Controller: Several security fixes.

[Gacko]

Fixes:

• CVE-2025-1097
• CVE-2025-1098
• CVE-2025-1974
• CVE-2025-24513
• CVE-2025-24514

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Gacko

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Gacko]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Gacko]

/triage accepted
/kind bug
/priority important-soon

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[bm1216]

Sorry if this is ignorant - but will this fix be backported to controller-1.10?

[Gacko]

This is not arrogant, no worries.

v1.10 has been discontinued with the release of v1.12. We normally only maintain main, a current release train and this release minus 1. Therefore eligible fixes get ported to the related release-* branches.

Since v1.10 already go discontinued some time ago, we cannot release a v1.10.7, even if we wanted, because it's not only missing the relevant security fixes, but also tons of other back-ported changes like dependency updates or code maintenance.

[zengyuxing007]

Directly disabed nginx -t might be simplistic and risky. Without the validation provided by nginx -t, changes to the ingress configuration could lead to the nginx process failing to load the updated configuration. In the event of a restart, the nginx ingress pod could crash outright.

[zengyuxing007]

Separating the Controller and Nginx components into different pods should resolve this issue. Decoupling the Controller and Nginx into separate pods can also fix other problems that may arise from having them co-located in the same pod.

It seems like this was mentioned in 2024 roadmap. I'm not sure if it's still in the plans at the moment.