chore(deps): update dependency kubernetes-sigs/aws-alb-ingress-controller to v2.17.1

[renovate]

This PR contains the following updates:

Package	Update	Change
kubernetes-sigs/aws-alb-ingress-controller	minor	v2.16.0 → v2.17.1

---

Release Notes

kubernetes-sigs/aws-alb-ingress-controller (kubernetes-sigs/aws-alb-ingress-controller)

v2.17.1

Compare Source

v2.17.1 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.17.1
Thanks to all our contributors! 😊

🚀 What's New

QUIC Protocol Support: Added QUIC protocol support for Gateway API and Service API
JWT Validation: Support for JWT validation in Gateway API
Default Load Balancer Scheme: Added support for specifying —default-load-balancer-scheme flag in Helm chart

🔧 Enhancements and Fixes

Bug Fixes

• Helm Chart: Duplicated CRD in helm kustomization

Documentation Updates

• Service Actions: Fixed service.beta.kubernetes.io/actions example in documentation
• Conformance Report: Generated v2.17.0 conformance test report

Changelog since v2.17.0

• Merge Main to release-2.17 (#​4533, @​wweiwei-li)
• [GW API] Add QUIC support (#​4530, @​zac-nixon)
• docs: fix service.beta.kubernetes.io/actions example (#​4529, @​davidxia)
• Add E2E tests for QUIC support in Service API. (#​4527, @​zac-nixon)
• feat(chart): add support for specifying —default-load-balancer-scheme flag (#​4141, @​ysam12345)
• fix: duplicated CRD in helm kustomization (#​4518, @​wweiwei-li)
• generate v2.17.0 conformance test report (#​4521, @​shuqz)
• [feat gw-api]support jwt validation (#​4516, @​shuqz)
• fix helm chart version (#​4515, @​wweiwei-li)

v2.17.0

Compare Source

v2.17.0 (requires Kubernetes 1.22+)

Documentation

Image: public.ecr.aws/eks/aws-load-balancer-controller:v2.17.0
Thanks to all our contributors! 😊

Known Issues

Helm Chart 1.17.0 includes duplicated CRD globalaccelerators, causing kustomize render to fail

⚠️ Actions required to use the new AWS Global Accelerator controller

• CRD Updates - If you're upgrading the charts using helm upgrade, you need to update CRDs manually: kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/aga/aga.k8s.aws_globalaccelerators.yaml
• IAM Policy Updates - Update the controller's IAM policy with Global Accelerator permissions (see IAM Policy)
• RBAC Updates - Apply the latest RBAC definitions for Global Accelerator controller permissions (see RBAC)
• Feature Flag for Global Accelerator - Enable the feature flag --enable-global-accelerator=true,--feature-gates=EnableRGTAPI to use Accelerator functionality

🚀 What's New

AWS Global Accelerator Support - A new controller that enables declarative management of AWS Global Accelerators directly from Kubernetes using Custom Resource Definitions (CRDs). It allows users to define Global Accelerator resources as Kubernetes manifests, automatically provisioning and managing accelerators, listeners, endpoint groups, and endpoints that reference Kubernetes Ingress, Kubernetes Services, Kubernetes Gateway, and AWS resource ARNs. For more details, check the documentation:

• Introduction of AWS Global Accelerator Controller
• Installation and Prerequisites for AWS Global Accelerator Controller
• Example of using AWS Global Accelerator Controller

Gateway API - GA Release Candidate: The Gateway API implementation in this release is considered a Release Candidate for its General Availability (GA) release planned for next month. We encourage extensive testing in production-like environments and welcome your feedback via GitHub issues to ensure a stable GA release. What's new in this release:

• TCP_UDP Protocol: Complete support for combined TCP_UDP protocol on NLB Gateways with detailed usage guidance
• Per-ParentRef Status: Route status now correctly updates per parentRef instead of per-route
• ReplacePrefixMatch: Enhanced support with documented ALB limitations
• Conformance Report: Generated Gateway API conformance report with detailed test results
• ACM Cert Discovery: Fixed memory leak in ACM certificate discovery
• App Protocol Support: Added support for kubernetes.io/h2c App Protocol

🔧 Enhancements and Fixes

✨ Enhancements

• Cross-Zone Handling: Improved handling for cross-zone disabled ALBs with automatic AZ detection
• Weighted Target Groups: Added support for weighted target groups on NLB listeners

🐛 Bug Fixes

• Helm Template: Fixed objectSelector.matchExpressions indentation in webhook.yaml
• Helm Chart: Added --max-targets-per-target-group flag support

📚 Documentation

• Prometheus Metrics: Corrected metric names to include aws_ prefix in documentation

Changelog since v2.16.0

• cut v2.17.0 release (#​4514, @​wweiwei-li)
• fix kustomize build error by correcting webhook name (#​4513, @​wweiwei-li)
• Fix markdown issue for the FR template (#​4507, @​guessi)
• bundle AGA crds into standard deployment (#​4512, @​wweiwei-li)
• Fix IPv6 tests (#​4511, @​wweiwei-li)
• Fix typo in pod readiness gate doc (#​4420, @​davidxia)
• add trust store e2e test and script for local testing (#​4510, @​shuqz)
• correct drift check for mtls listeners (#​4505, @​zac-nixon)
• handle cross zone disabled for alb (#​4496, @​shuqz)
• Add missing RBAC permissions for GlobalAccelerator CRD (#​4508, @​wweiwei-li)
• Run CI test in parallel (#​4503, @​wweiwei-li)
• Add check for duplicate endpoints (#​4502, @​wweiwei-li)
• Add condition to AGA IAM policy (#​4501, @​wweiwei-li)
• refactor app protocol, add support for app protocols that kubernetes + elb supports (#​4500, @​zac-nixon)
• Add basic aga controller e2e tests (#​4485, @​wweiwei-li)
• docs(prometheus): metric name should include aws_ prefix (#​4443, @​samuelmasuy)
• feat: add maxTargetsPerTarget group flag to helm chart (#​4408, @​mmiller-sh)
• use one instance of acm cert discovery in gateway builder (#​4493, @​zac-nixon)
• [feat gw-api]conformance report (#​4489, @​shuqz)
• [feat gw-api]add e2e for gateway status update validation (#​4488, @​shuqz)
• [feat gw-api]modify route status update per parentRef (#​4483, @​shuqz)
• NLB weighted target groups (#​4484, @​zac-nixon)
• [feat aga] Move iam policies into its own file for easy setup (#​4486, @​shraddhabang)
• [feat aga] Implement auto-discovery feature for supported endpoints (#​4476, @​shraddhabang)
• [feat aga] Add documentation for AGA controller (#​4478, @​shraddhabang)
• [feat aga] Implement endpoint management for endpoint groups in accelerator (#​4471, @​shraddhabang)
• [gw api] Add TCP_UDP for gateway api (#​4469, @​zac-nixon)
• Support BYOIP (#​4475, @​wweiwei-li)
• [feat aga] Implement endpoint group management with port override conflict resolution (#​4470, @​shraddhabang)
• [feat aga] Implement AGA endpoint resource references loading and monitoring (#​4458, @​shraddhabang)
• Merge AGAController branch into main (#​4466, @​zac-nixon)
• [feat aga] Add AGA listener support without auto-discovery (#​4436, @​shraddhabang)

---

Configuration

📅 Schedule: Branch creation - On day 1 and 15 of the month ( * * 1,15 * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🚀 Preview Deployment Ready!

Your pull request has been built and is ready for preview deployment.
Here's how to test your changes:

Container Images Built

• Balancer: ghcr.io/OWASP/wrongsecrets-balancer:pr-1051
• Cleaner: ghcr.io/OWASP/cleaner:pr-1051

Quick Deploy with Helm

# Add the wrongsecrets helm repository
helm repo add wrongsecrets https://owasp.org/wrongsecrets-ctf-party
helm repo update

# Deploy with preview images
helm install my-preview wrongsecrets/wrongsecrets-ctf-party \
  --set balancer.repository=ghcr.io/OWASP/wrongsecrets-balancer \
  --set balancer.tag=pr-1051 \
  --set wrongsecretsCleanup.repository=ghcr.io/OWASP/cleaner \
  --set wrongsecretsCleanup.tag=pr-1051 \
  --set imagePullPolicy=Always

# Port forward to access locally
kubectl port-forward service/wrongsecrets-balancer 3000:3000

Deploy with Custom Values

Click to see preview-values.yaml

balancer:
  repository: ghcr.io/OWASP/wrongsecrets-balancer
  tag: pr-1051

wrongsecretsCleanup:
  repository: ghcr.io/OWASP/cleaner
  tag: pr-1051

# Preview configuration
ingress:
  enabled: true
  hosts:
    - host: >-
        preview-pr-1051.wrongsecrets.local
      paths:
        - "/"

# Save the above values to preview-values.yaml, then:
helm install my-preview wrongsecrets/wrongsecrets-ctf-party \
  -f preview-values.yaml

Deploy with Local Build Scripts

# Clone this PR
git fetch origin pull/1051/head:pr-1051
git checkout pr-1051

# Use the existing deployment script with custom images
./build-and-deploy.sh

Test the Changes

1. Access the application at http://localhost:3000
2. Create a team and verify functionality
3. Test any new features or bug fixes

Container Registry

The preview images are available at:

• https://github.com/OWASP/wrongsecrets-ctf-party/pkgs/container/wrongsecrets-balancer
• https://github.com/OWASP/wrongsecrets-ctf-party/pkgs/container/cleaner

---

This preview was automatically generated for PR #1051