Container Service for Kubernetes:Nginx Ingress Controller

December 2025

Updated to community version v1.12.6.

Breaking changes:

• Global rate limiting removed (#11851): The following ConfigMap options are no longer supported: global-rate-limit-memcached-host, global-rate-limit-memcached-port, global-rate-limit-memcached-connect-timeout, global-rate-limit-memcached-max-idle-timeout, global-rate-limit-memcached-pool-size, global-rate-limit-status-code. The following annotations are also removed: global-rate-limit, global-rate-limit-window, global-rate-limit-key, global-rate-limit-ignored-cidrs.

• Third-party Lua plugins removed (#11821): Custom plugins in /etc/nginx/lua/plugins are no longer supported.

• Metric removed (#11795): ingress_upstream_latency_seconds has been removed.

New features:

• Annotation/AuthTLS allows named redirects (#13820).

• . is now allowed in Exact and Prefix path types (#13800).

• NGINX upgraded to OpenResty v1.25.3.2 (#13530).

• Any CORS origin protocol is now allowed (#11153).

• Added the --metrics-per-undefined-host parameter (#11818).

Optimizations:

• Hardened socket creation and validated error code input (#13786).

• Disabled architecture-specific optimizations for mimalloc (#13670).

Bug fixes:

• Fixed nginx_ingress_controller_config_last_reload_successful (#13859).

• Fixed the SSL session ticket path (#13668).

• Fixed ExternalName services with no endpoints (#13429).

• Fixed a DNS resolution issue for ExternalName backends (#12951).

September 2025

Feature updates:

• Added support for Network Load Balancer (NLB).

• Added Pod Disruption Budget configuration.

March 2025

v1.11.5-aliyun.1: Updated to community version v1.11.5 to fix CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, and CVE-2025-24514. See Vulnerability Notice for CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, and CVE-2025-24514 for details.

v1.11.4-aliyun.2: Optimized node scheduling affinity. Pods are no longer scheduled to Lingjun nodes.

February 2025

Updated to community version v1.11.4. Added support for configuring custom topology spread constraints for the component in the console.

August 2024

Updated to community version v1.10.4 to fix CVE-2024-7646. See the security advisory for details.

July 2024

• Added support for connecting to Application Real-Time Monitoring Service (ARMS) using OpenTelemetry. OpenTracing is no longer supported.

• Added the --shutdown-grace-period, --exclude-socket-metrics, and --default-ssl-certificate parameters on the Component Management page.

• Added NLB support for Layer 4 forwarding.

• Fixed CVE-2023-5363, CVE-2023-5678, CVE-2024-25062, and CVE-2024-2511.

• Upgraded NGINX to version 1.25.5, which enforces stricter backend response header validation: responses with duplicate, invalid, or conflicting Content-Length and Transfer-Encoding fields are rejected. See the changeset for details.

October 2023

• Added the --enable-annotation-validation parameter (annotation content validation is enabled by default to mitigate CVE-2023-5044).

• Fixed CVE-2023-44487.

September 2023

• Upgraded Golang to version 1.21.1.

• Changed hostname-based anti-affinity scheduling from preferred to required, enforcing node-level anti-affinity.

• Added support for OpenTelemetry (see the community configuration guide).

• Fixed CVE-2022-48174, CVE-2023-2975, CVE-2023-3446, and CVE-2023-3817.

June 2023

• Upgraded the Alpine image to version 1.18.

• Added the strict-validate-path-type configuration item for strict path validation (disabled by default; see the community ConfigMap configuration instructions).

• Fixed CVE-2023-28322 and CVE-2023-2650.

May 2023

• Upgraded Golang to version 1.20 and the Alpine image to version 1.17.

• Fixed an issue where nginx.ingress.kubernetes.io/canary-weight-total did not take effect.

• Fixed a panic when the ready status was missing in an EndpointSlice.

• Fixed CVE-2023-27536 and CVE-2023-0464.

• Removed the logic that checks for a service name prefix in EndpointSlices.

March 2023

• Added support for IP denylist configuration using nginx.ingress.kubernetes.io/denylist-source-range.

• Added support for the cluster-autoscaler.kubernetes.io/safe-to-evict: "false" annotation to prevent nodes hosting component pods from being scaled in automatically.

• Added support for enabling or disabling logs on the Component Management page.

• Fixed several stability issues and CVE-2023-0286, CVE-2022-4450, and CVE-2023-0215.

February 2023

• Upgraded NGINX to version 1.21.6 and Golang to version 1.19.2.

• Updated the AHAS Sentinel plugin to support the use-mse switch.

• Switched to coordination.k8s.io/leases for leader election.

• Switched from Endpoints to EndpointSlices for endpoint discovery.

• Added multiple Prometheus metrics and deprecated _ingress_upstream_latency_seconds (see ingress-nginx PR #8728).

• Added support for enabling NGINX debug logs for an IP range using debug-connections.

• Fixed CVE-2022-32149, CVE-2022-27664, and CVE-2022-1996.

June 2022

• Removed the alias and root directives from NGINX to reduce security risks.

• Fixed several stability issues.

May 2022

• Added and enabled by default the Ingress object deep inspection feature, which prevents Ingress configurations containing sensitive fields from being applied (fixes CVE-2021-25745).

• Fixed several stability issues.

April 2022

• Optimized scheduling affinity to allow all cluster nodes to be used as auto scaling nodes.

• Fixed security vulnerabilities when the AHAS Sentinel feature was enabled.

• Fixed several base image vulnerabilities.

March 2022

• Downgraded the NGINX version to 1.19.9 to align with the community version and improve stability.

• Fixed an issue where an incorrect cors-allow-origin configuration caused the controller to crash.

• Fixed an issue where a webhook check on Ingress resources outside the same IngressClass caused resource contention for Ingresses with the same path.

• Fixed an issue where the initContainer modified node kernel parameters when hostNetwork was used.

• Fixed CVE-2022-0778 and CVE-2022-23308.

January 2022

• Upgraded the AHAS Sentinel plugin, switching the module from Java to C++ for significant performance improvements.

• Switched to the Protobuf protocol for API Server communication to improve performance.

December 2021

• Switched to networking/v1 Ingress resources to support clusters of v1.22 and later.

• cors-allow-origin now supports multiple values and automatically returns the request origin when a website is accessed.

• Added support for configuring session affinity for canary releases (now the default behavior).

• Added support for canary releases without specifying a host.

• Accelerated Admission Webhook execution.

• Improved stability.

See the community changelog for full details.

October 2021

• Added the allow-snippet-annotations annotation to mitigate CVE-2021-25742 (see Vulnerability Notice for CVE-2021-25742).

• Disabled the SSL built-in cache to resolve a potential memory leak.

• Fixed CVE-2021-22945, CVE-2021-22946, CVE-2021-3711, and CVE-2021-3712.

• Upgraded the AHAS Sentinel SDK to version 1.9.7.

September 2021

• Upgraded the AHAS Sentinel plugin: optimized performance and stability, and added support for cluster-level traffic throttling.

• Fixed CVE-2021-36159.

• Disabled the kernel.core_uses_pid kernel parameter by default to prevent coredumps from consuming excessive disk space.

June 2021

Fixed CVE-2021-23017.

April 2021

Added backward compatibility for the the_real_ip field in log_format, which was used in v0.30 and earlier.

March 2021

• Enabled the Validating Admission Webhook by default (see how it works).

• Added validation for the service-weight annotation value.

• Improved performance for persistent and short-lived connections by 20%–50%.

• Added support for OCSP stapling.

• Upgraded LuaJIT to version 2.1.0, NGINX to version 1.19.6, and the Alpine image to version 3.13.

• Fixed OpenSSL CVEs.

• Enabled TLS 1.3 by default.

• Requires Kubernetes v1.16 or later.

• Synchronized with community version 0.44.0 (see the community changelog).

April 2020

• Added support for FastCGI backends.

• Enabled Dynamic SSL Cert Update mode by default.

• Added support for traffic mirroring configuration.

• Upgraded NGINX to version 1.17.8 and OpenResty to version 1.15.8; updated the base image to Alpine.

• Added support for Ingress Validating Webhook.

• Fixed CVE-2018-16843, CVE-2018-16844, CVE-2019-9511, CVE-2019-9513, and CVE-2019-9516.

• Synchronized with community version 0.30.0 (see the community changelog).

October 2019

Added support for wildcard domain names, allowlists, and redirect configurations when dynamic server updates are enabled.

July 2019

Optimized phased release rules to support Perl regular expression matching.

April 2019

• Synchronized with community version 0.22.0 (see Ingress-Nginx releases).

• Added support for blue-green deployment and phased release when dynamic updates are enabled.

• Enabled the dynamic update feature for NGINX Upstream by default.

January 2019

• Optimized the default NGINX worker process count to prevent excessive processes from consuming host resources.

• Improved blue-green deployments and phased releases to allow different port numbers for old and new service versions.

• Fixed NGINX configuration test failures during phased releases when the new version had no active backend pods.

• Fixed an issue where Ingress address endpoints were not updated due to abnormal API Server connections.

November 2018

• Synchronized with community version 0.20.0 (see the community changelog).

• Upgraded NGINX to version 1.15.6 to fix HTTP/2-related security vulnerabilities.

• Added support for regular expression configuration for paths.

• Removed the default default-http-backend Service; added support for configuring a custom default backend Service.

• Added support for denylist configurations based on IP, User-Agent, and Referer.

• Optimized default runtime permissions by removing privileged permissions.

• Added support for the AJP protocol.