NGINX Ingress Controller 5.6 delivers a strong set of security and traffic management enhancements, from flexible WAF policy sourcing to native OpenID Connect support. This release gives SecOps and platform teams more choice in how they author and enforce policies, while closing long-standing gaps that previously required snippets and workarounds. Here’s what’s new.
WAF via Management Plane: NGINX One Console, NIM, and HTTP Server
What’s new: NGINX Ingress Controller now supports pulling pre-compiled WAF policies from a range of sources, giving teams the flexibility to source policies from wherever they already work, covering both ClickOps and GitOps. Teams can source pre-compiled WAF policies from any of the following:
- NGINX One Console (N1C) — for teams authoring and compiling policies via the NGINX One Console
- NGINX Instance Manager (NIM) — for teams using the NIM platform to manage and compile policies
- A HTTP Server - For teams running CICD and have their policies stores in a separate HTTP endpoint.
Why it matters: SecOps teams can own and manage policies through the tools they already use, while application teams keep moving fast. This flexible retrieval model meets teams where they are, whether that’s a centralised team managing policies through NGINX One Console or a distributed setup using NIM.
WAF Policy Lifecycle Management
What’s new: NGINX Ingress Controller adds Policy Lifecycle Management for WAF, letting you define WAF policies as Kubernetes custom resources directly. The entire policy lifecycle happens inside Kubernetes, making it self-contained and cluster-scoped, and helping teams adopt GitOps workflows with standard tooling such as Argo CD and Flux.
Why it matters: Managing policy natively in Kubernetes makes it declarative, version-controlled, and auditable, giving teams a consistent approach that fits the workflows they already trust, with no external management plane required.
Native OpenID Connect (OIDC) Module
What’s new: NGINX Ingress Controller now supports native OpenID Connect using the new NGINX Plus OIDC module. This is offered as an additional option alongside the existing njs-based approach, giving teams the choice of which to use.
Why it matters: The native NGINX Plus module delivers a more robust, better-integrated, and easier-to-manage authentication experience, while teams that rely on the njs option can continue using it. It’s about giving teams more choice in how they implement standards-based identity and authentication.
HSTS Policy for VirtualServer, VirtualServerRoute, and Ingress
What’s new: HSTS can now be configured natively across VirtualServer, VirtualServerRoute, and Ingress resources. This has been a highly requested feature that previously required snippets and other workarounds.
Why it matters: HSTS is an important part of enforcing secure connections, and doing it natively removes the need for fragile snippet-based approaches. Teams get a clean, Kubernetes-native way to enforce HTTPS and improve their security posture.
Additional Annotations to Ease ingress-nginx Migrations
What’s new: NGINX Ingress Controller adds support for additional annotations to ease migrations from ingress-nginx, including `custom-http-errors` and `upstream-vhost`. As part of this, users can now manually set the `Host` and `X-Forwarded-*` headers and include custom error pages, giving teams more control over how requests are presented to backend applications.
Why it matters: Header handling and custom error pages are the kind of details that sound simple but quickly get complicated in real environments. Supporting these annotations natively closes gaps that previously pushed teams toward custom snippets, and smooths the path for teams migrating from ingress-nginx.
Logging Enhancements
What’s new: NGINX Ingress Controller now includes `resource_namespace` in NIC error logs.
Why it matters: Adding namespace context to error logs makes troubleshooting faster and easier, especially in multi-team environments where the same controller serves many namespaces.
Stability and Bug Fixes
This release also includes multiple stability improvements and bug fixes. Head over to the [GitHub release page]([u]https://github.com/nginx/kubernetes-ingress/releases[/u]) and our [public release docs]([u]https://docs.nginx.com/nginx-ingress-controller/[/u]) for the full picture.
A Thank You to our Community
Finally, this release blog focuses on the new enterprise-grade features in F5 NGINX Ingress Controller, but NIC 2.6 also includes some significant open source features built by the team, with contributions from our open source community. For more info on these, read through our community blog here: NGINX Ingress Controller 5.6: HSTS without snippets, a faster start on large clusters, and improved configuration safety – NGINX Community Blog.
We’re proud of what the team put together here, and we can’t wait to share it with the community and our Customers.