Additional command line arguments to pass to Ingress-Nginx Controller E.g. to specify the default SSL certificate you can use |
 | controller.extraContainers | list | `[]` | Additional containers to be added to the controller pod. See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. |
 | controller.extraEnvs | list | `[]` | Additional environment variables to set |
 | controller.extraInitContainers | list | `[]` | Containers, which are run before the app containers are started. |
-| controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. |
+| controller.extraModules | list | `[]` | Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module |
 | controller.extraVolumeMounts | list | `[]` | Additional volumeMounts to the controller main container. |
 | controller.extraVolumes | list | `[]` | Additional volumes to the controller pod. |
 | controller.healthCheckHost | string | `""` | Address to bind the health check endpoint. It is better to set this option to the internal node address if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. |
@@ -340,16 +325,16 @@ metadata:
 | controller.hostname | object | `{}` | Optionally customize the pod hostname. |
 | controller.image.allowPrivilegeEscalation | bool | `false` |  |
 | controller.image.chroot | bool | `false` |  |
-| controller.image.digest | string | `"sha256:e6b8de175acda6ca913891f0f727bca4527e797d52688cbe9fec9040d6f6b6fa"` |  |
-| controller.image.digestChroot | string | `"sha256:87c88e1c38a6c8d4483c8f70b69e2cca49853bb3ec3124b9b1be648edf139af3"` |  |
+| controller.image.digest | string | `"sha256:d5f8217feeac4887cb1ed21f27c2674e58be06bd8f5184cacea2a69abaf78dce"` |  |
+| controller.image.digestChroot | string | `"sha256:21b55a2f0213a18b91612a8c0850167e00a8e34391fd595139a708f9c047e7a8"` |  |
 | controller.image.image | string | `"ingress-nginx/controller"` |  |
 | controller.image.pullPolicy | string | `"IfNotPresent"` |  |
 | controller.image.readOnlyRootFilesystem | bool | `false` |  |
-| controller.image.runAsGroup | int | `82` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) |
+| controller.image.registry | string | `"registry.k8s.io"` |  |
 | controller.image.runAsNonRoot | bool | `true` |  |
-| controller.image.runAsUser | int | `101` | This value must not be changed using the official image. uid=101(www-data) gid=82(www-data) groups=82(www-data) |
+| controller.image.runAsUser | int | `101` |  |
 | controller.image.seccompProfile.type | string | `"RuntimeDefault"` |  |
-| controller.image.tag | string | `"v1.12.0"` |  |
+| controller.image.tag | string | `"v1.11.2"` |  |
 | controller.ingressClass | string | `"nginx"` | For backwards compatibility with ingress.class annotation, use ingressClass. Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation |
 | controller.ingressClassByName | bool | `false` | Process IngressClass per name (additionally as per spec.controller). |
 | controller.ingressClassResource | object | `{"aliases":[],"annotations":{},"controllerValue":"k8s.io/ingress-nginx","default":false,"enabled":true,"name":"nginx","parameters":{}}` | This section refers to the creation of the IngressClass resource. IngressClasses are immutable and cannot be changed after creation. We do not support namespaced IngressClasses, yet, so a ClusterRole and a ClusterRoleBinding is required. |
@@ -381,45 +366,51 @@ metadata:
 | controller.livenessProbe.periodSeconds | int | `10` |  |
 | controller.livenessProbe.successThreshold | int | `1` |  |
 | controller.livenessProbe.timeoutSeconds | int | `1` |  |
-| controller.maxmindLicenseKey | string | `""` | Maxmind license key to download GeoLite2 Databases. # https://blog.maxmind.com/2019/12/significant-changes-to-accessing-and-using-geolite2-databases/ |
+| controller.maxmindLicenseKey | string | `""` | Maxmind license key to download GeoLite2 Databases. # https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases |
 | controller.metrics.enabled | bool | `false` |  |
 | controller.metrics.port | int | `10254` |  |
 | controller.metrics.portName | string | `"metrics"` |  |
 | controller.metrics.prometheusRule.additionalLabels | object | `{}` |  |
-| controller.metrics.prometheusRule.annotations | object | `{}` | Annotations to be added to the PrometheusRule. |
 | controller.metrics.prometheusRule.enabled | bool | `false` |  |
 | controller.metrics.prometheusRule.rules | list | `[]` |  |
 | controller.metrics.service.annotations | object | `{}` |  |
-| controller.metrics.service.enabled | bool | `true` | Enable the metrics service or not. |
 | controller.metrics.service.externalIPs | list | `[]` | List of IP addresses at which the stats-exporter service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # |
 | controller.metrics.service.labels | object | `{}` | Labels to be added to the metrics service resource |
 | controller.metrics.service.loadBalancerSourceRanges | list | `[]` |  |
 | controller.metrics.service.servicePort | int | `10254` |  |
 | controller.metrics.service.type | string | `"ClusterIP"` |  |
 | controller.metrics.serviceMonitor.additionalLabels | object | `{}` |  |
-| controller.metrics.serviceMonitor.annotations | object | `{}` | Annotations to be added to the ServiceMonitor. |
+| controller.metrics.serviceMonitor.annotations | object | `{}` |  |
 | controller.metrics.serviceMonitor.enabled | bool | `false` |  |
-| controller.metrics.serviceMonitor.labelLimit | int | `0` | Per-scrape limit on number of labels that will be accepted for a sample. |
-| controller.metrics.serviceMonitor.labelNameLengthLimit | int | `0` | Per-scrape limit on length of labels name that will be accepted for a sample. |
-| controller.metrics.serviceMonitor.labelValueLengthLimit | int | `0` | Per-scrape limit on length of labels value that will be accepted for a sample. |
 | controller.metrics.serviceMonitor.metricRelabelings | list | `[]` |  |
 | controller.metrics.serviceMonitor.namespace | string | `""` |  |
 | controller.metrics.serviceMonitor.namespaceSelector | object | `{}` |  |
 | controller.metrics.serviceMonitor.relabelings | list | `[]` |  |
-| controller.metrics.serviceMonitor.sampleLimit | int | `0` | Defines a per-scrape limit on the number of scraped samples that will be accepted. |
 | controller.metrics.serviceMonitor.scrapeInterval | string | `"30s"` |  |
 | controller.metrics.serviceMonitor.targetLabels | list | `[]` |  |
-| controller.metrics.serviceMonitor.targetLimit | int | `0` | Defines a limit on the number of scraped targets that will be accepted. |
 | controller.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. |
 | controller.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # |
 | controller.name | string | `"controller"` |  |
 | controller.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
 | controller.nodeSelector | object | `{"kubernetes.io/os":"linux"}` | Node labels for controller pod assignment # Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ # |
+| controller.opentelemetry.containerSecurityContext.allowPrivilegeEscalation | bool | `false` |  |
+| controller.opentelemetry.containerSecurityContext.capabilities.drop[0] | string | `"ALL"` |  |
+| controller.opentelemetry.containerSecurityContext.readOnlyRootFilesystem | bool | `true` |  |
+| controller.opentelemetry.containerSecurityContext.runAsNonRoot | bool | `true` |  |
+| controller.opentelemetry.containerSecurityContext.runAsUser | int | `65532` | The image's default user, inherited from its base image `cgr.dev/chainguard/static`. |
+| controller.opentelemetry.containerSecurityContext.seccompProfile.type | string | `"RuntimeDefault"` |  |
+| controller.opentelemetry.enabled | bool | `false` |  |
+| controller.opentelemetry.image.digest | string | `"sha256:f7604ac0547ed64d79b98d92133234e66c2c8aade3c1f4809fed5eec1fb7f922"` |  |
+| controller.opentelemetry.image.distroless | bool | `true` |  |
+| controller.opentelemetry.image.image | string | `"ingress-nginx/opentelemetry-1.25.3"` |  |
+| controller.opentelemetry.image.registry | string | `"registry.k8s.io"` |  |
+| controller.opentelemetry.image.tag | string | `"v20240813-b933310d"` |  |
+| controller.opentelemetry.name | string | `"opentelemetry"` |  |
+| controller.opentelemetry.resources | object | `{}` |  |
 | controller.podAnnotations | object | `{}` | Annotations to be added to controller pods # |
 | controller.podLabels | object | `{}` | Labels to add to the pod container metadata |
 | controller.podSecurityContext | object | `{}` | Security context for controller pods |
 | controller.priorityClassName | string | `""` |  |
-| controller.progressDeadlineSeconds | int | `0` | Specifies the number of seconds you want to wait for the controller deployment to progress before the system reports back that it has failed. Ref.: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#progress-deadline-seconds |
 | controller.proxySetHeaders | object | `{}` | Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers |
 | controller.publishService | object | `{"enabled":true,"pathOverride":""}` | Allows customization of the source of the IP address or FQDN to report in the ingress status field. By default, it reads the information provided by the service. If disable, the status field reports the IP address of the node or nodes where an ingress controller pod is running. |
 | controller.publishService.enabled | bool | `true` | Enable 'publishService' or not |
@@ -442,24 +433,20 @@ metadata:
 | controller.service.annotations | object | `{}` | Annotations to be added to the external controller service. See `controller.service.internal.annotations` for annotations to be added to the internal controller service. |
 | controller.service.appProtocol | bool | `true` | Declare the app protocol of the external HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol |
 | controller.service.clusterIP | string | `""` | Pre-defined cluster internal IP address of the external controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
-| controller.service.clusterIPs | list | `[]` | Pre-defined cluster internal IP addresses of the external controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
 | controller.service.enableHttp | bool | `true` | Enable the HTTP listener on both controller services or not. |
 | controller.service.enableHttps | bool | `true` | Enable the HTTPS listener on both controller services or not. |
 | controller.service.enabled | bool | `true` | Enable controller services or not. This does not influence the creation of either the admission webhook or the metrics service. |
 | controller.service.external.enabled | bool | `true` | Enable the external controller service or not. Useful for internal-only deployments. |
-| controller.service.external.labels | object | `{}` | Labels to be added to the external controller service. |
 | controller.service.externalIPs | list | `[]` | List of node IP addresses at which the external controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips |
 | controller.service.externalTrafficPolicy | string | `""` | External traffic policy of the external controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip |
 | controller.service.internal.annotations | object | `{}` | Annotations to be added to the internal controller service. Mandatory for the internal controller service to be created. Varies with the cloud service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer |
 | controller.service.internal.appProtocol | bool | `true` | Declare the app protocol of the internal HTTP and HTTPS listeners or not. Supersedes provider-specific annotations for declaring the backend protocol. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol |
 | controller.service.internal.clusterIP | string | `""` | Pre-defined cluster internal IP address of the internal controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
-| controller.service.internal.clusterIPs | list | `[]` | Pre-defined cluster internal IP addresses of the internal controller service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
 | controller.service.internal.enabled | bool | `false` | Enable the internal controller service or not. Remember to configure `controller.service.internal.annotations` when enabling this. |
 | controller.service.internal.externalIPs | list | `[]` | List of node IP addresses at which the internal controller service is available. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips |
 | controller.service.internal.externalTrafficPolicy | string | `""` | External traffic policy of the internal controller service. Set to "Local" to preserve source IP on providers supporting it. Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip |
 | controller.service.internal.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the internal controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
 | controller.service.internal.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the internal controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
-| controller.service.internal.labels | object | `{}` | Labels to be added to the internal controller service. |
 | controller.service.internal.loadBalancerClass | string | `""` | Load balancer class of the internal controller service. Used by cloud providers to select a load balancer implementation other than the cloud provider default. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class |
 | controller.service.internal.loadBalancerIP | string | `""` | Deprecated: Pre-defined IP address of the internal controller service. Used by cloud providers to connect the resulting load balancer service to a pre-existing static IP. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer |
 | controller.service.internal.loadBalancerSourceRanges | list | `[]` | Restrict access to the internal controller service. Values must be CIDRs. Allows any source address by default. |
@@ -470,7 +457,6 @@ metadata:
 | controller.service.internal.ports | object | `{}` |  |
 | controller.service.internal.sessionAffinity | string | `""` | Session affinity of the internal controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity |
 | controller.service.internal.targetPorts | object | `{}` |  |
-| controller.service.internal.trafficDistribution | string | `""` | Traffic distribution policy of the internal controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution |
 | controller.service.internal.type | string | `""` | Type of the internal controller service. Defaults to the value of `controller.service.type`. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types |
 | controller.service.ipFamilies | list | `["IPv4"]` | List of IP families (e.g. IPv4, IPv6) assigned to the external controller service. This field is usually assigned automatically based on cluster configuration and the `ipFamilyPolicy` field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
 | controller.service.ipFamilyPolicy | string | `"SingleStack"` | Represents the dual-stack capabilities of the external controller service. Possible values are SingleStack, PreferDualStack or RequireDualStack. Fields `ipFamilies` and `clusterIP` depend on the value of this field. Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services |
@@ -487,7 +473,6 @@ metadata:
 | controller.service.sessionAffinity | string | `""` | Session affinity of the external controller service. Must be either "None" or "ClientIP" if set. Defaults to "None". Ref: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity |
 | controller.service.targetPorts.http | string | `"http"` | Port of the ingress controller the external HTTP listener is mapped to. |
 | controller.service.targetPorts.https | string | `"https"` | Port of the ingress controller the external HTTPS listener is mapped to. |
-| controller.service.trafficDistribution | string | `""` | Traffic distribution policy of the external controller service. Set to "PreferClose" to route traffic to endpoints that are topologically closer to the client. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#traffic-distribution |
 | controller.service.type | string | `"LoadBalancer"` | Type of the external controller service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types |
 | controller.shareProcessNamespace | bool | `false` |  |
 | controller.sysctls | object | `{}` | sysctls for controller pods # Ref: https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ |
@@ -498,7 +483,6 @@ metadata:
 | controller.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. # Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ # |
 | controller.udp.annotations | object | `{}` | Annotations to be added to the udp config configmap |
 | controller.udp.configMapNamespace | string | `""` | Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) |
-| controller.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ |
 | controller.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # |
 | controller.watchIngressWithoutClass | bool | `false` | Process Ingress objects without ingressClass annotation/ingressClassName field Overrides value for --watch-ingress-without-class flag of the controller binary Defaults to false |
 | defaultBackend.affinity | object | `{}` | Affinity and anti-affinity rules for server scheduling to nodes # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity |
@@ -510,6 +494,7 @@ metadata:
 | defaultBackend.autoscaling.targetMemoryUtilizationPercentage | int | `50` |  |
 | defaultBackend.containerSecurityContext | object | `{}` | Security context for default backend containers |
 | defaultBackend.enabled | bool | `false` |  |
+| defaultBackend.existingPsp | string | `""` | Use an existing PSP instead of creating one |
 | defaultBackend.extraArgs | object | `{}` |  |
 | defaultBackend.extraConfigMaps | list | `[]` |  |
 | defaultBackend.extraEnvs | list | `[]` | Additional environment variables to set for defaultBackend pods |
@@ -519,7 +504,7 @@ metadata:
 | defaultBackend.image.image | string | `"defaultbackend-amd64"` |  |
 | defaultBackend.image.pullPolicy | string | `"IfNotPresent"` |  |
 | defaultBackend.image.readOnlyRootFilesystem | bool | `true` |  |
-| defaultBackend.image.runAsGroup | int | `65534` |  |
+| defaultBackend.image.registry | string | `"registry.k8s.io"` |  |
 | defaultBackend.image.runAsNonRoot | bool | `true` |  |
 | defaultBackend.image.runAsUser | int | `65534` |  |
 | defaultBackend.image.seccompProfile.type | string | `"RuntimeDefault"` |  |
@@ -530,7 +515,7 @@ metadata:
 | defaultBackend.livenessProbe.periodSeconds | int | `10` |  |
 | defaultBackend.livenessProbe.successThreshold | int | `1` |  |
 | defaultBackend.livenessProbe.timeoutSeconds | int | `5` |  |
-| defaultBackend.minAvailable | int | `1` | Minimum available pods set in PodDisruptionBudget. Define either 'minAvailable' or 'maxUnavailable', never both. |
+| defaultBackend.minAvailable | int | `1` |  |
 | defaultBackend.minReadySeconds | int | `0` | `minReadySeconds` to avoid killing pods before we are ready # |
 | defaultBackend.name | string | `"defaultbackend"` |  |
 | defaultBackend.networkPolicy.enabled | bool | `false` | Enable 'networkPolicy' or not |
@@ -548,7 +533,6 @@ metadata:
 | defaultBackend.replicaCount | int | `1` |  |
 | defaultBackend.resources | object | `{}` |  |
 | defaultBackend.service.annotations | object | `{}` |  |
-| defaultBackend.service.clusterIPs | list | `[]` | Pre-defined cluster internal IP addresses of the default backend service. Take care of collisions with existing services. This value is immutable. Set once, it can not be changed without deleting and re-creating the service. Ref: https://kubernetes.io/docs/concepts/services-networking/service/#choosing-your-own-ip-address |
 | defaultBackend.service.externalIPs | list | `[]` | List of IP addresses at which the default backend service is available # Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips # |
 | defaultBackend.service.loadBalancerSourceRanges | list | `[]` |  |
 | defaultBackend.service.servicePort | int | `80` |  |
@@ -558,12 +542,11 @@ metadata:
 | defaultBackend.serviceAccount.name | string | `""` |  |
 | defaultBackend.tolerations | list | `[]` | Node tolerations for server scheduling to nodes with taints # Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ # |
 | defaultBackend.topologySpreadConstraints | list | `[]` | Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. Ref.: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ |
-| defaultBackend.unhealthyPodEvictionPolicy | string | `""` | Eviction policy for unhealthy pods guarded by PodDisruptionBudget. Ref: https://kubernetes.io/blog/2023/01/06/unhealthy-pod-eviction-policy-for-pdbs/ |
 | defaultBackend.updateStrategy | object | `{}` | The update strategy to apply to the Deployment or DaemonSet # |
 | dhParam | string | `""` | A base64-encoded Diffie-Hellman parameter. This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` # Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param |
-| global.image.registry | string | `"registry.k8s.io"` | Registry host to pull images from. |
 | imagePullSecrets | list | `[]` | Optional array of imagePullSecrets containing private registry credentials # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ |
 | namespaceOverride | string | `""` | Override the deployment namespace; defaults to .Release.Namespace |
+| podSecurityPolicy.enabled | bool | `false` |  |
 | portNamePrefix | string | `""` | Prefix for TCP and UDP ports names in ingress controller service # Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration |
 | rbac.create | bool | `true` |  |
 | rbac.scope | bool | `false` |  |

charts/ingress-nginx/README.md.gotmpl

@@ -226,22 +226,4 @@ Detail of how and why are in [this issue](https://github.com/helm/charts/pull/13
 
 As of version `1.26.0` of this chart, by simply not providing any clusterIP value, `invalid: spec.clusterIP: Invalid value: "": field is immutable` will no longer occur since `clusterIP: ""` will not be rendered.
 
-### Pod Security Admission
-
-You can use Pod Security Admission by applying labels to the `ingress-nginx` namespace as instructed by the [documentation](https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels).
-
-Example:
-
-```yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ingress-nginx
-  labels:
-    kubernetes.io/metadata.name: ingress-nginx
-    name: ingress-nginx
-    pod-security.kubernetes.io/enforce: restricted
-    pod-security.kubernetes.io/enforce-version: v1.31
-```
-
 {{ template "chart.valuesSection" . }}

charts/ingress-nginx/changelog/helm-chart-4.1.2.md

@@ -5,7 +5,7 @@ This file documents all notable changes to [ingress-nginx](https://github.com/ku
 ### 4.1.2
 
 * [8587](https://github.com/kubernetes/ingress-nginx/pull/8587) Add CAP_SYS_CHROOT to DS/PSP when needed
-* [8458](https://github.com/kubernetes/ingress-nginx/pull/8458) Add portNamePrefix Helm chart parameter
+* [8458](https://github.com/kubernetes/ingress-nginx/pull/8458) Add portNamePreffix Helm chart parameter
 * [8522](https://github.com/kubernetes/ingress-nginx/pull/8522) Add documentation for controller.service.loadBalancerIP in Helm chart
 
 **Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.1.0...helm-chart-4.1.2

charts/ingress-nginx/changelog/helm-chart-4.10.3.md

@@ -1,9 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.10.3
-
-* Update Ingress-Nginx version controller-v1.10.3
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.2...helm-chart-4.10.3

charts/ingress-nginx/changelog/helm-chart-4.10.4.md

@@ -1,9 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.10.4
-
-* Update Ingress-Nginx version controller-v1.10.4
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.3...helm-chart-4.10.4

charts/ingress-nginx/changelog/helm-chart-4.10.5.md

@@ -1,9 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.10.5
-
-* Update Ingress-Nginx version controller-v1.10.5
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.4...helm-chart-4.10.5

charts/ingress-nginx/changelog/helm-chart-4.10.6.md

@@ -1,10 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.10.6
-
-* CI: Fix chart testing. (#12260)
-* Update Ingress-Nginx version controller-v1.10.6
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.10.5...helm-chart-4.10.6

charts/ingress-nginx/changelog/helm-chart-4.11.3.md

@@ -1,9 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.11.3
-
-* Update Ingress-Nginx version controller-v1.11.3
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.2...helm-chart-4.11.3

charts/ingress-nginx/changelog/helm-chart-4.11.4.md

@@ -1,10 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.11.4
-
-* CI: Fix chart testing. (#12259)
-* Update Ingress-Nginx version controller-v1.11.4
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.3...helm-chart-4.11.4

charts/ingress-nginx/changelog/helm-chart-4.12.0-beta.0.md

@@ -1,9 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.12.0-beta.0
-
-* Update Ingress-Nginx version controller-v1.12.0-beta.0
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0-beta.0

charts/ingress-nginx/changelog/helm-chart-4.12.0.md

@@ -1,10 +0,0 @@
-# Changelog
-
-This file documents all notable changes to [ingress-nginx](https://github.com/kubernetes/ingress-nginx) Helm Chart. The release numbering uses [semantic versioning](http://semver.org).
-
-### 4.12.0
-
-* CI: Fix chart testing. (#12258)
-* Update Ingress-Nginx version controller-v1.12.0
-
-**Full Changelog**: https://github.com/kubernetes/ingress-nginx/compare/helm-chart-4.11.0...helm-chart-4.12.0

charts/ingress-nginx/changelog/helm-chart-4.7.0.md

@@ -6,7 +6,7 @@ This file documents all notable changes to [ingress-nginx](https://github.com/ku
 
 * helm: Fix opentelemetry module installation for daemonset (#9792)
 * Update charts/* to keep project name display aligned (#9931)
-* HPA: Use capabilities & align manifests. (#9521)
+* HPA: Use capabilites & align manifests. (#9521)
 * PodDisruptionBudget spec logic update (#9904)
 * add option for annotations in PodDisruptionBudget (#9843)
 * Update Ingress-Nginx version controller-v1.8.0

charts/ingress-nginx/ci/controller-admission-tls-cert-manager-values.yaml

@@ -0,0 +1,6 @@
+controller:
+  admissionWebhooks:
+    certManager:
+      enabled: true
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/controller-custom-ingressclass-flags.yaml

@@ -0,0 +1,7 @@
+controller:
+  watchIngressWithoutClass: true
+  ingressClassResource:
+    name: custom-nginx
+    enabled: true
+    default: true
+    controllerValue: "k8s.io/custom-nginx"

charts/ingress-nginx/ci/controller-ingressclass-values.yaml

@@ -1,15 +0,0 @@
-controller:
-  image:
-    repository: ingress-controller/controller
-    tag: 1.0.0-dev
-    digest: null
-
-  service:
-    type: ClusterIP
-
-  ingressClassResource:
-    name: custom-nginx
-    default: true
-    controllerValue: k8s.io/custom-nginx
-
-  watchIngressWithoutClass: true

charts/ingress-nginx/ci/daemonset-customconfig-values.yaml

@@ -0,0 +1,14 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  kind: DaemonSet
+  allowSnippetAnnotations: false
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+
+  config:
+    use-proxy-protocol: "true"

charts/ingress-nginx/ci/daemonset-customnodeport-values.yaml

@@ -1,26 +1,22 @@
 controller:
+  kind: DaemonSet
   image:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
+  admissionWebhooks:
+    enabled: false
 
   service:
     type: NodePort
-
-    external:
-      labels:
-        external-dns.alpha.kubernetes.io/hostname: external.example.com
-
     nodePorts:
       tcp:
         9000: 30090
       udp:
         9001: 30091
 
-portNamePrefix: port
-
 tcp:
-  9000: default/test:8080
+  9000: "default/test:8080"
 
 udp:
-  9001: default/test:8080
+  9001: "default/test:8080"

charts/ingress-nginx/ci/daemonset-extra-modules.yaml

@@ -0,0 +1,13 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+  service:
+    type: ClusterIP
+  extraModules:
+    - name: opentelemetry
+      image:
+        registry: registry.k8s.io
+        image: busybox
+        tag: latest

charts/ingress-nginx/ci/daemonset-headers-values.yaml

@@ -0,0 +1,14 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  addHeaders:
+    X-Frame-Options: deny
+  proxySetHeaders:
+    X-Forwarded-Proto: https
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/daemonset-internal-lb-values.yaml

@@ -1,15 +1,14 @@
 controller:
+  kind: DaemonSet
   image:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
+  admissionWebhooks:
+    enabled: false
   service:
     type: ClusterIP
-
     internal:
       enabled: true
-      labels:
-        external-dns.alpha.kubernetes.io/hostname: internal.example.com
       annotations:
         service.beta.kubernetes.io/aws-load-balancer-internal: "true"

charts/ingress-nginx/ci/daemonset-nodeport-values.yaml

@@ -0,0 +1,10 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: NodePort

charts/ingress-nginx/ci/daemonset-podannotations-values.yaml

@@ -1,16 +1,17 @@
 controller:
+  kind: DaemonSet
   image:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
+  admissionWebhooks:
+    enabled: false
+  metrics:
+    enabled: true
   service:
     type: ClusterIP
-
-  kind: DaemonSet
-
   podAnnotations:
-    prometheus.io/scrape: "true"
+    prometheus.io/path: /metrics
     prometheus.io/port: "10254"
     prometheus.io/scheme: http
-    prometheus.io/path: /metrics
+    prometheus.io/scrape: "true"

charts/ingress-nginx/ci/daemonset-tcp-udp-configMapNamespace-values.yaml

@@ -0,0 +1,20 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+  tcp:
+    configMapNamespace: default
+  udp:
+    configMapNamespace: default
+
+tcp:
+  9000: "default/test:8080"
+
+udp:
+  9001: "default/test:8080"

charts/ingress-nginx/ci/daemonset-tcp-udp-portNamePrefix-values.yaml

@@ -0,0 +1,18 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+
+tcp:
+  9000: "default/test:8080"
+
+udp:
+  9001: "default/test:8080"
+
+portNamePrefix: "port"

charts/ingress-nginx/ci/daemonset-tcp-udp-values.yaml

@@ -0,0 +1,16 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+
+tcp:
+  9000: "default/test:8080"
+
+udp:
+  9001: "default/test:8080"

charts/ingress-nginx/ci/daemonset-tcp-values.yaml

@@ -0,0 +1,14 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+
+tcp:
+  9000: "default/test:8080"
+  9001: "default/test:8080"

charts/ingress-nginx/ci/deamonset-default-values.yaml

@@ -1,12 +1,10 @@
 controller:
+  kind: DaemonSet
   image:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
+  admissionWebhooks:
+    enabled: false
   service:
     type: ClusterIP
-
-  admissionWebhooks:
-    certManager:
-      enabled: true

charts/ingress-nginx/ci/deamonset-metrics-values.yaml

@@ -0,0 +1,12 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  metrics:
+    enabled: true
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/deamonset-psp-values.yaml

@@ -0,0 +1,13 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+
+podSecurityPolicy:
+  enabled: true

charts/ingress-nginx/ci/deamonset-webhook-and-psp-values.yaml

@@ -0,0 +1,13 @@
+controller:
+  kind: DaemonSet
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: true
+  service:
+    type: ClusterIP
+
+podSecurityPolicy:
+  enabled: true

charts/ingress-nginx/ci/deamonset-webhook-values.yaml

@@ -1,13 +1,10 @@
 controller:
+  kind: DaemonSet
   image:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
+  admissionWebhooks:
+    enabled: true
   service:
     type: ClusterIP
-
-  kind: DaemonSet
-
-  metrics:
-    enabled: true

charts/ingress-nginx/ci/deployment-autoscaling-behavior-values.yaml

@@ -1,12 +1,4 @@
 controller:
-  image:
-    repository: ingress-controller/controller
-    tag: 1.0.0-dev
-    digest: null
-
-  service:
-    type: ClusterIP
-
   autoscaling:
     enabled: true
     behavior:
@@ -16,3 +8,7 @@ controller:
         - type: Pods
           value: 1
           periodSeconds: 180
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/deployment-autoscaling-values.yaml

@@ -0,0 +1,11 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  autoscaling:
+    enabled: true
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/deployment-customconfig-values.yaml

@@ -3,9 +3,10 @@ controller:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
-  service:
-    type: ClusterIP
-
   config:
     use-proxy-protocol: "true"
+  allowSnippetAnnotations: false
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/deployment-customnodeport-values.yaml

@@ -0,0 +1,20 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: NodePort
+    nodePorts:
+      tcp:
+        9000: 30090
+      udp:
+        9001: 30091
+
+tcp:
+  9000: "default/test:8080"
+
+udp:
+  9001: "default/test:8080"

charts/ingress-nginx/ci/deployment-default-values.yaml

@@ -1,10 +1,8 @@
+# Left blank to test default values
 controller:
   image:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
   service:
     type: ClusterIP
-
-  kind: Deployment

charts/ingress-nginx/ci/deployment-extra-modules-default-container-sec-context.yaml

@@ -0,0 +1,15 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  service:
+    type: ClusterIP
+  containerSecurityContext:
+    allowPrivilegeEscalation: false
+  extraModules:
+    - name: opentelemetry
+      image:
+        registry: registry.k8s.io
+        image: busybox
+        tag: latest

charts/ingress-nginx/ci/deployment-extra-modules-specific-container-sec-context.yaml

@@ -0,0 +1,15 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  service:
+    type: ClusterIP
+  extraModules:
+    - name: opentelemetry
+      image:
+        registry: registry.k8s.io
+        image: busybox
+        tag: latest
+      containerSecurityContext:
+        allowPrivilegeEscalation: false

charts/ingress-nginx/ci/deployment-extra-modules.yaml

@@ -0,0 +1,13 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  service:
+    type: ClusterIP
+  extraModules:
+    - name: opentelemetry
+      image:
+        registry: registry.k8s.io
+        image: busybox
+        tag: latest

charts/ingress-nginx/ci/deployment-headers-values.yaml

@@ -3,9 +3,11 @@ controller:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
-  service:
-    type: ClusterIP
-
+  admissionWebhooks:
+    enabled: false
+  addHeaders:
+    X-Frame-Options: deny
   proxySetHeaders:
     X-Forwarded-Proto: https
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/deployment-internal-lb-values.yaml

@@ -0,0 +1,19 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+    internal:
+      enabled: true
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-internal: "true"
+      ports:
+        http: 443
+        https: 80
+      targetPorts:
+        http: 443
+        https: 80

charts/ingress-nginx/ci/deployment-metrics-values.yaml

@@ -0,0 +1,11 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  metrics:
+    enabled: true
+  service:
+    type: ClusterIP

charts/ingress-nginx/ci/deployment-nodeport-values.yaml

@@ -0,0 +1,9 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: NodePort

charts/ingress-nginx/ci/deployment-opentelemetry-customregistry-values.yaml

@@ -3,11 +3,7 @@ controller:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
   service:
     type: ClusterIP
-
-  kind: Deployment
-
-  metrics:
+  opentelemetry:
     enabled: true

charts/ingress-nginx/ci/deployment-podannotations-values.yaml

@@ -3,14 +3,14 @@ controller:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
+  admissionWebhooks:
+    enabled: false
+  metrics:
+    enabled: true
   service:
     type: ClusterIP
-
-  kind: Deployment
-
   podAnnotations:
-    prometheus.io/scrape: "true"
+    prometheus.io/path: /metrics
     prometheus.io/port: "10254"
     prometheus.io/scheme: http
-    prometheus.io/path: /metrics
+    prometheus.io/scrape: "true"

charts/ingress-nginx/ci/deployment-psp-values.yaml

@@ -3,8 +3,8 @@ controller:
     repository: ingress-controller/controller
     tag: 1.0.0-dev
     digest: null
-
   service:
     type: ClusterIP
 
-  kind: DaemonSet
+podSecurityPolicy:
+  enabled: true

charts/ingress-nginx/ci/deployment-tcp-udp-configMapNamespace-values.yaml

@@ -0,0 +1,19 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+  tcp:
+    configMapNamespace: default
+  udp:
+    configMapNamespace: default
+
+tcp:
+  9000: "default/test:8080"
+
+udp:
+  9001: "default/test:8080"

charts/ingress-nginx/ci/deployment-tcp-udp-portNamePrefix-values.yaml

@@ -0,0 +1,17 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+
+tcp:
+  9000: "default/test:8080"
+
+udp:
+  9001: "default/test:8080"
+
+portNamePrefix: "port"

charts/ingress-nginx/ci/deployment-tcp-udp-values.yaml

@@ -0,0 +1,15 @@
+controller:
+  image:
+    repository: ingress-controller/controller
+    tag: 1.0.0-dev
+    digest: null
+  admissionWebhooks:
+    enabled: false
+  service:
+    type: ClusterIP
+
+tcp:
+  9000: "default/test:8080"
+
+udp:
+  9001: "default/test:8080"