[feature] bump nginx to 1.25.5 and add http3 module

[ipaqsa]

Bumping nginx to 1.25.5 and add http3 module.

Nginx 1.25.3 is end of life since 29.05.2024, and 1.25.5 has important bug fixes, and fixes for http3, so to improve security and prepare ingress-nginx for adding http3 support, we should bump current version.

It doesn't add HTTP/3 support, it just adds the HTTP/3 module during build, full HTTP/3 support requires additional steps.

What this PR does / why we need it:

It bumps nginx to 1.25.5, updates some others components and adds http3 module(to further add http 3 support) .

efbbf7239e9c:/# nginx -V
nginx version: nginx/1.25.5
built by gcc 13.2.1 20240309 (Alpine 13.2.1_git20240309) 
built with OpenSSL 3.3.1 4 Jun 2024
TLS SNI support enabled
configure arguments: ...--with-http_v2_module --with-http_v3_module ...

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• CVE Report (Scanner found CVE and adding report)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation only

Which issue/s this PR fixes

Fixes #11401

How Has This Been Tested?

It has been tested by e2e tests.

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I've read the CONTRIBUTION guide
• I have added unit and/or e2e tests to cover my changes.
• All new and existing tests passed.

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

Welcome @ipaqsa!

It looks like this is your first PR to kubernetes/ingress-nginx 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/ingress-nginx has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: ipaqsa / name: Stepan Paksashvili (0a3ff97, b3520d7)

[k8s-ci-robot]

Hi @ipaqsa. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[netlify]

✅ Deploy Preview for kubernetes-ingress-nginx canceled.

Name	Link
🔨 Latest commit	0a3ff97
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-ingress-nginx/deploys/66703bb42e4ed60008f62d5f

[tao12345666333]

Thank you

[ipaqsa]

@tao12345666333 I have passed e2e and signed CLA, could please review ?

And I didn't change the nginx version in the NGINX_BASE file and in the opentelemetry image

[longwuyuan]

@ipaqsa I am not a developer so @tao12345666333 and others will review and advise.

But out of curiosity, I looked. Even though you have not changed the base-image, you are making a lot of changes besides the flag for HTTP3.

My opinion is that you should NOT make any changes besides your HTTP3 module build flag. If that is redundant, then you should let @tao12345666333 or @rikatz add HTTP3 related changes.

My concern is that you are unaware of the impact project-wide and you are good-intentionally making changes like the TAG. These are extremely sensitive changes and there is unconventional awareness of the project needed like @tao12345666333 & @rikatz have.

Apologies but I had to say something after seeing the changes. I guess eventually it will all work out.

[ipaqsa]

@longwuyuan Thanks! The main point is that we want to add HTTP/3 support (#11172) and @tao12345666333 suggested that we should wait for an update to 1.25.5 (#11429), however there was a problem with building 1.25.5, but I found a fix for it in the latest commit of the stream-lua module(openresty/stream-lua-nginx-module@bea8a0c), and i thought it would be nice to try to contribute. I bumped up the versions of nginx and lua-stream module and added the HTTP/3 module as well. I passed e2e tests and hope that if I did something wrong, the community will help me. And other my changes are related to fixing wrong references in comments and I might be wrong about the TAG, so I want to get a review to correct.

[longwuyuan]

@ipaqsa than you for the update.
My comments are not related to wrong or right etc. I am not sure of the best approach to add HTTP3 support either. But I had to comment after seeing TAG change.

I see one example is the TAG that should not change by a user. That is always bumped only during release process. Else it creates problems.

I did not dig into the impact of changing the other SHA & stuff. I could try to run make dev-env locally, just out of curiosity.

But since Tao already commented, I think this will get to its appropriate destination, eventually.

Thanks again

[nabokihms]

@tao12345666333 is there anything we can help with to move this forward?

[strongjz]

/lgtm
/cherry-pick release-1.11

[k8s-infra-cherrypick-robot]

@strongjz: once the present PR merges, I will cherry-pick it on top of release-1.11 in a new PR and assign it to you.

In response to this:

/lgtm
/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ipaqsa, strongjz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [strongjz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-infra-cherrypick-robot]

@strongjz: cannot checkout release-1.11: error checking out "release-1.11": exit status 1 error: pathspec 'release-1.11' did not match any file(s) known to git

In response to this:

/lgtm
/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Gacko]

/cherry-pick release-1.10

[k8s-infra-cherrypick-robot]

@Gacko: new pull request created: #11541

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.