Merge branch 'main' into tests/add-fail-fast

Author: lucacome

.github/CHANGELOG_TEMPLATE.md

@@ -29,7 +29,7 @@ KNOWN ISSUES:
 
 COMPATIBILITY:
 
-- The Gateway API version: ``
+- Gateway API version: ``
 - NGINX version: ``
 - NGINX Plus version: ``
 - Kubernetes version: ``

.github/workflows/build.yml

@@ -82,7 +82,7 @@ jobs:
 
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2 # v2.1.4
+        uses: google-github-actions/auth@62cf5bd3e4211a0a0b51f2c6d6a37129d828611d # v2.1.5
         with:
           token_format: access_token
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY }}
@@ -162,15 +162,15 @@ jobs:
 
       - name: Scan SBOM
         id: scan
-        uses: anchore/scan-action@bc9adf64917dd9444d6cf4dd68620c34ca3a5f69 # v4.1.1
+        uses: anchore/scan-action@64a33b277ea7a1215a3c142735a1091341939ff5 # v4.1.2
         with:
           sbom: "sbom-${{ inputs.image }}.json"
           only-fixed: true
           add-cpes-if-none: true
           fail-build: false
 
       - name: Upload scan result to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
+        uses: github/codeql-action/upload-sarif@f0f3afee809481da311ca3a6ff1ff51d81dbeb24 # v3.26.4
         continue-on-error: true
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}

.github/workflows/ci.yml

@@ -147,7 +147,7 @@ jobs:
             .github/.cache/buster-for-binary
 
       - name: Create/Update Draft
-        uses: lucacome/draft-release@8a63d32c79a171ae6048e614a8988f0ac3ed56d4 # v1.1.0
+        uses: lucacome/draft-release@5d29432a46bff6c122cd4b07a1fb94e1bb158d34 # v1.1.1
         with:
           minor-label: "enhancement"
           major-label: "change"
@@ -159,7 +159,7 @@ jobs:
         if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
 
       - name: Download Syft
-        uses: anchore/sbom-action/download-syft@ab9d16d4b419c9d1a02df5213fa0ebe965ca5a57 # v0.17.1
+        uses: anchore/sbom-action/download-syft@61119d458adab75f756bc0b9e4bde25725f86a7a # v0.17.2
         if: github.ref_type == 'tag'
 
       - name: Install Cosign

.github/workflows/codeql-analysis.yml

@@ -52,7 +52,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
+        uses: github/codeql-action/init@f0f3afee809481da311ca3a6ff1ff51d81dbeb24 # v3.26.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -64,6 +64,6 @@ jobs:
           # queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
+        uses: github/codeql-action/analyze@f0f3afee809481da311ca3a6ff1ff51d81dbeb24 # v3.26.4
         with:
           category: "/language:${{matrix.language}}"

.github/workflows/conformance.yml

@@ -155,7 +155,7 @@ jobs:
         working-directory: ./tests
 
       - name: Upload profile to release
-        if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        if: ${{ startsWith(github.ref, 'refs/tags/') && inputs.enable-experimental == 'true' }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: gh release upload ${{ github.ref_name }} conformance-profile.yaml --clobber

.github/workflows/docs-build-push.yml

@@ -18,13 +18,30 @@ on:
     paths:
     - "site/**"
 
+concurrency:
+  group: ${{ github.ref_name }}-docs-push
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
+  vars:
+    runs-on: ubuntu-22.04
+    outputs:
+      azure_creds: ${{ steps.vars.outputs.defined }}
+    steps:
+    - name: Check if variable is set
+      id: vars
+      env:
+        AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS_DOCS }}
+      if: "${{ env.AZURE_CREDENTIALS != '' }}"
+      run: echo "defined=true" >> $GITHUB_OUTPUT
+
   call-docs-build-push:
-    if: ${{ github.event.repository.fork == false }}
-    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@03a9a3808fcb77cd0c19d7fa5d59b25565dd1d6d # v1.0.2
+    needs: [vars]
+    if: ${{ github.event.repository.fork == false && needs.vars.outputs.azure_creds == 'true' }}
+    uses: nginxinc/docs-actions/.github/workflows/docs-build-push.yml@a733e84a262f8d5d885bfc8eac80bc85928da322 # v1.0.3
     permissions:
       pull-requests: write # needed to write preview url comment to PR
       contents: read

.github/workflows/mend.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - main
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
     paths-ignore:
       - design/**
       - deploy**
@@ -25,10 +27,13 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
       - name: Download agent
         run: curl -LJO https://github.com/whitesource/unified-agent-distribution/releases/latest/download/wss-unified-agent.jar
+
       - name: Verify JAR
         run: jarsigner -verify wss-unified-agent.jar
+
       - name: Scan and upload
         env:
           PRODUCT_NAME: nginx-gateway-fabric_${{ github.ref_name }}

.github/workflows/nfr.yml

@@ -75,7 +75,7 @@ jobs:
 
       - name: Authenticate to Google Cloud
         id: auth
-        uses: google-github-actions/auth@f112390a2df9932162083945e46d439060d66ec2 # v2.1.4
+        uses: google-github-actions/auth@62cf5bd3e4211a0a0b51f2c6d6a37129d828611d # v2.1.5
         with:
           token_format: access_token
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY }}

.github/workflows/release-pr.yml

@@ -35,7 +35,7 @@ jobs:
 
       - name: Get Release Notes
         id: notes
-        uses: lucacome/draft-release@8a63d32c79a171ae6048e614a8988f0ac3ed56d4 # v1.1.0
+        uses: lucacome/draft-release@5d29432a46bff6c122cd4b07a1fb94e1bb158d34 # v1.1.1
         with:
           config-path: .github/release-notes.yml
           dry-run: true

.github/workflows/scorecards.yml

@@ -60,6 +60,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # v3.26.0
+        uses: github/codeql-action/upload-sarif@f0f3afee809481da311ca3a6ff1ff51d81dbeb24 # v3.26.4
         with:
           sarif_file: results.sarif

.golangci.yml

@@ -53,11 +53,11 @@ linters:
   enable:
     - asasalint
     - asciicheck
+    - copyloopvar
     - dupword
     - errcheck
     - errname
     - errorlint
-    - exportloopref
     - fatcontext
     - ginkgolinter
     - gocheckcompilerdirectives

.pre-commit-config.yaml

@@ -41,7 +41,7 @@ repos:
           - javascript
 
   - repo: https://github.com/golangci/golangci-lint
-    rev: v1.59.1
+    rev: v1.60.2
     hooks:
       - id: golangci-lint-full
         name: golangci-lint-root

CHANGELOG.md

@@ -4,6 +4,53 @@ This document includes a curated changelog for each release. We also publish a c
 a [GitHub release](https://github.com/nginxinc/nginx-gateway-fabric/releases), which, by contrast, is auto-generated
 and includes links to all PRs that went into the release.
 
+## Release 1.4.0
+
+_August 20, 2024_
+
+FEATURES:
+
+- Support IPv6. [2190](https://github.com/nginxinc/nginx-gateway-fabric/pull/2190)
+- Add support for TLS Passthrough using TLSRoutes. [2356](https://github.com/nginxinc/nginx-gateway-fabric/pull/2356)
+- Support cross-namespace routing with TLSRoutes. [2379](https://github.com/nginxinc/nginx-gateway-fabric/pull/2379)
+- Added server_zone metrics for NGINX Plus users. [2360](https://github.com/nginxinc/nginx-gateway-fabric/pull/2360)
+
+BUG FIXES:
+
+- Fixed issue where NGF Pod cannot recover if NGINX master process fails without cleaning up. [2131](https://github.com/nginxinc/nginx-gateway-fabric/pull/2131)
+- Leader election couldn't be disabled. [2307](https://github.com/nginxinc/nginx-gateway-fabric/pull/2307)
+- Disallow routes from attaching to listeners if not present in allowed routes. [2314](https://github.com/nginxinc/nginx-gateway-fabric/pull/2314)
+- Honor ReferenceGrants that allow GRPCRoutes to reference Services in different namespaces. [2337](https://github.com/nginxinc/nginx-gateway-fabric/pull/2337)
+- Fixed an issue that prevented ClientSettingsPolicies and ObservabilityPolicies from working when attached to an HTTPRoute where matching conditions were defined. [2318](https://github.com/nginxinc/nginx-gateway-fabric/pull/2318)
+- Replace TODO route condition with an Accepted/False condition. [2228](https://github.com/nginxinc/nginx-gateway-fabric/pull/2228)
+
+DOCUMENTATION:
+
+- Enhanced the troubleshooting guide with more details and scenarios. [2141](https://github.com/nginxinc/nginx-gateway-fabric/pull/2141)
+- Update kubectl exec syntax to remove deprecation warning. [2218](https://github.com/nginxinc/nginx-gateway-fabric/pull/2218). Thanks [aknot242](https://github.com/aknot242).
+- Add info on setting up host network access. [2263](https://github.com/nginxinc/nginx-gateway-fabric/pull/2263). Thanks [fardarter](https://github.com/fardarter).
+
+HELM CHART:
+
+- The version of the Helm chart is now 1.4.0
+- Add capability to set resource requests and limits on nginx-gateway deployment. [2216](https://github.com/nginxinc/nginx-gateway-fabric/pull/2216). Thanks to [anwbtom](https://github.com/anwbtom).
+- Add capability to configure custom annotations for the nginx-gateway-fabric pod(s). [2250](https://github.com/nginxinc/nginx-gateway-fabric/pull/2250). Thanks to [Robsta86](https://github.com/Robsta86).
+- Add helm chart examples. [2292](https://github.com/nginxinc/nginx-gateway-fabric/pull/2292)
+- Add seccompProfile. [2323](https://github.com/nginxinc/nginx-gateway-fabric/pull/2323)
+
+COMPATIBILITY:
+
+- Gateway API version: `1.1.0`
+- NGINX version: `1.27.1`
+- NGINX Plus version: `R32`
+- Kubernetes version: `1.25+`
+
+CONTAINER IMAGES:
+
+- Control plane: `ghcr.io/nginxinc/nginx-gateway-fabric:1.4.0`
+- Data plane: `ghcr.io/nginxinc/nginx-gateway-fabric/nginx:1.4.0`
+- Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:1.4.0`
+
 ## Release 1.3.0
 
 _June 11, 2024_
@@ -63,7 +110,7 @@ KNOWN ISSUES:
 
 COMPATIBILITY:
 
-- The Gateway API version: `1.1.0`. This release is not compatible with v1.0.0 of the Gateway API. See the UPGRADE section above for instructions on how to upgrade.
+- Gateway API version: `1.1.0`. This release is not compatible with v1.0.0 of the Gateway API. See the UPGRADE section above for instructions on how to upgrade.
 - NGINX version: `1.27.0`
 - NGINX Plus version: `R32`
 - Kubernetes version: `1.25+`
@@ -116,7 +163,7 @@ KNOWN ISSUES:
 
 COMPATIBILITY:
 
-- The Gateway API version: `1.0.0`
+- Gateway API version: `1.0.0`
 - NGINX version: `1.25.4`
 - NGINX Plus version: `R31`
 - Kubernetes version: `1.23+`
@@ -165,7 +212,7 @@ UPGRADE:
 
 COMPATIBILITY:
 
-- The Gateway API version: `1.0.0`
+- Gateway API version: `1.0.0`
 - NGINX version: `1.25.3`
 - Kubernetes version: `1.23+`
 
@@ -206,7 +253,7 @@ DOCUMENTATION:
 
 COMPATIBILITY:
 
-- The Gateway API version: `0.8.1`
+- Gateway API version: `0.8.1`
 - NGINX version: `1.25.2`
 - Kubernetes version: `1.23+`
 
@@ -239,7 +286,7 @@ DOCUMENTATION:
 
 COMPATIBILITY:
 
-- The Gateway API version: `0.8.0`
+- Gateway API version: `0.8.0`
 - NGINX version: `1.25.2`
 - Kubernetes version: `1.23+`
 
@@ -268,7 +315,7 @@ BUG FIXES:
 
 COMPATIBILITY:
 
-- The Gateway API version: `0.7.1`
+- Gateway API version: `0.7.1`
 - NGINX version: `1.25.x` \*
 - Kubernetes version: `1.21+`
 
@@ -327,7 +374,7 @@ DEPENDENCIES:
 
 COMPATIBILITY:
 
-- The Gateway API version: `0.7.1`
+- Gateway API version: `0.7.1`
 - NGINX version: `1.25.x` \*
 - Kubernetes version: `1.21+`
 
@@ -373,7 +420,7 @@ DEPENDENCIES:
 
 COMPATIBILITY:
 
-- The Gateway API version: `0.6.2`
+- Gateway API version: `0.6.2`
 - NGINX version: `1.23.x` \*
 - Kubernetes version: `1.21+`
 
@@ -411,7 +458,7 @@ DEPENDENCIES:
 
 COMPATIBILITY:
 
-- The Gateway API version: `0.5.1`
+- Gateway API version: `0.5.1`
 - NGINX version: `1.21.x` \*
 - Kubernetes version: `1.21+`
 
@@ -448,7 +495,7 @@ the [README](https://github.com/nginxinc/nginx-gateway-fabric) to learn how.
 
 COMPATIBILITY:
 
-- The Gateway API version: `0.5.0`
+- Gateway API version: `0.5.0`
 - NGINX version: `1.21.3`
 - Kubernetes version: `1.19+`
 

README.md

@@ -34,7 +34,7 @@ You can find the comprehensive NGINX Gateway Fabric user documentation on the [N
 We publish NGINX Gateway Fabric releases on GitHub. See
 our [releases page](https://github.com/nginxinc/nginx-gateway-fabric/releases).
 
-The latest release is [1.3.0](https://github.com/nginxinc/nginx-gateway-fabric/releases/tag/v1.3.0).
+The latest release is [1.4.0](https://github.com/nginxinc/nginx-gateway-fabric/releases/tag/v1.4.0).
 
 The edge version is useful for experimenting with new features that are not yet published in a release. To use, choose
 the _edge_ version built from the [latest commit](https://github.com/nginxinc/nginx-gateway-fabric/commits/main)
@@ -45,7 +45,7 @@ to the correct versions:
 
 | Version        | Description                              | Installation Manifests                                                            | Documentation and Examples                                                                                                                                                 |
 |----------------|------------------------------------------|-----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Latest release | For production use                       | [Manifests](https://github.com/nginxinc/nginx-gateway-fabric/tree/v1.3.0/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginxinc/nginx-gateway-fabric/tree/v1.3.0/examples).                           |
+| Latest release | For production use                       | [Manifests](https://github.com/nginxinc/nginx-gateway-fabric/tree/v1.4.0/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginxinc/nginx-gateway-fabric/tree/v1.4.0/examples).                           |
 | Edge           | For experimental use and latest features | [Manifests](https://github.com/nginxinc/nginx-gateway-fabric/tree/main/deploy).   | [Documentation](https://github.com/nginxinc/nginx-gateway-fabric/tree/main/site/content). [Examples](https://github.com/nginxinc/nginx-gateway-fabric/tree/main/examples). |
 
 ### Versioning
@@ -66,7 +66,8 @@ The following table lists the software versions NGINX Gateway Fabric supports.
 
 | NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus |
 |----------------------|-------------|------------|-----------|------------|
-| Edge                 | 1.1.0       | 1.25+      | 1.27.0    | R32        |
+| Edge                 | 1.1.0       | 1.25+      | 1.27.1    | R32        |
+| 1.4.0                | 1.1.0       | 1.25+      | 1.27.1    | R32        |
 | 1.3.0                | 1.1.0       | 1.25+      | 1.27.0    | R32        |
 | 1.2.0                | 1.0.0       | 1.23+      | 1.25.4    | R31        |
 | 1.1.0                | 1.0.0       | 1.23+      | 1.25.3    | n/a        |

build/Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.8
-FROM golang:1.22 AS builder
+FROM golang:1.23 AS builder
 
 WORKDIR /go/src/github.com/nginxinc/nginx-gateway-fabric
 
@@ -9,7 +9,7 @@ RUN go mod download
 COPY . /go/src/github.com/nginxinc/nginx-gateway-fabric
 RUN make build
 
-FROM golang:1.22 AS ca-certs-provider
+FROM golang:1.23 AS ca-certs-provider
 
 FROM alpine:3.20 AS capabilizer
 RUN apk add --no-cache libcap

build/Dockerfile.nginx

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.8
-FROM nginx:1.27.0-alpine-otel
+FROM nginx:1.27.1-alpine-otel
 
 ARG NJS_DIR
 ARG NGINX_CONF_DIR

charts/nginx-gateway-fabric/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: nginx-gateway-fabric
 description: NGINX Gateway Fabric
 type: application
-version: 1.3.0
+version: 1.4.0
 appVersion: "edge"
 kubeVersion: ">= 1.25.0-0"
 home: https://github.com/nginxinc/nginx-gateway-fabric

charts/nginx-gateway-fabric/README.md

@@ -1,7 +1,7 @@
 
 # NGINX Gateway Fabric Helm Chart
 
-![Version: 1.3.0](https://img.shields.io/badge/Version-1.3.0-informational?style=flat-square) ![AppVersion: edge](https://img.shields.io/badge/AppVersion-edge-informational?style=flat-square)
+![Version: 1.4.0](https://img.shields.io/badge/Version-1.4.0-informational?style=flat-square) ![AppVersion: edge](https://img.shields.io/badge/AppVersion-edge-informational?style=flat-square)
 
 - [NGINX Gateway Fabric Helm Chart](#nginx-gateway-fabric-helm-chart)
   - [Introduction](#introduction)