Applying NGINX configuration changes

nginxCustomServerBlockAddition, phpExecutionAllowlist, restApiHardening, nginx.deniedPaths and redirect.goneHosts all render into ConfigMaps that are mounted with subPath; the post-init scripts (wordpressPreinstallPlugins, wordpressConfigureCache, customPostInitScripts) are mounted the same way and carry their own checksum/postinit annotation. Such a mount never receives ConfigMap updates — the kubelet projects the file once when the container starts. Since 7.1.0-7 the pod template carries a checksum annotation for each of them, so changing any of these values rolls the pods automatically; leaving them unchanged keeps the checksum stable and restarts nothing.

On 7.1.0-6 and earlier this did not happen: the ConfigMap was updated, the Deployment spec stayed byte-identical, no rollout was triggered, and running pods kept the previous configuration indefinitely. If you are on such a version and a configuration change appears to have no effect, kubectl rollout restart the deployment.

nginxConfiguration and existingNginxConfigurationConfigMap do not belong to this list. The content of the first is rendered into a ConfigMap, the second names a ConfigMap of your own; either becomes a pod volume that no container mounts, so the image's nginx.conf stays in place. A ConfigMap named in existingNginxConfigurationConfigMap has to exist all the same, or the pod does not start. Additions to the server block go into nginxCustomServerBlockAddition.