Nginx version 1.25.3 is End Of Life

[moazrefat]

The used version of Nginx 1.25.3 is end of life since 29.05.2024 which makes ingress nginx risky to be used, you can find the details here
https://nginx.org/en/CHANGES

It would be very crucial to environments which runs ingress nginx on production to have supported version of nginx.

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[longwuyuan]

You asked in the other issue and I commented there already. #11396 (comment)

The project scans regularly for vulnerabilities and patches the controller regularly. Look up the history of patches and releases by doing searches in PRs.

[moazrefat]

@longwuyuan thanks for replying so quick.

so you are telling that this version (connected to ingress-ngixn pod and ran below command)

nginx-public-ingress-nginx-controller-fd5d4979c-kstp9:/etc/nginx$ nginx -version
nginx version: nginx/1.25.3

is not the same nginx version that's mentioned here https://nginx.org/en/CHANGES (v1.25.3) which is EOL but more of recompiled version with latest security patches

Sorry that is quite confusing for me.

[strongjz]

We are beholden to the openrusty community to upgrade the nginx version of the controller due to the amount of functionality the ingress-nginx controller relays on those lua and openrusty plugins.

[strongjz]

Looks like the lua stream module is not compatible with 1.25.5

https://github.com/kubernetes/ingress-nginx/actions/runs/9388160304/job/25852789887?pr=11429#step:9:8095

#11429