Skip to content

chore(deps): update dependency kubernetes-sigs/aws-alb-ingress-controller to v2.10.0 #767

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 21, 2024
Merged

chore(deps): update dependency kubernetes-sigs/aws-alb-ingress-controller to v2.10.0 #767

merged 1 commit into from
Nov 21, 2024

Conversation

@renovate
Copy link

@renovate renovate bot commented Nov 21, 2024

This PR contains the following updates:

Package Update Change
kubernetes-sigs/aws-alb-ingress-controller minor v2.7.1 -> v2.10.0

Release Notes

kubernetes-sigs/aws-alb-ingress-controller (kubernetes-sigs/aws-alb-ingress-controller)

v2.10.0

Compare Source

v2.10.0 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.10.0
Thanks to all our contributors!

Action required

🚨 🚨 🚨 We’ve added the multiClusterTargetGroup field to the TargetGroupBinding which users can set in order to share target groups among different Kubernetes clusters. Make sure to update the CRD definition in your cluster. If you're upgrading the charts using helm upgrade, you need to update CRDs manually: kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

ELB has updated their managed policy to include ec2:GetSecurityGroupsForVpc. We have updated the Load Balancer Controller policy to reflect that change. Please be sure to apply the latest IAM policy when upgrading.

What’s new

  • AWS Load Balancer Controller now supports MultiCluster target groups. This mode allows users to share target groups among multiple clusters, enabling a wide variety of use cases. For more information checkout the use case documentation
  • We’ve added support SageMaker HyperPod clusters. Users can now install the Load Balancer Controller into SageMaker HyperPod clusters in order to get integration with AWS ELB.
  • We’ve added integration with a new ELB feature that allows configuring sourceNAT for Dualstack NLBs to allow UDP traffic over IPv6.

Enhancement and Fixes

  • Update shield integration to use in-region endpoint rather then always using us-east-1.
  • (docs) Fix TLS Ingress annotation documentation for Security policy
  • (docs) Fix configuration documentation typos
  • (docs) Fix external-dns routing policies link
  • Add new ec2:GetSecurityGroupsForVpc permission to LBC policy.

Changelog since v2.9.2

  • UDP Support over IPv6 via Dualstack NLBs using SourceNAT configurations (#​3926)
  • Refactor aws cloud service and introduce a client provider (#​3895)
  • New Feature: Multi Cluster TargetGroupBinding (#​3853)
  • add sagemaker-hyperpod compute type to resolve its pods via VPC ENI (#​3886)
  • Fixed documentation typos (#​3885)
  • Fix alphabetic order in CRD for verify CRD to run (#​3911)
  • chore(docs): fix external-dns routing policies link (#​3893)
  • fix(docs): Update the link to the AWS documentation for the TLS Ingress annotation for Security policy (#​3876)
  • update the region of shield api (#​3920)
  • add ec2:GetSecurityGroupsForVpc to account for ELB API changes (#​3921)
  • BUG FIX: fix log message when target group and cluster are in different VPCs (#​3924)

v2.9.2

Compare Source

v2.9.2 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.9.2
Thanks to all our contributors! 😊

Action required

N/A

What’s New

N/A

Enhancement and Fixes

  • Fixes the controller crash due to enabling shield protection on ingress while creation
  • Skips newly added listener attributes reconcile for iso regions.

ChangeLog since v2.9.0

v2.9.1

Compare Source

v2.9.1 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.9.1
Thanks to all our contributors! 😊

Action required

🚨 🚨 🚨 The v2.9.1 contains a bug which will crash controllers with the account subscribed to AWS shield advanced service as described in https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/3888, please upgrade to v2.9.2+ for the bug fix if your account has subscribed to AWS shield and your controller has shield service enabled.

What’s New

  • AWS Load Balancer Controller now implements a deferral queue for TargetGroupBindings that change rarely. This means that during leadership failover, the controller will immediately work on target groups that have had their membership change. Previously, the controller would try to reconcile all target groups which could delay potential changes if the cluster had many TargetGroupBindings. This new deferral queue will detect TargetGroupBindings without any change and choose to reconcile them at a slower pace in the future, prioritizing TargetGroupBindings that have changed since the last reconcile cycle.

Enhancement and Fixes

  • Slow start containers should be more responsive to pod readiness checks. Previously, the controller could back-off for up to 16 minutes for checking the container readiness state. Now the controller will use a static 15 second delay to continually ensure your containers have started.
  • Implement a deferral queue to sideline TargetGroupBindings without a recent change.

ChangeLog since v2.9.0

v2.9.0

Compare Source

v2.9.0 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.9.0
Thanks to all our contributors! 😊

Action required

🚨 🚨 🚨 The v2.9.0 contains a bug which will crash controllers with the account subscribed to AWS shield advanced service as described in #​3888, please upgrade to v2.9.2+ for the bug fix if your account has subscribed to AWS shield and your controller has shield service enabled.
We've added a listenerAttributes field to IngressClassParams to support listener attributes for load balancers in the future. Note that there are no listener attributes supported on Application Load Balancers (ALBs) yet. Therefore, this field is currently not used. However, updating CRDs is necessary for future compatibility. If you're upgrading the charts using helm upgrade, you need to update CRDs manually: kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

AWS NLB now supports configurable TCP idle timeout. We've updated the reference IAM policies to explicitly add the elasticloadbalancing:DescribeListenerAttributes and elasticloadbalancing:ModifyListenerAttributes permissions for describing and modifying this listener attribute for NLB's TCP listener resources on controller.

What's new

  • AWS Load Balancer Controller now uses the new AWS SDK Go v2 version. The v2 SDK is designed to make API calls more efficiently, leading to improved performance in your applications. It comes with built-in retry mechanisms which will help us retrying the requests less aggressively. It also includes a variety of built-in backoff strategies, such as exponential backoff. These strategies help to avoid overwhelming the AWS service and give it time to recover from temporary errors.
  • Supports listener attributes on load balancers.
    • AWS Network Load Balancer (NLB) now supports configurable TCP idle timeout. This allows you to align the TCP idle timeout value of NLB with clients and target applications. This capability can help reduce TCP connection retries and latency in applications that use long-lived flows, such as telemetry reporting devices, databases, streaming services, and ERP systems.
  • Support for allowing multiple security groups with the same Name tag to be resolved for load balancers. The old implementation incorrectly assumed a one-to-one mapping between security group names. This fix allows multiple security groups with the same name to be resolved and attached to load balancers, providing flexible configurations and avoiding errors.
  • Support for identifying VPC by tags using a new runtime argument. This is helpful when access to AWS metadata is blocked and the VPC ID is unknown at deploy time.

Enhancement and Fixes

  • (Chart): Allow disabling ingress validation via helm flag
  • Migrate AWS SDK GO V1 to V2.
  • Support vpc- in target group binding vpc-id validation
  • Set klog logger to harmonize logging format

Changelog since v2.8.3

Full Changelog: kubernetes-sigs/aws-load-balancer-controller@v2.8.3...v2.9.0

v2.8.3

Compare Source

v2.8.3 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.3
Thanks to all our contributors! 😊

What's new

Patch CVE CVE-2024-39689 of ca-certificates introduced by base image.

What's Changed

Full Changelog: kubernetes-sigs/aws-load-balancer-controller@v2.8.2...v2.8.3

v2.8.2

Compare Source

v2.8.2 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.2
Thanks to all our contributors! 😊

What's new

Enhancements

  • We have changed the behavior for Application LoadBalancer Addons related annotations(WAFClassic,WAFv2,Shield Advanced) as follows:
    • alb.ingress.kubernetes.io/waf-acl-id
      • [new behavior] when this annotation is absent, existing WAFClassic WebACL(if any) on Application LoadBalancer won't be changed.
      • [new behavior] when this annotation is set to 'none', existing WAFClassic WebACL(if any) on Application LoadBalancer will be disassociated.
      • [unchanged behavior] when this annotation is set to any webACL ID, specified WAFClassic WebACL will be associated on Application LoadBalancer.
    • alb.ingress.kubernetes.io/wafv2-acl-arn
      • [new behavior] when this annotation is absent, existing WAFv2 WebACL(if any) on Application LoadBalancer won't be changed.
      • [new behavior] when this annotation is set to 'none', existing WAFv2 WebACL(if any) on Application LoadBalancer will be disassociated.
      • [unchanged behavior] when this annotation is set to any webACL ID, specified WAFv2 WebACL will be associated on Application LoadBalancer.
    • alb.ingress.kubernetes.io/shield-advanced-protection
      • [new behavior] when this annotation is absent, existing shield advanced protection(if any) on Application LoadBalancer won't be changed.
      • [unchanged behavior] when this annotation is set to 'false', existing shield advanced protection(if name matches managed by aws-load-balancer-controller) on Application LoadBalancer will be disassociated.
      • [unchanged behavior] when this annotation is set to 'true', an new shield advanced protection with name(managed by aws-load-balancer-controller) will be created and associated with Application LoadBalancer.

Changelog since v2.8.1

What's Changed

Full Changelog: kubernetes-sigs/aws-load-balancer-controller@v2.8.1...v2.8.2

v2.8.1

Compare Source

v2.8.1 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.1
Thanks to all our contributors! 😊

What's new

Dependencies Upgrade:

  • controller-runtime from 0.14.6 to v0.18.2
  • k8s.io deps from v0.26.x to v0.30.0

Bug fixes

  • Fix the incompatibility with sidecar restartPolicy field for k8s 1.29+
  • Fix the bug with mTLS feature, by having the controller return nil for MutualAuthentication if the feature is not enabled by cx explicitly. As this object is not supported by ELB API in outposts and local zones currently.
  • Restrict the resolveViaVPCENIs() to fargate nodes only

Enhancement

  • helm chart enhancement: add envFrom parameter; add creator parameter to disable default helm labels
  • doc enhancement

Changelog since v2.8.0

What's Changed

Full Changelog: kubernetes-sigs/aws-load-balancer-controller@v2.8.0...v2.8.1

v2.8.0

Compare Source

v2.8.0 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.0
Thanks to all our contributors! 😊

Action required

We have added certificateArn and updated ipAddressType fields in IngressClassParams, and added vpcID field in TargetGroupBinding. If you are upgrading the charts using helm upgrade, you need to update CRDs manually kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

ALB mTLS is now available in the China partition. We've updated the reference IAM policies to explicitly add the elasticloadbalancing:DescribeTrustStores permission for describing the trust stores resources to use the new mTLS feature for ingresses on controller. If you want to use the ALB mTLS feature in China region, updating your controller IAM policies with the new permissions.

Whats new

  • Support set the certificateArn for Ingress at the IngressClass level. This feature adds new certificateArn to the IngressClassParams Spec to configure the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams.
  • Support public IPv4 disablement for dualstack customer. This feature adds new ipAddressType enum dualstack-without-public-ipv4 to allow customers to provision load balancers without IPv4s for clients that can connect using just IPv6s. For example, users can choose a dualstack ALB without public IPv4 when setting up a new internet facing ALB, or switch to dualstack without public IPv4 for an existing internet facing ALB by specifying alb.ingress.kubernetes.io/ip-address-type: dualstack-without-public-ipv4 . To set the ipAddressType for ingress at the IngressClass level, add ipAddressType: dualstack-without-public-ipv4 to the IngressClassParams Spec. See AWS Launch What’s New Post about this feature.
  • Support optionally enforcing NLB security groups on PrivateLink traffic. This feature adds new annotation aws-load-balancer-inbound-sg-rules-on-private-link-traffic to configure whether to apply security group rules to traffic sent to the load balancer through AWS PrivateLink.
  • Support for TargetGroupBinding on targets outside the cluster's VPC. This feature adds vpcID to the TargetGroupBinding Spec to allow registration in target groups that are created with in a VPC that is different from the cluster VPC. If the vpcID is unspecified, the controller will fetch the cluster vpcID by default.
  • Support for Specify Managed Prefix List for access control. This feature adds new annotation alb.ingress.kubernetes.io/security-group-prefix-lists and service.beta.kubernetes.io/aws-load-balancer-security-group-prefix-lists to ensure the security group attached to the load balancer can allow access from the specified Managed Prefix List. The annotation will be ignored if alb.ingress.kubernetes.io/security-groups or service.beta.kubernetes.io/aws-load-balancer-security-groups is present.

Enhancement and Fixes

  • (Chart): Add additional service monitor functionality
  • (Chart): Allow passing template values for clusterName, region and vpcId
  • (Chart): Add RuntimeClassName
  • (Chart) Support —load-balancer-class in Helm Chart
  • Provide more customization options for the service mutator webhook
  • Preserve loadBalancerClass on Service updates

Changelog since v2.7.2

v2.7.2

Compare Source

v2.7.2 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.7.2
Thanks to all our contributors! 😊

Enhancement and Fixes

  • Feat : Allow ACM cert discovery to filter on CA ARNs
  • Enhancement : Adding support for Availability Zone Affinity
  • CVE patch for CVE-2024-24786
  • Doc updates

Changelog since v2.7.1

Configuration

📅 Schedule: Branch creation - "* * 1,15 * *" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies Pull requests that update a dependency file renovate labels Nov 21, 2024
@bendehaan bendehaan merged commit d9231ea into main Nov 21, 2024
8 checks passed
@bendehaan bendehaan deleted the renovate/kubernetes-sigs-aws-alb-ingress-controller-2.x branch November 21, 2024 16:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bendehaan bendehaan bendehaan approved these changes

@commjoen commjoen Awaiting requested review from commjoen commjoen is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bendehaan