Release 2.3.0 (#4474)

Author: github-actions[bot]

.github/CHANGELOG_TEMPLATE.md

@@ -41,4 +41,4 @@ CONTAINER IMAGES:
 - Control plane: `ghcr.io/nginx/nginx-gateway-fabric:%%VERSION%%`
 - Data plane: `ghcr.io/nginx/nginx-gateway-fabric/nginx:%%VERSION%%`
 - Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:%%VERSION%%`
-- Operator: `ghcr.io/nginx/nginx-gateway-fabric/operator:%%VERSION%%`
+- Operator: `ghcr.io/nginx/nginx-gateway-fabric/operator:<set-operator-version>`

CHANGELOG.md

@@ -4,6 +4,55 @@ This document includes a curated changelog for each release. We also publish a c
 a [GitHub release](https://github.com/nginx/nginx-gateway-fabric/releases), which, by contrast, is auto-generated
 and includes links to all PRs that went into the release.
 
+## Release 2.3.0
+
+_December 18, 2025_
+
+FEATURES:
+
+- Support Gateway API v1.4, moving BackendTLSPolicy from experimental to standard. [4166](https://github.com/nginx/nginx-gateway-fabric/pull/4166)
+- Add SupportedFeatures to GatewayClassStatus. [4236](https://github.com/nginx/nginx-gateway-fabric/pull/4236)
+- Add ability to configure access log format or turn logging off. [4102](https://github.com/nginx/nginx-gateway-fabric/pull/4102)
+- Added support for configuring backend TLS on Gateways to enable secure communication between the gateway and upstream. [3900](https://github.com/nginx/nginx-gateway-fabric/pull/3900)
+- Updated validation for pathType RegularExpression to support PCRE-style patterns while remaining RE2-friendly, improving compatibility with other projects. [4450](https://github.com/nginx/nginx-gateway-fabric/pull/4450)
+- Add support for multiple InferencePool backends on a Route. [4439](https://github.com/nginx/nginx-gateway-fabric/pull/4439)
+
+BUG FIXES:
+
+- Fix an issue where duplicate status entries could be written on routes. [4250](https://github.com/nginx/nginx-gateway-fabric/pull/4250)
+- Removed k8s API access from the NGINX data plane pod. [4368](https://github.com/nginx/nginx-gateway-fabric/pull/4368)
+- Fix an issue regarding configuring IPv6 DNS resolvers for ExternalName services. Thanks to [lucasl0st](https://github.com/lucasl0st). [4378](https://github.com/nginx/nginx-gateway-fabric/pull/4378)
+- Fix a bug where NGINX Service could not be created if the Gateway name was very long. [4387](https://github.com/nginx/nginx-gateway-fabric/pull/4387)
+- Fix an issue where NginxProxy config might not be honored if applied at the same time as the Gateway. [4399](https://github.com/nginx/nginx-gateway-fabric/pull/4399)
+- Fix issue where agent's Pod IP cannot be used to track the connecting data plane Pod. [4470](https://github.com/nginx/nginx-gateway-fabric/pull/4470)
+- Fix a bug to preserve external controller annotations for Deployment and DaemonSets to avoid constant updates. [4468](https://github.com/nginx/nginx-gateway-fabric/pull/4468)
+- Fix an issue where nginx pod could not connect to control plane when hostnetwork is enabled. [4481](https://github.com/nginx/nginx-gateway-fabric/pull/4481)
+
+HELM CHART:
+
+- The version of the Helm chart is now 2.3.0
+
+UPGRADE:
+
+- The Gateway API version has been updated to 1.4. This version of Gateway API must be installed before installing NGINX Gateway Fabric v2.3.0 [4166](https://github.com/nginx/nginx-gateway-fabric/pull/4166)
+- Remove deprecated v1alpha1 ObservabilityPolicy API. [4215](https://github.com/nginx/nginx-gateway-fabric/pull/4215)
+
+COMPATIBILITY:
+
+- Gateway API version: `1.4.1`
+- Gateway API Inference Extension version: `1.1.0`
+- NGINX version: `1.29.3`
+- NGINX Plus version: `R36`
+- NGINX Agent version: `v3.6.0`
+- Kubernetes version: `1.25+`
+
+CONTAINER IMAGES:
+
+- Control plane: `ghcr.io/nginx/nginx-gateway-fabric:2.3.0`
+- Data plane: `ghcr.io/nginx/nginx-gateway-fabric/nginx:2.3.0`
+- Data plane with NGINX Plus: `private-registry.nginx.com/nginx-gateway-fabric/nginx-plus:2.3.0`
+- Operator: `ghcr.io/nginx/nginx-gateway-fabric/operator:1.1.0`
+
 ## Release 2.2.2
 
 _December 10, 2025_

Makefile

@@ -1,5 +1,5 @@
 # variables that should not be overridden by the user
-VERSION = edge
+VERSION = 2.3.0
 SELF_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
 CHART_DIR = $(SELF_DIR)charts/nginx-gateway-fabric
 NGINX_CONF_DIR = internal/controller/nginx/conf

README.md

@@ -36,7 +36,7 @@ You can find the comprehensive NGINX Gateway Fabric user documentation on the [N
 We publish NGINX Gateway Fabric releases on GitHub. See
 our [releases page](https://github.com/nginx/nginx-gateway-fabric/releases).
 
-The latest release is [2.2.2](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v2.2.2).
+The latest release is [2.3.0](https://github.com/nginx/nginx-gateway-fabric/releases/tag/v2.3.0).
 
 The edge version is useful for experimenting with new features that are not yet published in a release. To use, choose
 the _edge_ version built from the [latest commit](https://github.com/nginx/nginx-gateway-fabric/commits/main)
@@ -47,7 +47,7 @@ to the correct versions:
 
 | Version | Description | Installation Manifests | Documentation and Examples |
 | ------- | ----------- | ---------------------- | -------------------------- |
-| Latest release | For production use | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.2/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.2.2/examples). |
+| Latest release | For production use | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/v2.3.0/deploy). | [Documentation](https://docs.nginx.com/nginx-gateway-fabric). [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/v2.3.0/examples). |
 | Edge | For experimental use and latest features | [Manifests](https://github.com/nginx/nginx-gateway-fabric/tree/main/deploy). | [Examples](https://github.com/nginx/nginx-gateway-fabric/tree/main/examples). |
 
 ### Versioning
@@ -69,6 +69,7 @@ The following table lists the software versions NGINX Gateway Fabric supports.
 | NGINX Gateway Fabric | Gateway API | Kubernetes | NGINX OSS | NGINX Plus | NGINX Agent |
 |----------------------|-------------|------------|-----------|------------|-------------|
 | Edge                 | 1.4.1       | 1.25+      | 1.29.3    | R36        | v3.6.0      |
+| 2.3.0                | 1.4.1       | 1.25+      | 1.29.3    | R36        | v3.6.0      |
 | 2.2.2                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.6.0      |
 | 2.2.1                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.5.0      |
 | 2.2.0                | 1.3.0       | 1.25+      | 1.29.2    | R35        | v3.3.2      |

charts/nginx-gateway-fabric/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: nginx-gateway-fabric
 description: NGINX Gateway Fabric
 type: application
-version: 2.2.2
-appVersion: "edge"
+version: 2.3.0
+appVersion: "2.3.0"
 kubeVersion: ">= 1.25.0-0"
 home: https://github.com/nginx/nginx-gateway-fabric
 icon: https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/main/charts/nginx-gateway-fabric/chart-icon.png

charts/nginx-gateway-fabric/README.md

@@ -1,7 +1,7 @@
 
 # NGINX Gateway Fabric Helm Chart
 
-![Version: 2.2.2](https://img.shields.io/badge/Version-2.2.2-informational?style=flat-square) ![AppVersion: edge](https://img.shields.io/badge/AppVersion-edge-informational?style=flat-square)
+![Version: 2.3.0](https://img.shields.io/badge/Version-2.3.0-informational?style=flat-square) ![AppVersion: 2.3.0](https://img.shields.io/badge/AppVersion-2.3.0-informational?style=flat-square)
 
 - [NGINX Gateway Fabric Helm Chart](#nginx-gateway-fabric-helm-chart)
   - [Introduction](#introduction)
@@ -208,7 +208,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
 | `certGenerator.ttlSecondsAfterFinished` | How long to wait after the cert generator job has finished before it is removed by the job controller. | int | `30` |
 | `clusterDomain` | The DNS cluster domain of your Kubernetes cluster. | string | `"cluster.local"` |
 | `gateways` | A list of Gateway objects. View https://gateway-api.sigs.k8s.io/reference/spec/#gateway for full Gateway reference. | list | `[]` |
-| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"autoscaling":{"enable":false},"config":{},"container":{"hostPorts":[],"lifecycle":{},"readinessProbe":{},"resources":{},"volumeMounts":[]},"debug":false,"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"edge"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","nginxOneConsole":{"dataplaneKeySecretName":"","endpointHost":"agent.connect.nginx.com","endpointPort":443,"skipVerify":false},"patches":[],"plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"patches":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","enforceInitialReport":true,"resolver":"","secretName":"nplus-license","skipVerify":false}}` |
+| `nginx` | The nginx section contains the configuration for all NGINX data plane deployments installed by the NGINX Gateway Fabric control plane. | object | `{"autoscaling":{"enable":false},"config":{},"container":{"hostPorts":[],"lifecycle":{},"readinessProbe":{},"resources":{},"volumeMounts":[]},"debug":false,"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/nginx/nginx-gateway-fabric/nginx","tag":"2.3.0"},"imagePullSecret":"","imagePullSecrets":[],"kind":"deployment","nginxOneConsole":{"dataplaneKeySecretName":"","endpointHost":"agent.connect.nginx.com","endpointPort":443,"skipVerify":false},"patches":[],"plus":false,"pod":{},"replicas":1,"service":{"externalTrafficPolicy":"Local","loadBalancerClass":"","loadBalancerIP":"","loadBalancerSourceRanges":[],"nodePorts":[],"patches":[],"type":"LoadBalancer"},"usage":{"caSecretName":"","clientSSLSecretName":"","endpoint":"","enforceInitialReport":true,"resolver":"","secretName":"nplus-license","skipVerify":false}}` |
 | `nginx.autoscaling` | Autoscaling configuration for the NGINX data plane. | object | `{"enable":false}` |
 | `nginx.autoscaling.enable` | Enable or disable Horizontal Pod Autoscaler for the NGINX data plane. | bool | `false` |
 | `nginx.config` | The configuration for the data plane that is contained in the NginxProxy resource. This is applied globally to all Gateways managed by this instance of NGINX Gateway Fabric. | object | `{}` |
@@ -246,7 +246,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
 | `nginx.usage.resolver` | The nameserver used to resolve the NGINX Plus usage reporting endpoint. Used with NGINX Instance Manager. | string | `""` |
 | `nginx.usage.secretName` | The name of the Secret containing the JWT for NGINX Plus usage reporting. Must exist in the same namespace that the NGINX Gateway Fabric control plane is running in (default namespace: nginx-gateway). | string | `"nplus-license"` |
 | `nginx.usage.skipVerify` | Disable client verification of the NGINX Plus usage reporting server certificate. | bool | `false` |
-| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"autoscaling":{"enable":false},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"gwAPIInferenceExtension":{"enable":false,"endpointPicker":{"disableTLS":false,"skipVerify":true}},"image":{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"name":"","nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{},"labels":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
+| `nginxGateway` | The nginxGateway section contains configuration for the NGINX Gateway Fabric control plane deployment. | object | `{"affinity":{},"autoscaling":{"enable":false},"config":{"logging":{"level":"info"}},"configAnnotations":{},"extraVolumeMounts":[],"extraVolumes":[],"gatewayClassAnnotations":{},"gatewayClassName":"nginx","gatewayControllerName":"gateway.nginx.org/nginx-gateway-controller","gwAPIExperimentalFeatures":{"enable":false},"gwAPIInferenceExtension":{"enable":false,"endpointPicker":{"disableTLS":false,"skipVerify":true}},"image":{"pullPolicy":"IfNotPresent","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"2.3.0"},"kind":"deployment","labels":{},"leaderElection":{"enable":true,"lockName":""},"lifecycle":{},"metrics":{"enable":true,"port":9113,"secure":false},"name":"","nodeSelector":{},"podAnnotations":{},"productTelemetry":{"enable":true},"readinessProbe":{"enable":true,"initialDelaySeconds":3,"port":8081},"replicas":1,"resources":{},"service":{"annotations":{},"labels":{}},"serviceAccount":{"annotations":{},"imagePullSecret":"","imagePullSecrets":[],"name":""},"snippetsFilters":{"enable":false},"terminationGracePeriodSeconds":30,"tolerations":[],"topologySpreadConstraints":[]}` |
 | `nginxGateway.affinity` | The affinity of the NGINX Gateway Fabric control plane pod. | object | `{}` |
 | `nginxGateway.autoscaling` | Autoscaling configuration for the NGINX Gateway Fabric control plane. | object | `{"enable":false}` |
 | `nginxGateway.autoscaling.enable` | Enable or disable Horizontal Pod Autoscaler for the control plane. | bool | `false` |
@@ -262,7 +262,7 @@ The following table lists the configurable parameters of the NGINX Gateway Fabri
 | `nginxGateway.gwAPIInferenceExtension.endpointPicker` | EndpointPicker TLS configuration. | object | `{"disableTLS":false,"skipVerify":true}` |
 | `nginxGateway.gwAPIInferenceExtension.endpointPicker.disableTLS` | Disable TLS for EndpointPicker communication. By default, TLS is enabled. Set to true only for development/testing or when using a service mesh for encryption. | bool | `false` |
 | `nginxGateway.gwAPIInferenceExtension.endpointPicker.skipVerify` | Disables TLS certificate verification when connecting to the EndpointPicker. By default, certificate verification is disabled. REQUIRED: Must be true until Gateway API Inference Extension EndpointPicker supports mounting certificates. See: https://github.com/kubernetes-sigs/gateway-api-inference-extension/issues/1556 | bool | `true` |
-| `nginxGateway.image` | The image configuration for the NGINX Gateway Fabric control plane. | object | `{"pullPolicy":"Always","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"edge"}` |
+| `nginxGateway.image` | The image configuration for the NGINX Gateway Fabric control plane. | object | `{"pullPolicy":"IfNotPresent","repository":"ghcr.io/nginx/nginx-gateway-fabric","tag":"2.3.0"}` |
 | `nginxGateway.image.repository` | The NGINX Gateway Fabric image to use | string | `"ghcr.io/nginx/nginx-gateway-fabric"` |
 | `nginxGateway.kind` | The kind of the NGINX Gateway Fabric installation - currently, only deployment is supported. | string | `"deployment"` |
 | `nginxGateway.labels` | Set of labels to be added for NGINX Gateway Fabric deployment. | object | `{}` |

charts/nginx-gateway-fabric/values.schema.json

@@ -487,7 +487,7 @@
         "image": {
           "properties": {
             "pullPolicy": {
-              "default": "Always",
+              "default": "IfNotPresent",
               "enum": [
                 "Always",
                 "IfNotPresent",
@@ -504,7 +504,7 @@
               "type": "string"
             },
             "tag": {
-              "default": "edge",
+              "default": "2.3.0",
               "required": [],
               "title": "tag",
               "type": "string"
@@ -902,7 +902,7 @@
           "description": "The image configuration for the NGINX Gateway Fabric control plane.",
           "properties": {
             "pullPolicy": {
-              "default": "Always",
+              "default": "IfNotPresent",
               "enum": [
                 "Always",
                 "IfNotPresent",
@@ -919,7 +919,7 @@
               "type": "string"
             },
             "tag": {
-              "default": "edge",
+              "default": "2.3.0",
               "required": [],
               "title": "tag",
               "type": "string"

charts/nginx-gateway-fabric/values.yaml

@@ -116,14 +116,14 @@ nginxGateway:
   image:
     # -- The NGINX Gateway Fabric image to use
     repository: ghcr.io/nginx/nginx-gateway-fabric
-    tag: edge
+    tag: 2.3.0
     # @schema
     # enum:
     #   - Always
     #   - IfNotPresent
     #   - Never
     # @schema
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
 
   productTelemetry:
     # -- Enable the collection of product telemetry.
@@ -288,14 +288,14 @@ nginx:
   image:
     # -- The NGINX image to use.
     repository: ghcr.io/nginx/nginx-gateway-fabric/nginx
-    tag: edge
+    tag: 2.3.0
     # @schema
     # enum:
     #   - Always
     #   - IfNotPresent
     #   - Never
     # @schema
-    pullPolicy: Always
+    pullPolicy: IfNotPresent
 
   # -- Is NGINX Plus image being used.
   plus: false