helm-chart-4.12.2

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.12.2

• Update Ingress-Nginx version controller-v1.12.2

Full Changelog: helm-chart-4.12.1...helm-chart-4.12.2

helm-chart-4.11.6

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.11.6

• Update Ingress-Nginx version controller-v1.11.6

Full Changelog: helm-chart-4.11.5...helm-chart-4.11.6

controller-v1.12.2

Changelog

controller-v1.12.2

Images:

• registry.k8s.io/ingress-nginx/controller:v1.12.2@sha256:03497ee984628e95eca9b2279e3f3a3c1685dd48635479e627d219f00c8eefa9
• registry.k8s.io/ingress-nginx/controller-chroot:v1.12.2@sha256:a697e2bfa419768315250d079ccbbca45f6099c60057769702b912d20897a574

All changes:

• Images: Trigger controller build. (#13313)
• Chart: Bump Kube Webhook CertGen. (#13311)
• Tests & Docs: Bump images. (#13308)
• Images: Trigger other builds (2/2). (#13293)
• Images: Trigger other builds (1/2). (#13290)
• Tests: Bump Test Runner to v1.3.3. (#13287)
• Go: Update dependencies. (#13283)
• Images: Trigger Test Runner build. (#13269)
• Images: Bump NGINX to v1.2.3. (#13266)
• Images: Trigger NGINX build. (#13262)
• Go: Update dependencies. (#13259)
• CI: Update Kubernetes to v1.32.4. (#13255)
• Docs: How to modify NLB TCP timeout. (#13249)
• Go: Update dependencies. (#13246)
• Docs: Improve formatting in monitoring.md. (#13241)
• Docs: Enable metrics in manifest-based deployments. (#13235)
• Tests: Bump Test Runner to v1.3.2. (#13233)
• Images: Trigger Test Runner build. (#13225)
• Images: Bump NGINX_BASE to v1.2.2. (#13222)
• Images: Trigger NGINX build. (#13219)
• Go: Update dependencies. (#13210)
• Docs: Fix link in installation instructions. (#13192)
• Go: Update dependencies. (#13149)
• Go: Bump to v1.24.2. (#13148)
• Annotations: Allow ciphers with underscores. (#13140)
• CI: Do not fail fast. (#13130)
• Images: Fix FromAsCasing. (#13125)
• Images: Extract modules. (#13123)
• Plugin: Improve error handling. (#13112)
• Docs: Fix OpenTelemetry listing. (#13107)
• Tests: Fallback to yq. (#13090)
• Go: Fix Mage. (#13078)

Dependency updates:

• Bump actions/download-artifact from 4.2.1 to 4.3.0 in the actions group (#13304)
• Bump the actions group with 2 updates (#13280)
• Bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 (#13213)
• Bump the go group across 2 directories with 1 update (#13207)
• Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 (#13204)
• Bump github/codeql-action from 3.28.14 to 3.28.15 in the actions group (#13203)
• Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 in /images/custom-error-pages/rootfs (#13200)
• Bump golang.org/x/oauth2 from 0.28.0 to 0.29.0 (#13181)
• Bump the go group across 2 directories with 1 update (#13179)
• Bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0 (#13177)
• Bump golang.org/x/crypto from 0.36.0 to 0.37.0 (#13175)
• Bump the actions group with 2 updates (#13173)
• Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 in the actions group (#13133)
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 (#13121)
• Bump the actions group with 2 updates (#13118)

Full Changelog: controller-v1.12.1...controller-v1.12.2

controller-v1.11.6

Changelog

controller-v1.11.6

Images:

• registry.k8s.io/ingress-nginx/controller:v1.11.6@sha256:4f04fad99f00e604ab488cf0945b4eaa2a93f603f97d2a45fc610ff0f3cad0f9
• registry.k8s.io/ingress-nginx/controller-chroot:v1.11.6@sha256:596f8b9ae4773d3b00dfd65855561419c7e70ecb23569a7a2998b47e160b4f85

All changes:

• Images: Trigger controller build. (#13314)
• Chart: Bump Kube Webhook CertGen. (#13312)
• Tests & Docs: Bump images. (#13309)
• Images: Trigger other builds (2/2). (#13294)
• Images: Trigger other builds (1/2). (#13291)
• Tests: Bump Test Runner to v1.3.3. (#13288)
• Go: Update dependencies. (#13284)
• Images: Trigger Test Runner build. (#13270)
• Images: Bump NGINX to v0.3.3. (#13267)
• Images: Trigger NGINX build. (#13263)
• Go: Update dependencies. (#13260)
• CI: Update Kubernetes to v1.32.4. (#13256)
• Docs: How to modify NLB TCP timeout. (#13250)
• Go: Update dependencies. (#13247)
• Docs: Improve formatting in monitoring.md. (#13240)
• Docs: Enable metrics in manifest-based deployments. (#13236)
• Tests: Bump Test Runner to v1.3.2. (#13234)
• Images: Trigger Test Runner build. (#13228)
• Images: Bump NGINX_BASE to v0.3.2. (#13223)
• Images: Trigger NGINX build. (#13220)
• Go: Update dependencies. (#13211)
• Docs: Fix link in installation instructions. (#13193)
• Go: Update dependencies. (#13151)
• Go: Bump to v1.24.2. (#13150)
• Annotations: Allow ciphers with underscores. (#13141)
• CI: Do not fail fast. (#13131)
• Images: Fix FromAsCasing. (#13126)
• Images: Extract modules. (#13124)
• Plugin: Improve error handling. (#13113)
• Docs: Fix OpenTelemetry listing. (#13108)
• Tests: Fallback to yq. (#13091)
• Go: Fix Mage. (#13080)

Dependency updates:

• Bump actions/download-artifact from 4.2.1 to 4.3.0 in the actions group (#13305)
• Bump the actions group with 2 updates (#13281)
• Bump github.com/onsi/ginkgo/v2 from 2.23.3 to 2.23.4 (#13214)
• Bump the go group across 2 directories with 1 update (#13206)
• Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 (#13205)
• Bump github/codeql-action from 3.28.14 to 3.28.15 in the actions group (#13202)
• Bump github.com/prometheus/client_golang from 1.21.1 to 1.22.0 in /images/custom-error-pages/rootfs (#13201)
• Bump golang.org/x/oauth2 from 0.28.0 to 0.29.0 (#13182)
• Bump the go group across 2 directories with 1 update (#13180)
• Bump github.com/fsnotify/fsnotify from 1.8.0 to 1.9.0 (#13178)
• Bump golang.org/x/crypto from 0.36.0 to 0.37.0 (#13176)
• Bump the actions group with 2 updates (#13174)
• Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 in the actions group (#13134)
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 (#13122)
• Bump the actions group with 2 updates (#13119)

Full Changelog: controller-v1.11.5...controller-v1.11.6

helm-chart-4.12.1

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.12.1

• Update Ingress-Nginx version controller-v1.12.1

Full Changelog: helm-chart-4.12.0...helm-chart-4.12.1

helm-chart-4.11.5

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.11.5

• Update Ingress-Nginx version controller-v1.11.5

Full Changelog: helm-chart-4.11.4...helm-chart-4.11.5

controller-v1.12.1

Changelog

controller-v1.12.1

This release fixes the following CVEs:

• CVE-2025-1097
• CVE-2025-1098
• CVE-2025-1974
• CVE-2025-24513
• CVE-2025-24514

Unfortunately, to fix CVE-2025-1974 it was necessary to disable the validation of the generated NGINX configuration during the validation of Ingress resources.

The resulting NGINX configuration is still checked before the actual loading, so that there are no failures of the underlying NGINX. However, invalid Ingress resources can lead to the NGINX configuration no longer being able to be updated.

To reduce such situations as far as possible, we therefore recommend enabling annotation validation and disabling snippet annotations. In case of doubt, such states can be determined from the logs of the Ingress NGINX Controller. Watch out for a line of dashes followed by "Error:" telling you what went wrong.

Images:

• registry.k8s.io/ingress-nginx/controller:v1.12.1@sha256:d2fbc4ec70d8aa2050dd91a91506e998765e86c96f32cffb56c503c9c34eed5b
• registry.k8s.io/ingress-nginx/controller-chroot:v1.12.1@sha256:90155c86548e0bb95b3abf1971cd687d8f5d43f340cfca0ad3484e2b8351096e

All changes:

• Images: Trigger controller build. (#13071)
• Controller: Several security fixes. (#13069)
• Chart: Bump Kube Webhook CertGen. (#13066)
• Tests & Docs: Bump images. (#13064)
• Images: Trigger other builds (2/2). (#13061)
• Images: Trigger other builds (1/2). (#13059)
• Tests: Bump Test Runner to v1.3.1. (#13048)
• Images: Trigger Test Runner build. (#13045)
• Images: Bump NGINX_BASE to v1.2.1. (#13044)
• Images: Trigger NGINX build. (#13039)
• Go: Update dependencies. (#13036)
• CI: Update KIND to v1.32.3. (#13029)
• CI: Update Kubernetes to v1.32.3. (#13025)
• Images: Rework. (3/3) (#13016)
• Images: Rework. (2/3) (#13011)
• Images: Rework. (1/3) (#13014)
• Custom Error Pages: Accept first of many MIME types. (#13006)
• Docs: Use enable-global-auth annotation instead of non-existing ConfigMap option. (#12978)
• Go: Update dependencies. (#12963)
• Docs: Update link to values.yaml. (#12960)
• fix DNS issues with unresolvable backends with ExternalName (#12951)
• Go: Bump to v1.24.1. (#12942)
• CI: Update KIND images. (#12931)
• Test: Remove gRPC Fortune Teller. (#12929)
• NGINX: Update ModSecurity. (#12915)
• Development: Update KIND images. (#12909)
• Config: Remove notes about future defaults. (#12898)
• Images: Update kubectl to v1.32.2. (#12856)
• Development: Update Kubernetes to v1.32.0. (#12853)
• CI: Update kubectl to v1.32.2. (#12851)
• Images: Migrate to AR. (2/2) (#12849)
• Images: Migrate to AR. (1/2) (#12846)
• Docs: Migrate to AR. (#12809)
• Docs: Enable code copy button. (#12805)
• Go: Bump to v1.23.6. (#12801)
• CI: Update Artifact Hub to v1.20.0. (#12793)
• Images: Update kubectl to v1.31.5. (#12791)
• CI: Update kubectl to v1.31.5. (#12789)
• Development: Bump Kubernetes to v1.31.4. (#12784)
• Go: Replace golang.org/x/exp/slices with slices. (#12781)
• Docs: Fix character format. (#12773)
• Docs: Improve bare-metal setup. (#12744)
• Build: Always use local tmp dir on macOS. (#12741)
• Development: Bump Kubernetes to v1.31.4. (#12739)
• Images: Bump gcb-docker-gcloud to v20250116-2a05ea7e3d. (#12738)
• Go: Bump to v1.23.5. (#12736)
• Docs: Clarify rate limits are per ingress controller replica. (#12715)
• Go: Stop using workspace. (#12712)
• Chart: Bump Kube Webhook CertGen. (#12696)
• Tests & Docs: Bump images. (#12694)
• Images: Trigger other builds (2/2). (#12690)
• Images: Trigger other builds (1/2). (#12688)
• Tests: Bump Test Runner to v20250112-01b7af21. (#12684)
• Images: Trigger Test Runner build. (#12681)
• Images: Bump NGINX_BASE to v1.2.0. (#12677)
• Images: Trigger NGINX build. (#12674)
• NGINX: Align quotes. (#12673)
• Annotations: Deny newlines. (#12667)
• Annotations: Reload on custom header changes. (#12652)
• NGINX: Bump ModSecurity. (#12651)
• NGINX: Bump OpenTelemetry. (#12631)

Dependency updates:

• Bump github.com/opencontainers/runc from 1.2.5 to 1.2.6 in the go group across 1 directory (#13033)
• Bump github.com/onsi/ginkgo/v2 from 2.23.0 to 2.23.3 (#13027)
• Bump the actions group with 5 updates (#13023)
• Bump dorny/test-reporter from 1.9.1 to 2.0.0 (#12989)
• Bump github.com/prometheus/common from 0.62.0 to 0.63.0 (#12987)
• Bump the go group across 3 directories with 9 updates (#12985)
• Bump the actions group with 3 updates (#12984)
• Bump github/codeql-action from 3.28.10 to 3.28.11 in the actions group (#12968)
• Bump github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.0 (#12958)
• Bump golang.org/x/crypto from 0.35.0 to 0.36.0 (#12955)
• Bump the go group across 2 directories with 1 update (#12938)
• Bump google.golang.org/grpc from 1.70.0 to 1.71.0 (#12937)
• Bump golang.org/x/crypto from 0.34.0 to 0.35.0 (#12923)
• Bump the actions group with 3 updates (#12921)
• Bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0 (#12900)
• Bump golang.org/x/crypto from 0.33.0 to 0.34.0 (#12893)
• Bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0 in /images/custom-error-pages/rootfs (#12892)
• Bump the actions group with 4 updates (#12889)
• Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 (#12867)
• Bump the go group across 3 directories with 11 updates (#12865)
• Bump the actions group with 2 updates (#12863)
• Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 in /images/kube-webhook-certgen/rootfs (#12861)
• Bump the actions group with 4 updates (#12814)
• Bump golang.org/x/crypto from 0.32.0 to 0.33.0 (#12812)
• Bump the actions group with 2 updates (#12777)
• Bump the go group across 2 directories with 1 update (#12775)
• Bump google.golang.org/grpc from 1.69.4 to 1.70.0 (#12760)
• Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.20.1 in the go group across 1 directory (#12758)
• Bump the actions group with 5 updates (#12756)
• Bump sigs.k8s.io/controller-runtime from 0.19.4 to 0.20.0 (#12732)
• Bump github.com/prometheus/common from 0.61.0 to 0.62.0 (#12728)
• Bump the go group across 3 directories with 9 updates (#12726)
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 in the actions group (#12725)
• Bump google.golang.org/grpc from 1.69.2 to 1.69.4 in the go group across 1 directory (#12699)
• Bump the actions group with 3 updates (#12664)
• Bump the go group across 1 directory with 3 updates (#12662)
• Bump golang.org/x/crypto from 0.31.0 to 0.32.0 (#12661)
• Bump github.com/onsi/ginkgo/v2 from 2.22.1 to 2.22.2 (#12628)

Full Changelog: controller-v1.12.0...controller-v1.12.1

controller-v1.11.5

Changelog

controller-v1.11.5

This release fixes the following CVEs:

• CVE-2025-1097
• CVE-2025-1098
• CVE-2025-1974
• CVE-2025-24513
• CVE-2025-24514

Unfortunately, to fix CVE-2025-1974 it was necessary to disable the validation of the generated NGINX configuration during the validation of Ingress resources.

The resulting NGINX configuration is still checked before the actual loading, so that there are no failures of the underlying NGINX. However, invalid Ingress resources can lead to the NGINX configuration no longer being able to be updated.

To reduce such situations as far as possible, we therefore recommend enabling annotation validation and disabling snippet annotations. In case of doubt, such states can be determined from the logs of the Ingress NGINX Controller. Watch out for a line of dashes followed by "Error:" telling you what went wrong.

Images:

• registry.k8s.io/ingress-nginx/controller:v1.11.5@sha256:a1cbad75b0a7098bf9325132794dddf9eef917e8a7fe246749a4cea7ff6f01eb
• registry.k8s.io/ingress-nginx/controller-chroot:v1.11.5@sha256:ec9df3eb6b06563a079ee46045da94cbf750f7dbb16fdbcb9e3265b551ed72ad

All changes:

• Images: Trigger controller build. (#13072)
• Controller: Several security fixes. (#13070)
• Chart: Bump Kube Webhook CertGen. (#13067)
• Tests & Docs: Bump images. (#13065)
• Images: Trigger other builds (2/2). (#13060)
• Images: Trigger other builds (1/2). (#13058)
• Tests: Bump Test Runner to v1.3.1. (#13049)
• Images: Trigger Test Runner build. (#13046)
• Images: Bump NGINX_BASE to v0.3.1. (#13041)
• Images: Trigger NGINX build. (#13040)
• Go: Update dependencies. (#13037)
• CI: Update KIND to v1.32.3. (#13030)
• CI: Update Kubernetes to v1.32.3. (#13026)
• Images: Rework. (3/3) (#13017)
• Images: Rework. (2/3) (#13012)
• Images: Rework. (1/3) (#13015)
• Custom Error Pages: Accept first of many MIME types. (#13007)
• Docs: Use enable-global-auth annotation instead of non-existing ConfigMap option. (#12977)
• Go: Update dependencies. (#12964)
• Docs: Update link to values.yaml. (#12961)
• fix DNS issues with unresolvable backends with ExternalName (#12952)
• Go: Bump to v1.24.1. (#12943)
• CI: Update KIND images. (#12932)
• Test: Remove gRPC Fortune Teller. (#12930)
• NGINX: Update ModSecurity. (#12916)
• Development: Update KIND images. (#12910)
• Config: Remove notes about future defaults. (#12899)
• Images: Update kubectl to v1.32.2. (#12855)
• Development: Update Kubernetes to v1.32.0. (#12854)
• CI: Update kubectl to v1.32.2. (#12852)
• Images: Migrate to AR. (2/2) (#12850)
• Images: Migrate to AR. (1/2) (#12847)
• Docs: Migrate to AR. (#12808)
• Docs: Enable code copy button. (#12806)
• Go: Bump to v1.23.6. (#12800)
• CI: Update Artifact Hub to v1.20.0. (#12794)
• Images: Update kubectl to v1.31.5. (#12792)
• CI: Update kubectl to v1.31.5. (#12790)
• Development: Bump Kubernetes to v1.31.4. (#12783)
• Go: Replace golang.org/x/exp/slices with slices. (#12780)
• Docs: Fix character format. (#12774)
• Docs: Improve bare-metal setup. (#12745)
• Build: Always use local tmp dir on macOS. (#12742)
• Development: Bump Kubernetes to v1.31.4. (#12740)
• Images: Bump gcb-docker-gcloud to v20250116-2a05ea7e3d. (#12737)
• Go: Bump to v1.23.5. (#12735)
• Docs: Clarify rate limits are per ingress controller replica. (#12716)
• Go: Stop using workspace. (#12713)
• Chart: Bump Kube Webhook CertGen. (#12697)
• Tests & Docs: Bump images. (#12695)
• Images: Trigger other builds (2/2). (#12691)
• Images: Trigger other builds (1/2). (#12687)
• Tests: Bump Test Runner to v20250112-01b7af21. (#12685)
• Images: Trigger Test Runner build. (#12682)
• Images: Bump NGINX_BASE to v0.3.0. (#12679)
• Images: Trigger NGINX build. (#12675)
• NGINX: Align quotes. (#12670)
• Annotations: Deny newlines. (#12666)
• Annotations: Reload on custom header changes. (#12653)
• NGINX: Bump ModSecurity. (#12650)
• NGINX: Bump OpenTelemetry. (#12632)

Dependency updates:

• Bump github.com/opencontainers/runc from 1.2.5 to 1.2.6 in the go group across 1 directory (#13034)
• Bump github.com/onsi/ginkgo/v2 from 2.23.0 to 2.23.3 (#13028)
• Bump the actions group with 5 updates (#13024)
• Bump dorny/test-reporter from 1.9.1 to 2.0.0 (#12990)
• Bump github.com/prometheus/common from 0.62.0 to 0.63.0 (#12988)
• Bump the go group across 3 directories with 9 updates (#12986)
• Bump the actions group with 3 updates (#12983)
• Bump github/codeql-action from 3.28.10 to 3.28.11 in the actions group (#12969)
• Bump github.com/onsi/ginkgo/v2 from 2.22.2 to 2.23.0 (#12959)
• Bump golang.org/x/crypto from 0.35.0 to 0.36.0 (#12956)
• Bump the go group across 2 directories with 1 update (#12939)
• Bump google.golang.org/grpc from 1.70.0 to 1.71.0 (#12936)
• Bump golang.org/x/crypto from 0.34.0 to 0.35.0 (#12924)
• Bump the actions group with 3 updates (#12922)
• Bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0 (#12901)
• Bump golang.org/x/crypto from 0.33.0 to 0.34.0 (#12894)
• Bump github.com/prometheus/client_golang from 1.20.5 to 1.21.0 in /images/custom-error-pages/rootfs (#12891)
• Bump the actions group with 4 updates (#12890)
• Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 (#12868)
• Bump the go group across 3 directories with 11 updates (#12866)
• Bump the actions group with 2 updates (#12864)
• Bump github.com/spf13/cobra from 1.8.1 to 1.9.1 in /images/kube-webhook-certgen/rootfs (#12862)
• Bump the actions group with 4 updates (#12815)
• Bump golang.org/x/crypto from 0.32.0 to 0.33.0 (#12813)
• Bump the actions group with 2 updates (#12778)
• Bump the go group across 2 directories with 1 update (#12776)
• Bump google.golang.org/grpc from 1.69.4 to 1.70.0 (#12761)
• Bump sigs.k8s.io/controller-runtime from 0.20.0 to 0.20.1 in the go group across 1 directory (#12759)
• Bump the actions group with 5 updates (#12757)
• Bump sigs.k8s.io/controller-runtime from 0.19.4 to 0.20.0 (#12731)
• Bump github.com/prometheus/common from 0.61.0 to 0.62.0 (#12729)
• Bump the go group across 3 directories with 9 updates (#12727)
• Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 in the actions group (#12724)
• Bump google.golang.org/grpc from 1.69.2 to 1.69.4 in the go group across 1 directory (#12700)
• Bump the actions group with 3 updates (#12665)
• Bump the go group across 1 directory with 3 updates (#12663)
• Bump golang.org/x/crypto from 0.31.0 to 0.32.0 (#12660)
• Bump github.com/onsi/ginkgo/v2 from 2.22.1 to 2.22.2 (#12629)

Full Changelog: controller-v1.11.4...controller-v1.11.5

helm-chart-4.12.0

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.12.0

• CI: Fix chart testing. (#12258)
• Update Ingress-Nginx version controller-v1.12.0

Full Changelog: helm-chart-4.11.0...helm-chart-4.12.0

helm-chart-4.11.4

Changelog

This file documents all notable changes to ingress-nginx Helm Chart. The release numbering uses semantic versioning.

4.11.4

• CI: Fix chart testing. (#12259)
• Update Ingress-Nginx version controller-v1.11.4

Full Changelog: helm-chart-4.11.3...helm-chart-4.11.4