Update NGINX Ingress Controller to 3.4.0 (#218)

Co-authored-by: Paul Abel <[email protected]>

bundle/manifests/nginx-ingress-operator.clusterserviceversion.yaml

@@ -74,7 +74,7 @@ metadata:
               "image": {
                 "pullPolicy": "IfNotPresent",
                 "repository": "nginx/nginx-ingress",
-                "tag": "3.3.2-ubi"
+                "tag": "3.4.0-ubi"
               },
               "includeYear": false,
               "ingressClass": {

config/samples/charts_v1alpha1_nginxingress.yaml

@@ -34,7 +34,7 @@ spec:
     customPorts: []
     image:
       repository: nginx/nginx-ingress
-      tag: "3.3.2-ubi"
+      tag: "3.4.0-ubi"
       # digest: "sha256:CHANGEME"
       pullPolicy: IfNotPresent
     lifecycle: {}

docs/nginx-ingress-controller.md

@@ -46,7 +46,7 @@ spec:
     customPorts: []
     image:
       repository: nginx/nginx-ingress
-      tag: "3.3.2-ubi"
+      tag: "3.4.0-ubi"
       # digest: "sha256:CHANGEME"
       pullPolicy: IfNotPresent
     lifecycle: {}

examples/deployment-oss-min/nginx-ingress-controller.yaml

@@ -11,7 +11,7 @@ spec:
     image:
       pullPolicy: IfNotPresent
       repository: nginx/nginx-ingress
-      tag: 3.3.2-ubi
+      tag: 3.4.0-ubi
     ingressClass:
       name: nginx
     kind: deployment

examples/deployment-plus-min/nginx-ingress-controller.yaml

@@ -11,7 +11,7 @@ spec:
     image:
       pullPolicy: IfNotPresent
       repository: nginx/nginx-ingress
-      tag: 3.3.2-ubi
+      tag: 3.4.0-ubi
     ingressClass:
       name: nginx
     kind: deployment

helm-charts/nginx-ingress/Chart.yaml

@@ -1,8 +1,8 @@
 apiVersion: v2
-appVersion: 3.3.2
+appVersion: 3.4.0
 description: NGINX Ingress Controller
 home: https://github.com/nginxinc/kubernetes-ingress
-icon: https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.3.2/deployments/helm-chart/chart-icon.png
+icon: https://raw.githubusercontent.com/nginxinc/kubernetes-ingress/v3.4.0/charts/nginx-ingress/chart-icon.png
 keywords:
 - ingress
 - nginx
@@ -12,6 +12,6 @@ maintainers:
   name: nginxinc
 name: nginx-ingress
 sources:
-- https://github.com/nginxinc/kubernetes-ingress/tree/v3.3.2/deployments/helm-chart
+- https://github.com/nginxinc/kubernetes-ingress/tree/v3.4.0/charts/nginx-ingress
 type: application
-version: 1.0.2
+version: 1.1.0

helm-charts/nginx-ingress/README.md

@@ -15,8 +15,9 @@ This chart deploys the NGINX Ingress Controller in your Kubernetes cluster.
 - If you’d like to use NGINX Plus:
   - To pull from the F5 Container registry, configure a docker registry secret using your JWT token from the MyF5 portal
     by following the instructions from
-    [here](https://docs.nginx.com/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret). Make sure to
-    specify the secret using `controller.serviceAccount.imagePullSecretName` parameter.
+    [here](https://docs.nginx.com/nginx-ingress-controller/installation/using-the-jwt-token-docker-secret).
+    Make sure to specify the secret using one of the following parameters:
+    `controller.serviceAccount.imagePullSecretName` or `controller.serviceAccount.imagePullSecretsNames`.
   - Alternatively, pull an Ingress Controller image with NGINX Plus and push it to your private registry by following
     the instructions from
     [here](https://docs.nginx.com/nginx-ingress-controller/installation/pulling-ingress-controller-image).
@@ -78,14 +79,14 @@ To install the chart with the release name my-release (my-release is the name th
 For NGINX:
 
 ```console
-helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.0.2
+helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.1.0
 ```
 
 For NGINX Plus: (assuming you have pushed the Ingress Controller image `nginx-plus-ingress` to your private registry
 `myregistry.example.com`)
 
 ```console
-helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.0.2 --set controller.image.repository=myregistry.example.com/nginx-plus-ingress --set controller.nginxplus=true
+helm install my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.1.0 --set controller.image.repository=myregistry.example.com/nginx-plus-ingress --set controller.nginxplus=true
 ```
 
 This will install the latest `edge` version of the Ingress Controller from GitHub Container Registry. If you prefer to
@@ -100,7 +101,7 @@ CRDs](#upgrading-the-crds).
 To upgrade the release `my-release`:
 
 ```console
-helm upgrade my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.0.2
+helm upgrade my-release oci://ghcr.io/nginxinc/charts/nginx-ingress --version 1.1.0
 ```
 
 ### Uninstalling the Chart
@@ -141,7 +142,7 @@ upgrading/deleting the CRDs.
 1. Pull the chart sources:
 
     ```console
-    helm pull oci://ghcr.io/nginxinc/charts/nginx-ingress --untar --version 1.0.2
+    helm pull oci://ghcr.io/nginxinc/charts/nginx-ingress --untar --version 1.1.0
     ```
 
 2. Change your working directory to nginx-ingress:
@@ -227,11 +228,11 @@ The steps you should follow depend on the Helm release name:
     Selector:               app=nginx-ingress-nginx-ingress
     ```
 
-2. Checkout the latest available tag using `git checkout v3.3.2`
+2. Checkout the latest available tag using `git checkout v3.4.0`
 
-3. Navigate to `/kubernates-ingress/deployments/helm-chart`
+3. Navigate to `/kubernates-ingress/charts/nginx-ingress`
 
-4. Update the `selectorLabels: {}` field in the `values.yaml` file located at `/kubernates-ingress/deployments/helm-chart`
+4. Update the `selectorLabels: {}` field in the `values.yaml` file located at `/kubernates-ingress/charts/nginx-ingress`
 with the copied `Selector` value.
 
     ```shell
@@ -279,11 +280,11 @@ reviewing its events:
     Selector:               app=<helm_release_name>-nginx-ingress
     ```
 
-2. Checkout the latest available tag using `git checkout v3.3.2`
+2. Checkout the latest available tag using `git checkout v3.4.0`
 
-3. Navigate to `/kubernates-ingress/deployments/helm-chart`
+3. Navigate to `/kubernates-ingress/charts/nginx-ingress`
 
-4. Update the `selectorLabels: {}` field in the `values.yaml` file located at `/kubernates-ingress/deployments/helm-chart`
+4. Update the `selectorLabels: {}` field in the `values.yaml` file located at `/kubernates-ingress/charts/nginx-ingress`
 with the copied `Selector` value.
 
     ```shell
@@ -342,10 +343,11 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.hostNetwork` | Enables the Ingress Controller pods to use the host's network namespace. | false |
 |`controller.dnsPolicy` | DNS policy for the Ingress Controller pods. | ClusterFirst |
 |`controller.nginxDebug` | Enables debugging for NGINX. Uses the `nginx-debug` binary. Requires `error-log-level: debug` in the ConfigMap via `controller.config.entries`. | false |
+| `controller.shareProcessNamespace` | Enables process namespace sharing. When process namespace sharing is enabled, processes in a container are visible to all other containers in the same pod. [docs](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) | false |
 |`controller.logLevel` | The log level of the Ingress Controller. | 1 |
 |`controller.image.digest` | The image digest of the Ingress Controller. | None |
 |`controller.image.repository` | The image repository of the Ingress Controller. | nginx/nginx-ingress |
-|`controller.image.tag` | The tag of the Ingress Controller image. | 3.3.2 |
+|`controller.image.tag` | The tag of the Ingress Controller image. | 3.4.0 |
 |`controller.image.pullPolicy` | The pull policy for the Ingress Controller image. | IfNotPresent |
 |`controller.lifecycle` | The lifecycle of the Ingress Controller pods. | {} |
 |`controller.customConfigMap` | The name of the custom ConfigMap used by the Ingress Controller. If set, then the default config is ignored. | "" |
@@ -370,15 +372,15 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.initContainers` | InitContainers for the Ingress Controller pods. | [] |
 |`controller.extraContainers` | Extra (eg. sidecar) containers for the Ingress Controller pods. | [] |
 |`controller.resources` | The resources of the Ingress Controller pods. | requests: cpu=100m,memory=128Mi |
+|`controller.initContainerResources` | The resources of the init container which is used when `controller.readOnlyRootFilesystem` is set to `true` | requests: cpu=100m,memory=128Mi |
 |`controller.replicaCount` | The number of replicas of the Ingress Controller deployment. | 1 |
 |`controller.ingressClass.name` | A class of the Ingress Controller. An IngressClass resource with the name equal to the class must be deployed. Otherwise, the Ingress Controller will fail to start. The Ingress Controller only processes resources that belong to its class - i.e. have the "ingressClassName" field resource equal to the class. The Ingress Controller processes all the VirtualServer/VirtualServerRoute/TransportServer resources that do not have the "ingressClassName" field for all versions of Kubernetes. | nginx |
-|`controller.ingressClass.create` | Creates a new IngressClass object with the name `controller.ingressClass.name`. Set to `false` to use an existing ingressClass created using `kubectl` with the same name. If you use `helm upgrade`, do not change the values from the previous release as helm will delete IngressClass objects managed by helm. If you are upgrading from a release earlier than 3.3.2, do not set the value to false. | true |
+|`controller.ingressClass.create` | Creates a new IngressClass object with the name `controller.ingressClass.name`. Set to `false` to use an existing ingressClass created using `kubectl` with the same name. If you use `helm upgrade`, do not change the values from the previous release as helm will delete IngressClass objects managed by helm. If you are upgrading from a release earlier than 3.4.0, do not set the value to false. | true |
 |`controller.ingressClass.setAsDefaultIngress` | New Ingresses without an `"ingressClassName"` field specified will be assigned the class specified in `controller.ingressClass.name`. Requires `controller.ingressClass.create`.  | false |
 |`controller.watchNamespace` | Comma separated list of namespaces the Ingress Controller should watch for resources. By default the Ingress Controller watches all namespaces. Mutually exclusive with `controller.watchNamespaceLabel`. Please note that if configuring multiple namespaces using the Helm cli `--set` option, the string needs to wrapped in double quotes and the commas escaped using a backslash - e.g. `--set controller.watchNamespace="default\,nginx-ingress"`. | "" |
 |`controller.watchNamespaceLabel` | Configures the Ingress Controller to watch only those namespaces with label foo=bar. By default the Ingress Controller watches all namespaces. Mutually exclusive with `controller.watchNamespace`. | "" |
 |`controller.watchSecretNamespace` | Comma separated list of namespaces the Ingress Controller should watch for resources of type Secret. If this arg is not configured, the Ingress Controller watches the same namespaces for all resources. See `controller.watchNamespace` and `controller.watchNamespaceLabel`. Please note that if configuring multiple namespaces using the Helm cli `--set` option, the string needs to wrapped in double quotes and the commas escaped using a backslash - e.g. `--set controller.watchSecretNamespace="default\,nginx-ingress"`. | "" |
 |`controller.enableCustomResources` | Enable the custom resources. | true |
-|`controller.enablePreviewPolicies` | Enable preview policies. This parameter is deprecated. To enable OIDC Policies please use `controller.enableOIDC` instead. | false |
 |`controller.enableOIDC` | Enable OIDC policies. | false |
 |`controller.enableTLSPassthrough` | Enable TLS Passthrough on default port 443. Requires `controller.enableCustomResources`. | false |
 |`controller.tlsPassThroughPort` | Set the port for the TLS Passthrough. Requires `controller.enableCustomResources` and `controller.enableTLSPassthrough`.  | 443 |
@@ -415,6 +417,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.serviceAccount.annotations` | The annotations of the Ingress Controller service account. | {} |
 |`controller.serviceAccount.name` | The name of the service account of the Ingress Controller pods. Used for RBAC. | Autogenerated |
 |`controller.serviceAccount.imagePullSecretName` | The name of the secret containing docker registry credentials. Secret must exist in the same namespace as the helm release. | "" |
+|`controller.serviceAccount.imagePullSecretsNames` | The list of secret names containing docker registry credentials. Secret must exist in the same namespace as the helm release. | [] |
 |`controller.serviceMonitor.name` | The name of the serviceMonitor. | Autogenerated |
 |`controller.serviceMonitor.create` | Create a ServiceMonitor custom resource. | false |
 |`controller.serviceMonitor.labels` | Kubernetes object labels to attach to the serviceMonitor object. | "" |
@@ -441,6 +444,7 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.minReadySeconds` | Specifies the minimum number of seconds for which a newly created Pod should be ready without any of its containers crashing, for it to be considered available. [docs](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#min-ready-seconds) | 0 |
 |`controller.autoscaling.enabled` | Enables HorizontalPodAutoscaling. | false |
 |`controller.autoscaling.annotations` | The annotations of the Ingress Controller HorizontalPodAutoscaler. | {} |
+|`controller.autoscaling.behavior` | Behavior configuration for the HPA. | {} |
 |`controller.autoscaling.minReplicas` | Minimum number of replicas for the HPA. | 1 |
 |`controller.autoscaling.maxReplicas` | Maximum number of replicas for the HPA. | 3 |
 |`controller.autoscaling.targetCPUUtilizationPercentage` | The target CPU utilization percentage. | 50 |
@@ -451,7 +455,10 @@ The following tables lists the configurable parameters of the NGINX Ingress Cont
 |`controller.podDisruptionBudget.maxUnavailable` | The number of Ingress Controller pods that can be unavailable. This is a mutually exclusive setting with "minAvailable". | 0 |
 |`controller.strategy` | Specifies the strategy used to replace old Pods with new ones. Docs for [Deployment update strategy](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy) and [Daemonset update strategy](https://kubernetes.io/docs/tasks/manage-daemon/update-daemon-set/#daemonset-update-strategy) | {} |
 |`controller.disableIPV6` | Disable IPV6 listeners explicitly for nodes that do not support the IPV6 stack. | false |
+|`controller.defaultHTTPListenerPort`  | Sets the port for the HTTP `default_server` listener. | 80 |
+|`controller.defaultHTTPSListenerPort`  | Sets the port for the HTTPS `default_server` listener. | 443 |
 |`controller.readOnlyRootFilesystem` | Configure root filesystem as read-only and add volumes for temporary data. | false |
+|`controller.enableSSLDynamicReload` | Enable lazy loading for SSL Certificates. | true |
 |`rbac.create` | Configures RBAC. | true |
 |`prometheus.create` | Expose NGINX or NGINX Plus metrics in the Prometheus format. | true |
 |`prometheus.port` | Configures the port to scrape the metrics. | 9113 |