Nginx v1.19.10 #8307

sskserk · 2022-03-07T11:24:51Z

What this PR does / why we need it:

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Documentation only

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.
I've read the CONTRIBUTION guide
I have added tests to cover my changes.
All new and existing tests passed.

linux-foundation-easycla · 2022-03-07T11:24:54Z

The committers are authorized under a signed CLA.

✅ sskserk (068996c17a214dd4380a52ec46eee19b697205ce)

k8s-ci-robot · 2022-03-07T11:25:00Z

Hi @sskserk. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sskserk · 2022-03-07T11:47:51Z

The committers listed above are authorized under a signed CLA.

✅ login: sskserk (a9852faa5ad0d40e586c27401e1c92a7d107cb1c)

iamNoah1

@sskserk, please sign the cla first :)

sskserk · 2022-03-07T12:14:43Z

@sskserk, please sign the cla first :)

I did't already. When I click the "Please click here to be authorized." it redirects me to the https://na3.docusign.net/ . Once I sign the document it redirects me to the wrong PR

dmathieu · 2022-03-07T13:03:28Z

Could you keep the OpenTelemetry image in sync as well?
https://github.com/kubernetes/ingress-nginx/blob/main/images/opentelemetry/rootfs/build.sh#L21

sskserk · 2022-03-07T13:10:35Z

Could you keep the OpenTelemetry image in sync as well? https://github.com/kubernetes/ingress-nginx/blob/main/images/opentelemetry/rootfs/build.sh#L21

done

jarias-lfx · 2022-03-07T14:28:09Z

/easycla

strongjz · 2022-03-07T14:30:10Z

Thanks for the PR! Can we update the PR or post it below on why we need this update to 1.19.10? We can also discuss this on the community call if need be.

Thanks,
James

sskserk · 2022-03-07T14:32:34Z

Thanks for the PR! Can we update the PR or post it below on why we need this update to 1.19.10? We can also discuss this on the community call if need be.

Thanks, James

@strongjz , the final goal is the property https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_time . I need it to control the corresponding property.

I want to increase the version of Nginx and then in a separate PR introduce the "keepalive_time" property

sskserk · 2022-03-07T14:48:48Z

Thanks for the PR! Can we update the PR or post it below on why we need this update to 1.19.10? We can also discuss this on the community call if need be.

Thanks, James

@strongjz , thank you! The user.name of the commits is fixed.

sskserk · 2022-03-07T15:22:22Z

@trnl

strongjz · 2022-03-07T16:26:12Z

/priority backlog
/triage accepted
/ok-to-test
/kind feature

sskserk · 2022-03-08T13:28:10Z

@strongjz , what are the next steps? Are there any additional gaps in this PR?

strongjz · 2022-03-09T14:25:41Z

/lgtm
/hold

I dont see any reason not too from the 1.19.10 change log but I want to hear what @rikatz has to say.

We did just release 1.1.2, nginx 1.19.10 wont go into effect till 1.1.3

@sskserk I'll comment back here what the image sha is so you can still test till we put out 1.1.3

sskserk · 2022-03-10T15:54:12Z

@strongjz , @rikatz , @iamNoah1 ,

I'm trying to start using the keepalive_time property of Nginx v1.19.10 here -> #8319

But the e2e tests fail because they run against image built on v1.19.9 but with the introduced keepalive_time configuration property. Nginx 1.19.9 simply is not starting because it doesn't recognize the new property. I guess this is because the basic image is not rebuilt

internal/ingress/controller/config/config.go

strongjz · 2022-03-14T15:47:57Z

/remove-hold
/lgtm

k8s-ci-robot · 2022-03-14T15:49:20Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sskserk, strongjz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~images/OWNERS~~ [strongjz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

strongjz · 2022-03-14T19:22:52Z

@sskserk the image build

https://console.cloud.google.com/cloud-build/builds;region=global/c5bcf0d3-c7db-4f19-a1d3-c1c1cd5d0255?project=k8s-staging-ingress-nginx

Image ID.

gcr.io/k8s-staging-ingress-nginx/nginx:v20220314-controller-v1.1.2-8-g01b92b8b3@sha256:68d88ad12e5ab880b0bcaf02b04032c294de62b8bfb0e9994c99bbfe3c0955dc

Prow build output https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/ingress-nginx/8307/pull-ingress-nginx-boilerplate/1503399038462988288

remove 0.46.0 from supported versions table (kubernetes#8258) Minor fix for missing pathType property (kubernetes#8244) Updated confusing error (kubernetes#8262) Add a certificate info metric (kubernetes#8253) When the ingress controller loads certificates (new ones or following a secret update), it performs a series of check to ensure its validity. In our systems, we detected a case where, when the secret object is compromised, for example when the certificate does not match the secret key, different pods of the ingress controller are serving a different version of the certificate. This behaviour is due to the cache mechanism of the ingress controller, keeping the last known certificate in case of corruption. When this happens, old ingress-controller pods will keep serving the old one, while new pods, by failing to load the corrupted certificates, would use the default certificate, causing invalid certificates for its clients. This generates a random error on the client side, depending on the actual pod instance it reaches. In order to allow detecting occurences of those situations, add a metric to expose, for all ingress controlller pods, detailed informations of the currently loaded certificate. This will, for example, allow setting an alert when there is a certificate discrepency across all ingress controller pods using a query similar to `sum(nginx_ingress_controller_ssl_certificate_info{host="name.tld"})by(serial_number)` This also allows to catch other exceptions loading certificates (failing to load the certificate from the k8s API, ... Co-authored-by: Daniel Ricart <[email protected]> Co-authored-by: Daniel Ricart <[email protected]> Issue#8241 (kubernetes#8273) * replace daemon set for deployment manifest * nit Start Release process for v1.1.2 (kubernetes#8275) Signed-off-by: Jintao Zhang <[email protected]> Add fsGroup value to admission-webhooks/job-patch charts (kubernetes#8267) * added fsGroup to admission createSecret and patchWebhook job * added fsGroup to admission createSecret and patchWebhook job * modified helm/README.md to add value for fsGroup * fixed patch job values ordering * remove manually edited README for replacement with helm-docs generated version * re-adding charts/README.md generated by helm-docs Add OpenSSF Best practices badge (kubernetes#8277) fix: deny locations with invalid auth-url annotation (kubernetes#8256) * fix: deny locations with invalid auth-url annotation Signed-off-by: m.nabokikh <[email protected]> * Delete duplicate test Signed-off-by: m.nabokikh <[email protected]> force prow job by changing something in images/ot dir (kubernetes#8281) Images dir was merged in before the test-infra prow job, so the image was never built. kubernetes#8013 Jan 16 https://github.com/kubernetes/test-infra/pull/25344/files Prow job 4 days ago. Fix OpenTelemetry sidecar image build (kubernetes#8286) * fix wrong checksum for nginx image * fix wrong platform. Arm64 has grpc, when arm doesn't update tag for image (kubernetes#8290) remove git tag env from cloud build the latest git tag is from helm, so force the make file use of TAG ?=v$(shell date +%m%d%Y)-$(shell git rev-parse --short HEAD) release-v1.1.2-continued (kubernetes#8294) * v1.1.2 release Signed-off-by: Jintao Zhang <[email protected]> * release-v1.1.2-continued Co-authored-by: Jintao Zhang <[email protected]> docs: fix changelog formatting (kubernetes#8302) leaving it the git tag (kubernetes#8311) fixing the git tag for the image version, it is what it is . Missing annotations (kubernetes#8288) Not quite sure but It seems that `nginx.ingress.kubernetes.io/canary-by-header` is missing. Names cannot contain _ (underscore)! So I changed it to -. (kubernetes#8300) * The name can't use _(underscore)! So fix it! The name can't use _(underscore)! So fix it! * Fix configMap name can't use _(underscore) Fix configMap name can't use _(underscore) Pinned GitHub workflows by SHA (kubernetes#8334) - Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies - Included permissions for some of the actions. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions Dependabot can upgrade pinned version of actions. Update monitoring.md (kubernetes#8324) Added missing repo on "helm upgrade" command Add the shareProcessNamespace as a configurable setting. (kubernetes#8287) Nginx v1.19.10 (kubernetes#8307) kubectl code overview info

k8s-ci-robot added needs-priority size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 7, 2022

k8s-ci-robot requested review from ElvinEfendi and rikatz March 7, 2022 11:25

sskserk changed the title ~~nginx 1.19.10~~ Nginx v1.19.10 Mar 7, 2022

iamNoah1 reviewed Mar 7, 2022

View reviewed changes

sskserk requested a review from iamNoah1 March 7, 2022 13:28

sskserk force-pushed the nginx_11910 branch 2 times, most recently from c5eb904 to 068996c Compare March 7, 2022 14:47

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Mar 7, 2022

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. priority/backlog Higher priority than priority/awaiting-more-evidence. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 7, 2022

k8s-ci-robot removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-kind Indicates a PR lacks a `kind/foo` label and requires one. labels Mar 7, 2022

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 9, 2022

k8s-ci-robot assigned strongjz Mar 9, 2022

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Mar 9, 2022

sskserk force-pushed the nginx_11910 branch from 068996c to a9852fa Compare March 11, 2022 16:05

k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Mar 11, 2022

rikatz reviewed Mar 11, 2022

View reviewed changes

internal/ingress/controller/config/config.go Outdated Show resolved Hide resolved

Nginx v1.19.10

56241b2

sskserk force-pushed the nginx_11910 branch from a9852fa to 56241b2 Compare March 14, 2022 09:20

k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Mar 14, 2022

sskserk requested review from rikatz and strongjz March 14, 2022 10:25

k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. and removed do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. labels Mar 14, 2022

k8s-ci-robot merged commit 01b92b8 into kubernetes:main Mar 14, 2022

rchshld pushed a commit to joomcode/ingress-nginx that referenced this pull request May 19, 2023

Nginx v1.19.10 (kubernetes#8307)

2cb9755

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Nginx v1.19.10 #8307

Nginx v1.19.10 #8307

sskserk commented Mar 7, 2022 •

edited

Loading

linux-foundation-easycla bot commented Mar 7, 2022 •

edited

Loading

k8s-ci-robot commented Mar 7, 2022

sskserk commented Mar 7, 2022 •

edited by linux-foundation-easycla bot

Loading

iamNoah1 left a comment

sskserk commented Mar 7, 2022

dmathieu commented Mar 7, 2022

sskserk commented Mar 7, 2022

jarias-lfx commented Mar 7, 2022

strongjz commented Mar 7, 2022

sskserk commented Mar 7, 2022 •

edited

Loading

sskserk commented Mar 7, 2022

sskserk commented Mar 7, 2022

strongjz commented Mar 7, 2022

sskserk commented Mar 8, 2022

strongjz commented Mar 9, 2022

sskserk commented Mar 10, 2022

strongjz commented Mar 14, 2022

k8s-ci-robot commented Mar 14, 2022

strongjz commented Mar 14, 2022

Nginx v1.19.10 #8307

Nginx v1.19.10 #8307

Conversation

sskserk commented Mar 7, 2022 • edited Loading

What this PR does / why we need it:

Types of changes

Which issue/s this PR fixes

How Has This Been Tested?

Checklist:

linux-foundation-easycla bot commented Mar 7, 2022 • edited Loading

k8s-ci-robot commented Mar 7, 2022

sskserk commented Mar 7, 2022 • edited by linux-foundation-easycla bot Loading

iamNoah1 left a comment

Choose a reason for hiding this comment

sskserk commented Mar 7, 2022

dmathieu commented Mar 7, 2022

sskserk commented Mar 7, 2022

jarias-lfx commented Mar 7, 2022

strongjz commented Mar 7, 2022

sskserk commented Mar 7, 2022 • edited Loading

sskserk commented Mar 7, 2022

sskserk commented Mar 7, 2022

strongjz commented Mar 7, 2022

sskserk commented Mar 8, 2022

strongjz commented Mar 9, 2022

sskserk commented Mar 10, 2022

strongjz commented Mar 14, 2022

k8s-ci-robot commented Mar 14, 2022

strongjz commented Mar 14, 2022

sskserk commented Mar 7, 2022 •

edited

Loading

linux-foundation-easycla bot commented Mar 7, 2022 •

edited

Loading

sskserk commented Mar 7, 2022 •

edited by linux-foundation-easycla bot

Loading

sskserk commented Mar 7, 2022 •

edited

Loading