The module lifecycle stage: Generally available version

The module has requirements for installation

v1.3.0

Highlights

  • IMPORTANT: if geoIP2 is set in an IngressNginxController, its controller and validator pods now start only after the GeoIP2 databases are downloaded. Previously, the controller started without the databases when the download failed, and the errors appeared only later, for example when a configuration using GeoIP2 variables was loaded. Now the problem is detected at pod startup instead. Before upgrading, make sure geoproxy can download the configured databases.
  • Added Deckhouse Ingress annotations that replace the most common snippet annotations; see the documentation for details
  • Nginx was updated to 1.30.6

New Features

  • Added Deckhouse Ingress annotations that replace the most common snippet annotations; see the documentation for details
  • The custom-headers annotation is now available in controller 1.10
  • X-Frame-Options, X-Content-Type-Options and Content-Security-Policy are added to global-allowed-response-headers, so the custom-headers annotation can set them without extra configuration
  • The GeoIP2 databases are downloaded into controller pods from geoproxy by the geoip-loader init container and sidecar instead of by the controller itself, and NGINX rereads updated databases without a reload
  • Added the GeoIP DB status per controller panel to the Grafana dashboards

Improvements

  • Updated the base map of the geomap panels in the Grafana dashboards

Fixes

  • The controller-manager, kruise, validator and geoproxy pods are now restricted to amd64 nodes only if the nodes in the cluster have different architectures. Previously, the restriction was always applied.

Security Updates

  • Updated golang.org/x/crypto, golang.org/x/net, golang.org/x/text and related Go modules, as well as the Go toolchain, in the module images and hooks to fix known vulnerabilities
  • Nginx was updated to 1.30.6

Breaking Changes

  • If an IngressNginxController has geoIP2 configured, the geoip-loader-init init container downloads the GeoIP2 databases from geoproxy before the controller starts and fails until the download succeeds. A controller or validator pod does not start while the databases cannot be downloaded, for example with an invalid maxmindLicenseKey or with MaxMind or the mirror unreachable. A rolling update then stops at the first new pod: controllers with the LoadBalancer inlet keep serving traffic with the old pods, while with other inlets the node whose pod is being replaced stops serving traffic.

Upgrade Notes

  • Before upgrading clusters where IngressNginxController resources have geoIP2 configured, check that the maxmindLicenseKey or the mirror set in geoIP2 is valid and reachable from the cluster. If a controller pod stays in the Init state after the upgrade, the reason is shown in the status of its geoip-loader-init container.

Documentation

  • Added a FAQ section on the additional Ingress annotations and on replacing snippet annotations with them

v1.2.1

Highlights

  • The nginx.ingress.kubernetes.io/ingress-nginx-hsts annotation is now accepted in any namespace

New Features

  • The nginx.ingress.kubernetes.io/ingress-nginx-hsts annotation is now accepted on Ingress resources in any namespace, including application namespaces and kube-system

v1.2.0

Highlights

  • The IngressNginxController API was extended with an annotationPolicy section that controls which Ingress annotations the controller accepts

New Features

  • Added the annotationPolicy section to IngressNginxController: allowSnippetAnnotations, riskLevel, allowCrossNamespaceResources and valueWordBlocklist, which map to the corresponding controller ConfigMap options
  • Added two Deckhouse Ingress annotations for module Ingress resources, proxy-ssl-use-controller-certificate and ingress-nginx-hsts. They apply a fixed NGINX configuration without enabling snippet annotations.
  • A canary Ingress can now set its own backend-protocol annotation instead of inheriting the protocol of the primary Ingress
  • Added the nginx_ingress_controller_rejected_annotation metric and the NginxIngressAnnotationsRejected alert, which report Ingress resources whose annotations the controller refuses
  • Added an AGE column to the IngressNginxController resource

Fixes

  • Annotation-related ConfigMap options are now applied to Ingress resources that already existed when the option changed
  • Annotation rejection logs now identify the Ingress, the offending annotation and the risk level it exceeded

Documentation

  • Updated documentation

v1.1.5

Fixes

  • Nginx version update to 1.30.5

v1.1.4

Fixes

  • IngressNginxController validation was slightly relaxed to comply with Kubernetes patterns

v1.1.3

Highlights

  • Kruise controller memory consumption was decreased by disabling unnecessary CRD caching
  • Module was refactored to prevent yaml injections

Fixes

  • Module was refactored to prevent yaml injections
  • Added missing anti-affinity
  • Fixed detecting real client IP for WithSSLPassthrough inlets
  • Fixed real client IP settings for ProxyProtocol inlets

v1.1.2

Fixes

  • Kruise controller uses local (in terms of module) kube-rbac-proxy image
  • HPA scaler uses local (in terms of module) pause image

v1.1.1

Fixes

  • Namespace pod policy action is set to “warn” to prevent rollout deadlocks

v1.1.0

Highlights

  • Updated NGINX to 1.30.4

New Features

  • Added SecurityPolicyException resources for compliance with the Restricted profile of the Pod Security Standards (PSS)
  • Added support for canary migration from Ingress to Gateway API

Improvements

  • Updated NGINX to 1.30.4

Fixes

  • Fixed tests
  • Fixed vulnerabilities in dependencies

Dependencies

  • Updated Go to 1.26.6

v1.0.15

Fixes

  • Fixed RBACv1 rules

v1.0.14

Fixes

  • Fixed latest CVEs
  • Fixed kruise daemonset/scale RBAC rules

v1.0.13

Highlights

  • Fixed CSE module build with OpenVEX

Fixes

  • Fixed CSE module build with OpenVEX

v1.0.12

Highlights

  • Added OpenVEX statements for GO-2026-5932
  • Fixed Kruise webhook annotations

Fixes

  • Fixed Kruise webhook annotations

Security Updates

  • Added OpenVEX statements for GO-2026-5932

v1.0.11

Highlights

  • Updated the build to stop using build_dir
  • Added changelog

Improvements

  • Updated the build to stop using build_dir
  • Added changelog

v1.0.10

Highlights

  • Fixed templates
  • Fixed CVE and DMT issues

Fixes

  • Fixed templates
  • Fixed CVE and DMT issues

v1.0.9

Highlights

  • Reworked config hash metric calculation

Improvements

  • Reworked config hash metric calculation to reduce false positives

v1.0.8

Highlights

  • Fixed several CVEs
  • Fixed template tests

Fixes

  • Fixed several CVEs
  • Fixed template tests

v1.0.7

Highlights

  • Enabled the module by default

New Features

  • Enabled the module by default

v1.0.6

Highlights

  • Updated the build process

Improvements

  • Updated the build process

v1.0.4

Highlights

  • Added production CI

New Features

  • Added production CI

Documentation

  • Updated documentation

v1.0.3

Highlights

  • Fixed failover mount points

Fixes

  • Fixed failover mount points

v1.0.2

Highlights

  • Fixed controller mount points

Fixes

  • Fixed controller mount points

v1.0.1

Highlights

  • Fixed controller mount points
  • Updated Nginx

Improvements

  • Updated Nginx to 1.30.3 to address recent CVEs

Fixes

  • Fixed controller mount points for compliance with the CSE edition

v1.0.0

Highlights

  • Added a new CRD version
  • Added a new controller version
  • Added a controller manager

New Features

  • Added the validationIsolationMode setting for IngressNginxController versions 1.14 and 1.15. It applies additional isolation levels when running validation tasks.
  • Added Ingress Nginx controller version 1.15.1
  • Added a controller manager. Its role is currently limited to conversions and validations; in future releases it will fully replace the Kruise controller manager.

Improvements

  • Added IngressNginxController CRD v2 with new fields for resource management

Documentation

  • Updated documentation