What is the NGINX Ingress controller?-Container Service for Kubernetes(ACK)-阿里云帮助中心

Track version updates, security patches, and feature changes for the NGINX Ingress controller add-on.

Important

Because the Ingress NGINX open-source project stopped maintenance and updates after March 2026, Container Service for Kubernetes will discontinue maintenance of the NGINX Ingress controller add-on. Ensure that you fully understand the risks before you use it. For more information, see [Product Announcement] End of maintenance for Nginx Ingress Controller.

Add-on overview

NGINX Ingress controller is built on the Kubernetes community open-source project Ingress NGINX and provides a unified entry point for Services in a cluster. The NGINX Ingress controller code is identical to that of the community Ingress NGINX project. Releases are based on upstream community iterations and use the same version numbers as the community project. NGINX Ingress controller is an unmanaged add-on deployed on nodes in your cluster. You are responsible for its operations and maintenance (O&M), and no service-level agreement (SLA) is provided. It supports extensive customization.

Ingress terms

An Ingress is a Kubernetes resource that acts as the access entry point for cluster services and carries almost all traffic to them. It routes external traffic to internal Service pods through forwarding rules. See Comparison among Nginx Ingresses, ALB Ingresses, and MSE Ingresses.

How NGINX Ingress controller works

The cluster must include an Nginx Ingress Controller to parse Nginx Ingress forwarding rules. The controller receives requests, matches them against the rules, and forwards them to backend Service pods. The relationship among a Service, an Nginx Ingress, and the Nginx Ingress Controller:

A Service abstracts one or more identical backend services.
An Nginx Ingress defines reverse proxy rules that route HTTP/HTTPS requests to Service pods based on host and URL path.
The Nginx Ingress Controller parses Nginx Ingress rules. When an Ingress changes, the controller updates its forwarding rules and routes incoming requests to the appropriate Service pod.

Compatibility between NGINX Ingress controller and cluster versions

When you upgrade the add-on, if the target add-on version is incompatible with the current cluster version, upgrade the cluster first. For instructions, see Upgrade clusters.

NGINX Ingress controller version	Compatible cluster versions
[v1.12.6-release.1, v1.14.5-release.4]	Version 1.24 and later
[v1.5.1-aliyun.1, v1.11.5-aliyun.1]	Version 1.22 and later
[v1.1.0-aliyun.1, v1.2.1-aliyun.1]	Version 1.20 and later

Risks of outdated versions

The NGINX Ingress controller has ended maintenance for v1.2 and earlier versions. For more information, see the product announcement. Outdated versions of the add-on cannot use the features supported by newer versions or benefit from their bug fixes, and they cannot obtain timely, effective technical support. They also face the risk of security vulnerabilities that cannot be fixed. Upgrade the add-on as soon as possible.

Usage instructions

To install or upgrade NGINX Ingress controller, see Manage the Nginx Ingress Controller add-on and Upgrade the NGINX Ingress Controller.
To create, view, update, and delete NGINX Ingress in the console or by using kubectl, see Create and use an NGINX Ingress.
For information about using NGINX Ingress controller, see Implement phased releases and blue-green deployments using Nginx Ingress, Configure public and private CLB types for Ingress Controller, and Use an Ingress controller to mirror network traffic.

Change history

July 2026

Version

Image URL

Change date

Changes

Impacts

v1.14.5-release.4

registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.14.5-release.4

July 16, 2026

Optimization:

Updated the Golang version to v1.25.12.

Vulnerability fixes:

Backported upstream NGINX vulnerability patches:
- CVE-2026-9256: Heap buffer overflow in ngx_http_rewrite_module with overlapping captures
- CVE-2026-42055: HTTP/2 header length overflow in gRPC upstream module
- CVE-2026-48142: 1-byte buffer overread in ngx_http_charset_module
- CVE-2026-49975: Unbounded request header count (max_headers directive)
  
  Important
  The fix for CVE-2026-49975 adds the max_headers directive, which by default limits a single request to a maximum of 1000 HTTP headers. Requests that exceed the limit return 400, and the connection is closed. Before you upgrade, ensure that a single request in your workload carries no more than 950 HTTP headers (reserve capacity for HTTP headers inserted by other gateways along the request path).

Upgrade during off-peak hours. The change process may briefly interrupt established connections.

May 2026

Version

Image URL

Change date

Changes

Impacts

v1.14.5-release.1

registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.14.5-release.1

May 20, 2026

Optimization:

Updated the Golang version to v1.25.10.
Updated the NGINX baseline version to v1.27.1.

Vulnerability fixes:

Backported upstream NGINX vulnerability patches:
- CVE-2026-42945: Buffer overflow in the ngx_http_rewrite_module
- CVE-2026-42946: Buffer overread in the ngx_http_scgi_module and ngx_http_uwsgi_module
- CVE-2026-42934: Buffer overread in the ngx_http_charset_module
- CVE-2026-40460: HTTP/3 address spoofing
- CVE-2026-40701: Resolver use-after-free in OCSP
- CVE-2026-1642: SSL upstream injection

Upgrade during off-peak hours. The change process may briefly interrupt established connections.

April 2026

Version	Image URL	Change date	Changes	Impacts
v1.13.9-release.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.13.9-release.1	April 2, 2026	Updated to the community v1.13.9 release. For more information, see the full update records. Key changes Vulnerability fixes: Ingress Controller: Fixed an NGINX configuration injection vulnerability caused by a combination of annotations. (#14731) CVE-2026-4342: ingress-nginx comment-based nginx configuration injection (#137893), with a score of 8.8, is a high-severity vulnerability. By combining specific Ingress annotations, attackers can inject malicious data into the rules.http.paths.path field, thereby injecting arbitrary configuration into NGINX. This may allow arbitrary code to be executed in the context of the ingress-nginx controller and expose all Secrets accessible to the controller. In a default installation, all Secrets in the cluster are accessible. This causes severe information disclosure and compromises system integrity.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

March 2026

Version	Image URL	Change date	Changes	Impacts
v1.13.8-release.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.13.8-release.1	March 16, 2026	Updated to the community v1.13.8 release. For more information, see the full update records. Important v1.13.x changes the logic for obtaining the real client IP address when both `use-proxy-protocol` and `use-forwarded-headers` are enabled. Some deployments use the PROXY protocol to obtain the real client IP address. In these scenarios, if `use-forwarded-headers` is also enabled and `proxy-real-ip-cidr` retains the default value of `0.0.0.0/0`, all PROXY protocol addresses are considered trusted proxies. The client-provided `X-Forwarded-For` may be trusted, allowing the client IP address to be spoofed. During the upgrade, carefully verify the nginx-ingress-controller configuration. If you need to keep both `use-proxy-protocol: "true"` and `use-forwarded-headers: "true"`, narrow `proxy-real-ip-cidr` from its default value of `0.0.0.0/0` to the actual trusted TCP peers. Include the egress CIDRs of upstream L7 proxies, such as the Local IP CIDRs of Classic Load Balancer (CLB) or Network Load Balancer (NLB). This lets traffic directly connected to a TCP load balancer continue to use the PROXY protocol address, while parsing the forwarded-for chain only from trusted upstream proxies. Key changes Vulnerability fixes: NGINX: Updated OWASP Core Rule Set (CRS) to v4.22.0. (#14418) CVE-2026-21876, with a score of 9.3, is a critical vulnerability. Fixed a logic flaw in OWASP CRS when validating multipart/form-data character sets. Previously, attackers could bypass Web Application Firewall (WAF) detection by crafting multipart requests and hiding malicious payloads in a specific character encoding. These payloads were parsed and executed by backend applications after they passed through the WAF. Admission Controller: Limited the request size that the validating admission webhook can process to 9 MB. (#14494) CVE-2026-24514: ingress-nginx Admission Controller denial of service (#136680), with a score of 3.1, is a low-severity vulnerability. Limited the request size that the validating admission webhook can process to prevent attackers from exhausting Admission Controller memory by creating oversized objects or requests. Such objects or requests could cause the ingress-nginx controller Pod to be OOM-killed or exhaust node memory. This results in a denial of service. Template: Added quotation marks to all `location` and `server_name` directives, and escaped quotation marks and backslashes. (#14503) CVE-2026-24512: ingress-nginx rules.http.paths.path nginx configuration injection (#136678), with a score of 8.8, is a high-severity vulnerability. Fixed an issue where the `rules.http.paths.path` field could inject raw NGINX configuration. This prevents attackers from using carefully crafted path values to bypass template boundaries and write arbitrary directives to the configuration file. Such directives could execute arbitrary code in the controller Pod and access all Secrets readable by the controller. Annotations: Added `^` and `$` boundaries to the auth method regular expression. (#14506) CVE-2026-1580: ingress-nginx auth-method nginx configuration injection (#136677), with a score of 8.8, is a high-severity vulnerability. Strengthened validation of the `nginx.ingress.kubernetes.io/auth-method` annotation value, allowing only exact matches of expected methods. This prevents attackers from injecting special content that is directly concatenated into the NGINX configuration, leading to configuration injection, remote code execution, and theft of cluster Secrets. Template: Bypassed custom error pages when processing auth URL requests. (#14497) CVE-2026-24513: ingress-nginx auth-url protection bypass (#136679), with a score of 3.1, is a low-severity vulnerability. Fixed an authentication bypass that can occur when the `auth-url` annotation is used with a custom error page backend if the backend does not correctly handle the `X-Code` header. This ensures that authentication failures (401/403) are not mistakenly treated as successful responses, preventing unauthorized access to protected paths. Template: Added quotation marks to the `proxy_pass` directive. (#14669) CVE-2026-3288: ingress-nginx rewrite-target nginx configuration injection (#137560), with a score of 8.8, is a high-severity vulnerability. Fixed an issue where the `nginx.ingress.kubernetes.io/rewrite-target` annotation value was not strictly filtered and could be used to inject arbitrary directives into the NGINX configuration file. Because this value is directly concatenated into the generated `nginx.conf`, an attacker needs only low-privilege permission to create or modify Ingress resources in the cluster. The attacker can then execute arbitrary code in the controller Pod context and read all Secrets accessible to the controller. In a default installation, this includes all Secrets in the cluster. Optimization: Controller: Added UID validity checks. (#14500) Annotations: Consider aliases in risk assessments. (#14666) Controller: Correctly enable SSL Passthrough when it is requested on HTTP-only hosts. (#14557) Annotations: Use a dedicated regular expression for `proxy-cookie-domain`. (#14551) Template: Use `RawURLEncoding` instead of `URLEncoding` with padding removed. (#14538) Bug fixes: Fixed a synchronization issue when the host clock jumps into the future. (#14450) Fixed a panic caused by an empty `cpu.max` file. (#14449) Fixed a panic caused by writing the status code prematurely when returning a custom error page. (#14163) Controller: Fixed a possible premature exit in host/path overlap detection for multiple rules. The checkOverlap function should check all rules of a new Ingress object to ensure that they do not overlap with any existing Ingress object. Previously, the function exited prematurely after the first rule passed validation. (#14131) Annotations: Fixed an issue where the Equals function did not validate the `auth-proxy-set-headers` field. (#14104) Store: Fixed a panic in the Service deletion handler. When v1.Service resource states differ in scope between the Kubernetes client cache and Kubernetes storage, the Kubernetes client returns an unhandled cache.DeletedFinalStateUnknown type, causing a panic in subsequent checks. (#14057) Controller: Fixed the sorting issue for `limit_req_zone` to ensure that the configuration is sorted before it takes effect. (#14006) Config/Annotations: Fixed backward compatibility for `proxy-busy-buffers-size` so that it is rendered only when the parameter is explicitly defined in the template. (#13638) Config/Annotations: Removed the default value of `proxy-busy-buffers-size`. (#13790) Lua: Fixed a type mismatch. (#14515)	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

December 2025

Version	Image URL	Change date	Changes	Impacts
v1.12.6-release.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.12.6-release.1	December 11, 2025	Updated to the community v1.12.6 release. Important To improve the security of ingress-nginx, this release changes the default values of some security configurations. If you have used or intend to use features prohibited by these security configurations, carefully assess the security risk. Then manually enable the features by adding configuration to the ConfigMap `kube-system/nginx-configuration`: The default allowed annotation risk level is lowered to High. If you have used or expect to use Critical-level annotations, such as snippet-type annotations, manually add `annotations-risk-level: Critical`. Cross-namespace references are disallowed by default. Ingress references resources such as ConfigMaps or Secrets across namespaces through the `auth-secret`, `auth-tls-secret`, `auth-proxy-set-header`, `fastcgi-params-configmap`, and `proxy-ssl-secret` annotations. If you have used or intend to use such cross-namespace references, manually add `allow-cross-namespace-resources: "true"`. Strict path validation is enabled by default. This means paths of type `Exact` and `Prefix` are allowed only if they start with `/` and contain only letters, numbers, `-`, `_`, `.`, and `/`. If you have used or intend to use other paths, such as paths containing `+` or `$`, manually add `strict-validate-path-type: "false"` or change the path type to `ImplementationSpecific`. Key feature changes New features: Annotations/AuthTLS: Allow named redirects. (#13820) Allow paths of type `Exact` and `Prefix` to use `.`. (#13800) NGINX: Upgraded to OpenResty v1.25.3.2. (#13530) Allow any protocol for CORS origins. (#11153) Metrics: Added the `--metrics-per-undefined-host` parameter. (#11818) Optimization: Security: Hardened socket creation and validated error code input. (#13786) Security: Adjusted default security configuration values (#11819): Lowered the allowed annotation risk level from Critical to High. Disallowed cross-namespace references by default. Enabled strict path validation. NGINX: Disabled architecture-specific optimizations for mimalloc. (#13670) Removed the global rate-limiting feature. (#11851) Removed the following configuration options: `global-rate-limit-memcached-host` `global-rate-limit-memcached-port` `global-rate-limit-memcached-connect-timeout` `global-rate-limit-memcached-max-idle-timeout` `global-rate-limit-memcached-pool-size` `global-rate-limit-status-code` Removed the following annotations: `global-rate-limit` `global-rate-limit-window` `global-rate-limit-key` `global-rate-limit-ignored-cidrs` Removed support for third-party Lua plugins (#11821). Custom plugins in the `/etc/nginx/lua/plugins` directory are no longer supported. Metrics: Removed `ingress_upstream_latency_seconds`. (#11795) Bug fixes: Metrics: Fixed `nginx_ingress_controller_config_last_reload_successful`. (#13859) Controller: Fixed the SSL session ticket path. (#13668) Lua: Fixed an `ExternalName` Service without endpoints. (#13429) Fixed the DNS resolution issue when ExternalName is used as a backend. (#12951)	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

September 2025

Version

Image URL

Change date

Changes

Impacts

v1.11.5-release.2

registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.11.5-release.2

September 11, 2025

Feature optimizations:

Supports the use of Network Load Balancer (NLB).
Added configuration for Pod Disruption Budgets.

Upgrade during off-peak hours. The change process may briefly interrupt established connections.

March 2025

Version	Image URL	Change date	Changes	Impacts
v1.11.5-aliyun.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.11.5-aliyun.1	March 26, 2025	Updated to the community v1.11.5 release and fixed CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, and CVE-2025-24514. For details, see Security Advisory: NGINX Ingress Controller Vulnerabilities (CVE-2025-1974 and Related CVEs). Important To fix the CVE-2025-1974 vulnerability, starting with this release, the NGINX Ingress controller add-on keeps the validating admission webhook enabled but disables NGINX native configuration validation by default. If you enable snippet annotations, which are used to customize native NGINX directives, these configurations are no longer prevalidated by the validating admission webhook. Related errors are raised only when NGINX reloads its configuration. Check the NGINX Ingress controller Pod logs after each change to Ingress rules and promptly correct the Ingress configuration based on the relevant error logs. Incorrect configurations do not affect running NGINX Ingress controller Pods, but newly created Pods fail to start during scaling, restarts, or other operations because of configuration errors. Before you change configurations in a production environment, complete full validation of snippet directives in a test environment.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.
v1.11.4-aliyun.2	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.11.4-aliyun.2	March 19, 2025	Optimized node scheduling affinity configuration so that Pods are not scheduled on Lingjun nodes.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

February 2025

Version	Image URL	Change date	Changes	Impacts
v1.11.4-aliyun.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.11.4-aliyun.1	February 12, 2025	Updated to the community v1.11.4 release and added customizable topology constraint configuration for the add-on in the console.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

August 2024

Version	Image URL	Change date	Changes	Impacts
v1.10.4-aliyun.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.10.4-aliyun.1	August 20, 2024	Updated to the community v1.10.4 release and fixed the CVE-2024-7646 vulnerability. For more information about the vulnerability, see Security issue.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

July 2024

Version	Image URL	Change date	Changes	Impacts
v1.10.2-aliyun.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.10.2-aliyun.1	July 24, 2024	Supports integration with Application Real-Time Monitoring Service (ARMS) through OpenTelemetry. OpenTracing is no longer supported. On the Add-ons page, you can configure the `--shutdown-grace-period`, `--exclude-socket-metrics`, and `--default-ssl-certificate` parameters. Supports using NLB for Layer 4 forwarding. Hardened image security and fixed CVE-2023-5363, CVE-2023-5678, CVE-2024-25062, and CVE-2024-2511. Upgraded NGINX to version 1.25.5. The new NGINX version strengthens validation for headers in backend responses. For more information, see changeset. Backend responses that include duplicate `Content-Length` and `Transfer-Encoding` header fields are rejected. Backend responses that include an invalid `Content-Length` or `Transfer-Encoding` header field are rejected. Backend responses that include both `Content-Length` and `Transfer-Encoding` header fields are rejected.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

October 2023

Version

Image URL

Change date

Changes

Impacts

v1.9.3-aliyun.1

registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.9.3-aliyun.1

October 24, 2023

Important

Due to security considerations, the add-on disables all snippet annotations (such as nginx.ingress.kubernetes.io/configuration-snippet) by default starting with this release.

Enabling snippet annotations is not recommended for security and stability reasons. If you need to use them, fully assess the risks and then manually enable them in the ConfigMap kube-system/nginx-configuration by adding allow-snippet-annotations: "true".

Disabled the ability to add snippets in annotations by default.
Added the --enable-annotation-validation parameter, which enables annotation content validation by default to mitigate CVE-2023-5044.
Fixed CVE-2023-44487.

Upgrade during off-peak hours. The change process may briefly interrupt established connections.

September 2023

Version

Image URL

Change date

Changes

Impacts

v1.8.2-aliyun.1

registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.8.2-aliyun.1

September 20, 2023

Upgraded Golang to version 1.21.1.
Changed Hostname anti-affinity scheduling from preferred to required, which enforces node anti-affinity scheduling.
Supports enabling OpenTelemetry. For detailed instructions, see the community configuration guide.
Fixed vulnerabilities including CVE-2022-48174, CVE-2023-2975, CVE-2023-3446, and CVE-2023-3817.

Upgrade during off-peak hours. The change process may briefly interrupt established connections.

June 2023

Version

Image URL

Change date

Changes

Impacts

v1.8.0-aliyun.1

registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.8.0-aliyun.1

June 20, 2023

Upgraded the Alpine image version to 1.18.
Added the strict-validate-path-type configuration item to enable strict path validation (disabled by default). For more information, see the community ConfigMap configuration instructions.
Fixed vulnerabilities including CVE-2023-28322 and CVE-2023-2650.

Upgrade during off-peak hours. The change process may briefly interrupt established connections.

May 2023

Version	Image URL	Change date	Changes	Impacts
v1.7.0-aliyun.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.7.0-aliyun.1	May 5, 2023	Important This version no longer supports Transport Layer Security (TLS) v1.1 and v1.0 by default. If you upgrade the NGINX Ingress controller to this version, be aware of the impact on your services. For more information about the impact of this issue, see set ssl-protocols config not working after v1.6.4. To force the use of legacy TLS encryption methods, see What are the known issues in earlier versions of the NGINX Ingress Controller? Upgraded Golang to version 1.20 and the Alpine image version to 1.17. Fixed an issue where `nginx.ingress.kubernetes.io/canary-weight-total` did not take effect. Fixed a panic that occurred when the ready status was missing from an EndpointSlice. Fixed vulnerabilities including CVE-2023-27536 and CVE-2023-0464. Removed the logic that uses the service name as a prefix when checking EndpointSlices.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

March 2023

Version	Image URL	Change date	Changes	Impacts
v1.6.4-aliyun.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.6.4-aliyun.1	March 17, 2023	Supports configuring an IP denylist by using `nginx.ingress.kubernetes.io/denylist-source-range`. Supports adding the annotation `cluster-autoscaler.kubernetes.io/safe-to-evict: "false"` to prevent the node hosting the Pod from being automatically scaled in. Supports enabling or disabling logs on the add-on management page. Fixed several stability issues. Fixed vulnerabilities including CVE-2023-0286, CVE-2022-4450, and CVE-2023-0215.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

February 2023

Version	Image URL	Change date	Changes	Impacts
v1.5.1-aliyun.1	registry-cn-hangzhou.ack.aliyuncs.com/acs/aliyun-ingress-controller:v1.5.1-aliyun.1	February 10, 2023	NGINX Ingress controller version 1.5.1 and later supports only ACK clusters version 1.22.0 and later. Upgraded NGINX to version 1.21.6 and Golang to version 1.19.2. Updated the Application High Availability Service (AHAS) Sentinel plugin to support the use-mse switch. Uses the coordination.k8s.io/leases resource for leader election. Uses EndpointSlice instead of Endpoint for endpoint discovery. Added multiple Prometheus metrics and deprecated _ingress_upstream_latency_seconds. For more information, see ingress-nginx. Supports using debug-connections to enable NGINX debug logs for IP ranges. Fixed vulnerabilities including CVE-2022-32149, CVE-2022-27664, and CVE-2022-1996.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

June 2022

Version	Image URL	Change date	Changes	Impacts
v1.2.1-aliyun.1	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v1.2.1-aliyun.1	June 28, 2022	Removed the `alias` and `root` directives from NGINX to reduce security risks. Fixed several stability issues.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

May 2022

Version	Image URL	Change date	Changes	Impacts
v1.2.0-aliyun.1	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v1.2.0-aliyun.1	May 10, 2022	Added and enabled deep inspection of Ingress objects by default to prevent configurations for Ingress resources that contain sensitive fields from being written. This feature fixed the CVE-2021-25745 issue. Fixed several stability issues.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

April 2022

Version	Image URL	Change date	Changes	Impacts
v0.44.0.12-27ae67262-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.44.0.12-27ae67262-aliyun	April 29, 2022	Optimized scheduling affinity configuration to allow all nodes in the cluster to serve as autoscaling nodes. Fixed known security vulnerabilities that occurred when the AHAS Sentinel feature was enabled. Fixed vulnerabilities in several base images.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

March 2022

Version	Image URL	Change date	Changes	Impacts
v1.1.2-aliyun.2	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v1.1.2-aliyun.2	March 21, 2022	Downgraded NGINX to version 1.19.9 to align with the community version and improve stability. Fixed an issue where an invalid `cors-allow-origin` configuration caused the controller to crash. Fixed a conflict between Ingress resources with the same paths that occurred when the validating admission webhook checked Ingress resources not belonging to the same IngressClass. Fixed an issue where initContainer modified node kernel parameters when hostNetwork was used. Fixed CVE-2022-0778 and CVE-2022-23308.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

January 2022

Version	Image URL	Change date	Changes	Impacts
v1.1.0-aliyun.2	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v1.1.0-aliyun.2	January 12, 2022	Upgraded the AHAS Sentinel plugin by replacing the Java module with a C++ module, significantly improving performance. Uses the Protocol Buffers (Protobuf) protocol to communicate with the API Server to improve performance.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

December 2021

Version

Image URL

Change date

Changes

Impacts

v1.1.0-aliyun.1

registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v1.1.0-aliyun.1

December 17, 2021

NGINX Ingress controller version 1.X.X supports only ACK clusters version 1.20.0 and later. Use NGINX Ingress controller version 0.X.X for earlier clusters.
Uses networking v1 Ingress resources to support clusters version 1.22 and later.
cors-allow-originsupports multiple values and automatically responds based on Origin when a website is accessed.
Supports configuring session affinity for Canary releases and makes it the default behavior.
Supports configuring Canary releases without specifying a Host.
Accelerated the execution of the validating admission webhook.
Improved stability.

For more information, see the community Changelog.

Upgrade during off-peak hours. The change process may briefly interrupt established connections.

October 2021

Version	Image URL	Change date	Changes	Impacts
v0.44.0.9-7b9e93e7e-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.44.0.9-7b9e93e7e-aliyun	October 28, 2021	Added the allow-snippet-annotations annotation to mitigate the CVE-2021-25742 vulnerability. For more information, see Vulnerability fixed: CVE-2021-25742. Disabled the SSL builtin cache to fix a potential memory leak. Fixed vulnerabilities: CVE-2021-22945, CVE-2021-22946, CVE-2021-3711, and CVE-2021-3712. Upgraded the AHAS Sentinel SDK to 1.9.7.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

September 2021

Version	Image URL	Change date	Changes	Impacts
v0.44.0.5-e66e17ee3-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.44.0.5-e66e17ee3-aliyun	September 6, 2021	Upgraded the AHAS Sentinel plugin. Improved plugin performance and stability. Added support for cluster traffic throttling. Fixed the CVE-2021-36159 vulnerability. Disabled the kernel.core_uses_pid kernel parameter by default to prevent coredump files from consuming excessive disk space.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

June 2021

Version	Image URL	Change date	Changes	Impacts
v0.44.0.3-8e83e7dc6-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.44.0.3-8e83e7dc6-aliyun	June 1, 2021	Fixed the CVE-2021-23017 vulnerability.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

April 2021

Version	Image URL	Change date	Changes	Impacts
v0.44.0.2-abf1c6fe4-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.44.0.2-abf1c6fe4-aliyun	April 1, 2021	Added compatibility with the log_format field `the_real_ip` configured in versions 0.30 and earlier.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

March 2021

Version	Image URL	Change date	Changes	Impacts
v0.44.0.1-5e842447b-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.44.0.1-5e842447b-aliyun	March 8, 2021	Enabled the validating admission webhook by default. For more information, see How the NGINX Ingress controller works. Validated the value configured for the `service-weight` annotation. Improved the performance of persistent and short-lived connections by 20% to 50%. Added support for Online Certificate Status Protocol (OCSP) stapling. Upgraded LuaJIT to version 2.1.0. Upgraded NGINX to version 1.19.6. Upgraded the Alpine image to version 3.13. Fixed OpenSSL CVEs. Enabled TLS 1.3 by default. Note By default, HTTPS supports only TLS 1.2 and TLS 1.3. To enable support for TLS 1.0 and TLS 1.1, see Which TLS versions are supported? Requires Kubernetes version v1.16 and later. Updated to align with community version 0.44.0. For more information, see the community Changelog.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

April 2020

Version	Image URL	Change date	Changes	Impacts
v0.30.0.1-5f89cb606-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.30.0.1-5f89cb606-aliyun	April 2, 2020	Added support for FastCGI backends. Enabled the Dynamic SSL Cert Update mode by default. Added support for traffic mirroring configurations. Upgraded NGINX to version 1.17.8 and OpenResty to version 1.15.8, and updated the base image to Alpine. Added support for the Ingress validating admission webhook. Fixed vulnerabilities: CVE-2018-16843, CVE-2018-16844, CVE-2019-9511, CVE-2019-9513, and CVE-2019-9516. Major updates: Configurations such as lua-resty-waf, session-cookie-hash, and force-namespace-isolation are deprecated. Changed the x-forwarded-prefix type from boolean to string. The the_real_ip variable in log-format will be deprecated in a future release and replaced by remote_addr. Updated to align with community version 0.30.0. For detailed change records, see the community Changelog.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

October 2019

Version	Image URL	Change date	Changes	Impacts
v0.22.0.5-552e0db-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.22.0.5-552e0db-aliyun	October 24, 2019	Supports wildcard domain names, allowlists, and redirect configuration when dynamic Server updates are enabled.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

July 2019

Version	Image URL	Change date	Changes	Impacts
v0.22.0.4-5a14d4b-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.22.0.4-5a14d4b-aliyun	July 18, 2019	Optimized canary release rules and added support for Perl regular expression matching.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

April 2019

Version	Image URL	Change date	Changes	Impacts
v0.22.0.3-da10b7f-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.22.0.3-da10b7f-aliyun	April 25, 2019	Updated to align with community version 0.22.0. For change records, see Ingress NGINX. Supports blue-green deployment and canary release mechanisms when dynamic updates are enabled. Enabled dynamic updates for NGINX upstreams by default. Major updates include: The rewrite-target annotation uses capture group configuration. For configuration instructions, see rewrite-target. For a smooth upgrade, see GitHub.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

January 2019

Version	Image URL	Change date	Changes	Impacts
v0.20.0.2-cc39f1b-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.20.0.2-cc39f1b-aliyun	January 17, 2019	Optimized the default NGINX worker process count configuration to prevent excessive NGINX processes from consuming host resources. Optimized blue-green deployment and canary releases to allow new and legacy Services to use different Service port numbers. Resolved an issue where NGINX configuration testing failed during a canary release when the new-version Service backend had no active Pods. Fixed an issue where the Ingress Address endpoint was not updated because of K8s API Server connection errors.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.

November 2018

Version	Image URL	Change date	Changes	Impacts
v0.20.0.1-4597ce2-aliyun	registry.cn-hangzhou.aliyuncs.com/acs/aliyun-ingress-controller:v0.20.0.1-4597ce2-aliyun	November 29, 2018	Updated to align with community version 0.20.0. For change records, see the Ingress NGINX releases. Upgraded NGINX to version 1.15.6 and fixed HTTP/2-related security vulnerabilities. Supports regular expression configuration for paths. Removed the default-http-backend Service and added support for configuring a custom default backend Service. Supports denylist configuration based on IP addresses, User-Agent, and Referer. Optimized default runtime permissions by removing the privileges runtime permission. Supports the AJP protocol.	Upgrade during off-peak hours. The change process may briefly interrupt established connections.