From 4220a965f122386c946bc13d83d0e064466ebccd Mon Sep 17 00:00:00 2001 From: Foo Bar Date: Wed, 10 Jun 2026 10:43:15 +0800 Subject: [PATCH 1/2] fix: default ingress-controller listenerPortMatchMode to off The auto mode (apisix-ingress-controller#2703, shipped in 2.1.0) injects a server_port route var derived from the Gateway listener port (e.g. 80/443), but APISIX server_port reflects the data-plane listening port (e.g. 9080/9443), so routes 404 after upgrade. Default to off so port-var injection is opt-in. --- charts/apisix-ingress-controller/Chart.yaml | 2 +- charts/apisix-ingress-controller/README.md | 2 +- charts/apisix-ingress-controller/templates/configmap.yaml | 2 +- charts/apisix-ingress-controller/values.yaml | 6 +++++- 4 files changed, 8 insertions(+), 4 deletions(-) diff --git a/charts/apisix-ingress-controller/Chart.yaml b/charts/apisix-ingress-controller/Chart.yaml index b5c4011e..bdf27e43 100644 --- a/charts/apisix-ingress-controller/Chart.yaml +++ b/charts/apisix-ingress-controller/Chart.yaml @@ -24,7 +24,7 @@ keywords: - nginx - crd type: application -version: 1.2.0 +version: 1.2.1 appVersion: 2.1.0 sources: - https://github.com/apache/apisix-helm-chart diff --git a/charts/apisix-ingress-controller/README.md b/charts/apisix-ingress-controller/README.md index d178ec44..12e2db58 100644 --- a/charts/apisix-ingress-controller/README.md +++ b/charts/apisix-ingress-controller/README.md @@ -121,7 +121,7 @@ The same for container level, you need to set: | config.leaderElection.leaseDuration | string | `"15s"` | | | config.leaderElection.renewDeadline | string | `"10s"` | | | config.leaderElection.retryPeriod | string | `"2s"` | | -| config.listenerPortMatchMode | string | `"auto"` | | +| config.listenerPortMatchMode | string | `"off"` | | | config.logLevel | string | `"info"` | | | config.metricsAddr | string | `":8080"` | | | config.probeAddr | string | `":8081"` | | diff --git a/charts/apisix-ingress-controller/templates/configmap.yaml b/charts/apisix-ingress-controller/templates/configmap.yaml index 4d2833da..3600669e 100644 --- a/charts/apisix-ingress-controller/templates/configmap.yaml +++ b/charts/apisix-ingress-controller/templates/configmap.yaml @@ -35,7 +35,7 @@ data: secure_metrics: {{ .Values.config.secureMetrics | default false }} exec_adc_timeout: {{ .Values.config.execADCTimeout | default "15s" }} disable_gateway_api: {{ .Values.config.disableGatewayAPI | default false }} - listener_port_match_mode: {{ .Values.config.listenerPortMatchMode | default "auto" }} + listener_port_match_mode: {{ .Values.config.listenerPortMatchMode | default "off" }} provider: type: {{ .Values.config.provider.type | default "apisix" }} sync_period: {{ .Values.config.provider.syncPeriod | default "1s" }} diff --git a/charts/apisix-ingress-controller/values.yaml b/charts/apisix-ingress-controller/values.yaml index 0b2cb338..13b5fb09 100644 --- a/charts/apisix-ingress-controller/values.yaml +++ b/charts/apisix-ingress-controller/values.yaml @@ -92,7 +92,11 @@ config: secureMetrics: false execADCTimeout: "15s" disableGatewayAPI: false - listenerPortMatchMode: "auto" + # server_port matches the port APISIX actually listens on (e.g. 9080/9443), + # not the Gateway listener port. Defaults to "off" so port-var injection is + # opt-in; set to "auto"/"explicit" only when APISIX listens on the same ports + # declared in the Gateway listeners. + listenerPortMatchMode: "off" provider: type: "apisix" syncPeriod: "1m" From 1cdc185c56e2c5ac3f494d912d1be11e3d88d73a Mon Sep 17 00:00:00 2001 From: Foo Bar Date: Wed, 10 Jun 2026 10:43:15 +0800 Subject: [PATCH 2/2] fix: default apisix chart ingress-controller listenerPortMatchMode to off Mirror the subchart default change in the umbrella apisix chart so bundled deployments also default port-var injection to off. --- charts/apisix/Chart.yaml | 2 +- charts/apisix/values.yaml | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/charts/apisix/Chart.yaml b/charts/apisix/Chart.yaml index d34c9af5..26af41cc 100644 --- a/charts/apisix/Chart.yaml +++ b/charts/apisix/Chart.yaml @@ -31,7 +31,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 2.14.1 +version: 2.14.2 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/charts/apisix/values.yaml b/charts/apisix/values.yaml index f7c3a6a9..79c78a3f 100644 --- a/charts/apisix/values.yaml +++ b/charts/apisix/values.yaml @@ -688,6 +688,11 @@ etcd: # -- Ingress controller configuration ingress-controller: enabled: false + config: + # server_port matches the port APISIX actually listens on (e.g. 9080/9443), + # not the Gateway listener port. Default to "off" so port-var injection is + # opt-in. + listenerPortMatchMode: "off" webhook: # Specifies whether to enable the validation webhook. # Note: This feature relies on the '/apisix/admin/configs/validate' endpoint.