Release 2.0.0

CHANGELOG.md

@@ -4,6 +4,71 @@ This document includes a curated changelog for each release. We also publish a c
 a [GitHub release](https://github.com/nginx/nginx-gateway-fabric/releases), which, by contrast, is auto-generated
 and includes links to all PRs that went into the release.
 
+## Release 2.0.0
+
+_June 5, 2025_
+
+BREAKING CHANGES:
+
+[How to upgrade to 2.0.0](https://docs.nginx.com/nginx-gateway-fabric/install/upgrade-version/#upgrade-from-v1x-to-v2x).
+
+The following change are breaking and require users to fully uninstall NGINX Gateway Fabric (including NGINX Gateway Fabric CRDs) before re-installing the new version. Gateway API resources (such as Gateway, HTTPRoute, etc) are unaffected and can be left alone. [3318](https://github.com/nginx/nginx-gateway-fabric/pull/3318)
+
+- Control plane and data plane have been separated into different Deployments. The control plane will provision an NGINX data plane Deployment and Service when a Gateway object is created.
+- NginxProxy CRD resource is now namespace-scoped (was cluster-scoped).
+- NginxProxy resource controls infrastructure fields for the NGINX Deployment and Service, such as replicas, loadBalancerIP, serviceType, etc. Users who want to set or update these fields must do so either at installation time through the helm chart (which sets them globally), or per Gateway. Updating these fields directly on a provisioned nginx Deployment or Service will not take effect. This does not apply to the the NGINX Gateway Fabric control plane Deployment.
+- Helm values structure has changed slightly to better support the separate Deployments.
+- `nginxGateway.replicaCount` Helm value has been renamed to `nginxGateway.replicas`.
+
+FEATURES:
+
+- Support for creating and deploying multiple Gateways. [3318](https://github.com/nginx/nginx-gateway-fabric/pull/3318)
+- NginxProxy resource can now additionally be attached to a Gateway, and will overwrite any settings that are attached at the GatewayClass level, for the Gateway that it's attached to. [3318](https://github.com/nginx/nginx-gateway-fabric/pull/3318)
+- Listener isolation supported for all routes. [3067](https://github.com/nginx/nginx-gateway-fabric/pull/3067)
+- Allow configuration of NGINX Plus API access. [3066](https://github.com/nginx/nginx-gateway-fabric/pull/3066)
+- Adds regex matching for headers and query params for HTTPRoutes and headers for GRPCRoutes. [3093](https://github.com/nginx/nginx-gateway-fabric/pull/3093)
+- Add support for request mirroring using the RequestMirror filter. [3066](https://github.com/nginx/nginx-gateway-fabric/pull/3306)
+
+BUG FIXES:
+
+- Fix an issue where default headers were still being set when overwritten by a user. [3249](https://github.com/nginx/nginx-gateway-fabric/pull/3249)
+- Add 503 status code when there are zero upstream endpoints. [3406](https://github.com/nginx/nginx-gateway-fabric/pull/3406)
+- Fixed bug that occurred when a route's ParentRef does not include a sectionName and the Gateway's listeners have duplicate hostnames. This would cause conflicts when the route tries to attach to all the listeners and falsely trigger validation checks around overlapping routes. [3418](https://github.com/nginx/nginx-gateway-fabric/pull/3418)
+
+DOCUMENTATION:
+
+- Migrated the documentation website into the [NGINX documentation repository](https://github.com/nginx/documentation). [3047](https://github.com/nginx/nginx-gateway-fabric/pull/3047)
+
+HELM CHART:
+
+- The version of the Helm chart is now 2.0.0
+- Helm values structure has changed slightly to better support the separate Deployments.
+- `nginxGateway.replicaCount` Helm value has been renamed to `nginxGateway.replicas`.
+- Add support for control plane Deployment labels. [3194](https://github.com/nginx/nginx-gateway-fabric/pull/3194). Thanks to [Butterneck](https://github.com/Butterneck).
+
+UPGRADE:
+
+- [Upgrade to 2.0.0](https://docs.nginx.com/nginx-gateway-fabric/install/upgrade-version/#upgrade-from-v1x-to-v2x)
+
+DEPENDENCIES:
+
+- NGINX Plus was updated to R34. [3281](https://github.com/nginx/nginx-gateway-fabric/pull/3281)
+- Update to v1.3.0 of the Gateway API. [3348](https://github.com/nginx/nginx-gateway-fabric/pull/3348)
+
+COMPATIBILITY:
+
+- Gateway API version: `1.3.0`
+- NGINX version: `1.28.0`
+- NGINX Plus version: `R34`
+- NGINX Agent version: `v3.0.0`
+- Kubernetes version: `1.25+`
+
+CONTAINER IMAGES:
+
+- Control plane: `ghcr.io/nginx/nginx-gateway-fabric:2.0.0`
+- Data plane: `ghcr.io/nginx/nginx-gateway-fabric/nginx:2.0.0`
+- Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:2.0.0`
+
 ## Release 1.6.2
 
 _March 11, 2025_

Makefile

@@ -1,5 +1,5 @@
 # variables that should not be overridden by the user
-VERSION = edge
+VERSION = 2.0.0
 SELF_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
 CHART_DIR = $(SELF_DIR)charts/nginx-gateway-fabric
 NGINX_CONF_DIR = internal/controller/nginx/conf

README.md

@@ -20,6 +20,8 @@ the [Gateway API Compatibility](https://docs.nginx.com/nginx-gateway-fabric/over
 
 Learn about our [design principles](/docs/developer/design-principles.md) and [architecture](https://docs.nginx.com/nginx-gateway-fabric/overview/gateway-architecture/).
 
+NGINX Gateway Fabric uses [NGINX Agent](https://github.com/nginx/agent) to configure NGINX.
+
 ## Getting Started
 
 1. [Get started using a kind cluster](https://docs.nginx.com/nginx-gateway-fabric/get-started/).
@@ -34,7 +36,7 @@ You can find the comprehensive NGINX Gateway Fabric user documentation on the [N
 We publish NGINX Gateway Fabric releases on GitHub. See
 our [releases page](https://github.com/nginx/nginx-gateway-fabric/releases).
 
-The latest release is [1.6.2](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v1.6.2).
+The latest release is [2.0.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v2.0.0).
 
 The edge version is useful for experimenting with new features that are not yet published in a release. To use, choose
 the _edge_ version built from the [latest commit](https://github.com/nginx/nginx-gateway-fabric/commits/main)
@@ -45,7 +47,7 @@ to the correct versions:
 
 | Version        | Description                              | Installation Manifests                                                         | Documentation and Examples                                                                                                                                           |
 |----------------|------------------------------------------|--------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Latest release | For production use                       | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v1.6.2/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v1.6.2/examples).                        |
+| Latest release | For production use                       | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.0.0/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.0.0/examples).                        |
 | Edge           | For experimental use and latest features | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/main/deploy).   | [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/main/examples). |
 
 ### Versioning
@@ -64,19 +66,20 @@ the [Issue Lifecycle](ISSUE_LIFECYCLE.md) document for information on issue crea
 
 The following table lists the software versions NGINX Gateway Fabric supports.
 
-| NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus |
-|----------------------|-------------|------------|-----------|------------|
-| Edge                 | 1.3.0       | 1.25+      | 1.28.0    | R34        |
-| 1.6.2                | 1.2.1       | 1.25+      | 1.27.4    | R33        |
-| 1.6.1                | 1.2.1       | 1.25+      | 1.27.4    | R33        |
-| 1.6.0                | 1.2.1       | 1.25+      | 1.27.3    | R33        |
-| 1.5.1                | 1.2.0       | 1.25+      | 1.27.2    | R33        |
-| 1.5.0                | 1.2.0       | 1.25+      | 1.27.2    | R33        |
-| 1.4.0                | 1.1.0       | 1.25+      | 1.27.1    | R32        |
-| 1.3.0                | 1.1.0       | 1.25+      | 1.27.0    | R32        |
-| 1.2.0                | 1.0.0       | 1.23+      | 1.25.4    | R31        |
-| 1.1.0                | 1.0.0       | 1.23+      | 1.25.3    | n/a        |
-| 1.0.0                | 0.8.1       | 1.23+      | 1.25.2    | n/a        |
+| NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus | NGINX Agent |
+|----------------------|-------------|------------|-----------|------------|-------------|
+| Edge                 | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.0      |
+| 2.0.0                | 1.3.0       | 1.25+      | 1.28.0    | R34        | v3.0.0      |
+| 1.6.2                | 1.2.1       | 1.25+      | 1.27.4    | R33        | ---         |
+| 1.6.1                | 1.2.1       | 1.25+      | 1.27.4    | R33        | ---         |
+| 1.6.0                | 1.2.1       | 1.25+      | 1.27.3    | R33        | ---         |
+| 1.5.1                | 1.2.0       | 1.25+      | 1.27.2    | R33        | ---         |
+| 1.5.0                | 1.2.0       | 1.25+      | 1.27.2    | R33        | ---         |
+| 1.4.0                | 1.1.0       | 1.25+      | 1.27.1    | R32        | ---         |
+| 1.3.0                | 1.1.0       | 1.25+      | 1.27.0    | R32        | ---         |
+| 1.2.0                | 1.0.0       | 1.23+      | 1.25.4    | R31        | ---         |
+| 1.1.0                | 1.0.0       | 1.23+      | 1.25.3    | n/a        | ---         |
+| 1.0.0                | 0.8.1       | 1.23+      | 1.25.2    | n/a        | ---         |
 
 ## SBOM (Software Bill of Materials)
 

charts/nginx-gateway-fabric/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: nginx-gateway-fabric
 description: NGINX Gateway Fabric
 type: application
-version: 1.6.2
-appVersion: "edge"
+version: 2.0.0
+appVersion: "2.0.0"
 kubeVersion: ">= 1.25.0-0"
 home: https://github.com/nginx/nginx-gateway-fabric
 icon: https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/main/charts/nginx-gateway-fabric/chart-icon.png

charts/nginx-gateway-fabric/README.md

@@ -1,7 +1,7 @@
 
 # NGINX Gateway Fabric Helm Chart
 
-![Version: 1.6.2](https://img.shields.io/badge/Version-1.6.2-informational?style=flat-square) ![AppVersion: edge](https://img.shields.io/badge/AppVersion-edge-informational?style=flat-square)
+![Version: 2.0.0](https://img.shields.io/badge/Version-2.0.0-informational?style=flat-square) ![AppVersion: 2.0.0](https://img.shields.io/badge/AppVersion-2.0.0-informational?style=flat-square)
 
 - [NGINX Gateway Fabric Helm Chart](#nginx-gateway-fabric-helm-chart)
   - [Introduction](#introduction)
@@ -259,7 +259,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
 | `certGenerator.serverTLSSecretName` | The name of the Secret containing TLS CA, certificate, and key for the NGINX Gateway Fabric control plane to securely communicate with the NGINX Agent. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"server-tls"` |
 | `clusterDomain` | The DNS cluster domain of your Kubernetes cluster. | string | `"cluster.local"` |
 | `gateways` | A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference. | list | `[]` |
-| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{},"debug":false,"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"edge"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |
+| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"config":{},"container":{},"debug":false,"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"2.0.0"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","resolver":"","secretName":"nplus-license","skipVerify":false}}` |
 | `nginx.config` | The configuration for the data plane that is contained in the NginxProxy resource. This is applied globally to all Gateways managed by this instance of NGINX Gateway Fabric. | object | `{}` |
 | `nginx.container` | The container configuration for the NGINX container. This is applied globally to all Gateways managed by this instance of NGINX Gateway Fabric. | object | `{}` |
 | `nginx.debug` | Enable debugging for NGINX. Uses the nginx-debug binary. The NGINX error log level should be set to debug in the NginxProxy resource. | bool | `false` |
@@ -283,7 +283,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
 | `nginx.usage.resolver` | The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager. | string | `""` |
 | `nginx.usage.secretName` | The name of the Secret containing the JWT for NGINX Plus usage reporting. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"nplus-license"` |
 | `nginx.usage.skipVerify` | Disable client verification of the NGINX Plus usage reporting server certificate. | bool | `false` |
-| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
+| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"2.0.0"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
 | `nginxGateway.affinity` | The affinity of the NGINX Gateway Fabric control plane pod. | object | `{}` |
 | `nginxGateway.config.logging.level` | Log level. | string | `"info"` |
 | `nginxGateway.configAnnotations` | Set of custom annotations for NginxGateway objects. | object | `{}` |
@@ -293,7 +293,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
 | `nginxGateway.gatewayClassName` | The name of the GatewayClass that will be created as part of this release. Every NGINX Gateway Fabric must have a unique corresponding GatewayClass resource. NGINX Gateway Fabric only processes resources that belong to its class - i.e. have the "gatewayClassName" field resource equal to the class. | string | `"nginx"` |
 | `nginxGateway.gatewayControllerName` | The name of the Gateway controller. The controller name must be of the form: DOMAIN/PATH. The controller's domain is gateway.nginx.org. | string | `"gateway.nginx.org/nginx-gateway-controller"` |
 | `nginxGateway.gwAPIExperimentalFeatures.enable` | Enable the experimental features of Gateway API which are supported by NGINX Gateway Fabric. Requires the Gateway APIs installed from the experimental channel. | bool | `false` |
-| `nginxGateway.image` | The image configuration for the NGINX Gateway Fabric control plane. | object | `{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"}` |
+| `nginxGateway.image` | The image configuration for the NGINX Gateway Fabric control plane. | object | `{"pullPolicy":"IfNotPresent","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"2.0.0"}` |
 | `nginxGateway.image.repository` | The NGINX Gateway Fabric image to use | string | `"ghcr.io/nginx/nginx-gateway-fabric"` |
 | `nginxGateway.kind` | The kind of the NGINX Gateway Fabric installation - currently, only deployment is supported. | string | `"deployment"` |
 | `nginxGateway.labels` | Set of labels to be added for NGINX Gateway Fabric deployment. | object | `{}` |

charts/nginx-gateway-fabric/values.schema.json

@@ -290,7 +290,7 @@
         "image": {
           "properties": {
             "pullPolicy": {
-              "default": "Always",
+              "default": "IfNotPresent",
               "enum": [
                 "Always",
                 "IfNotPresent",
@@ -307,7 +307,7 @@
               "type": "string"
             },
             "tag": {
-              "default": "edge",
+              "default": "2.0.0",
               "required": [],
               "title": "tag",
               "type": "string"
@@ -591,7 +591,7 @@
           "description": "The image configuration for the NGINX Gateway Fabric control plane.",
           "properties": {
             "pullPolicy": {
-              "default": "Always",
+              "default": "IfNotPresent",
               "enum": [
                 "Always",
                 "IfNotPresent",
@@ -608,7 +608,7 @@
               "type": "string"
             },
             "tag": {
-              "default": "edge",
+              "default": "2.0.0",
               "required": [],
               "title": "tag",
               "type": "string"

charts/nginx-gateway-fabric/values.yaml

@@ -112,14 +112,14 @@ nginxGateway:
   image:
     # -- The NGINX Gateway Fabric image to use
     repository: ghcr.io/nginx/nginx-gateway-fabric
-    tag: edge
+    tag: 2.0.0
     # @schema
     # enum:
     #   - Always
     #   - IfNotPresent
     #   - Never
     # @schema
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
 
   productTelemetry:
     # -- Enable the collection of product telemetry.
@@ -196,14 +196,14 @@ nginx:
   image:
     # -- The NGINX image to use.
     repository: ghcr.io/nginx/nginx-gateway-fabric/nginx
-    tag: edge
+    tag: 2.0.0
     # @schema
     # enum:
     #   - Always
     #   - IfNotPresent
     #   - Never
     # @schema
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
 
   # -- Is NGINX Plus image being used.
   plus: false