Container Service for Kubernetes:Nginx Ingress Controller

• The NGINX Alias and Root directives are deleted to reduce the potential risks.
• Some stability issues are fixed.

• The deep inspection feature for Ingresses is added and enabled by default. This feature can prevent you from configuring Ingresses that contain sensitive fields. This feature fixes the CVE-2021-25745 vulnerability.
• Some stability issues are fixed.

• Affinity settings are optimized for scheduling. You can enable auto scaling for all the nodes in a Container Service for Kubernetes (ACK) cluster.
• The vulnerabilities that exist after you enable the Application High Availability Service (AHAS) Sentinel feature are fixed.
• Specific vulnerabilities in base images are fixed.

• The version of the NGINX component is rolled back to V1.19.9, which is the same as the version of open source NGINX. This NGINX version is more stable.
• The following issue is fixed: The NGINX Ingress controller crashes if the cors-allow-origin configuration is invalid.
• The following issue is fixed: The Ingresses that use the same webhook URL conflict with each other when the system checks the webhook URLs of the Ingresses that belong to different IngressClasses.
• The following issue is fixed: InitContainer modifies the kernel parameters of nodes if hostNetwork is set to true.
• The CVE-2022-0778 and CVE-2022-23308 vulnerabilities are patched.

• The AHAS Sentinel plug-in is updated and the Java module is replaced by the C++ module. This greatly improves performance.
• Protocol Buffers (Protobuf) is used to communicate with the Kubernetes API server of a cluster. This improves communication efficiency.

• NGINX Ingress controller V1.X.X supports only ACK clusters that run Kubernetes V1.20.0 and later. For ACK clusters that run earlier Kubernetes versions, you must use NGINX Ingress controller V0.X.X.
• networking v1 Ingresses are used to support ACK clusters that run Kubernetes 1.22 and later.
• You can specify multiple origins in the cors-allow-origin field. Requested resources are fetched based on the specified origins.
• Session affinity can be enabled to define the behavior of canaries. You can also reset to the default behavior of canaries.
• Canaries can be configured even when no host is specified.
• Admission webhooks are accelerated.
• Stability issues are fixed.

For more information, see Ingress-NGINX changelog.

• The allow-snippet-annotations annotation is added to reduce the impact of vulnerability CVE-2021-25742. For more information, see Vulnerability fixed: CVE-2021-25742.
• SSL builtin cache is disabled to prevent potential memory leaks.
• The following vulnerabilities are fixed: CVE-2021-22945, CVE-2021-22946, CVE-2021-3711, and CVE-2021-3712. For more information, see CVE-2021-22945, CVE-2021-22946, CVE-2021-3711, and CVE-2021-3712.
• The AHAS sentinel SDK is updated to V1.9.7.

• The AHAS sentinel plug-in is updated.
  • The performance and stability are improved.
  • Traffic throttling for clusters is supported.
• Vulnerability CVE-2021-36159 is fixed. For more information, see CVE-2021-36159.
• By default, the kernel parameter kernel.core_uses_pid is disabled. This prevents coredump files from occupying excessive disk space.

• By default, validating admission webhooks are enabled. For more information, see How the NGINX Ingress controller works.
• Validity check is performed on the value of the service-weight annotation.
• The performance of persistent connections and short-lived connections is increased by 20% to 50%.
• Online Certificate Status Protocol (OCSP) stapling is supported.
• LuaJIT is updated to V2.1.0.
• NGINX is updated to V1.19.6.
• Alpine Linux is updated to V3.13 for base images.
• CVE vulnerabilities related to OpenSSL are fixed.
• By default, Transport Layer Security (TLS) 1.3 is enabled.
  Note By default, only TLS 1.2 and TLS 1.3 are supported by HTTPS. For more information about how to enable HTTPS to support TLS 1.0 and TLS 1.1, see Which SSL or TLS protocol versions are supported by Ingresses?.
• The Kubernetes version must be 1.16 or later.
• The NGINX Ingress controller is updated based on open source Ingress-NGINX 0.44.0. For more information, see Ingress-NGINX changelog.

• FastCGI Backend is supported.
• By default, the Dynamic SSL Cert Update mode is enabled.
• Traffic mirroring is supported.
• NGINX is updated to V1.17.8 and OpenResty is updated to V1.15.8. The operating system of base images is updated to Alpine Linux.
• Ingress validating admission webhooks are supported.
• The following vulnerabilities are fixed: CVE-2018-16843, CVE-2018-16844, CVE-2019-9511, CVE-2019-9513, and CVE-2019-9516.
• Major updates:
  • The lua-resty-waf, session-cookie-hash, and force-namespace-isolation configurations are deprecated.
  • The data type of x-forwarded-prefix is changed from BOOLEAN to STRING.
  • The the_real_ip field in the log-format parameter will be deprecated in the next version and replaced with the remote_addr field.
• The NGINX Ingress controller is updated based on Ingress-NGINX 0.30.0. For more information about the updates, see Ingress-NGINX changelog.

• The NGINX Ingress controller is updated based on Ingress-NGINX 0.22.0. For more information about the updates, see Ingress-NGINX.
• Blue-green releases and canary releases are supported if you enable dynamic update for NGINX upstream servers.
• By default, dynamic update is enabled for NGINX upstream servers.
• Major updates: Capture groups are used for rewrite-target annotations. For more information, see rewrite-target. For more information about how to smoothly update the NGINX Ingress controller, visit GitHub.

• The default number of NGINX worker processes is limited. This avoids the issue that an excessive number of NGINX processes occupy host resources.
• The port numbers of Services that route traffic to the old application version and the new application version can be different during blue-green releases and canary releases.
• The NGINX configuration verification failure is fixed when no pod is active on the backend servers of the new application version during canary releases.
• The issue that Ingress address endpoints are not updated due to failed connections to the Kubernetes API server is fixed.

• The NGINX Ingress controller is updated based on Ingress-NGINX 0.20.0. For more information about the updates, see Ingress-NGINX.
• NGINX is updated to V1.15.6 and HTTP/2-related vulnerabilities are fixed.
• Regular expressions are supported by the path parameter.
• The default-http-backend Service is removed and custom default backend Services are supported.
• Blacklists based on IP addresses, user agents, and referer headers are supported.
• The default permissions are optimized and the privileged permissions are removed.
• Apache JServ Protocol (AJP) is supported.