Merge branch 'main' into jp-docops-1683

.github/dependency-review-config.yml

@@ -0,0 +1,13 @@
+allow_licenses:
+  - Apache-1.1
+  - Apache-2.0
+  - BSD-2-Clause
+  - BSD-3-Clause
+  - BSL-1.0
+  - ISC
+  - MIT
+  - NCSA
+  - OpenSSL
+  - Python-2.0
+  - X11
+comment-summary-in-pr: true

.github/workflows/build-oss.yml

@@ -66,7 +66,7 @@ jobs:
         if: ${{ github.event_name != 'pull_request' && ! startsWith(github.ref, 'refs/heads/release-') }}
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@5727f247b64f324ec403ac56ae05e220fd02b65f # v2.1.0
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_PUBLIC_ECR }}

.github/workflows/build-plus.yml

@@ -69,7 +69,7 @@ jobs:
         if: github.event_name != 'pull_request'
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@5727f247b64f324ec403ac56ae05e220fd02b65f # v2.1.0
+        uses: aws-actions/configure-aws-credentials@5fd3084fc36e372ff1fff382a39b10d03659f355 # v2.2.0
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.AWS_ROLE_MARKETPLACE }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,20 @@
+name: "Dependency Review"
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: "Checkout Repository"
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@1360a344ccb0ab6e9475edef90ad2f46bf8003b1 # v3.0.6
+        with:
+          config-file: "./.github/dependency-review-config.yml"

.goreleaser.yml

@@ -93,36 +93,38 @@ builds:
     tags:
       - aws
 
-archives:
-  - id: kubernetes-ingress
-    builds: [kubernetes-ingress]
-
 changelog:
   skip: true
 
-checksum:
-  name_template: 'checksums.txt'
+archives:
+  - id: kubernetes-ingress
+    builds: [kubernetes-ingress]
 
 sboms:
   - artifacts: archive
     ids: [kubernetes-ingress]
+    documents:
+      - "${artifact}.spdx.json"
 
 release:
   ids: [kubernetes-ingress]
   extra_files:
-    - glob: ./dist/**.sbom
+    - glob: ./dist/**.spdx.json
 
 blobs:
   - provider: azblob
     bucket: '{{.Env.AZURE_BUCKET_NAME}}'
     extra_files:
-      - glob: ./dist/**.sbom
-
-milestones:
-  - close: true
+      - glob: ./dist/**.spdx.json
 
 announce:
   slack:
     enabled: true
     channel: '#announcements'
     message_template: 'NGINX Ingress Controller {{ .Tag }} is out! Check it out: {{ .ReleaseURL }}'
+
+milestones:
+  - close: true
+
+snapshot:
+  name_template: 'edge'

Makefile

@@ -95,7 +95,7 @@ endif
 .PHONY: build-goreleaser
 build-goreleaser: ## Build Ingress Controller binary using GoReleaser
 	@goreleaser -v || (code=$$?; printf "\033[0;31mError\033[0m: there was a problem with GoReleaser. Follow the docs to install it https://goreleaser.com/install\n"; exit $$code)
-	GOOS=linux GOPATH=$(shell go env GOPATH) GOARCH=$(ARCH) goreleaser build --rm-dist --debug --snapshot --id kubernetes-ingress --single-target
+	GOOS=linux GOPATH=$(shell go env GOPATH) GOARCH=$(ARCH) goreleaser build --clean --debug --snapshot --id kubernetes-ingress --single-target
 
 .PHONY: debian-image
 debian-image: build ## Create Docker image for Ingress Controller (Debian)

build/Dockerfile

@@ -10,7 +10,7 @@ FROM opentracing/nginx-opentracing:nginx-1.25.0-alpine as alpine-opentracing-lib
 
 
 ############################################# Base image for Debian #############################################
-FROM nginx:1.25.0 AS debian
+FROM nginx:1.25.1 AS debian
 
 RUN --mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \
 	apt-get update \
@@ -24,7 +24,7 @@ RUN --mount=type=bind,from=opentracing-lib,target=/tmp/ot/ \
 
 
 ############################################# Base image for Alpine #############################################
-FROM nginx:1.25.0-alpine AS alpine
+FROM nginx:1.25.1-alpine AS alpine
 
 RUN --mount=type=bind,from=alpine-opentracing-lib,target=/tmp/ot/ \
 	apk add --no-cache libcap libstdc++ \
@@ -110,7 +110,7 @@ RUN --mount=type=secret,id=nginx-repo.crt,dst=/etc/ssl/nginx/nginx-repo.crt,mode
 
 
 ############################################# Base image for UBI #############################################
-FROM nginxcontrib/nginx:1.25.0-ubi AS ubi
+FROM nginxcontrib/nginx:1.25.1-ubi AS ubi
 ARG IC_VERSION
 
 LABEL name="NGINX Ingress Controller" \

deployments/common/crds/k8s.nginx.org_virtualserverroutes.yaml

@@ -588,6 +588,8 @@ spec:
                             type: string
                           path:
                             type: string
+                          samesite:
+                            type: string
                           secure:
                             type: boolean
                       slow-start:

deployments/common/crds/k8s.nginx.org_virtualservers.yaml

@@ -675,6 +675,8 @@ spec:
                             type: string
                           path:
                             type: string
+                          samesite:
+                            type: string
                           secure:
                             type: boolean
                       slow-start:

deployments/helm-chart/crds/k8s.nginx.org_virtualserverroutes.yaml

@@ -588,6 +588,8 @@ spec:
                             type: string
                           path:
                             type: string
+                          samesite:
+                            type: string
                           secure:
                             type: boolean
                       slow-start:

deployments/helm-chart/crds/k8s.nginx.org_virtualservers.yaml

@@ -675,6 +675,8 @@ spec:
                             type: string
                           path:
                             type: string
+                          samesite:
+                            type: string
                           secure:
                             type: boolean
                       slow-start:

docs/content/configuration/virtualserver-and-virtualserverroute-resources.md

@@ -460,6 +460,7 @@ sessionCookie:
   domain: .example.com
   httpOnly: false
   secure: true
+  samesite: strict
 ```
 See the [`sticky`](https://nginx.org/en/docs/http/ngx_http_upstream_module.html?#sticky) directive for additional information. The session cookie corresponds to the `sticky cookie` method.
 
@@ -475,6 +476,7 @@ Note: This feature is supported only in NGINX Plus.
 |``domain`` | The domain for which the cookie is set. | ``string`` | No |
 |``httpOnly`` | Adds the ``HttpOnly`` attribute to the cookie. | ``boolean`` | No |
 |``secure`` | Adds the ``Secure`` attribute to the cookie. | ``boolean`` | No |
+|``samesite`` | Adds the ``SameSite`` attribute to the cookie. The allowed values are: ``strict``, ``lax``, ``none`` | ``string`` | No |
 {{% /table %}}
 
 ### Header

docs/content/f5-ingresslink.md

@@ -2,7 +2,7 @@
 title: Using with F5 BIG-IP
 description: |
   Learn how to use NGINX Ingress Controller with F5 IngressLink to configure your F5 BIG-IP device.
-weight: 1800
+weight: 2000
 doctypes: ["concept"]
 toc: true
 docs: "DOCS-600"

docs/content/installation/installation-with-manifests.md

@@ -112,7 +112,7 @@ Create a custom resource definition for `APDosPolicy`, `APDosLogConf` and `DosPr
    $ kubectl apply -f common/crds/appprotectdos.f5.com_dosprotectedresources.yaml
    ```
 
-## 3. Deploy the Ingress Controller
+## 4. Deploy the Ingress Controller
 
 We include two options for deploying the Ingress Controller:
 * *Deployment*. Use a Deployment if you plan to dynamically change the number of Ingress Controller replicas.
@@ -132,7 +132,7 @@ If you would like to use the App Protect DoS module, you will need to deploy the
    $ kubectl apply -f service/appprotect-dos-arb-svc.yaml
    ```
 
-### 3.1 Run the Ingress Controller
+### 4.1 Run the Ingress Controller
 * *Use a Deployment*.
     When you run the Ingress Controller by using a Deployment, by default, Kubernetes will create one Ingress Controller pod.
 
@@ -165,20 +165,20 @@ If you would like to use the App Protect DoS module, you will need to deploy the
 
     **Note**: Update the `nginx-plus-ingress.yaml` with the chosen image from the F5 Container registry; or the container image that you have built.
 
-### 3.2 Check that the Ingress Controller is Running
+### 4.2 Check that the Ingress Controller is Running
 
 Run the following command to make sure that the Ingress Controller pods are running:
 ```
 $ kubectl get pods --namespace=nginx-ingress
 ```
 
-## 4. Get Access to the Ingress Controller
+## 5. Get Access to the Ingress Controller
 
 **If you created a daemonset**, ports 80 and 443 of the Ingress Controller container are mapped to the same ports of the node where the container is running. To access the Ingress Controller, use those ports and an IP address of any node of the cluster where the Ingress Controller is running.
 
 **If you created a deployment**, below are two options for accessing the Ingress Controller pods.
 
-### 4.1 Create a Service for the Ingress Controller Pods
+### 5.1 Create a Service for the Ingress Controller Pods
 
 * *Use a NodePort service*.
 

docs/content/releases.md

@@ -1,7 +1,7 @@
 ---
 title: Releases
 description: "NGINX Ingress Controller Release Notes."
-weight: 1900
+weight: 2100
 doctypes: ["concept"]
 toc: true
 docs: "DOCS-616"

docs/content/technical-specifications.md

@@ -1,7 +1,7 @@
 ---
 title: Technical Specifications
 description: "NGINX Ingress Controller Technical Specifications."
-weight: 2000
+weight: 2200
 doctypes: ["concept"]
 toc: true
 docs: "DOCS-617"

docs/content/troubleshooting/_index.md

@@ -1,7 +1,7 @@
 ---
 title: Troubleshooting
 description:
-weight: 2000
+weight: 1800
 menu:
   docs:
     parent: NGINX Ingress Controller

docs/content/tutorials/_index.md

@@ -1,7 +1,7 @@
 ---
 title: Tutorials
 description:
-weight: 2100
+weight: 1900
 menu:
   docs:
     parent: NGINX Ingress Controller

docs/go.mod

@@ -2,4 +2,4 @@ module github.com/nginxinc/kubernetes-ingress/docs
 
 go 1.19
 
-require github.com/nginxinc/nginx-hugo-theme v0.28.0
+require github.com/nginxinc/nginx-hugo-theme v0.32.0

docs/go.sum

@@ -1,2 +1,3 @@
 github.com/nginxinc/nginx-hugo-theme v0.28.0 h1:RHHvBmFk2Uptk+efLPSIuBd2elc3IOZPElkJbkkpAHo=
 github.com/nginxinc/nginx-hugo-theme v0.28.0/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=
+github.com/nginxinc/nginx-hugo-theme v0.32.0/go.mod h1:DPNgSS5QYxkjH/BfH4uPDiTfODqWJ50NKZdorguom8M=

go.mod

@@ -3,8 +3,8 @@ module github.com/nginxinc/kubernetes-ingress
 go 1.20
 
 require (
-	github.com/aws/aws-sdk-go-v2/config v1.18.22
-	github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.10
+	github.com/aws/aws-sdk-go-v2/config v1.18.26
+	github.com/aws/aws-sdk-go-v2/service/marketplacemetering v1.14.13
 	github.com/cert-manager/cert-manager v1.12.1
 	github.com/go-chi/chi/v5 v5.0.8
 	github.com/golang-jwt/jwt/v4 v4.5.0
@@ -14,31 +14,31 @@ require (
 	github.com/nginxinc/nginx-plus-go-client v0.10.0
 	github.com/nginxinc/nginx-prometheus-exporter v0.11.0
 	github.com/nginxinc/nginx-service-mesh v1.7.0
-	github.com/prometheus/client_golang v1.15.1
+	github.com/prometheus/client_golang v1.16.0
 	github.com/spiffe/go-spiffe/v2 v2.1.6
 	github.com/stretchr/testify v1.8.4
 	golang.org/x/exp v0.0.0-20230105000112-eab7a2c85304
-	k8s.io/api v0.27.2
-	k8s.io/apimachinery v0.27.2
-	k8s.io/client-go v0.27.2
-	k8s.io/code-generator v0.27.2
+	k8s.io/api v0.27.3
+	k8s.io/apimachinery v0.27.3
+	k8s.io/client-go v0.27.3
+	k8s.io/code-generator v0.27.3
 	k8s.io/utils v0.0.0-20230505201702-9f6742963106
 	sigs.k8s.io/controller-tools v0.12.0
 )
 
 require (
 	github.com/Azure/go-ntlmssp v0.0.0-20220621081337-cb9428e4ac1e // indirect
 	github.com/Microsoft/go-winio v0.6.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.18.0 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.33 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.27 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.34 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.27 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.12.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.18.10 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.18.1 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.13.25 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.28 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.3.35 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.28 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.12.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.14.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.19.1 // indirect
 	github.com/aws/smithy-go v1.13.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
@@ -85,7 +85,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.4.0 // indirect
 	github.com/prometheus/common v0.42.0 // indirect
-	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/prometheus/procfs v0.10.1 // indirect
 	github.com/rogpeppe/go-internal v1.10.0 // indirect
 	github.com/spf13/cobra v1.7.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect