⚠️ Upgrade Notes

No CRD updates required. This is a patch release with no CRD changes. Upgrading the controller is sufficient.

If you are coming from a release older than v3.6.0, apply the CRD steps from the v3.6.0 release notes first.

🔒 Security

Controller image rebuilt on a base image that distrusts 5 certificate authorities
The controller image is now built on eks-distro-minimal-base-nonroot:2026-10-23-1792785692.2023 (from 2026-07-27-1785178906.2023), which removes 5 distrusted eMudhra/emSign roots from the image CA bundle. Three were present and trusted in the previous base image -- emSign ECC Root CA - G3, emSign ECC Root CA - C3 and emSign Root CA - C1 -- taking the trusted root count from 143 to 140. This affects outbound TLS trust decisions made by the controller; there is no change to controller behavior or configuration. Upstream change: aws/eks-distro-build-tooling#2169. (#4937, @shraddhabang)

github.com/klauspost/compress updated to v1.18.7
Addresses CVE-2026-63209, an out-of-bounds read in s2.NewDict. This is a test-only indirect dependency reached through the e2e suite (httpexpect -> fasthttp) and is not linked into the controller binary, so released images were not affected -- the bump keeps source-level dependency scanning clean. (#4937, @shraddhabang)

🔧 Enhancements and Fixes

Gateway

• Skip the redundant child-resource fan-out during the controller's initial cache sync. Create handlers for HTTPRoute, GRPCRoute, TCPRoute, TLSRoute, UDPRoute, ListenerSet, GatewayClass, ReferenceGrant, Service, LoadBalancerConfiguration, TargetGroupConfiguration and ListenerRuleConfiguration now return early when the event is part of the informer's initial list, since existing Gateways receive their own initial events and reconcile against the synced cache anyway. This reduces redundant reconcile enqueues at controller start-up, improving start-up time on clusters with many Gateway child resources. No behavioral change after start-up. (#4935, @zac-nixon)

Misc

• Formatting fix in the Ingress group reconciler and trailing-newline fixes across the Gateway e2e suites (#4935)

What's Changed

• perf(gw api): improve start up time by not enqueuing child resources by @zac-nixon in #4935
• cut v3.6.2 release by @shraddhabang in #4937

Full Changelog: v3.6.1...v3.6.2

⚠️ Upgrade Notes

No CRD updates required. This is a patch release with no CRD changes. Upgrading the controller is sufficient.

If you are coming from a release older than v3.6.0, apply the CRD steps from the v3.6.0 release notes first.

🔒 Security

Go toolchain and golang.org/x/net updated to clear 18 CVEs
The controller image is now built with Go 1.26.10 (from 1.26.6) and golang.org/x/net v0.60.0 (from v0.58.0), resolving 18 vulnerabilities reported against the controller binary — 4 HIGH, 13 MEDIUM, 1 LOW. The Go patch covers 13 stdlib findings including CVE-2026-78667 (DoS via crafted HTTP Range headers), CVE-2026-78669 (DoS via excessive HTTP/2 SETTINGS frames) and CVE-2026-97031 (crypto/tls DoS via ECH outer extension references). The x/net bump covers 5 HTTP/2 findings (CVE-2026-78669, -78659, -78660, -78663, -97032) spanning flow-control bypass, trailer handling and HPACK encoder DoS. (#4933, @shraddhabang)

No API, CRD or behavioral change — the go directive in go.mod remains at 1.26.5, so the minimum version for module consumers is unchanged.

🚀 What's New

Per-resource reconcile condition metric
A new awslbc_controller_reconcile_condition gauge reports whether the last reconcile of each individual resource succeeded (1) or failed (0), labelled by controller, namespace and name. Wired across the Ingress, Service, Gateway, TargetGroupBinding and GlobalAccelerator reconcilers. (#4812, @gurpalw)

Node Ready time exposed on pod endpoints
PodEndpoint now carries NodeReadyTime, the LastTransitionTime of the pod's node Ready condition. (#4932, @zac-nixon)

🔧 Enhancements and Fixes

Networking

• Treat InvalidGroup.NotFound as success when releasing the auto-generated backend security group — a group already deleted out-of-band no longer fails the reconcile, it is logged and the cached ID cleared (#4928)

Mutual authentication

• Move the mTLS config parsing helpers out of the Ingress listener model builder into pkg/shared_utils, so Gateway and Ingress share one implementation (ParseMtlsConfigEntries). Pure refactor, no behavior change (#4918)

📖 Documentation Updates

• Document the new awslbc_controller_reconcile_condition gauge in the Prometheus metrics guide, with an example query for finding resources that are failing to reconcile (#4812)

What's Changed

• fix(scripts): eks-charts sync gh CLI compat + docs version bump by @shraddhabang in #4922
• fix(networking): treat InvalidGroup.NotFound as success in releaseSG by @nakshah87 in #4928
• Move mutual auth helpers to shared utils by @bobert-2 in #4918
• feat(metrics): add per-resource reconcile condition gauge by @gurpalw in #4812
• feat(backend): expose node Ready time on pod endpoints by @zac-nixon in #4932
• build(deps): bump go to 1.26.10 and golang.org/x/net to v0.60.0 by @shraddhabang in #4933
• cut v3.6.1 release by @shraddhabang in #4934

New Contributors

• @nakshah87 made their first contribution in #4928
• @gurpalw made their first contribution in #4812

Full Changelog: v3.6.0...v3.6.1

⚠️ Action Required

CRD Updates (Required)

There is no Gateway API graduation in this release -- the controller remains built against Gateway API CRDs v1.6.0 (unchanged from v3.5.0). As a safety measure, we recommend applying the latest AWS-vended CRDs before upgrading the controller.

Apply the latest AWS-vended CRD definitions:

Action :

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"
• kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml

🚀 What's New

Cross-account TargetGroupBinding -- AZ-aware IP registration (opt-in)
Cross-account TargetGroupBinding IP targets can now be registered with the pod's actual Availability Zone, improving cross-account zonal routing. Opt-in to preserve existing behavior by default. (#4877, @cqi1217)

frontend-nlb-status-only annotation for Ingress
New annotation to control whether the Ingress status hostname exposes only the frontend NLB -- fixes ExternalDNS record creation when fronting an ALB Ingress with an NLB. If the NLB is not yet provisioned, no hostname is written. (#4849, @dominikhei)

Gateway API customization for downstream/automode importers
Importers embedding the controller can now customize Gateway names, customize finalizers, and customize the Gateway controller wiring - enabling consumers to extend Gateway behavior. ReferenceGrant now uses the v1 apiVersion. (#4878, #4886, #4887, @zac-nixon)

🔧 Enhancements and Fixes

Gateway

• Avoid DuplicateTargetGroupName for Services with multiple named target ports (#4876)
• Use v1 for the ReferenceGrant apiVersion; allow finalizers to be customized (#4886)
• Use a / separator in Gateway route-loader cache keys to avoid cache-key collisions (#4916)
• Fix the deletion guard for Gateway TargetGroupConfigurations still referenced by TCPRoutes (#4802)
• Ignore unpermitted cross-namespace TCPRoutes in the Gateway TGC deletion guard, so a TCPRoute without a ReferenceGrant can no longer pin another namespace's TGC finalizer (#4919)

**AWS Certificates Management **

• Use the public Route 53 zone for Amazon-issued ACM DNS validation in split-horizon DNS setups (#4847)

Networking / TargetGroupBinding

• Canonicalize CIDRs for security-group inbound rules to avoid spurious reconciliation failures (#4904)
• Fix TargetGroupBinding networking with empty ports (#4909)

WAF

• Ignore a WAF ACL set to an empty string (treat as unset) (#4888)

Controller / Informer robustness

• Handle DeletedFinalStateUnknown tombstones in TypedInformer's DeleteFunc (#4879)
• Make the pod informer transform idempotent so WatchList streaming sync no longer falls back to a full LIST (#4881)

Misc

• Clearer OIDC permission messaging (#4912)

📖 Documentation Updates

• Warn against manually deleting controller-generated TargetGroupBinding objects (#4902)
• Document security/trust implications of AllowedRoutes.Namespaces.From: All (#4872)
• Remove unsupported vpcId field from LoadBalancerConfiguration docs (#4760)
• Fix wrong default for frontend-nlb-eip-allocations in annotation docs (#4871)
• Fix ipam-ipv4-pool-id example plus tip/note block spacing (#4752)

What's Changed

• Document security/trust implications of AllowedRoutes.Namespaces.From… by @wweiwei-li in #4872
• docs: Remove vpcId from LoadBalancerConfiguration documentation by @dominikhei in #4760
• fix(gateway): avoid DuplicateTargetGroupName for Services with multiple named targetPorts by @legal90 in #4876
• fix: ipam-ipv4-pool-id example, tip and note block spacing by @wind0r in #4752
• feat(gateway custom): allow importers to customize gateway names by @zac-nixon in #4878
• fix: handle DeletedFinalStateUnknown tombstones in TypedInformer's DeleteFunc by @ginbear in #4879
• Make pod informer transform idempotent so WatchList streaming sync does not fall back to full LIST by @yash97 in #4881
• use v1 for referencegrant apiversion, allow finalizers to be customized for gateway api by @zac-nixon in #4886
• refactor: Allow automode controllers to customize the gateway controller by @zac-nixon in #4887
• fix(waf): ignore waf acl set to empty string by @zac-nixon in #4888
• refactor: making tests configurable to run on eks auto framework by @jupdec in #4891
• test: mirror UDP/GRPC test images to networking-e2e-test-images by @jupdec in #4894
• test/gateway: make e2e suite partition-aware and register ECR tag resolver by @jupdec in #4908
• chore: OIDC permission messaging by @zac-nixon in #4912
• fix: canonicalize CIDRs for security group inbound rules to avoid reconciliation failures by @bobert-2 in #4904
• test: default GRPC/UDP images to public ECR to fix the tests by @shraddhabang in #4911
• Fix TGB networking with empty ports by @dlanov in #4909
• docs: warn against manually deleting controller-generated TargetGroupBinding by @shashankvarma499 in #4902
• Register cross-account TargetGroupBinding IP targets with the pod's availability zone (opt-in) by @cqi1217 in #4877
• Fixed wrong default for frontend-nlb-eip-allocations in annotation docs by @dominikhei in #4871
• Added frontend-nlb-status-only annotation to fix ExternalDNS record creation when using a frontend NLB by @dominikhei in #4849
• fix: use '/' separator in Gateway route-loader cache keys to avoid co… by @wweiwei-li in #4916
• fix: use public Route 53 zone for Amazon-issued ACM DNS validation in split-horizon DNS by @niv1612 in #4847
• Fix deletion guard for Gateway TargetGroupConfigurations still referenced by TCPRoutes by @immanuwell in #4802
• fix: ignore unpermitted cross namespace TCPRoutes in gateway target TGC deletion guard by @shraddhabang in #4919
• cut v3.6.0 release by @shraddhabang in #4921

New Contributors

• @dominikhei made their first contribution in #4760
• @legal90 made their first contribution in #4876
• @wind0r made their first contribution in #4752
• @ginbear made their first contribution in #4879
• @yash97 made their first contribution in #4881
• @dlanov made their first contribution in #4909
• @shashankvarma499 made their first contribution in #4902
• @cqi1217 made their first contribution in #4877
• @niv1612 made their first contribution in #4847

Full Changelog: v3.5.0...v3.6.0

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

Gateway API CRD Updates (All Gateway API users)

Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller.

Why: This release requires Gateway API CRDs v1.6.0. The controller is built against this version for conformance and feature support

Important: Update CRDs before upgrading the controller. If you upgrade the controller first, NLB Gateway (TCPRoute/UDPRoute/TLSRoute) will be automatically disabled until the CRDs are updated. Since the standard install no longer serves v1alpha2, you must update any existing v1alpha2 route manifests to gateway.networking.k8s.io/v1

Action: Apply v1.6 Gateway CRDs

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.6.0/standard-install.yaml

LBC Gateway CRD Updates (All Gateway API users)

Who: All users running Gateway API resources (Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute) with the AWS Load Balancer Controller.

Why: This release adds v1 as the storage version for LBC-specific Gateway CRDs (LoadBalancerConfiguration, TargetGroupConfiguration, ListenerRuleConfiguration), with v1beta1 marked as deprecated. The controller reads v1 only, but existing v1beta1 resources are transparently converted to v1 by the API server — no immediate manifest changes required. However, v1beta1 will stop being served in a future release. We recommend updating your manifests to use gateway.k8s.aws/v1 at your earliest convenience.

Action: Apply the updated LBC Gateway CRDs:

kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml

🚀What's New

Gateway API v1 Graduation

This release graduates Gateway API support to v1 for L4 routes. TCPRoute and UDPRoute now use the stable gateway.networking.k8s.io/v1 API version (previously v1alpha2), and the controller passes Gateway API conformance v1.6.0. The AWS-vended Gateway API CRDs have been upgraded to v1 accordingly.

🔧Enhancements and Fixes

Certificate Management

• Fix ACM certificate creation for Ingresses with wildcard hosts — the character in hostname was breaking ACM tag validation Certificate list support for ECDSA/RSA use
• Add certificate management controller flag to helm chart

Route Precedence

• Unified cross-kind route precedence for HTTPRoute/GRPCRoute, single code path eliminates non-transitivity
• Fix non-transitive rule precedence for routes without hostnames

Networking

• Filter EndpointSlices by IP family for target group registration
• Match hosted zones by longest suffix in GetHostedZoneID
• Fix: ICMP Type/Code constants
• Fix: render feature gates as parseable key-value pairs

Module & Build

• Module path updated to sigs.k8s.io/aws-load-balancer-controller/v3. Users who are importing the code base will need to adjust their imports accordingly.

Helm

• Correct enableEndpointSlices default in Helm values comment

📖 Documentation Updates

• Add guidance on migrating between services without downtime
• Clarify scheme change replacement behavior
• Fix Markdown formatting of blue/green guide
• Fix stale contributor setup and invalid IAM role ARN examples
• Fix doc annotation name
• Fix admonition indentation for ipam-ipv4-pool-id annotation
• Clarify WAF addon ownership and document IngressGroup security risks
• Remove CloudFormation link

What's Changed

• Fix Markdown formatting of blue/green guide by @Tenzer in #4835
• ci: Add GO-2026-5932 to govulncheck ignore list by @shraddhabang in #4839
• use /v3 in module name by @zac-nixon in #4770
• feat(gateway): Use Gateway API v1 for TCPRoute and UDPRoute by @nicomazzarello in #4829
• upgrade AWS vended Gateway API CRDs to v1 by @zac-nixon in #4844
• update code to use v1 crds by @zac-nixon in #4845
• Add label for accessing secrets - to support restricted access for EKS Auto LBC by @jupdec in #4838
• docs: fix admonition indentation for ipam-ipv4-pool-id annotation by @nikhilmaheshwari24 in #4837
• v1.6.0 conformance + rule refactor by @zac-nixon in #4861
• fix: handle invalid condition name for tgb by @zac-nixon in #4862
• Fix ACM certificate creation for Ingresses with wildcard hosts by @nbr in #4786
• docs: clarify scheme change replacement by @kappa8219 in #4860
• fix: use "/" separator in getCacheKey to avoid TGB cache collisions by @jupdec in #4864
• fix: subnet auto-discovery to IPv6-capable subnets for dualstack ip address type by @jupdec in #4865
• Add ipv6 check for tests by @wweiwei-li in #4868
• cut v3.5.0 release by @wweiwei-li in #4869

New Contributors

• @Tenzer made their first contribution in #4835
• @nicomazzarello made their first contribution in #4829
• @nikhilmaheshwari24 made their first contribution in #4837
• @kappa8219 made their first contribution in #4860

Full Changelog: v3.4.2...v3.5.0

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

[ALB Gateway Users] Double check your ALB rule limits, when using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated. Users who specify multiple hostnames per route will want to double check their ALB limits. 2c65734

CRD Updates

• No CRD updates required for this release.

IAM Policy Updates

• No IAM policy changes required for this release.

Gateway API updates

• No Gateway API CRD updates required for this release.

🔧 Enhancements and Fixes

[Rule precedence] - When using HTTP / GRPC route with multiple hostnames, a distinict rule per hostname is generated.
[Validation Fix] - Fixed a bug that let invalid protocol types get ignored, rather than throwing a validation error.
[Process Crash] - Fixed a bug that caused a NPE when an invalid pod health condition was present.

What's Changed

• V3.4.3 by @zac-nixon in #4863

Full Changelog: v3.4.2...v3.4.3

v3.4.2 Release Notes

📚 Quick Links

v3.4.2 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.2

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

• No CRD updates required for this release.

IAM Policy Updates

• No IAM policy changes required for this release.

Gateway API updates

• No Gateway API CRD updates required for this release.

🔒 Security Fix

• Cross-Kind Route Precedence Fix (PR #4818): Fixed a vulnerability where ALB listener rule priority was determined by route kind rather than route specificity when HTTPRoute and GRPCRoute share a hostname on the same Gateway listener. Previously, HTTPRoute would always receive a lower ALB priority number (evaluated first) than a specific GRPCRoute, allowing cross-namespace traffic interception. The controller now uses a unified precedence comparator that orders rules by hostname specificity → path type → path length → method constraint → header count → creation timestamp, regardless of route kind.

  Affected configurations: Shared Gateways with AllowedRoutes.Namespaces.From: All (or a namespace selector admitting multiple tenants) where both HTTPRoute and GRPCRoute attach to the same HTTPS listener with the same hostname.

  Workaround for unpatched versions: Restrict Gateway listener AllowedRoutes.Namespaces.From to Same or use a restrictive namespace Selector.

🔧 Enhancements and Fixes

• [Security fix] Unified cross-kind route precedence for HTTPRoute/GRPCRoute — specific routes now correctly outrank catch-all routes regardless of kind (#4818)
• [Bug fix] Fix e2e test gRPC service name mismatch in cross-kind precedence test (#4830)
• [Enhancement] Upgrade Go toolchain from 1.26.4 to 1.26.5 — fixes CVE-2026-39822 and CVE-2026-42505

Documentation Updates

• Add guidance on migrating between services without downtime (#4819)

🌟 Complete Change Log

• fix(gateway): Unified cross-kind route precedence for HTTPRoute/GRPCRoute by @shraddhabang in #4818
• fix(e2e): Use correct gRPC service name in cross-kind precedence test by @shraddhabang in #4830
• docs: add guidance on migrating between services without downtime by @Thiru-2004-varul in #4819

New Contributors

• @Thiru-2004-varul made their first contribution in #4819

Full Changelog: v3.4.1...v3.4.2

v3.4.1 Release Notes

📚 Quick Links

v3.4.1 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.1

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

IAM Policy Updates

• No IAM policy changes required for this release.

Gateway API updates

• No Gateway API CRD updates required for this release.

🚀 What's New

Ingress Features

• ECDSA/RSA Certificate Auto-Discovery (PR #4490): The controller now supports automatic discovery of both ECDSA and RSA certificates from ACM when building the certificate list for Ingress resources. This enables dual-certificate configurations for optimized TLS performance across different client types.
  Gateway API Features
• Shared Hostname for HTTPRoute and GRPCRoute (PR #4794): HTTPRoute and GRPCRoute resources can now share the same hostname on a Gateway listener. The overlapping hostname restriction between HTTP and gRPC routes has been removed, enabling mixed protocol configurations on the same domain.

🔧 Enhancements and Fixes

• [Bug fix] Filter EndpointSlices by IP family for target group registration — prevents IPv4 addresses from being registered to IPv6 target groups (#4783)
• [Bug fix] Match hosted zones by longest suffix in GetHostedZoneID — fixes DNS validation for deeply nested subdomains and wildcard SANs (#4785)
• [Bug fix] Fix non-transitive rule precedence for routes without hostnames — catch-all routes no longer intermittently sort above host-specific rules (#4809)
• [Bug fix] Fix ICMP Type/Code constants (#4799)
• [Bug fix] Fix render feature gates as parseable key-value pairs (#4757)
• [Enhancement] Add enableCertificateManagement controller flag to Helm chart (#4726)

Documentation Updates

• Correct enableEndpointSlices default value in Helm values comment (#4806)
• Clarify WAF addon ownership and document IngressGroup security risks (#4797)
• Fix stale contributor setup and invalid IAM role ARN examples (#4791)
• Fix doc annotation name (#4787)

🌟 Complete Change Log

• [fix] filter EndpointSlices by IP family for target group registration by @shuqz in #4783
• [fix] doc annotation name by @shuqz in #4787
• refactor ipv6 testing by @zac-nixon in #4788
• add ipv6 annotations to cert generation tests by @zac-nixon in #4790
• Match Route53 hosted zones by longest suffix in GetHostedZoneID by @nbr in #4785
• Fix feature gates string representation by @immanuwell in #4757
• add source nat setting so udp tests pass on ipv6 cluster by @zac-nixon in #4795
• skip service quic tests when using ipv6 by @zac-nixon in #4796
• Clarify WAF addon ownership and document IngressGroup security risks by @wweiwei-li in #4797
• fix: ICMP Type/Code constants by @wweiwei-li in #4799
• docs: fix stale contributor setup and invalid IAM role ARN examples by @immanuwell in #4791
• Auto discovery default certificate and certificate list by @abeowlu in #4490
• [Gateway API]remove overlapping check in httpRoute and GRPCRoute by @shuqz in #4794
• fix(cert_management): add default-pca-arn controller flag to helm chart by @the-technat in #4726
• Fix non-transitive rule precedence for routes without hostnames by @sergeylanzman in #4809
• Fix incorrect enableEndpointSlices default in Helm values.yaml comment by @BobDu in #4806
• cut v3.4.1 release by @shraddhabang in #4813

New Contributors

• @nbr made their first contribution in #4785
• @abeowlu made their first contribution in #4490
• @sergeylanzman made their first contribution in #4809

Full Changelog: v3.4.0...v3.4.1

📚 Quick Links

v3.4.0 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.4.0
Thanks to all our contributors! 😊

🎉 Ingress to Gateway Migration Tool

We are excited to introduce the Ingress to Gateway Migration Tool, the biggest addition in this release! This tooling helps you migrate AWS Load Balancer Controller (LBC) Ingress resources to Gateway API resources, step by step. The migration is designed to be safe and non-disruptive — new ALBs are created alongside your existing ones, so current workloads keep running throughout the entire process.

Two tools are provided to help you migrate with confidence:s

• lbc-migrate CLI: Translates your Ingress manifests (annotations, rules, and IngressGroups) into equivalent Gateway API YAML. Supports cluster scraping (--from-cluster), file input (-f), directory input (--input-dir), single-Ingress and multi-namespace scoping, and per-namespace output splitting.
• Migration Console: A local, in-cluster web UI that compares the AWS resource stack produced by both the Ingress and Gateway controllers, field by field. This lets you verify equivalence before applying your Gateway manifests for real.

To get started, see the Migration Guide for the end-to-end walkthrough.

We encourage you to try it out and welcome any feedback via GitHub Issues.

⚠️ Gateway API Behavior Change

Only one L4 route per listener is eligible for traffic when using an NLB Gateway

• Change: When multiple L4 (TCP/UDP/TLS) routes target the same listener, the controller only forwards traffic to the oldest route. (#4745).
• Impact: If you currently attach more than one TCP/UDP/TLS route to the same listener, only the oldest route will continue serving traffic after upgrading. Review your L4 route configurations and consolidate to a single route per listener to avoid unexpected traffic changes.

🔧 Enhancements and Fixes

• Regex path reconcile loop: Ignore the top-level RegexValues field that AWS mirrors in DescribeRules responses, preventing an unnecessary ModifyRule on every reconcile (#4749)
• Service reconciler nil check: Return early in the service reconciler when the load balancer is nil (#4751)
• TGC health check for ALB target groups: Fixed an error when updating health check settings in TargetGroupConfiguration for Gateway API ALB target groups (#4741)
• NLB weighted target groups: Allow weight 0 for NLB weighted target groups, with a guard requiring at least one non-zero weight (#4738)
• Capacity units validation: Validate CapacityUnits on capacity reservation annotations instead of silently dropping parse errors (which reset the reservation to 0) (#4750)
• Checkpoint early-exit race: Ensure pods with pending readiness gates are always reconciled, fixing a checkpoint early-exit race with same-IP re-registration (#4737)
• Retryable error wrapping: Wrap the last retryable error with a timeout error for clearer failure reporting (#4761)
• Readiness gate efficiency: The TargetGroupBinding controller now watches pod events instead of requeueing on a fixed timer when using readiness gates, responding faster while avoiding unnecessary requeues (#4678)
• Unit-test workflow permissions: Declare contents: read on the unit-test workflow to pin the default GITHUB_TOKEN to read-only (#4736)
• Webhooks upgraded to v1: Admission webhooks were upgraded from v1beta1 to v1. Applied automatically on upgrade — no action needed (#4743)
• Listener rule tag reconcile: Reconcile listener rule tags for all matched rules (#4772)

🌟 Complete Change Log

• [feat i2g]support split by namespace output by @shuqz in #4733
• [feat i2g] Fix user tag propagation to ListenerRuleConfigurations in lbc-migrate by @shuqz in #4735
• [feat i2g] Add IngressPlanAnnotation feature gate for dry-run plan by @shuqz in #4734
• fix checkpoint early-exit by @wweiwei-li in #4737
• [fix]allow weight zero in NLB target group by @shuqz in #4738
• Watch pod events for updating TargetGroupBindings with ReadinessGates by @cezarsa in #4678
• [feat i2g] multi-ingress TGC with RouteConfigurations by @shuqz in #4742
• upgrade webhooks to v1 by @zac-nixon in #4743
• Fix error when updating health check settings in TGC for Gateway API ALB target groups by @shraddhabang in #4741
• reject multiple l4 routes for same listener by @zac-nixon in #4745
• fix: return early in service reconciler when lb is nil by @wweiwei-li in #4751
• Validate load balancer capacity units annotations by @immanuwell in #4750
• [feat i2g] bug fix by @shuqz in #4746
• [feat i2g]setup e2e test for migration tool by @shuqz in #4739
• ci(test): declare contents: read on the unit-test workflow by @arpitjain099 in #4736
• [feat i2g]add in-cluster console for model comparison by @shuqz in #4728
• fix: ignore top-level RegexValues mirrored by AWS in DescribeRules response by @pataraktw in #4749
• [feat i2g] add e2e tests for ingress2gateway migration tool by @shuqz in #4771
• [feat i2g] docs: migration guide, lbc-migrate reference, and in-cluster console by @shuqz in #4759
• Add multiple ingress test that sorts rules based on priority by @jupdec in #4756
• Reconcile listener rule tags for all matched rules by @andreybutenko in #4772
• cut v3.4.0 release by @shuqz in #4776

New Contributors

• @immanuwell made their first contribution in #4750
• @arpitjain099 made their first contribution in #4736
• @pataraktw made their first contribution in #4749

Full Changelog: v3.3.0...v3.4.0

v3.3.0 Release Notes

📚 Quick Links

v3.3.0 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.3.0

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action: Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

IAM Policy Updates

If you enable the EnableCertificateManagement feature gate, attach the additional IAM policy for ACM and Route53 permissions to your controller's IAM role. See the documentation for details.

Gateway API updates

• Installation of LBC Gateway API specific CRDs: kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml
• If using only ALB Gateway
  • Standard Gateway API CRDs: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/standard-install.yaml
• If using NLB Gateway
  • Experimental Gateway API CRDs: kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.5.0/experimental-install.yaml [Required: Used for L4 Routes]

🚀 What's New

Ingress Features

• ACM Certificate Management (Feature Gate: EnableCertificateManagement): The controller can now automatically create and manage TLS certificates in ACM using hostnames from Ingress resources. It supports both Amazon-issued certificates with DNS validation via Route53 and private certificates via AWS Private CA. Enable with --feature-gates=EnableCertificateManagement=true and the create-acm-cert: "true" annotation. See the Certificate Management documentation for setup, IAM policy requirements, and ingress group behavior.

🔧 Enhancements and Fixes

• [Bug fix] Fix ENI resolution when pod has an IPv6 address (#4706)
• [Bug fix] Fix frontend NLB listener and target group tagging (#4700)
• [Bug fix] Add externalId into cache key for cross-account TGB (#4714)
• [Bug fix] ACM cert management bug fixes and doc improvements
• [Enhancement] Gateway API auto-detection improvements and LBC-specific CRD handling in Helm

Documentation Updates

• ACM Certificate Management guide with ingress group behavior, security considerations, and IAM policy scoping
• Updated the gateway api installation docs to include the AWS vended CRD as pre-requisites

What's Changed

• fix: tag frontend NLB target groups and listeners by @hakman in #4700
• Retry gateway nlb with tls listener send https request test by @bobert-2 in #4701
• Retry gateway nlb with tls listener and instance target test by @bobert-2 in #4703
• randomize gatewayclass in e2e test by @zac-nixon in #4704
• [feat i2g]support group ingress translate by @shuqz in #4692
• [feat i2g] add documentation for tgb by @shuqz in #4705
• feat(acm): add ACM certificate management feature by @the-technat in #4554
• [feat i2g]support dry-run mode for gateway api controller by @shuqz in #4709
• fix eni resolution when pod has an ipv6 address by @zac-nixon in #4706
• Automate helm ClusterRole RBAC sync from kubebuilder by @shraddhabang in #4686
• Increase timeout for gateway nlb tls listener tests by @bobert-2 in #4713
• add externalId into cache key by @shuqz in #4714
• enhance gateway auto detection logic for CRD by @shuqz in #4721
• [feat acm-certs-mgmt] bug fixes and doc improvements by @shraddhabang in #4711
• cut v3.3.0 release by @shraddhabang in #4723

New Contributors

• @hakman made their first contribution in #4700

Full Changelog: v3.2.2...v3.3.0

v3.2.2 Release Notes

📚 Quick Links

v3.2.2 (requires Kubernetes 1.22+)

Image: public.ecr.aws/eks/aws-load-balancer-controller:v3.2.2

Documentation

Thanks to all our contributors!💜💜💜

⚠️ Action Required

CRD Updates

Action : Please apply the latest CRD definitions

• kubectl apply -k "github.com/aws/eks-charts/stable/aws-load-balancer-controller/crds?ref=master"

What's Changed

• [feat i2g]support ssl-redirect translate by @shuqz in #4669
• Add dynamic annoucement banner for live docs by @shraddhabang in #4673
• fixed#4680 wrapping last retryable err with timeout err by @viveksb007 in #4681
• [feat i2g]support auth translate by @shuqz in #4679
• [feat i2g]support jwt-validation translate by @shuqz in #4683
• Fix HyperPod pod ENI resolution with VPC CNI prefix delegation by @guessi in #4667
• remove special isolated region check for listener attributes by @zac-nixon in #4690
• pin shas for github workflows by @zac-nixon in #4691
• Override user agent by @wweiwei-li in #4694
• ignore listenerset when CRD is missing by @zac-nixon in #4689
• release v3.2.2 by @zac-nixon in #4696

New Contributors

• @viveksb007 made their first contribution in #4681

Full Changelog: v3.2.1...v3.2.2