ALB Ingress Controller

Version number

Release date

Changes

Impact

v3.2.1

October 20, 2026

New features:

• Added Gateway API support for displaying the associated ALB instance ID in Gateway.status.addresses.

• Added ALB Gateway API resources to add-on upgrade prechecks.

• Added Gateway API support for configuring listener descriptions, timeout periods, Gzip, TLS security policies, mutual authentication, X-Forwarded-For (XFF), logs, and labels by protocol and port through AlbInstance.spec.listeners.

• Added Gateway API support for configuring request header insertion actions through AlbRule.

• Added Gateway API support for configuring the security group associated with an ALB instance through AlbInstance.

• Added support for configuring a server certificate and a CA certificate for a Gateway HTTPS listener by certificate ID.

• Added support for configuring multiple CA certificates for an HTTPS listener.

Optimizations:

• Added reconciliation hashes for Gateway and AlbServiceExtension. Resources whose configurations have not changed skip repeated reconciliation after the controller restarts.

• Added the ALBReconciled and ALBAppliedHash statuses for viewing reconciliation results and the most recent successfully applied hash.

• Improved reference protection for ALB GatewayClass. A GatewayClass that is still used by a Gateway is protected by a finalizer.

• Enabled XFF by default for newly created Gateway listeners. Existing listeners that do not specify a processing mode retain their cloud-side XFF setting.

• Added detection of mutual authentication switches and CA certificate changes to add-on upgrade prechecks.

Bug fixes:

• Fixed an issue where namespace label changes did not trigger reconciliation of the related Gateway.

• Fixed an issue where the originally associated Gateway was not reconciled again in time after the referenced object of a ReferenceGrant or AlbServerGroup was updated.

• Fixed false precheck reports caused by TCP health checks not ignoring HTTP-specific parameters.

• Fixed false precheck reports caused by non-HTTPS listeners not ignoring QuicConfig.

• Fixed an issue where XForwardedForClientCertSubjectDNAlias was incorrectly set to XForwardedForClientCertIssuerDNAlias.

• Fixed incorrect backend server group reuse caused by server group resource ID conflicts when the same HTTPRoute referenced Services with the same name and port in different namespaces.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v3.1.1

September 3, 2026

Bug fixes:

• Fixed an issue where the ALB OpenAPI incorrectly used public endpoints, which prevented the controller from working properly in non-public Virtual Private Clouds (VPCs) and in some regions.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v3.1.0

August 10, 2026

New features:

• Added Gateway API support for declaratively managing service extensions for ALB Extended Edition through the AlbServiceExtension resource, and for referencing them in forwarding rules or server groups.

• Added Gateway API support for using AlbService to configure Fqdn and IpSegment backends for ALB Extended Edition, and for referencing them in HTTPRoute.

Optimizations:

• Optimized the forwarding rule update logic to prevent invalid updates triggered by inconsistent backend server group return order, which caused prechecks to fail.

• Fixed an issue where health check status codes were not parsed or delivered according to the health check protocol in some scenarios, which caused prechecks to fail.

Bug fixes:

• Fixed an issue where a Service might not trigger reconciliation in time after node changes when externalTrafficPolicy was set to Local.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v3.0.0

July 6, 2026

New features:

• Added support for creating and managing ALB Extended Edition instances through the Gateway API.

• Added support for associating service extension IDs with the forwarding rules of ALB Extended Edition instances through AlbRule.

• Added support for associating service extension IDs with the server groups of ALB Extended Edition instances through AlbServerGroup.

• Added the AlbInstance custom resource definition (CRD). ALB instance configurations, such as address type, availability zones, logging, and bandwidth packages, can be defined through the infrastructure.parametersRef reference of a Gateway resource. Some properties take effect only when the instance is created.

• ALB Standard Edition instances created through the Gateway API have instance managed mode enabled by default. You cannot manually change the listener and forwarding rule configurations of these newly created ALB Standard Edition instances in the ALB console. This restriction applies only to ALB instances created after you upgrade to this version. Existing instances are not affected.

Optimizations:

• Backend persistent connections are enabled by default for server groups created through the Gateway API. Existing server groups are not affected. Before you upgrade, confirm whether this behavior change affects your services.

• The Gateway API uses EndpointSlice instead of Endpoints for endpoint discovery by default.

• Added support for multi-port Services through the Gateway API.

• Added ReadinessGate support through the Gateway API. Only the Terway network plugin supports this feature; the Flannel network plugin does not.

Bug fixes:

• Fixed an issue where the Gateway API did not automatically retry after Service discovery errors.

• Fixed an issue where deletion of a Gateway resource associated with an HTTPRoute was blocked.

• Fixed an issue where a listener was deleted directly after a certificate error. The operation is now blocked and an error is reported when a certificate is abnormal.

• Fixed an issue where the server group was not cleared in time after a Service was deleted in Gateway API scenarios.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v2.20.1

June 8, 2026

Optimizations:

• Increased the wait time and number of retries for asynchronous tasks.

Bug fixes:

• Fixed an issue where clusters running version 1.20 or earlier could not fall back from EndpointSlice to Endpoints for endpoint discovery.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v2.20.0

April 16, 2026

New features:

• Added support in ListenerSpec for the logConfig option accessLogRecordCustomizedHeadersAllowDisable: true, which allows accessLogRecordCustomizedHeadersEnabled to be set to false.

• Added Webhook interception for the deletion of Service and Secret resources that are still used by ALB Ingress.

• Added a Webhook validation that when the path type is Prefix, the path value cannot contain the wildcard *.

Optimizations:

• Optimized controller memory usage.

• Used EndpointSlice instead of Endpoints for endpoint discovery by default.

• Optimized asynchronous task wait times for server group operations.

Bug fixes:

• Fixed an issue where modifying the ALB resource group ID through AlbConfig did not take effect.

• Fixed an issue where an incorrect forwarding configuration could cause the controller to panic when custom forwarding rules were used.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v2.19.1

February 12, 2026

Optimizations:

• Optimized handling of throttled OpenAPI calls by adding automatic retries for some error codes.

• Added support for an empty Tag Value and validation for duplicate Tag Keys.

Bug fixes:

• Fixed an issue where adding ReadinessGate to a Pod was not retried when an Ingress event triggered backend server group creation.

• Fixed an issue where querying the listener status failed after the listener log configuration was updated.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v2.19.0

January 7, 2026

New features:

• Added hot reloading for Secrets specified by defaultCertificate.

• Added support for configuring an Ingress with the following actions simultaneously: rate limiting + fixed response/redirect + forward.

Optimizations:

• Improved the error messages returned when listener creation fails because a certificate has expired.

• Improved controller reconciliation performance.

• Enhanced Webhook validation by adding checks for the following scenarios:

  • The format of the SourceIP field in custom forwarding conditions.

  • AclType field values, specifically whether the value is black or white.

  • An Ingress in which backend specifies only service.name without specifying service.port.

• Added a Webhook check for whether an Ingress is an ALB Ingress.

Bug fixes:

• Fixed an issue where the corresponding labels on an ALB instance could not be cleared when the AlbConfig tags field was completely deleted.

• Fixed an issue where deleting a Service could cause the controller process to panic in extreme scenarios.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v2.18.0-aliyun.1

July 4, 2025

• Enabled instance managed mode by default. This mode prevents manual changes to the listener and forwarding rule configurations in the ALB console for ALB instances that are automatically created through AlbConfig. This restriction applies only to ALB instances created after you upgrade to this version. Existing instances and reused instances are not affected.

• Added support for manually specifying a default certificate through defaultCertificate in AlbConfig.

• Optimized the priority sorting logic for forwarding rules and removed the global uniqueness constraint on order.

• Added support for Elastic Compute Service (ECS) Metadata hardened mode only.

• Fixed an issue where throttling could cause the controller to panic when querying asynchronous task operations.

• Fixed an issue where an access control list (ACL) took effect on only one listener when HTTPS and QUIC listeners shared the same port.

• Used a fixed wait interval when readinessGate waited for Pods that were not ready.

• Optimized the Admission Webhook validation logic for forwarding actions that do not include a final-type forwarding action.

This upgrade does not affect your services.

Version number

Release date

Changes

Impact

v2.17.2-aliyun.1

March 31, 2025

• Fixed a port-not-found reconciliation error for server groups when Ingress rules in multiple namespaces pointed to Services with the same name but different ports.

• Fixed an issue where an incorrect parameter was used to query IPv4 addresses in IPv6 dual-stack clusters.

• Increased the maximum number of security groups per batch API call for adding or removing security groups from 4 to 9.

• Skipped API calls when no additional labels needed to be added.

This upgrade does not affect your services.

v2.17.1-aliyun.1

March 18, 2025

• Added support for Gateway API 1.1.0 and later.

This upgrade does not affect your services.

v2.16.0-aliyun.1

March 4, 2025

• Enabled persistent connections by default for newly created server groups.

• Added support for setting custom labels for listeners.

• Added support for disabling the cross-zone capability of server groups.

• Optimized overall Service reconciliation performance.

• Optimized when the ReadinessGate feature updates Pod status. Pod status is updated only after all server groups are updated successfully.

• A canary release must be split into two Ingress resources or implemented through custom forwarding actions. If a canary Annotation is added directly to an Ingress by mistake, the system reports an error and retains the original forwarding rules.

This upgrade does not affect your services.