Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

Gateway API CRD Updates (All Gateway API users)

Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller.

Why: This release requires Gateway API CRDs v1.6.0. The controller is built against this version for conformance and feature support

Important: Update CRDs before upgrading the controller. If you upgrade the controller first, NLB Gateway (TCPRoute/UDPRoute/TLSRoute) will be automatically disabled until the CRDs are updated. Since the standard install no longer serves v1alpha2, you must update any existing v1alpha2 route manifests to gateway.networking.k8s.io/v1

Action: Apply v1.6 Gateway CRDs

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.0/standard-install.yaml

LBC Gateway CRD Updates (All Gateway API users)

Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller.

Why: This release adds v1 as the storage version for LBC-specific Gateway CRDs (LoadBalancerConfiguration, TargetGroupConfiguration, ListenerRuleConfiguration), with v1beta1 marked as deprecated. The controller reads v1 only, but existing v1beta1 resources are transparently converted to v1 by the API server — no immediate manifest changes required. However, v1beta1 will stop being served in a future release. We recommend updating your manifests to use gateway.k8s.aws/v1 at your earliest convenience.

Action: Apply the updated LBC Gateway CRDs:

kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml

🚀What's New

Gateway API v1 Graduation

This release graduates Gateway API support to v1 for L4 routes. TCPRoute and UDPRoute now use the stable gateway.networking.k8s.io/v1 API version (previously v1alpha2), and the controller passes Gateway API conformance v1.6.0. The AWS-vended Gateway API CRDs have been upgraded to v1 accordingly.

🔧Enhancements and Fixes

Certificate Management

• Fix ACM certificate creation for Ingresses with wildcard hosts — the character in hostname was breaking ACM tag validation Certificate list support for ECDSA/RSA use
• Add certificate management controller flag to helm chart

Route Precedence

• Unified cross-kind route precedence for HTTPRoute/GRPCRoute, single code path eliminates non-transitivity
• Fix non-transitive rule precedence for routes without hostnames

Networking

• Filter EndpointSlices by IP family for target group registration
• Match hosted zones by longest suffix in GetHostedZoneID
• Fix: ICMP Type/Code constants
• Fix: render feature gates as parseable key-value pairs

Module & Build

• Module path updated to sigs.k8s.io/aws-load-balancer-controller/v3. Users who are importing the code base will need to adjust their imports accordingly.

Helm

• Correct enableEndpointSlices default in Helm values comment

📖 Documentation Updates

• Add guidance on migrating between services without downtime
• Clarify scheme change replacement behavior
• Fix Markdown formatting of blue/green guide
• Fix stale contributor setup and invalid IAM role ARN examples
• Fix doc annotation name
• Fix admonition indentation for ipam-ipv4-pool-id annotation
• Clarify WAF addon ownership and document IngressGroup security risks
• Remove CloudFormation link

What's Changed

• Fix Markdown formatting of blue/green guide by @Tenzer in #4835
• ci: Add GO-2026-5932 to govulncheck ignore list by @shraddhabang in #4839
• use /v3 in module name by @zac-nixon in #4770
• feat(gateway): Use Gateway API v1 for TCPRoute and UDPRoute by @nicomazzarello in #4829
• upgrade AWS vended Gateway API CRDs to v1 by @zac-nixon in #4844
• update code to use v1 crds by @zac-nixon in #4845
• Add label for accessing secrets - to support restricted access for EKS Auto LBC by @jupdec in #4838
• docs: fix admonition indentation for ipam-ipv4-pool-id annotation by @nikhilmaheshwari24 in #4837
• v1.6.0 conformance + rule refactor by @zac-nixon in #4861
• fix: handle invalid condition name for tgb by @zac-nixon in #4862
• Fix ACM certificate creation for Ingresses with wildcard hosts by @nbr in #4786
• docs: clarify scheme change replacement by @kappa8219 in #4860
• fix: use "/" separator in getCacheKey to avoid TGB cache collisions by @jupdec in #4864
• fix: subnet auto-discovery to IPv6-capable subnets for dualstack ip address type by @jupdec in #4865
• Add ipv6 check for tests by @wweiwei-li in #4868
• cut v3.5.0 release by @wweiwei-li in #4869

New Contributors

• @Tenzer made their first contribution in #4835
• @nicomazzarello made their first contribution in #4829
• @nikhilmaheshwari24 made their first contribution in #4837
• @kappa8219 made their first contribution in #4860

Full Changelog: v3.4.2...v3.5.0

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

[ALB Gateway Users] Double check your ALB rule limits, when using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated. Users who specify multiple hostnames per route will want to double check their ALB limits. 2c65734

CRD Updates

• No CRD updates required for this release.

IAM Policy Updates

• No IAM policy changes required for this release.

Gateway API updates

• No Gateway API CRD updates required for this release.

🔧 Enhancements and Fixes

[Rule precedence] - When using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated.
[Validation Fix] - Fixed a bug that let invalid protocol types get ignored, rather than throwing a validation error.
[Process Crash] - Fixed a bug that caused a NPE when an invalid pod health condition was present.

What's Changed

• V3.4.3 by @zac-nixon in #4863

Full Changelog: v3.4.2...v3.4.3

v3.4.2 Release Notes

📚 Quick Links

v3.4.2 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.2

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

• No CRD updates required for this release.

IAM Policy Updates

• No IAM policy changes required for this release.

Gateway API updates

• No Gateway API CRD updates required for this release.

🔒 Security Fix

• Cross-Kind Route Precedence Fix (PR #4818): Fixed a vulnerability where ALB listener rule priority was determined by route kind rather than route specificity when HTTPRoute and GRPCRoute share a hostname on the same Gateway listener. Previously, HTTPRoute would always receive a lower ALB priority number (evaluated first) than a specific GRPCRoute, allowing cross-namespace traffic interception. The controller now uses a unified precedence comparator that orders rules by hostname specificity → path type → path length → method constraint → header count → creation timestamp, regardless of route kind.

  Affected configurations: Shared Gateways with AllowedRoutes.Namespaces.From: All (or a namespace selector admitting multiple tenants) where both HTTPRoute and GRPCRoute attach to the same HTTPS listener with the same hostname.

  Workaround for unpatched versions: Restrict Gateway listener AllowedRoutes.Namespaces.From to Same or use a restrictive namespace Selector.

🔧 Enhancements and Fixes

• [Security fix] Unified cross-kind route precedence for HTTPRoute/GRPCRoute — specific routes now correctly outrank catch-all routes regardless of kind (#4818)
• [Bug fix] Fix e2e test gRPC service name mismatch in cross-kind precedence test (#4830)
• [Enhancement] Upgrade Go toolchain from 1.26.4 to 1.26.5 — fixes CVE-2026-39822 and CVE-2026-42505

Documentation Updates

• Add guidance on migrating between services without downtime (#4819)

🌟 Complete Change Log

• fix(gateway): Unified cross-kind route precedence for HTTPRoute/GRPCRoute by @shraddhabang in #4818
• fix(e2e): Use correct gRPC service name in cross-kind precedence test by @shraddhabang in #4830
• docs: add guidance on migrating between services without downtime by @Thiru-2004-varul in #4819

New Contributors

• @Thiru-2004-varul made their first contribution in #4819

Full Changelog: v3.4.1...v3.4.2

v3.4.1 Release Notes

📚 Quick Links

v3.4.1 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.1

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

IAM Policy Updates

• No IAM policy changes required for this release.

Gateway API updates

• No Gateway API CRD updates required for this release.

🚀 What's New

Ingress Features

• ECDSA/RSA Certificate Auto-Discovery (PR #4490): The controller now supports automatic discovery of both ECDSA and RSA certificates from ACM when building the certificate list for Ingress resources. This enables dual-certificate configurations for optimized TLS performance across different client types.
  Gateway API Features
• Shared Hostname for HTTPRoute and GRPCRoute (PR #4794): HTTPRoute and GRPCRoute resources can now share the same hostname on a Gateway listener. The overlapping hostname restriction between HTTP and gRPC routes has been removed, enabling mixed protocol configurations on the same domain.

🔧 Enhancements and Fixes

• [Bug fix] Filter EndpointSlices by IP family for target group registration — prevents IPv4 addresses from being registered to IPv6 target groups (#4783)
• [Bug fix] Match hosted zones by longest suffix in GetHostedZoneID — fixes DNS validation for deeply nested subdomains and wildcard SANs (#4785)
• [Bug fix] Fix non-transitive rule precedence for routes without hostnames — catch-all routes no longer intermittently sort above host-specific rules (#4809)
• [Bug fix] Fix ICMP Type/Code constants (#4799)
• [Bug fix] Fix render feature gates as parseable key-value pairs (#4757)
• [Enhancement] Add enableCertificateManagement controller flag to Helm chart (#4726)

Documentation Updates

• Correct enableEndpointSlices default value in Helm values comment (#4806)
• Clarify WAF addon ownership and document IngressGroup security risks (#4797)
• Fix stale contributor setup and invalid IAM role ARN examples (#4791)
• Fix doc annotation name (#4787)

🌟 Complete Change Log

• [fix] filter EndpointSlices by IP family for target group registration by @shuqz in #4783
• [fix] doc annotation name by @shuqz in #4787
• refactor ipv6 testing by @zac-nixon in #4788
• add ipv6 annotations to cert generation tests by @zac-nixon in #4790
• Match Route53 hosted zones by longest suffix in GetHostedZoneID by @nbr in #4785
• Fix feature gates string representation by @immanuwell in #4757
• add source nat setting so udp tests pass on ipv6 cluster by @zac-nixon in #4795
• skip service quic tests when using ipv6 by @zac-nixon in #4796
• Clarify WAF addon ownership and document IngressGroup security risks by @wweiwei-li in #4797
• fix: ICMP Type/Code constants by @wweiwei-li in #4799
• docs: fix stale contributor setup and invalid IAM role ARN examples by @immanuwell in #4791
• Auto discovery default certificate and certificate list by @abeowlu in #4490
• [Gateway API]remove overlapping check in httpRoute and GRPCRoute by @shuqz in #4794
• fix(cert_management): add default-pca-arn controller flag to helm chart by @the-technat in #4726
• Fix non-transitive rule precedence for routes without hostnames by @sergeylanzman in #4809
• Fix incorrect enableEndpointSlices default in Helm values.yaml comment by @BobDu in #4806
• cut v3.4.1 release by @shraddhabang in #4813

New Contributors

• @nbr made their first contribution in #4785
• @abeowlu made their first contribution in #4490
• @sergeylanzman made their first contribution in #4809

Full Changelog: v3.4.0...v3.4.1

📚 Quick Links

v3.4.0 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.0
Thanks to all our contributors! 😊

🎉 Ingress to Gateway Migration Tool

We are excited to introduce the Ingress to Gateway Migration Tool, the biggest addition in this release! This tooling helps you migrate AWS Load Balancer Controller (LBC) Ingress resources to Gateway API resources, step by step. The migration is designed to be safe and non-disruptive — new ALBs are created alongside your existing ones, so current workloads keep running throughout the entire process.

Two tools are provided to help you migrate with confidence:s

• lbc-migrate CLI: Translates your Ingress manifests (annotations, rules, and IngressGroups) into equivalent Gateway API YAML. Supports cluster scraping (--from-cluster), file input (-f), directory input (--input-dir), single-Ingress and multi-namespace scoping, and per-namespace output splitting.
• Migration Console: A local, in-cluster web UI that compares the AWS resource stack produced by both the Ingress and Gateway controllers, field by field. This lets you verify equivalence before applying your Gateway manifests for real.

To get started, see the Migration Guide for the end-to-end walkthrough.

We encourage you to try it out and welcome any feedback via GitHub Issues.

⚠️ Gateway API Behavior Change

Only one L4 route per listener is eligible for traffic when using an NLB Gateway

• Change: When multiple L4 (TCP/UDP/TLS) routes target the same listener, the controller only forwards traffic to the oldest route. (#4745).
• Impact: If you currently attach more than one TCP/UDP/TLS route to the same listener, only the oldest route will continue serving traffic after upgrading. Review your L4 route configurations and consolidate to a single route per listener to avoid unexpected traffic changes.

🔧 Enhancements and Fixes

• Regex path reconcile loop: Ignore the top-level RegexValues field that AWS mirrors in DescribeRules responses, preventing an unnecessary ModifyRule on every reconcile (#4749)
• Service reconciler nil check: Return early in the service reconciler when the load balancer is nil (#4751)
• TGC health check for ALB target groups: Fixed an error when updating health check settings in TargetGroupConfiguration for Gateway API ALB target groups (#4741)
• NLB weighted target groups: Allow weight 0 for NLB weighted target groups, with a guard requiring at least one non-zero weight (#4738)
• Capacity units validation: Validate CapacityUnits on capacity reservation annotations instead of silently dropping parse errors (which reset the reservation to 0) (#4750)
• Checkpoint early-exit race: Ensure pods with pending readiness gates are always reconciled, fixing a checkpoint early-exit race with same-IP re-registration (#4737)
• Retryable error wrapping: Wrap the last retryable error with a timeout error for clearer failure reporting (#4761)
• Readiness gate efficiency: The TargetGroupBinding controller now watches pod events instead of requeueing on a fixed timer when using readiness gates, responding faster while avoiding unnecessary requeues (#4678)
• Unit-test workflow permissions: Declare contents: read on the unit-test workflow to pin the default GITHUB_TOKEN to read-only (#4736)
• Webhooks upgraded to v1: Admission webhooks were upgraded from v1beta1 to v1. Applied automatically on upgrade — no action needed (#4743)
• Listener rule tag reconcile: Reconcile listener rule tags for all matched rules (#4772)

🌟 Complete Change Log

• [feat i2g]support split by namespace output by @shuqz in #4733
• [feat i2g] Fix user tag propagation to ListenerRuleConfigurations in lbc-migrate by @shuqz in #4735
• [feat i2g] Add IngressPlanAnnotation feature gate for dry-run plan by @shuqz in #4734
• fix checkpoint early-exit by @wweiwei-li in #4737
• [fix]allow weight zero in NLB target group by @shuqz in #4738
• Watch pod events for updating TargetGroupBindings with ReadinessGates by @cezarsa in #4678
• [feat i2g] multi-ingress TGC with RouteConfigurations by @shuqz in #4742
• upgrade webhooks to v1 by @zac-nixon in #4743
• Fix error when updating health check settings in TGC for Gateway API ALB target groups by @shraddhabang in #4741
• reject multiple l4 routes for same listener by @zac-nixon in #4745
• fix: return early in service reconciler when lb is nil by @wweiwei-li in #4751
• Validate load balancer capacity units annotations by @immanuwell in #4750
• [feat i2g] bug fix by @shuqz in #4746
• [feat i2g]setup e2e test for migration tool by @shuqz in #4739
• ci(test): declare contents: read on the unit-test workflow by @arpitjain099 in #4736
• [feat i2g]add in-cluster console for model comparison by @shuqz in #4728
• fix: ignore top-level RegexValues mirrored by AWS in DescribeRules response by @pataraktw in #4749
• [feat i2g] add e2e tests for ingress2gateway migration tool by @shuqz in #4771
• [feat i2g] docs: migration guide, lbc-migrate reference, and in-cluster console by @shuqz in #4759
• Add multiple ingress test that sorts rules based on priority by @jupdec in #4756
• Reconcile listener rule tags for all matched rules by @andreybutenko in #4772
• cut v3.4.0 release by @shuqz in #4776

New Contributors

• @immanuwell made their first contribution in #4750
• @arpitjain099 made their first contribution in #4736
• @pataraktw made their first contribution in #4749

Full Changelog: v3.3.0...v3.4.0

v3.3.0 Release Notes

📚 Quick Links

v3.3.0 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.3.0

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action: Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

IAM Policy Updates

If you enable the EnableCertificateManagement feature gate, attach the additional IAM policy for ACM and Route53 permissions to your controller's IAM role. See the documentation for details.

Gateway API updates

• Installation of LBC Gateway API specific CRDs: kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml
• If using only ALB Gateway
  • Standard Gateway API CRDs: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/standard-install.yaml
• If using NLB Gateway
  • Experimental Gateway API CRDs: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/experimental-install.yaml [Required: Used for L4 Routes]

🚀 What's New

Ingress Features

• ACM Certificate Management (Feature Gate: EnableCertificateManagement): The controller can now automatically create and manage TLS certificates in ACM using hostnames from Ingress resources. It supports both Amazon-issued certificates with DNS validation via Route53 and private certificates via AWS Private CA. Enable with --feature-gates=EnableCertificateManagement=true and the create-acm-cert: "true" annotation. See the Certificate Management documentation for setup, IAM policy requirements, and ingress group behavior.

🔧 Enhancements and Fixes

• [Bug fix] Fix ENI resolution when pod has an IPv6 address (#4706)
• [Bug fix] Fix frontend NLB listener and target group tagging (#4700)
• [Bug fix] Add externalId into cache key for cross-account TGB (#4714)
• [Bug fix] ACM cert management bug fixes and doc improvements
• [Enhancement] Gateway API auto-detection improvements and LBC-specific CRD handling in Helm

Documentation Updates

• ACM Certificate Management guide with ingress group behavior, security considerations, and IAM policy scoping
• Updated the gateway api installation docs to include the AWS vended CRD as pre-requisites

What's Changed

• fix: tag frontend NLB target groups and listeners by @hakman in #4700
• Retry gateway nlb with tls listener send https request test by @bobert-2 in #4701
• Retry gateway nlb with tls listener and instance target test by @bobert-2 in #4703
• randomize gatewayclass in e2e test by @zac-nixon in #4704
• [feat i2g]support group ingress translate by @shuqz in #4692
• [feat i2g] add documentation for tgb by @shuqz in #4705
• feat(acm): add ACM certificate management feature by @the-technat in #4554
• [feat i2g]support dry-run mode for gateway api controller by @shuqz in #4709
• fix eni resolution when pod has an ipv6 address by @zac-nixon in #4706
• Automate helm ClusterRole RBAC sync from kubebuilder by @shraddhabang in #4686
• Increase timeout for gateway nlb tls listener tests by @bobert-2 in #4713
• add externalId into cache key by @shuqz in #4714
• enhance gateway auto detection logic for CRD by @shuqz in #4721
• [feat acm-certs-mgmt] bug fixes and doc improvements by @shraddhabang in #4711
• cut v3.3.0 release by @shraddhabang in #4723

New Contributors

• @hakman made their first contribution in #4700

Full Changelog: v3.2.2...v3.3.0

v3.2.2 Release Notes

📚 Quick Links

v3.2.2 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.2.2

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

What's Changed

• [feat i2g]support ssl-redirect translate by @shuqz in #4669
• Add dynamic annoucement banner for live docs by @shraddhabang in #4673
• fixed#4680 wrapping last retryable err with timeout err by @viveksb007 in #4681
• [feat i2g]support auth translate by @shuqz in #4679
• [feat i2g]support jwt-validation translate by @shuqz in #4683
• Fix HyperPod pod ENI resolution with VPC CNI prefix delegation by @guessi in #4667
• remove special isolated region check for listener attributes by @zac-nixon in #4690
• pin shas for github workflows by @zac-nixon in #4691
• Override user agent by @wweiwei-li in #4694
• ignore listenerset when CRD is missing by @zac-nixon in #4689
• release v3.2.2 by @zac-nixon in #4696

New Contributors

• @viveksb007 made their first contribution in #4681

Full Changelog: v3.2.1...v3.2.2

Same release as https://github.com/kubernetes-sigs/aws-load-balancer-controller/releases/tag/v3.2.0, but fixes ListenerSet permissions for Gateway API users installing via Helm.

v3.2.0 Release Notes

📚 Quick Links

v3.2.0 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.2.0

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

Gateway API updates

🚨 This release moves the Gateway API version from 1.3 to 1.5. For NLB Gateway users, this means that TLSRoute has been moved to the v1 API and is no longer served in the Alpha API version. It is recommended to install the experimental version of the TLSRoute to ensure zero downtime upgrades. 🚨

• Installation of LBC Gateway API specific CRDs: kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml
• If using only ALB Gateway
  • Standard Gateway API CRDs: kubectl apply --server-side=true -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/standard-install.yaml
• If using NLB Gateway
  • Experimental Gateway API CRDs: kubectl apply --server-side=true -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/experimental-install.yaml [Required: Used for L4 Routes]

🚨Deprecations

• --aws-vpc-tag-key is now deprecated and ignored. All tags from --aws-vpc-tags are always used for VPC lookup. This flag will be removed in a future release.

🚨Breaking Changes

• If you were passing multiple tags via --aws-vpc-tags but your VPC only matched a subset of them, the controller will now fail to find the VPC since all tags are used as filters. Update your VPC tags or your --aws-vpc-tags value to ensure they match.

🚀 What's New

Gateway API Features

• Update to Gateway API v1.5.0
• Autodetect Gateway resources. No more feature flag flipping! The feature flags are still available to turn off the Gateway API feature.
• Introduce ListenerSet resources

Ingress Features

• Add Frontend NLB attributes annotation

🔧 Enhancements and Fixes

• [Bug fix] Fixed subnet resolution when subnets having conflicting name tags.
• [Bug fix] Fixed multi tag VPC look ups.
• [Bug fix] Normalize ingress DNS name to lower case.
• [Bug fix] Prevent nil pointer when assigning endpoints to WAF / Shield clients.
• [Enhancement] Configurable re-queue time for Target Group Bindings.
• [Enhancement] Automatically skip aws: system tags during tag reconcilation.
• [Enhancement] Backfill concurrency controls in Helm chart.
• [Enhancement] Adding namespace selectors to Service and Ingress webhooks.

Documentation Updates

• Add cert expiry best practices
• Add more AGA examples
• Update label selector documentation

What's Changed

• update golang.org/x/net/ to resolve cves by @zac-nixon in #4608
• add auto detection of gateway api resources by @zac-nixon in #4602
• feat(ingress): add frontend-nlb-attribtues annotation for ingress by @swarner1033 in #4380
• Update documents for TargetGroupBinding and Helm Installation with ArgoCD by @zac-nixon in #4610
• Fix subnet resolution when multiple subnets share the same Name tag by @bjhaid in #4588
• add sorting after describeSubnet and update contribute instruction by @shuqz in #4612
• Upgrade to v1.5 of Gateway API by @zac-nixon in #4613
• [feat gw-api]add gateway and gatewayclass level tgc support by @shuqz in #4611
• fix route status reconciler for gw v1.5 upgrade by @zac-nixon in #4615
• ListenerSet event handler by @zac-nixon in #4616
• Add flag supporting configurable targetgroupbinding requeue duration by @cezarsa in #4617
• add target optimizer field to gateway documentation by @zac-nixon in #4619
• add listenerset, fix bug with route reconciler, add proper unit tests by @zac-nixon in #4620
• add cert expiry best practice by @zac-nixon in #4622
• [feat i2g]setup cli and framework by @shuqz in #4621
• Add missing feature gates to docs and fix search bar by @swibrow in #4618
• [feat aga] Add additional examples for usecases by @shraddhabang in #4623
• [Gateway API] ListenerSet Loader by @zac-nixon in #4625
• add ingress webhook validator selectors to helm chart by @zac-nixon in #4626
• Skip AWS system tags during tag reconciliation by @wweiwei-li in #4628
• [Gateway API] Validate ListenerSet listeners by @zac-nixon in #4629
• [feat i2g]implement annotation translate by @shuqz in #4630
• Expose some missing max-concurrency flags in Helm chart by @cezarsa in #4637
• [Gateway API] Support attaching routes from listeners originating from a ListenerSet by @zac-nixon in #4639
• [feat i2g]add translate for use-annotation by @shuqz in #4642
• [Gateway API] ListenerSet status updater by @zac-nixon in #4645
• fix: Allowing namespace selectors for mservice webhook by @wesbrownfavor in #4646
• add listener set docs by @zac-nixon in #4647
• Change default client-side rate-limiter to correctly match ELBv2 api limits by @cezarsa in #4641
• Fix multi-tag VPC lookup by @shraddhabang in #4638
• Update LabelSelector reference to v1.32 by @saivenkateshi in #4635
• resolve parent ref gateway whenever listener is used by @zac-nixon in #4650
• Fix ingress and service controllers to normalize dns name by @bobert-2 in #4655
• Fix FindLoadBalancerByDNSName to be case-insensitive by @bobert-2 in #4657
• fixes from listenerset conformance testing by @zac-nixon in #4660
• Fix: skip empty ExternalId in AssumeRole for cross-account TGB by @devanshpoplii in #4659
• fix: guard BaseEndpoint assignment for wafregional and shield clients by @kahirokunn in #4658
• Refactor Gateway API tests into modules by @zac-nixon in #4661
• update base image by @zac-nixon in #4664
• implement conditions and transforms translation by @shuqz in #4653
• add calculate attached listenerset unit test by @zac-nixon in #4665

New Contributors

• @bjhaid made their first contribution in #4588
• @cezarsa made their first contribution in #4617
• @swibrow made their first contribution in #4618
• @wesbrownfavor made their first contribution in #4646
• @saivenkateshi made their first contribution in #4635
• @devanshpoplii made their first contribution in #4659

Full Changelog: v3.1.0...v3.2.0

📚 Quick Links

v3.1.0 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.1.0

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

If using Gateway API feature

• Installation of LBC Gateway API specific CRDs: kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml
• Standard Gateway API CRDs: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml [REQUIRED]
• Experimental Gateway API CRDs: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/experimental-install.yaml [OPTIONAL: Used for L4 Routes]

🚀 What's New

Gateway API Enhancements

• [ALB Gateway] Port defaulting for scheme - Fixed redirect port handling to comply with Gateway API spec. When port is not specified in HTTPRequestRedirectFilter, the controller correctly defaults to well-known ports (80 for http, 443 for https) based on the redirect scheme.
• [ALB Gateway] Improved regex handling - Corrected regex value handling in Gateway API route matching
• [Gateway] Status hostname normalization - Gateway status hostnames are now normalized to lowercase for consistency

AWS Global Accelerator Controller

• [AGA] Cross-namespace reference support - AGA resources can now reference resources across namespaces, enabling more flexible multi-tenant architectures

🔧 Enhancements and Fixes

• [NLB Gateway] TLS passthrough listener - Fixed TLS listener construction to respect TLS mode configuration. NLB Gateways now support passthrough, termination, and re-encryption modes as defined in Gateway API spec. Note: SNI-based routing is not supported due to AWS NLB dataplane limitations.
• [Ingress] Rule optimizer - Fixed incorrect removal of regex-based listener rules that could cause routing failures
• [HelmUpgrade] Webhook certificate regeneration - Fixed certificate regeneration issues during Helm upgrades. Reintroduce the keepTLSSecret parameter with improved logic that maintains cert-manager compatibility.
• [Gateway] NPE on invalid parameters - Added null pointer protection and enhanced debugging for invalid parameter references

Documentation Updates

• Updated service.beta.kubernetes.io/aws-load-balancer-type annotation documentation
• Moved QUIC documentation to L4 section for better organization
• Updated Helm chart information

Changelog since v3.0.0

• [feat aga] Add cross-namespace reference support for AGA by @shraddhabang in #4547
• fix TLS passthrough listener by @zac-nixon in #4559
• Fix NPE on invalid parameters ref, add more debugging details to accepted status by @zac-nixon in #4562
• add port defaulting for scheme by @zac-nixon in #4568
• move QUIC documentation to l4 by @zac-nixon in #4570
• Fix rule optimizer incorrectly removing regex-based listener rules by @shraddhabang in #4569
• correct regex value handling in gateway api by @zac-nixon in #4577
• Add k8s event for TGB failures by @vishwas121 in #4571
• Update docs for service.beta.kubernetes.io/aws-load-balancer-type annotation by @Kellyyan in #4578
• update helm info by @zac-nixon in #4583
• Fix webhook certificate regeneration on Helm upgrades by @shraddhabang in #4581
• Filter RequeueNeeded errors to skip event triggers on TGB controller by @vishwas121 in #4584
• fix(gateway): normalize status hostname to lowercase by @TOGEP in #4591

New Contributors

• @vishwas121 made their first contribution in #4571
• @TOGEP made their first contribution in #4591

Full Changelog: v3.0.0...v3.1.0