NGINX Ingress Controller 5.6: native HSTS, startup in 6 seconds

NGINX released version 5.6 of NGINX Ingress Controller on 2 September 2026, with a significant shift for those managing production Kubernetes clusters: less configuration delegated to snippets, more features managed directly by native resources.

The most visible change concerns HTTP Strict Transport Security. Until now, enforcing HSTS required a snippet, which Kubernetes tools cannot validate: an error in the snippet could reach production unnoticed. From 5.6 onwards, HSTS is configurable as a native policy on VirtualServer, VirtualServerRoute and Ingress, with consistent behaviour across all three resource types.

On the operational front, the most impactful improvement is startup speed when the -enable-config-safety flag is active. Previously, each configuration file was validated individually before being written, with a cost that grew quadratically with the number of resources. Now all files are written together and a single nginx -t is run across the entire tree; if validation fails, the controller identifies the responsible resources, excludes them and restarts with the others, logging what failed to load. In internal testing on a cluster with 250 Ingress and 250 VirtualServer resources, startup dropped from 107 to 6 seconds.

Two new annotations ease the transition for those coming from Ingress-NGINX: nginx.org/upstream-vhost sets the Host header sent upstream instead of the controller's internal host, and nginx.org/custom-http-errors routes configured error codes to a dedicated backend. A ConfigMap entry, disable-forwarded-headers, allows disabling X-Forwarded-For, -Host, -Port and -Proto headers when already set by an upstream load balancer or CDN.

Other operational fixes: upstream services in different namespaces now receive endpoint updates without becoming stale; the Helm chart can declare a NetworkPolicy via controller.networkPolicy; secret rotation reloads NGINX for every secret type (CA, JWK, htpasswd, OIDC, API key), not just TLS certificates as before. Also fixed: a path validation regex that blocked legitimate paths like /variables, a spurious warning on wildcard TLS secrets without secretName, and ExternalAuth redirection. Support for NGINX Service Mesh integration has been removed: users relying on it must remove related flags and annotations before upgrading.

The full changelog is on the project's GitHub repository; NGINX Ingress Controller documentation covers the upgrade procedure to 5.6.