search

OWASP / wrongsecrets

Vulnerable app with examples showing how to not use secrets
https://owasp.org/www-project-wrongsecrets/
GNU Affero General Public License v3.0
1.24k stars 365 forks source link

chore(deps): update dependency kubernetes-sigs/aws-alb-ingress-controller to v2.10.0 #1755

Closed renovate[bot] closed 2 weeks ago

renovate[bot] commented 2 weeks ago

This PR contains the following updates:

Package Update Change
kubernetes-sigs/aws-alb-ingress-controller minor v2.7.1 -> v2.10.0

Release Notes

kubernetes-sigs/aws-alb-ingress-controller (kubernetes-sigs/aws-alb-ingress-controller) ### [`v2.10.0`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.10.0) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.9.2...v2.10.0) #### v2.10.0 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.10/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.10.0 Thanks to all our contributors! #### Action required 🚨 🚨 🚨 We’ve added the multiClusterTargetGroup field to the TargetGroupBinding which users can set in order to share target groups among different Kubernetes clusters. Make sure to update the CRD definition in your cluster. If you're upgrading the charts using helm upgrade, you need to update CRDs manually: `kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"` ELB has updated their managed policy to include `ec2:GetSecurityGroupsForVpc`. We have updated the Load Balancer Controller policy to reflect that change. Please be sure to apply the latest IAM policy when upgrading. #### What’s new - AWS Load Balancer Controller now supports MultiCluster target groups. This mode allows users to share target groups among multiple clusters, enabling a wide variety of use cases. For more information checkout the use case [documentation](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/tree/main/docs/guide/use_cases/multi_cluster) - We’ve added support SageMaker HyperPod clusters. Users can now install the Load Balancer Controller into SageMaker HyperPod clusters in order to get integration with AWS ELB. - We’ve added integration with a new ELB feature that allows configuring sourceNAT for Dualstack NLBs to allow UDP traffic over IPv6. #### Enhancement and Fixes - Update shield integration to use in-region endpoint rather then always using us-east-1. - (docs) Fix TLS Ingress annotation documentation for Security policy - (docs) Fix configuration documentation typos - (docs) Fix external-dns routing policies link - Add new ec2:GetSecurityGroupsForVpc permission to LBC policy. #### Changelog since v2.9.2 - UDP Support over IPv6 via Dualstack NLBs using SourceNAT configurations ([#​3926](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3926)) - Refactor aws cloud service and introduce a client provider ([#​3895](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3895)) - New Feature: Multi Cluster TargetGroupBinding ([#​3853](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3853)) - add sagemaker-hyperpod compute type to resolve its pods via VPC ENI ([#​3886](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3886)) - Fixed documentation typos [(#​3885](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3885)) - Fix alphabetic order in CRD for verify CRD to run ([#​3911](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3911)) - chore(docs): fix external-dns routing policies link ([#​3893](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3893)) - fix(docs): Update the link to the AWS documentation for the TLS Ingress annotation for Security policy ([#​3876](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3876)) - update the region of shield api ([#​3920](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3920)) - add ec2:GetSecurityGroupsForVpc to account for ELB API changes ([#​3921](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3921)) - BUG FIX: fix log message when target group and cluster are in different VPCs ([#​3924](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3924)) ### [`v2.9.2`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.9.2) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.9.1...v2.9.2) #### v2.9.2 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.9/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.9.2 Thanks to all our contributors! 😊 #### Action required N/A #### What’s New N/A #### Enhancement and Fixes - Fixes the controller crash due to enabling shield protection on ingress while creation - Skips newly added listener attributes reconcile for iso regions. #### ChangeLog since v2.9.0 - Skip listener attributes reconcile for Isolated regions ([#​3884](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3884), [@​wweiwei-li](https://redirect.github.com/wweiwei-li)) - Fix controller crash due enabling shield protection after AWSSDKGoV2 upgrade ([#​3896](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3896), [@​shraddhabang](https://redirect.github.com/shraddhabang)) ### [`v2.9.1`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.9.1) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.9.0...v2.9.1) #### v2.9.1 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.9/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.9.1 Thanks to all our contributors! 😊 #### Action required 🚨 🚨 🚨 The v2.9.1 contains a bug which will crash controllers with the account subscribed to AWS shield advanced service as described in [https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/3888](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/issues/3888), please upgrade to v2.9.2+ for the bug fix if your account has subscribed to AWS shield and your controller has shield service enabled. #### What’s New - AWS Load Balancer Controller now implements a deferral queue for TargetGroupBindings that change rarely. This means that during leadership failover, the controller will immediately work on target groups that have had their membership change. Previously, the controller would try to reconcile all target groups which could delay potential changes if the cluster had many TargetGroupBindings. This new deferral queue will detect TargetGroupBindings without any change and choose to reconcile them at a slower pace in the future, prioritizing TargetGroupBindings that have changed since the last reconcile cycle. #### Enhancement and Fixes - Slow start containers should be more responsive to pod readiness checks. Previously, the controller could back-off for up to 16 minutes for checking the container readiness state. Now the controller will use a static 15 second delay to continually ensure your containers have started. - Implement a deferral queue to sideline TargetGroupBindings without a recent change. #### ChangeLog since v2.9.0 - Feature: Deferred queue for no-op TGB ([https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3861](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3861)) ### [`v2.9.0`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.9.0) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.8.3...v2.9.0) #### v2.9.0 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.9/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.9.0 Thanks to all our contributors! 😊 #### Action required 🚨 🚨 🚨 The v2.9.0 contains a bug which will crash controllers with the account subscribed to AWS shield advanced service as described in [#​3888](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/issues/3888), please upgrade to v2.9.2+ for the bug fix if your account has subscribed to AWS shield and your controller has shield service enabled. We've added a `listenerAttributes` field to `IngressClassParams` to support listener attributes for load balancers in the future. Note that there are no listener attributes supported on Application Load Balancers (ALBs) yet. Therefore, this field is currently not used. However, updating CRDs is necessary for future compatibility. If you're upgrading the charts using helm upgrade, you need to update CRDs manually: `kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"` AWS NLB now supports configurable [TCP idle timeout](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/update-idle-timeout.html). We've updated the [reference IAM policies](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json) to explicitly add the `elasticloadbalancing:DescribeListenerAttributes` and `elasticloadbalancing:ModifyListenerAttributes` permissions for describing and modifying this listener attribute for NLB's TCP listener resources on controller. #### What's new - AWS Load Balancer Controller now uses the new AWS SDK Go v2 version. The v2 SDK is designed to make API calls more efficiently, leading to improved performance in your applications. It comes with built-in retry mechanisms which will help us retrying the requests less aggressively. It also includes a variety of built-in backoff strategies, such as exponential backoff. These strategies help to avoid overwhelming the AWS service and give it time to recover from temporary errors. - Supports listener attributes on load balancers. - AWS Network Load Balancer (NLB) now supports configurable TCP idle timeout. This allows you to align the TCP idle timeout value of NLB with clients and target applications. This capability can help reduce TCP connection retries and latency in applications that use long-lived flows, such as telemetry reporting devices, databases, streaming services, and ERP systems. - Support for allowing multiple security groups with the same Name tag to be resolved for load balancers. The old implementation incorrectly assumed a one-to-one mapping between security group names. This fix allows multiple security groups with the same name to be resolved and attached to load balancers, providing flexible configurations and avoiding errors. - Support for identifying VPC by tags using a new runtime argument. This is helpful when access to AWS metadata is blocked and the VPC ID is unknown at deploy time. #### Enhancement and Fixes - (Chart): Allow disabling ingress validation via helm flag - Migrate AWS SDK GO V1 to V2. - Support vpc- in target group binding vpc-id validation - Set klog logger to harmonize logging format #### Changelog since v2.8.3 - Use the documented .Capabilities.KubeVersion.Version built-in value in the hpa template ([#​3766](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3766), [@​prasadkatti](https://redirect.github.com/prasadkatti)) - Migrate aws sdk go v1 to v2 ([#​3844](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3844), [@​shraddhabang](https://redirect.github.com/shraddhabang)) - Support listener attributes ([#​3843, @​](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/issues/3843), [@​wweiwei-li](https://redirect.github.com/wweiwei-li)) - feat: support vpc- in target group binding vpc-id validation ([#​3845](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3845), [@​khizunov](https://redirect.github.com/khizunov)) - Allow disabling ingress validation via helm flag ([#​3847](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3847), [@​sarevalo2002](https://redirect.github.com/sarevalo2002)) - fix: Set klog logger to harmonize logging format ([#​3833](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3833), [@​mycrEEpy](https://redirect.github.com/mycrEEpy)) - Doc: Fix markdown table ([#​3832](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3832), [@​linoleparquet](https://redirect.github.com/linoleparquet)) - \[Doc] Update cert-manager GitHub URL ([#​3842](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3842), [@​capytan](https://redirect.github.com/capytan)) - bump up base image version ([#​3854](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3854), [@​oliviassss](https://redirect.github.com/oliviassss)) - update mkdocs dependencies ([#​3803](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3803), [@​M00nF1sh](https://redirect.github.com/M00nF1sh)) - Allow multiple SGs with the same Name tag([#​3775](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3775), [@​alloveras](https://redirect.github.com/alloveras)) - Fetch VPC ID from runtime using VPC tags provided via controller flags ([#​3656](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3656), [@​jeswinkoshyninan](https://redirect.github.com/jeswinkoshyninan)) **Full Changelog**: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v2.8.3...v2.9.0 ### [`v2.8.3`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.8.3) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.8.2...v2.8.3) #### v2.8.3 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.3 Thanks to all our contributors! 😊 #### What's new Patch CVE `CVE-2024-39689` of `ca-certificates` introduced by base image. #### What's Changed - cherry-pick: bump up base image version ([#​3854](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/issues/3854)) by [@​oliviassss](https://redirect.github.com/oliviassss) in [https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3855](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3855) - cut v2.8.3 release by [@​oliviassss](https://redirect.github.com/oliviassss) in [https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3856](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3856) **Full Changelog**: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v2.8.2...v2.8.3 ### [`v2.8.2`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.8.2) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.8.1...v2.8.2) #### v2.8.2 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.2 Thanks to all our contributors! 😊 #### What's new #### Enhancements - We have changed the behavior for Application LoadBalancer Addons related annotations(WAFClassic,WAFv2,Shield Advanced) as follows: - `alb.ingress.kubernetes.io/waf-acl-id` - \[**new behavior**] when this annotation is absent, existing WAFClassic WebACL(if any) on Application LoadBalancer won't be changed. - \[**new behavior**] when this annotation is set to 'none', existing WAFClassic WebACL(if any) on Application LoadBalancer will be disassociated. - \[unchanged behavior] when this annotation is set to any webACL ID, specified WAFClassic WebACL will be associated on Application LoadBalancer. - `alb.ingress.kubernetes.io/wafv2-acl-arn` - \[**new behavior**] when this annotation is absent, existing WAFv2 WebACL(if any) on Application LoadBalancer won't be changed. - \[**new behavior**] when this annotation is set to 'none', existing WAFv2 WebACL(if any) on Application LoadBalancer will be disassociated. - \[unchanged behavior] when this annotation is set to any webACL ID, specified WAFv2 WebACL will be associated on Application LoadBalancer. - `alb.ingress.kubernetes.io/shield-advanced-protection` - \[**new behavior**] when this annotation is absent, existing shield advanced protection(if any) on Application LoadBalancer won't be changed. - \[unchanged behavior] when this annotation is set to 'false', existing shield advanced protection(if name matches `managed by aws-load-balancer-controller`) on Application LoadBalancer will be disassociated. - \[unchanged behavior] when this annotation is set to 'true', an new shield advanced protection with name(`managed by aws-load-balancer-controller`) will be created and associated with Application LoadBalancer. #### Changelog since v2.8.1 #### What's Changed - bump up go to 1.22.5 by [@​oliviassss](https://redirect.github.com/oliviassss) in [https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3798](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3798) - keep LB addons' settings unchanged unless explicitly specified by [@​M00nF1sh](https://redirect.github.com/M00nF1sh) in [https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3800](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3800) - cut v2.8.2 release by [@​M00nF1sh](https://redirect.github.com/M00nF1sh) in [https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3802](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3802) **Full Changelog**: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v2.8.1...v2.8.2 ### [`v2.8.1`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.8.1) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.8.0...v2.8.1) #### v2.8.1 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.1 Thanks to all our contributors! 😊 #### What's new Dependencies Upgrade: - `controller-runtime` from 0.14.6 to v0.18.2 - `k8s.io` deps from v0.26.x to v0.30.0 #### Bug fixes - Fix the incompatibility with sidecar `restartPolicy` field for k8s 1.29+ - Fix the bug with mTLS feature, by having the controller return nil for `MutualAuthentication` if the feature is not enabled by cx explicitly. As this object is not supported by ELB API in outposts and local zones currently. - Restrict the `resolveViaVPCENIs()` to fargate nodes only #### Enhancement - helm chart enhancement: add `envFrom` parameter; add `creator` parameter to disable default helm labels - doc enhancement #### Changelog since v2.8.0 #### What's Changed - cut v2.8.1 release by [@​oliviassss](https://redirect.github.com/oliviassss) in [https://github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3733](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3733) - fixed the mTLS bug ([#​3717](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3717), [@​shethyogita83](https://redirect.github.com/shethyogita83)) - update the traffic test for ingress ([#​3725](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3725), [@​oliviassss](https://redirect.github.com/oliviassss)) - prevent controller runtime complaining about SetupLogger() was never called ([#​3724](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3724), [@​oliviassss](https://redirect.github.com/oliviassss)) - Update go to v1.22, controller-runtime dependency to v0.18.2, and kubernetes libs to v0.30.0([#​3707](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3707), [@​larntz](https://redirect.github.com/larntz)) - restrict resolveViaVPCENIs to fargate only ([#​3709](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3709), [@​oliviassss](https://redirect.github.com/oliviassss)) - Added helm envFrom value parameter for cluster-name ([#​3683](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3683), [@​omerap12](https://redirect.github.com/omerap12)) - feat: disable default helm labels ([#​3574](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3574), [@​darkweaver87](https://redirect.github.com/darkweaver87)) - Removed extra slash to fix kubectl apply of crd command ([#​3638](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3638), [@​hyperbolic2346](https://redirect.github.com/hyperbolic2346)) **Full Changelog**: https://github.com/kubernetes-sigs/aws-load-balancer-controller/compare/v2.8.0...v2.8.1 ### [`v2.8.0`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.8.0) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.7.2...v2.8.0) #### v2.8.0 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.8.0 Thanks to all our contributors! 😊 #### Action required We have added `certificateArn` and updated `ipAddressType` fields in IngressClassParams, and added `vpcID` field in TargetGroupBinding. If you are upgrading the charts using helm upgrade, you need to update CRDs manually `kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"` ALB mTLS is now available in the China partition. We've updated the [reference IAM policies](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy_cn.json) to explicitly add the `elasticloadbalancing:DescribeTrustStores` permission for describing the trust stores resources to use the new mTLS feature for ingresses on controller. If you want to use the ALB mTLS feature in China region, updating your controller IAM policies with the new permissions. #### Whats new - Support set the `certificateArn` for Ingress at the IngressClass level. This feature adds new `certificateArn` to the IngressClassParams Spec to configure the ARN of the certificates for all Ingresses that belong to IngressClass with this IngressClassParams. - Support public IPv4 disablement for dualstack customer. This feature adds new ipAddressType enum `dualstack-without-public-ipv4` to allow customers to provision load balancers without IPv4s for clients that can connect using just IPv6s. For example, users can choose a dualstack ALB without public IPv4 when setting up a new internet facing ALB, or switch to dualstack without public IPv4 for an existing internet facing ALB by specifying `alb.ingress.kubernetes.io/ip-address-type: dualstack-without-public-ipv4` . To set the `ipAddressType` for ingress at the IngressClass level, add `ipAddressType: dualstack-without-public-ipv4` to the IngressClassParams Spec. See [AWS Launch What’s New Post](https://aws.amazon.com/about-aws/whats-new/2024/05/application-load-balancer-ipv6-internet-clients/) about this feature. - Support optionally enforcing NLB security groups on PrivateLink traffic. This feature adds new annotation `aws-load-balancer-inbound-sg-rules-on-private-link-traffic` to configure whether to apply security group rules to traffic sent to the load balancer through AWS PrivateLink. - Support for TargetGroupBinding on targets outside the cluster's VPC. This feature adds `vpcID` to the TargetGroupBinding Spec to allow registration in target groups that are created with in a VPC that is different from the cluster VPC. If the `vpcID` is unspecified, the controller will fetch the cluster `vpcID` by default. - Support for Specify Managed Prefix List for access control. This feature adds new annotation `alb.ingress.kubernetes.io/security-group-prefix-lists` and `service.beta.kubernetes.io/aws-load-balancer-security-group-prefix-lists` to ensure the security group attached to the load balancer can allow access from the specified Managed Prefix List. The annotation will be ignored if `alb.ingress.kubernetes.io/security-groups` or `service.beta.kubernetes.io/aws-load-balancer-security-groups` is present. #### Enhancement and Fixes - (Chart): Add additional service monitor functionality - (Chart): Allow passing template values for clusterName, region and vpcId - (Chart): Add RuntimeClassName - (Chart) Support —load-balancer-class in Helm Chart - Provide more customization options for the service mutator webhook - Preserve loadBalancerClass on Service updates #### Changelog since v2.7.2 - Restrict dual-stack-without-ipv4 e2e test to pdx only ([#​3700](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3700), [@​oliviassss](https://redirect.github.com/oliviassss)) - Add IPAddressTypeWithoutPublicIPV4 ([#​3693](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3693), [@​wweiwei-li](https://redirect.github.com/wweiwei-li)) - Add dual stack without public IPv4 IP Address type ([#​3688](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3688), [@​wweiwei-li](https://redirect.github.com/wweiwei-li)) - Add non-alphanumeric input validation test for vpcID and fix typo ([#​3687](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3687), [@​shraddhabang](https://redirect.github.com/shraddhabang)) - \[DOC] add KAT documentation ([#​3682](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3682), [@​ChuksGrinage](https://redirect.github.com/ChuksGrinage)) - feat(chart): Added additional service monitor functionality ([#​3645](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3645), [@​stevehipwell](https://redirect.github.com/stevehipwell)) - \[helm chart] Allow passing template values for clusterName, region and vpcId ([#​3664](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3664), [@​adriananeci](https://redirect.github.com/adriananeci)) - Add validation for vpcID in tgb spec ([#​3663](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3663), [@​shraddhabang](https://redirect.github.com/shraddhabang)) - feat(chart) : add RuntimeClassName ([#​3646](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3646), [@​LiuQhahah](https://redirect.github.com/LiuQhahah)) - upgrade x/net to v0.23.0 ([#​3659](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3659), [@​oliviassss](https://redirect.github.com/oliviassss)) - feat: Specify Managed Prefix List for access control ([#​3584](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3584), [@​yo-ga](https://redirect.github.com/yo-ga)) - Provide more customization options for the service mutator webhook ([#​3653](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3653), [@​diversario](https://redirect.github.com/diversario)) - Add DescribeTrustStores to IAM policy for China partition ([#​3662](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3662), [@​andreybutenko](https://redirect.github.com/andreybutenko)) - Feature Support —load-balancer-class in Helm Chart ([#​3647](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3647), [@​YoonHyunWoo](https://redirect.github.com/YoonHyunWoo)) - Preserve loadBalancerClass on Service updates ([#​3641](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3641), [@​diversario](https://redirect.github.com/diversario)) - Add support for optionally enforcing NLB security groups on PrivateLi… ([#​3594](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3594), [@​wweiwei-li](https://redirect.github.com/wweiwei-li)) - Add certificateArn field to IngressClassParam([#​3616](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3616), [@​Nezz7](https://redirect.github.com/Nezz7)) - feat: Support TargetGroupBinding on targets outside the cluster's VPC ([#​3479](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3479), [@​ikosenn](https://redirect.github.com/ikosenn)) - docs: ingress subnets annotation - clarify locale differences ([#​3579](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3579), [@​alebedev87](https://redirect.github.com/alebedev87)) ### [`v2.7.2`](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v2.7.2) [Compare Source](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/compare/v2.7.1...v2.7.2) #### v2.7.2 (requires Kubernetes 1.22+) #### [Documentation](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.5/) Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.7.2 Thanks to all our contributors! 😊 #### Enhancement and Fixes - Feat : Allow ACM cert discovery to filter on CA ARNs - Enhancement : Adding support for Availability Zone Affinity - CVE patch for [CVE-2024-24786](https://nvd.nist.gov/vuln/detail/CVE-2024-24786) - Doc updates #### Changelog since v2.7.1 - Update [golang.org/protobuf](http://golang.org/protobuf) version to fix CVE-2024-24786 ([#​3618](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3618), [@​shraddhabang](https://redirect.github.com/shraddhabang)) - Adding support for Availability Zone Affinity ([#​3470](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3470), [@​alex-berger](https://redirect.github.com/alex-berger)) - update go version to mitigate CVE ([#​3615](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3615), [@​haouc](https://redirect.github.com/haouc)) - Repo controlled build go version ([#​3598](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3598), [@​xdu31](https://redirect.github.com/xdu31)) - fix: new ca-filter causing expontentially more api-calls ([#​3608](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3608), [@​the-technat](https://redirect.github.com/the-technat)) - Add example for NLB target-group-attributes to enable unhealthy target connection draining ([#​3577](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3577), [@​jukie](https://redirect.github.com/jukie)) - feat: allowed ACM cert discovery to filter on CA ARNs ([#​3565](https://redirect.github.com/kubernetes-sigs/aws-alb-ingress-controller/issues/3565)) ([#​3591](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3591), [@​the-technat](https://redirect.github.com/the-technat)) - bump up controller-tools version to fix ci failure ([#​3580](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3580), [@​oliviassss](https://redirect.github.com/oliviassss)) - fix log level in listener manager and tagging manager ([#​3573](https://redirect.github.com/kubernetes-sigs/aws-load-balancer-controller/pull/3573), [@​oliviassss](https://redirect.github.com/oliviassss))

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

â™» Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.