v3.4.1

v3.4.1 Release Notes

📚 Quick Links

v3.4.1 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.1

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

IAM Policy Updates

• No IAM policy changes required for this release.

Gateway API updates

• No Gateway API CRD updates required for this release.

🚀 What's New

Ingress Features

• ECDSA/RSA Certificate Auto-Discovery (PR #4490): The controller now supports automatic discovery of both ECDSA and RSA certificates from ACM when building the certificate list for Ingress resources. This enables dual-certificate configurations for optimized TLS performance across different client types.
  Gateway API Features
• Shared Hostname for HTTPRoute and GRPCRoute (PR #4794): HTTPRoute and GRPCRoute resources can now share the same hostname on a Gateway listener. The overlapping hostname restriction between HTTP and gRPC routes has been removed, enabling mixed protocol configurations on the same domain.

🔧 Enhancements and Fixes

• [Bug fix] Filter EndpointSlices by IP family for target group registration — prevents IPv4 addresses from being registered to IPv6 target groups (#4783)
• [Bug fix] Match hosted zones by longest suffix in GetHostedZoneID — fixes DNS validation for deeply nested subdomains and wildcard SANs (#4785)
• [Bug fix] Fix non-transitive rule precedence for routes without hostnames — catch-all routes no longer intermittently sort above host-specific rules (#4809)
• [Bug fix] Fix ICMP Type/Code constants (#4799)
• [Bug fix] Fix render feature gates as parseable key-value pairs (#4757)
• [Enhancement] Add enableCertificateManagement controller flag to Helm chart (#4726)

Documentation Updates

• Correct enableEndpointSlices default value in Helm values comment (#4806)
• Clarify WAF addon ownership and document IngressGroup security risks (#4797)
• Fix stale contributor setup and invalid IAM role ARN examples (#4791)
• Fix doc annotation name (#4787)

🌟 Complete Change Log

• [fix] filter EndpointSlices by IP family for target group registration by @shuqz in #4783
• [fix] doc annotation name by @shuqz in #4787
• refactor ipv6 testing by @zac-nixon in #4788
• add ipv6 annotations to cert generation tests by @zac-nixon in #4790
• Match Route53 hosted zones by longest suffix in GetHostedZoneID by @nbr in #4785
• Fix feature gates string representation by @immanuwell in #4757
• add source nat setting so udp tests pass on ipv6 cluster by @zac-nixon in #4795
• skip service quic tests when using ipv6 by @zac-nixon in #4796
• Clarify WAF addon ownership and document IngressGroup security risks by @wweiwei-li in #4797
• fix: ICMP Type/Code constants by @wweiwei-li in #4799
• docs: fix stale contributor setup and invalid IAM role ARN examples by @immanuwell in #4791
• Auto discovery default certificate and certificate list by @abeowlu in #4490
• [Gateway API]remove overlapping check in httpRoute and GRPCRoute by @shuqz in #4794
• fix(cert_management): add default-pca-arn controller flag to helm chart by @the-technat in #4726
• Fix non-transitive rule precedence for routes without hostnames by @sergeylanzman in #4809
• Fix incorrect enableEndpointSlices default in Helm values.yaml comment by @BobDu in #4806
• cut v3.4.1 release by @shraddhabang in #4813

New Contributors

• @nbr made their first contribution in #4785
• @abeowlu made their first contribution in #4490
• @sergeylanzman made their first contribution in #4809

Full Changelog: v3.4.0...v3.4.1