diff --git a/charts/apisix/Chart.yaml b/charts/apisix/Chart.yaml index 915da86c..6a93851f 100644 --- a/charts/apisix/Chart.yaml +++ b/charts/apisix/Chart.yaml @@ -31,7 +31,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 2.15.0 +version: 2.16.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/charts/apisix/README.md b/charts/apisix/README.md index 64dfe2af..7f1ecc6a 100644 --- a/charts/apisix/README.md +++ b/charts/apisix/README.md @@ -54,6 +54,9 @@ The command removes all the Kubernetes components associated with the chart and | apisix.admin.externalIPs | list | `[]` | IPs for which nodes in the cluster will also accept traffic for the servic | | apisix.admin.ingress | object | `{"annotations":{},"enabled":false,"hosts":[{"host":"apisix-admin.local","paths":["/apisix"]}],"tls":[]}` | Using ingress access Apache APISIX admin service | | apisix.admin.ingress.annotations | object | `{}` | Ingress annotations | +| apisix.admin.ingress.enabled | bool | `false` | Enable an Ingress resource in front of the Admin API service | +| apisix.admin.ingress.hosts | list | `[{"host":"apisix-admin.local","paths":["/apisix"]}]` | Ingress host and path rules | +| apisix.admin.ingress.tls | list | `[]` | Ingress TLS settings | | apisix.admin.ip | string | `"0.0.0.0"` | which ip to listen on for Apache APISIX admin API. Set to `"[::]"` when on IPv6 single stack | | apisix.admin.port | int | `9180` | which port to use for Apache APISIX admin API | | apisix.admin.servicePort | int | `9180` | Service port to use for Apache APISIX admin API | @@ -66,40 +69,66 @@ The command removes all the Kubernetes components associated with the chart and | apisix.customPlugins.plugins[0].configMap | object | `{"mounts":[{"key":"the-file-name","path":"mount-path"}],"name":"configmap-name"}` | plugin codes can be saved inside configmap object. | | apisix.customPlugins.plugins[0].configMap.mounts | list | `[{"key":"the-file-name","path":"mount-path"}]` | since keys in configmap is flat, mountPath allows to define the mount path, so that plugin codes can be mounted hierarchically. | | apisix.customPlugins.plugins[0].configMap.name | string | `"configmap-name"` | name of configmap. | +| apisix.deleteURITailSlash | bool | `false` | Delete the '/' at the end of the URI | | apisix.deployment.mode | string | `"traditional"` | Apache APISIX deployment mode Optional: traditional, decoupled, standalone ref: https://apisix.apache.org/docs/apisix/deployment-modes/ | | apisix.deployment.role | string | `"traditional"` | Deployment role Optional: traditional, data_plane, control_plane ref: https://apisix.apache.org/docs/apisix/deployment-modes/ | -| apisix.deployment.role_traditional.config_provider | string | `"etcd"` | | +| apisix.deployment.role_traditional.config_provider | string | `"etcd"` | Config provider for the traditional role. enum: etcd, yaml | | apisix.deployment.standalone | object | `{"config":"routes:\n-\n uri: /hi\n upstream:\n nodes:\n \"127.0.0.1:1980\": 1\n type: roundrobin\n","existingConfigMap":""}` | Standalone rules configuration ref: https://apisix.apache.org/docs/apisix/deployment-modes/#standalone | | apisix.deployment.standalone.config | string | `"routes:\n-\n uri: /hi\n upstream:\n nodes:\n \"127.0.0.1:1980\": 1\n type: roundrobin\n"` | Rules which are set to the default apisix.yaml configmap. If apisix.delpoyment.standalone.existingConfigMap is empty, these are used. | | apisix.deployment.standalone.existingConfigMap | string | `""` | Specifies the name of the ConfigMap that contains the rule configurations. The configuration must be set to the key named `apisix.yaml` in the configmap. | | apisix.discovery.enabled | bool | `false` | Enable or disable Apache APISIX integration service discovery | | apisix.discovery.registry | object | `{}` | Service discovery registry. Refer to [configuration under discovery](https://github.com/apache/apisix/blob/master/conf/config.yaml.example#L307) for example. Also see [example of using external service discovery](https://apisix.apache.org/docs/ingress-controller/1.8.0/tutorials/external-service-discovery/). | -| apisix.dns.resolvers[0] | string | `"127.0.0.1"` | | -| apisix.dns.resolvers[1] | string | `"172.20.0.10"` | | -| apisix.dns.resolvers[2] | string | `"114.114.114.114"` | | -| apisix.dns.resolvers[3] | string | `"223.5.5.5"` | | -| apisix.dns.resolvers[4] | string | `"1.1.1.1"` | | -| apisix.dns.resolvers[5] | string | `"8.8.8.8"` | | -| apisix.dns.timeout | int | `5` | | -| apisix.dns.validity | int | `30` | | -| apisix.enableHTTP2 | bool | `true` | | +| apisix.dns.enableResolvSearchOpt | bool | `true` | Honor the `search` option in `/etc/resolv.conf` when resolving domain names | +| apisix.dns.resolvers | list | `[]` | Nameservers used by APISIX to resolve upstream domain names. When empty (default), nameservers are read from `/etc/resolv.conf`, which is usually what you want inside Kubernetes | +| apisix.dns.timeout | int | `5` | DNS resolver timeout in seconds | +| apisix.dns.validity | int | `30` | Override the TTL in seconds of valid DNS records | +| apisix.enableHTTP2 | bool | `true` | Enable HTTP/2 on the HTTP listeners | | apisix.enableIPv6 | bool | `true` | Enable nginx IPv6 resolver | | apisix.enableServerTokens | bool | `true` | Whether the APISIX version number should be shown in Server header | | apisix.extPlugin.cmd | list | `["/path/to/apisix-plugin-runner/runner","run"]` | the command and its arguements to run as a subprocess | | apisix.extPlugin.enabled | bool | `false` | Enable External Plugins. See [external plugin](https://apisix.apache.org/docs/apisix/next/external-plugin/) | | apisix.fullCustomConfig.config | object | `{}` | If apisix.fullCustomConfig.enabled is true, full customized config.yaml. Please note that other settings about APISIX config will be ignored | | apisix.fullCustomConfig.enabled | bool | `false` | Enable full customized config.yaml | +| apisix.graphql.maxSize | int | `1048576` | The maximum size in bytes of GraphQL queries APISIX parses when matching routes by GraphQL attributes (default 1MiB) | +| apisix.lru | object | `{"secret":{"count":512,"neg_count":512,"neg_ttl":60,"ttl":300}}` | fine tune the parameters of LRU cache for some features like secret | +| apisix.lru.secret.count | int | `512` | Maximum number of cached secret values | +| apisix.lru.secret.neg_count | int | `512` | Maximum number of cached negative (failed lookup) results | +| apisix.lru.secret.neg_ttl | int | `60` | TTL in seconds for cached negative (failed lookup) results | +| apisix.lru.secret.ttl | int | `300` | TTL in seconds for cached secret values | | apisix.luaModuleHook | object | `{"configMapRef":{"mounts":[{"key":"","path":""}],"name":""},"enabled":false,"hookPoint":"","luaPath":""}` | Whether to add a custom lua module | | apisix.luaModuleHook.configMapRef | object | `{"mounts":[{"key":"","path":""}],"name":""}` | configmap that stores the codes | | apisix.luaModuleHook.configMapRef.mounts[0] | object | `{"key":"","path":""}` | Name of the ConfigMap key, for setting the mapping relationship between ConfigMap key and the lua module code path. | | apisix.luaModuleHook.configMapRef.mounts[0].path | string | `""` | Filepath of the plugin code, for setting the mapping relationship between ConfigMap key and the lua module code path. | | apisix.luaModuleHook.configMapRef.name | string | `""` | Name of the ConfigMap where the lua module codes store | +| apisix.luaModuleHook.enabled | bool | `false` | Enable loading a custom lua module hook | | apisix.luaModuleHook.hookPoint | string | `""` | the hook module which will be used to inject third party code into APISIX use the lua require style like: "module.say_hello" | | apisix.luaModuleHook.luaPath | string | `""` | extend lua_package_path to load third party code | -| apisix.nginx.configurationSnippet | object | `{"httpAdmin":"","httpEnd":"","httpSrv":"","httpStart":"","main":"","stream":""}` | Custom configuration snippet. | +| apisix.nginx.configurationSnippet | object | `{"httpAdmin":"","httpEnd":"","httpSrv":"","httpStart":"","main":"","stream":""}` | Custom nginx configuration snippets injected into the generated nginx.conf. As arbitrary configuration can be added here, it is your responsibility to make sure the snippets don't conflict with the configuration generated by APISIX. | +| apisix.nginx.configurationSnippet.httpAdmin | string | `""` | Snippet added to the nginx `server` block that serves the Admin API | +| apisix.nginx.configurationSnippet.httpEnd | string | `""` | Snippet added to the end of the nginx `http` block | +| apisix.nginx.configurationSnippet.httpSrv | string | `""` | Snippet added to the nginx `server` block that proxies regular traffic | +| apisix.nginx.configurationSnippet.httpStart | string | `""` | Snippet added to the beginning of the nginx `http` block | +| apisix.nginx.configurationSnippet.main | string | `""` | Snippet added to the nginx `main` (top-level) block | +| apisix.nginx.configurationSnippet.stream | string | `""` | Snippet added to the nginx `stream` block | | apisix.nginx.customLuaSharedDicts | list | `[]` | Add custom [lua_shared_dict](https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#lua_shared_dict) settings, click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict | -| apisix.nginx.enableCPUAffinity | bool | `true` | | -| apisix.nginx.envs | list | `[]` | | +| apisix.nginx.enableCPUAffinity | bool | `true` | Bind nginx worker processes to CPUs | +| apisix.nginx.envs | list | `[]` | List of environment variable names allowed to be accessed within nginx (rendered as nginx `env` directives) | +| apisix.nginx.http | object | `{"charset":"utf-8","clientBodyTimeout":"60s","clientHeaderTimeout":"60s","clientMaxBodySize":0,"proxySslServerName":true,"realIpFrom":["127.0.0.1","unix:"],"realIpHeader":"X-Real-IP","realIpRecursive":"off","sendTimeout":"10s","underscoresInHeaders":"on","upstream":{"keepalive":320,"keepaliveRequests":1000,"keepaliveTimeout":"60s"},"variablesHashMaxSize":2048}` | Nginx HTTP subsystem configurations | +| apisix.nginx.http.charset | string | `"utf-8"` | The charset added to the "Content-Type" response header field, see [charset](http://nginx.org/en/docs/http/ngx_http_charset_module.html#charset) | +| apisix.nginx.http.clientBodyTimeout | string | `"60s"` | timeout for reading client request body, then 408 (Request Time-out) error is returned to the client | +| apisix.nginx.http.clientHeaderTimeout | string | `"60s"` | timeout for reading client request header, then 408 (Request Time-out) error is returned to the client | +| apisix.nginx.http.clientMaxBodySize | int | `0` | The maximum allowed size of the client request body. If exceeded, the 413 (Request Entity Too Large) error is returned to the client. Note that unlike Nginx, we don't limit the body size by default (0 means no limit). | +| apisix.nginx.http.proxySslServerName | bool | `true` | Enables or disables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066) when establishing a connection with the proxied HTTPS server | +| apisix.nginx.http.realIpFrom | list | `["127.0.0.1","unix:"]` | Trusted addresses from which the real IP header is honored, see [set_real_ip_from](http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from) | +| apisix.nginx.http.realIpHeader | string | `"X-Real-IP"` | The request header used to determine the client's real IP address, see [real_ip_header](http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header) | +| apisix.nginx.http.realIpRecursive | string | `"off"` | Whether to search for the real IP recursively when the header set in apisix.nginx.http.realIpHeader contains multiple addresses, see [real_ip_recursive](http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive) | +| apisix.nginx.http.sendTimeout | string | `"10s"` | timeout for transmitting a response to the client, then the connection is closed | +| apisix.nginx.http.underscoresInHeaders | string | `"on"` | Enable the use of underscores in client request header fields | +| apisix.nginx.http.upstream | object | `{"keepalive":320,"keepaliveRequests":1000,"keepaliveTimeout":"60s"}` | Keepalive settings for connections from APISIX to upstream servers | +| apisix.nginx.http.upstream.keepalive | int | `320` | Maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. When this number is exceeded, the least recently used connections are closed | +| apisix.nginx.http.upstream.keepaliveRequests | int | `1000` | Maximum number of requests that can be served through one keepalive connection. After the maximum number of requests is made, the connection is closed | +| apisix.nginx.http.upstream.keepaliveTimeout | string | `"60s"` | Timeout during which an idle keepalive connection to an upstream server will stay open | +| apisix.nginx.http.variablesHashMaxSize | int | `2048` | The maximum size of the nginx variables hash table | | apisix.nginx.keepaliveTimeout | string | `"60s"` | Timeout during which a keep-alive client connection will stay open on the server side. | | apisix.nginx.logs.accessLog | string | `"/dev/stdout"` | Access log path | | apisix.nginx.logs.accessLogFormat | string | `"$remote_addr - $remote_user [$time_local] $http_host \\\"$request\\\" $status $body_bytes_sent $request_time \\\"$http_referer\\\" \\\"$http_user_agent\\\" $upstream_addr $upstream_status $upstream_response_time \\\"$upstream_scheme://$upstream_host$upstream_uri\\\""` | Access log format | @@ -107,31 +136,53 @@ The command removes all the Kubernetes components associated with the chart and | apisix.nginx.logs.enableAccessLog | bool | `true` | Enable access log or not, default true | | apisix.nginx.logs.errorLog | string | `"/dev/stderr"` | Error log path | | apisix.nginx.logs.errorLogLevel | string | `"warn"` | Error log level | +| apisix.nginx.logs.stream | object | `{"accessLog":"logs/access_stream.log","accessLogFormat":"$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time","accessLogFormatEscape":"default","enableAccessLog":false}` | Stream (L4 proxy) access log configuration | +| apisix.nginx.logs.stream.accessLog | string | `"logs/access_stream.log"` | Stream access log path | +| apisix.nginx.logs.stream.accessLogFormat | string | `"$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time"` | Stream access log format | +| apisix.nginx.logs.stream.accessLogFormatEscape | string | `"default"` | Allows setting json or default characters escaping in variables for stream | +| apisix.nginx.logs.stream.enableAccessLog | bool | `false` | Enable stream access log or not, default false | | apisix.nginx.luaSharedDicts | list | `[]` | Override default [lua_shared_dict](https://github.com/apache/apisix/blob/master/conf/config.yaml.example#L250-L276) settings, click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict | +| apisix.nginx.maxPendingTimers | int | `16384` | Maximum number of pending timers. Increase it if you see "too many pending timers" error | +| apisix.nginx.maxRunningTimers | int | `4096` | Maximum number of running timers. Increase it if you see "lua_max_running_timers are not enough" error | | apisix.nginx.metaLuaSharedDicts | list | `[]` | Override default meta-level [lua_shared_dict](https://github.com/apache/apisix/blob/master/conf/config.yaml.example) settings, meta-level shared dicts are shared across both HTTP and stream subsystems. Since APISIX 3.16.0, `upstream-healthcheck` is a meta-level shared dict. click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict | -| apisix.nginx.workerConnections | string | `"10620"` | | -| apisix.nginx.workerProcesses | string | `"auto"` | | -| apisix.nginx.workerRlimitNofile | string | `"20480"` | | +| apisix.nginx.workerConnections | string | `"10620"` | The maximum number of connections that each worker process can open | +| apisix.nginx.workerProcesses | string | `"auto"` | The number of nginx worker processes. `auto` means the number of CPU cores | +| apisix.nginx.workerRlimitNofile | string | `"20480"` | The number of files a worker process can open, should be larger than apisix.nginx.workerConnections | +| apisix.nginx.workerShutdownTimeout | string | `"240s"` | Timeout for a graceful shutdown of worker processes | +| apisix.normalizeURILikeServlet | bool | `false` | The URI normalization in servlet is a little different from the RFC's. See https://github.com/jakartaee/servlet/blob/master/spec/src/main/asciidoc/servlet-spec-body.adoc#352-uri-path-canonicalization, which is used under Tomcat. Turn this option on if you want to be compatible with servlet when matching URI path. | | apisix.pluginAttrs | object | `{}` | Set APISIX plugin attributes. By default, APISIX's [plugin_attr](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua#L295) are automatically used. See [configuration example](https://github.com/apache/apisix/blob/master/conf/config.yaml.example#L591). | | apisix.plugins | list | `[]` | Customize the list of APISIX plugins to enable. By default, APISIX's [default plugins](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua#L196) are automatically used. | | apisix.prometheus.containerPort | int | `9091` | container port where the metrics are exposed | -| apisix.prometheus.enabled | bool | `false` | | +| apisix.prometheus.enabled | bool | `false` | Enable Prometheus metrics. ref: https://apisix.apache.org/docs/apisix/plugins/prometheus/ | | apisix.prometheus.metricPrefix | string | `"apisix_"` | prefix of the metrics | | apisix.prometheus.path | string | `"/apisix/prometheus/metrics"` | path of the metrics endpoint | +| apisix.proxyCache | object | `{"cacheTtl":"10s","zones":[{"cache_levels":"1:2","disk_path":"/tmp/disk_cache_one","disk_size":"1G","memory_size":"50m","name":"disk_cache_one"},{"memory_size":"50m","name":"memory_cache"}]}` | Proxy caching configuration used by the proxy-cache plugin. | +| apisix.proxyCache.cacheTtl | string | `"10s"` | The default caching time in disk if the upstream does not specify the cache time | +| apisix.proxyCache.zones | list | `[{"cache_levels":"1:2","disk_path":"/tmp/disk_cache_one","disk_size":"1G","memory_size":"50m","name":"disk_cache_one"},{"memory_size":"50m","name":"memory_cache"}]` | The parameters of a cache. The `memory_size` field stores the cache index for the disk strategy and the cache content for the memory strategy; `disk_size`, `disk_path` and `cache_levels` only apply to the disk strategy. | +| apisix.proxyProtocol | object | `{"enableTcpPP":false,"enableTcpPPToUpstream":false,"listenHttpNodePort":null,"listenHttpPort":null,"listenHttpsNodePort":null,"listenHttpsPort":null}` | PROXY Protocol configuration. | +| apisix.proxyProtocol.enableTcpPP | bool | `false` | Accept the PROXY Protocol on every service.stream.tcp port. | +| apisix.proxyProtocol.enableTcpPPToUpstream | bool | `false` | Send the PROXY Protocol to the upstream server on every service.stream.tcp port. | +| apisix.proxyProtocol.listenHttpNodePort | int | `nil` | The nodePort of the PROXY Protocol HTTP port, only used if service.type is NodePort. If not set, a random port will be assigned by Kubernetes. | +| apisix.proxyProtocol.listenHttpPort | int | `nil` | The HTTP port that accepts the PROXY Protocol. It differs from `service.http` ports and `apisix.admin` port: this port only accepts HTTP requests carrying the PROXY Protocol, while the other ports only accept plain HTTP requests. If you enable the PROXY Protocol, you must use this port to receive HTTP requests with it. When set, the port is also exposed on the gateway Service. | +| apisix.proxyProtocol.listenHttpsNodePort | int | `nil` | The nodePort of the PROXY Protocol HTTPS port, only used if service.type is NodePort. If not set, a random port will be assigned by Kubernetes. | +| apisix.proxyProtocol.listenHttpsPort | int | `nil` | The HTTPS port that accepts the PROXY Protocol. When set, the port is also exposed on the gateway Service. | | apisix.router.http | string | `"radixtree_host_uri"` | Defines how apisix handles routing: - radixtree_uri: match route by uri(base on radixtree) - radixtree_host_uri: match route by host + uri(base on radixtree) - radixtree_uri_with_parameter: match route by uri with parameters | | apisix.setIDFromPodUID | bool | `false` | Use Pod metadata.uid as the APISIX id. | +| apisix.showUpstreamStatusInResponseHeader | bool | `false` | When true, the upstream status is always written to the `X-APISIX-Upstream-Status` response header; when false, it is written only for 5xx responses | | apisix.ssl.additionalContainerPorts | list | `[]` | Support multiple https ports, See [Configuration](https://github.com/apache/apisix/blob/0bc65ea9acd726f79f80ae0abd8f50b7eb172e3d/conf/config-default.yaml#L99) | | apisix.ssl.certCAFilename | string | `""` | Filename be used in the apisix.ssl.existingCASecret | -| apisix.ssl.containerPort | int | `9443` | | -| apisix.ssl.enableHTTP3 | bool | `false` | | -| apisix.ssl.enabled | bool | `false` | | +| apisix.ssl.containerPort | int | `9443` | Container port APISIX listens on for HTTPS traffic | +| apisix.ssl.enableHTTP3 | bool | `false` | Enable HTTP/3 (QUIC) on the HTTPS listeners | +| apisix.ssl.enabled | bool | `false` | Enable HTTPS listeners | | apisix.ssl.existingCASecret | string | `""` | Specifies the name of Secret contains trusted CA certificates in the PEM format used to verify the certificate when APISIX needs to do SSL/TLS handshaking with external services (e.g. etcd) | | apisix.ssl.fallbackSNI | string | `""` | Define SNI to fallback if none is presented by client | | apisix.ssl.sslCiphers | string | `"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"` | TLS ciphers allowed to use. | | apisix.ssl.sslProtocols | string | `"TLSv1.2 TLSv1.3"` | TLS protocols allowed to use. | -| apisix.status.ip | string | `"0.0.0.0"` | | -| apisix.status.port | int | `7085` | | +| apisix.ssl.sslSessionTickets | bool | `false` | Enable or disable TLS session tickets. Disabled by default because session tickets defeat Perfect Forward Secrecy (see https://github.com/mozilla/server-side-tls/issues/135) | +| apisix.status.ip | string | `"0.0.0.0"` | The IP address on which the status endpoint (`/status`, `/status/ready`) listens | +| apisix.status.port | int | `7085` | The port on which the status endpoint listens | | apisix.stream_plugins | list | `[]` | Customize the list of APISIX stream_plugins to enable. By default, APISIX's [default stream_plugins](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua#L294) are automatically used. | +| apisix.tracing | bool | `false` | Enable comprehensive request lifecycle tracing (SSL/SNI, rewrite, access, header_filter, body_filter, and log). When disabled, OpenTelemetry collects only a single span per request. | | apisix.trustedAddresses | list | `["127.0.0.1"]` | When configured, APISIX will trust the `X-Forwarded-*` Headers passed in requests from the IP/CIDR in the list. | | apisix.vault.enabled | bool | `false` | Enable or disable the vault integration | | apisix.vault.host | string | `""` | The host address where the vault server is running. | @@ -139,24 +190,26 @@ The command removes all the Kubernetes components associated with the chart and | apisix.vault.timeout | int | `10` | HTTP timeout for each request. | | apisix.vault.token | string | `""` | The generated token from vault instance that can grant access to read data from the vault. | | apisix.wasm.enabled | bool | `false` | Enable Wasm Plugins. See [wasm plugin](https://apisix.apache.org/docs/apisix/next/wasm/) | -| apisix.wasm.plugins | list | `[]` | | -| autoscaling.enabled | bool | `false` | | -| autoscaling.maxReplicas | int | `100` | | -| autoscaling.minReplicas | int | `1` | | -| autoscaling.targetCPUUtilizationPercentage | int | `80` | | -| autoscaling.targetMemoryUtilizationPercentage | int | `80` | | +| apisix.wasm.plugins | list | `[]` | List of Wasm plugins, each item with `name`, `priority` and `file` (path or URL of the wasm binary) | +| autoscaling.enabled | bool | `false` | Enable HorizontalPodAutoscaler for APISIX (only when useDaemonSet is false) | +| autoscaling.maxReplicas | int | `100` | Maximum number of APISIX replicas | +| autoscaling.minReplicas | int | `1` | Minimum number of APISIX replicas | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | Target average CPU utilization percentage that triggers scaling | +| autoscaling.targetMemoryUtilizationPercentage | int | `80` | Target average memory utilization percentage that triggers scaling | | autoscaling.version | string | `"v2"` | HPA version, the value is "v2" or "v2beta1", default "v2" | | control.enabled | bool | `true` | Enable Control API | | control.ingress | object | `{"annotations":{},"enabled":false,"hosts":[{"host":"apisix-control.local","paths":["/*"]}],"tls":[]}` | Using ingress access Apache APISIX Control service | | control.ingress.annotations | object | `{}` | Ingress annotations | -| control.ingress.hosts | list | `[{"host":"apisix-control.local","paths":["/*"]}]` | Ingress Class Name className: "nginx" | +| control.ingress.enabled | bool | `false` | Enable an Ingress resource in front of the Control API service | +| control.ingress.hosts | list | `[{"host":"apisix-control.local","paths":["/*"]}]` | Ingress host and path rules | +| control.ingress.tls | list | `[]` | Ingress TLS settings | | control.service.annotations | object | `{}` | Control annotations | | control.service.externalIPs | list | `[]` | IPs for which nodes in the cluster will also accept traffic for the servic | | control.service.ip | string | `"127.0.0.1"` | which ip to listen on for Apache APISIX Control API | | control.service.port | int | `9090` | which port to use for Apache APISIX Control API | | control.service.servicePort | int | `9090` | Service port to use for Apache APISIX Control API | | control.service.type | string | `"ClusterIP"` | Control service type | -| etcd | object | `{"auth":{"rbac":{"create":false,"rootPassword":""},"tls":{"certFilename":"","certKeyFilename":"","enabled":false,"existingSecret":"","sni":"","verify":true}},"autoCompactionMode":"periodic","autoCompactionRetention":"1h","containerSecurityContext":{"enabled":false},"enabled":true,"image":{"registry":"docker.io","repository":"bitnamilegacy/etcd","tag":"latest"},"prefix":"/apisix","replicaCount":3,"service":{"port":2379},"timeout":30}` | etcd configuration use the FQDN address or the IP of the etcd | +| etcd | object | `{"auth":{"rbac":{"create":false,"rootPassword":""},"tls":{"certFilename":"","certKeyFilename":"","enabled":false,"existingSecret":"","sni":"","verify":true}},"autoCompactionMode":"periodic","autoCompactionRetention":"1h","containerSecurityContext":{"enabled":false},"enabled":true,"image":{"registry":"docker.io","repository":"bitnamilegacy/etcd","tag":"latest"},"prefix":"/apisix","replicaCount":3,"service":{"port":2379},"startupRetry":2,"timeout":30,"watchTimeout":50}` | etcd configuration use the FQDN address or the IP of the etcd | | etcd.auth | object | `{"rbac":{"create":false,"rootPassword":""},"tls":{"certFilename":"","certKeyFilename":"","enabled":false,"existingSecret":"","sni":"","verify":true}}` | if etcd.enabled is true, set more values of bitnamilegacy/etcd helm chart | | etcd.auth.rbac.create | bool | `false` | No authentication by default. Switch to enable RBAC authentication | | etcd.auth.rbac.rootPassword | string | `""` | root password for etcd. Requires etcd.auth.rbac.create to be true. | @@ -166,12 +219,18 @@ The command removes all the Kubernetes components associated with the chart and | etcd.auth.tls.existingSecret | string | `""` | name of the secret contains etcd client cert | | etcd.auth.tls.sni | string | `""` | specify the TLS Server Name Indication extension, the ETCD endpoint hostname will be used when this setting is unset. | | etcd.auth.tls.verify | bool | `true` | whether to verify the etcd endpoint certificate when setup a TLS connection to etcd | +| etcd.autoCompactionMode | string | `"periodic"` | Auto compaction mode (periodic or revision), only used when etcd.enabled is true | +| etcd.autoCompactionRetention | string | `"1h"` | Auto compaction retention for mvcc key value store, only used when etcd.enabled is true | | etcd.containerSecurityContext | object | `{"enabled":false}` | added for backward compatibility with old kubernetes versions, as seccompProfile is not supported in kubernetes < 1.19 | | etcd.enabled | bool | `true` | install built-in etcd by default, set false if do not want to install built-in etcd together, this etcd is based on bitnamilegacy/etcd helm chart and latest bitnami docker image, only for development and testing purposes, if you want to use etcd in production, we recommend you to install etcd by yourself and use `externalEtcd` to connect it. | | etcd.image | object | `{"registry":"docker.io","repository":"bitnamilegacy/etcd","tag":"latest"}` | docker image for built-in etcd | | etcd.image.tag | string | `"latest"` | `bitnamilegacy/etcd` only provide `latest` tag now, ref: https://github.com/bitnami/containers/issues/83267, you can switch `etcd.image.repository` to `bitnamilegacy/etcd` to use old versioned tags. | | etcd.prefix | string | `"/apisix"` | apisix configurations prefix | +| etcd.replicaCount | int | `3` | Number of etcd replicas, only used when etcd.enabled is true | +| etcd.service.port | int | `2379` | etcd client service port | +| etcd.startupRetry | int | `2` | The number of retries to etcd during startup | | etcd.timeout | int | `30` | Set the timeout value in seconds for subsequent socket operations from apisix to etcd cluster | +| etcd.watchTimeout | int | `50` | Set the timeout value in seconds for watching etcd | | externalEtcd | object | `{"existingSecret":"","host":["http://etcd.host:2379"],"password":"","secretPasswordKey":"etcd-root-password","user":"root"}` | external etcd configuration. If etcd.enabled is false, these configuration will be used. | | externalEtcd.existingSecret | string | `""` | if externalEtcd.existingSecret is the name of secret containing the external etcd password | | externalEtcd.host | list | `["http://etcd.host:2379"]` | if etcd.enabled is false, use external etcd, support multiple address, if your etcd cluster enables TLS, please use https scheme, e.g. https://127.0.0.1:2379. | @@ -182,18 +241,22 @@ The command removes all the Kubernetes components associated with the chart and | extraDeploy | list | `[]` | Additional Kubernetes resources to deploy with the release. | | extraEnvVars | list | `[]` | extraEnvVars An array to add extra env vars e.g: extraEnvVars: - name: FOO value: "bar" - name: FOO2 valueFrom: secretKeyRef: name: SECRET_NAME key: KEY | | extraInitContainers | list | `[]` | Additional `initContainers`, See [Kubernetes initContainers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) for the detail. | -| extraVolumeMounts | list | `[]` | Additional `volume`, See [Kubernetes Volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the detail. | +| extraVolumeMounts | list | `[]` | Additional `volumeMounts` for the APISIX container, See [Kubernetes Volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the detail. | | extraVolumes | list | `[]` | Additional `volume`, See [Kubernetes Volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the detail. | -| fullnameOverride | string | `""` | | +| fullnameOverride | string | `""` | String to fully override the chart fullname | | global.imagePullSecrets | list | `[]` | Global Docker registry secret names as an array | -| hostNetwork | bool | `false` | | +| hostNetwork | bool | `false` | Use the host's network namespace | | image.pullPolicy | string | `"IfNotPresent"` | Apache APISIX image pull policy | | image.repository | string | `"apache/apisix"` | Apache APISIX image repository | | image.tag | string | `"3.17.0-ubuntu"` | Apache APISIX image tag Overrides the image tag whose default is the chart appVersion. | | ingress | object | `{"annotations":{},"enabled":false,"hosts":[{"host":"apisix.local","paths":[]}],"servicePort":null,"tls":[]}` | Using ingress access Apache APISIX service | | ingress-controller | object | `{"enabled":false,"webhook":{"enabled":false}}` | Ingress controller configuration | +| ingress-controller.enabled | bool | `false` | Enable the apisix-ingress-controller sub-chart | | ingress.annotations | object | `{}` | Ingress annotations | +| ingress.enabled | bool | `false` | Enable an Ingress resource in front of the APISIX service | +| ingress.hosts | list | `[{"host":"apisix.local","paths":[]}]` | Ingress host and path rules | | ingress.servicePort | number | `nil` | Service port to send traffic. Defaults to `service.http.servicePort`. | +| ingress.tls | list | `[]` | Ingress TLS settings | | initContainer.image | string | `"busybox"` | Init container image | | initContainer.tag | float | `1.28` | Init container tag | | metrics | object | `{"serviceMonitor":{"annotations":{},"enabled":false,"interval":"15s","labels":{},"name":"","namespace":""}}` | Observability configuration. | @@ -203,7 +266,7 @@ The command removes all the Kubernetes components associated with the chart and | metrics.serviceMonitor.labels | object | `{}` | @param serviceMonitor.labels ServiceMonitor extra labels | | metrics.serviceMonitor.name | string | `""` | name of the serviceMonitor, by default, it is the same as the apisix fullname | | metrics.serviceMonitor.namespace | string | `""` | namespace where the serviceMonitor is deployed, by default, it is the same as the namespace of the apisix | -| nameOverride | string | `""` | | +| nameOverride | string | `""` | String to partially override the chart fullname | | nodeSelector | object | `{}` | Node labels for Apache APISIX pod assignment | | podAnnotations | object | `{}` | Annotations to add to each pod | | podDisruptionBudget | object | `{"enabled":false,"maxUnavailable":1,"minAvailable":"90%"}` | See https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more details | @@ -212,23 +275,30 @@ The command removes all the Kubernetes components associated with the chart and | podDisruptionBudget.minAvailable | string | `"90%"` | Set the `minAvailable` of podDisruptionBudget. You can specify only one of `maxUnavailable` and `minAvailable` in a single PodDisruptionBudget. See [Specifying a Disruption Budget for your Application](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget) for more details | | podSecurityContext | object | `{}` | Set the securityContext for Apache APISIX pods | | priorityClassName | string | `""` | Set [priorityClassName](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) for Apache APISIX pods | -| rbac.create | bool | `false` | | +| rbac.create | bool | `false` | Whether RBAC resources (ClusterRole and ClusterRoleBinding) should be created | | replicaCount | int | `1` | if useDaemonSet is true or autoscaling.enabled is true, replicaCount not become effective | | resources | object | `{}` | Set pod resource requests & limits | | securityContext | object | `{}` | Set the securityContext for Apache APISIX container | -| service.externalIPs | list | `[]` | | -| service.externalTrafficPolicy | string | `"Cluster"` | | +| service.externalIPs | list | `[]` | IPs for which nodes in the cluster will also accept traffic for the service | +| service.externalTrafficPolicy | string | `"Cluster"` | Setting how the Service route external traffic. If you want to keep the client source IP, you can set this to Local, ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip | | service.http | object | `{"additionalContainerPorts":[],"containerPort":9080,"enabled":true,"servicePort":80}` | Apache APISIX service settings for http | | service.http.additionalContainerPorts | list | `[]` | Support multiple http ports, See [Configuration](https://github.com/apache/apisix/blob/0bc65ea9acd726f79f80ae0abd8f50b7eb172e3d/conf/config-default.yaml#L24) | +| service.http.containerPort | int | `9080` | Container port APISIX listens on for HTTP traffic | +| service.http.enabled | bool | `true` | Enable plain HTTP listeners | +| service.http.servicePort | int | `80` | Kubernetes service port for HTTP traffic | | service.labelsOverride | object | `{}` | Override default labels assigned to Apache APISIX gateway resources | | service.stream | object | `{"enabled":false,"tcp":[],"udp":[]}` | Apache APISIX service settings for stream. L4 proxy (TCP/UDP) | +| service.stream.enabled | bool | `false` | Enable the stream (L4 proxy) subsystem | +| service.stream.tcp | list | `[]` | TCP proxy port list, element format: port number, or a map with `addr` and optional `tls` | +| service.stream.udp | list | `[]` | UDP proxy port list | | service.tls | object | `{"servicePort":443}` | Apache APISIX service settings for tls | +| service.tls.servicePort | int | `443` | Kubernetes service port for HTTPS traffic | | service.type | string | `"NodePort"` | Apache APISIX service type for user access itself | -| serviceAccount.annotations | object | `{}` | | -| serviceAccount.create | bool | `false` | | -| serviceAccount.name | string | `""` | | +| serviceAccount.annotations | object | `{}` | Annotations to add to the ServiceAccount | +| serviceAccount.create | bool | `false` | Whether a ServiceAccount should be created for the APISIX pods | +| serviceAccount.name | string | `""` | Name of the ServiceAccount to use. If not set and create is true, a name is generated from the chart fullname | | timezone | string | `""` | timezone is the timezone where apisix uses. For example: "UTC" or "Asia/Shanghai" This value will be set on apisix container's environment variable TZ. You may need to set the timezone to be consistent with your local time zone, otherwise the apisix's logs may used to retrieve event maybe in wrong timezone. | | tolerations | list | `[]` | List of node taints to tolerate | | topologySpreadConstraints | list | `[]` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods | -| updateStrategy | object | `{}` | | +| updateStrategy | object | `{}` | Update strategy of the workload (Deployment or DaemonSet), e.g. `type: RollingUpdate` | | useDaemonSet | bool | `false` | set false to use `Deployment`, set true to use `DaemonSet` | diff --git a/charts/apisix/templates/configmap.yaml b/charts/apisix/templates/configmap.yaml index 61895271..8739d729 100644 --- a/charts/apisix/templates/configmap.yaml +++ b/charts/apisix/templates/configmap.yaml @@ -75,30 +75,42 @@ data: enable_ipv6: {{ .Values.apisix.enableIPv6 }} # Enable nginx IPv6 resolver enable_http2: {{ .Values.apisix.enableHTTP2 }} enable_server_tokens: {{ .Values.apisix.enableServerTokens }} # Whether the APISIX version number should be shown in Server header + show_upstream_status_in_response_header: {{ .Values.apisix.showUpstreamStatusInResponseHeader }} # when true, all upstream statuses are written to `X-APISIX-Upstream-Status`; otherwise only 5xx codes - # proxy_protocol: # Proxy Protocol configuration - # listen_http_port: 9181 # The port with proxy protocol for http, it differs from node_listen and admin_listen. - # # This port can only receive http request with proxy protocol, but node_listen & admin_listen - # # can only receive http request. If you enable proxy protocol, you must use this port to - # # receive http request with proxy protocol - # listen_https_port: 9182 # The port with proxy protocol for https - # enable_tcp_pp: true # Enable the proxy protocol for tcp proxy, it works for stream_proxy.tcp option - # enable_tcp_pp_to_upstream: true # Enables the proxy protocol to the upstream server + {{- if or .Values.apisix.proxyProtocol.enableTcpPP .Values.apisix.proxyProtocol.enableTcpPPToUpstream .Values.apisix.proxyProtocol.listenHttpPort .Values.apisix.proxyProtocol.listenHttpsPort }} + proxy_protocol: + {{- if .Values.apisix.proxyProtocol.listenHttpPort }} + listen_http_port: {{ .Values.apisix.proxyProtocol.listenHttpPort }} + {{- end }} + {{- if .Values.apisix.proxyProtocol.listenHttpsPort }} + listen_https_port: {{ .Values.apisix.proxyProtocol.listenHttpsPort }} + {{- end }} + enable_tcp_pp: {{ .Values.apisix.proxyProtocol.enableTcpPP }} + enable_tcp_pp_to_upstream: {{ .Values.apisix.proxyProtocol.enableTcpPPToUpstream }} + {{- end }} proxy_cache: # Proxy Caching configuration - cache_ttl: 10s # The default caching time if the upstream does not specify the cache time + cache_ttl: {{ .Values.apisix.proxyCache.cacheTtl }} # The default caching time if the upstream does not specify the cache time zones: # The parameters of a cache - - name: disk_cache_one # The name of the cache, administrator can be specify - # which cache to use by name in the admin api - memory_size: 50m # The size of shared memory, it's used to store the cache index - disk_size: 1G # The size of disk, it's used to store the cache data - disk_path: "/tmp/disk_cache_one" # The path to store the cache data - cache_levels: "1:2" # The hierarchy levels of a cache - # - name: disk_cache_two - # memory_size: 50m - # disk_size: 1G - # disk_path: "/tmp/disk_cache_two" - # cache_levels: "1:2" + {{- toYaml .Values.apisix.proxyCache.zones | nindent 10 }} + + delete_uri_tail_slash: {{ .Values.apisix.deleteURITailSlash }} # delete the '/' at the end of the URI + # The URI normalization in servlet is a little different from the RFC's. + # See https://github.com/jakartaee/servlet/blob/master/spec/src/main/asciidoc/servlet-spec-body.adoc#352-uri-path-canonicalization, + # which is used under Tomcat. + # Turn this option on if you want to be compatible with servlet when matching URI path. + normalize_uri_like_servlet: {{ .Values.apisix.normalizeURILikeServlet }} + + # fine tune the parameters of LRU cache for some features like secret + lru: + secret: + ttl: {{ .Values.apisix.lru.secret.ttl }} # seconds + count: {{ .Values.apisix.lru.secret.count }} + neg_ttl: {{ .Values.apisix.lru.secret.neg_ttl }} + neg_count: {{ .Values.apisix.lru.secret.neg_count }} + + tracing: {{ .Values.apisix.tracing }} # Enable comprehensive request lifecycle tracing (SSL/SNI, rewrite, access, header_filter, body_filter, and log). + # When disabled, OpenTelemetry collects only a single span per request. router: http: {{ .Values.apisix.router.http }} # radixtree_uri: match route by uri(base on radixtree) @@ -147,12 +159,15 @@ data: {{- end }} {{- end }} {{- end }} - # dns_resolver: - # {{- range $resolver := .Values.apisix.dns.resolvers }} - # - {{ $resolver }} - # {{- end }} + {{- with .Values.apisix.dns.resolvers }} + dns_resolver: # If not set, read from `/etc/resolv.conf` + {{- range $resolver := . }} + - {{ $resolver }} + {{- end }} + {{- end }} dns_resolver_valid: {{.Values.apisix.dns.validity}} resolver_timeout: {{.Values.apisix.dns.timeout}} + enable_resolv_search_opt: {{ .Values.apisix.dns.enableResolvSearchOpt }} ssl: enable: {{ .Values.apisix.ssl.enabled }} listen: @@ -163,6 +178,7 @@ data: {{- end }} ssl_protocols: {{ .Values.apisix.ssl.sslProtocols | quote }} ssl_ciphers: {{ .Values.apisix.ssl.sslCiphers | quote }} + ssl_session_tickets: {{ .Values.apisix.ssl.sslSessionTickets }} {{- if and .Values.apisix.ssl.enabled .Values.apisix.ssl.existingCASecret }} ssl_trusted_certificate: "/usr/local/apisix/conf/ssl/{{ .Values.apisix.ssl.certCAFilename }}" {{- end }} @@ -187,6 +203,9 @@ data: worker_processes: "{{ .Values.apisix.nginx.workerProcesses }}" enable_cpu_affinity: {{ and true .Values.apisix.nginx.enableCPUAffinity }} worker_rlimit_nofile: {{ default "20480" .Values.apisix.nginx.workerRlimitNofile }} # the number of files a worker process can open, should be larger than worker_connections + worker_shutdown_timeout: "{{ default "240s" .Values.apisix.nginx.workerShutdownTimeout }}" # timeout for a graceful shutdown of worker processes + max_pending_timers: {{ default "16384" .Values.apisix.nginx.maxPendingTimers }} # increase it if you see "too many pending timers" error + max_running_timers: {{ default "4096" .Values.apisix.nginx.maxRunningTimers }} # increase it if you see "lua_max_running_timers are not enough" error event: worker_connections: {{ default "10620" .Values.apisix.nginx.workerConnections }} {{- with .Values.apisix.nginx.envs }} @@ -202,6 +221,13 @@ data: {{ $dict.name }}: {{ $dict.size }} {{- end }} {{- end }} + stream: + enable_access_log: {{ .Values.apisix.nginx.logs.stream.enableAccessLog }} + {{- if .Values.apisix.nginx.logs.stream.enableAccessLog }} + access_log: "{{ .Values.apisix.nginx.logs.stream.accessLog }}" + access_log_format: '{{ .Values.apisix.nginx.logs.stream.accessLogFormat }}' + access_log_format_escape: {{ .Values.apisix.nginx.logs.stream.accessLogFormatEscape }} + {{- end }} http: enable_access_log: {{ .Values.apisix.nginx.logs.enableAccessLog }} {{- if .Values.apisix.nginx.logs.enableAccessLog }} @@ -210,14 +236,26 @@ data: access_log_format_escape: {{ .Values.apisix.nginx.logs.accessLogFormatEscape }} {{- end }} keepalive_timeout: {{ .Values.apisix.nginx.keepaliveTimeout | quote }} - client_header_timeout: 60s # timeout for reading client request header, then 408 (Request Time-out) error is returned to the client - client_body_timeout: 60s # timeout for reading client request body, then 408 (Request Time-out) error is returned to the client - send_timeout: 10s # timeout for transmitting a response to the client.then the connection is closed - underscores_in_headers: "on" # default enables the use of underscores in client request header fields - real_ip_header: "X-Real-IP" # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header + client_header_timeout: {{ .Values.apisix.nginx.http.clientHeaderTimeout }} # timeout for reading client request header, then 408 (Request Time-out) error is returned to the client + client_body_timeout: {{ .Values.apisix.nginx.http.clientBodyTimeout }} # timeout for reading client request body, then 408 (Request Time-out) error is returned to the client + send_timeout: {{ .Values.apisix.nginx.http.sendTimeout }} # timeout for transmitting a response to the client.then the connection is closed + client_max_body_size: {{ .Values.apisix.nginx.http.clientMaxBodySize }} # The maximum allowed size of the client request body. + # If exceeded, the 413 (Request Entity Too Large) error is returned to the client. + # Note that unlike Nginx, we don't limit the body size by default. + underscores_in_headers: {{ .Values.apisix.nginx.http.underscoresInHeaders | quote }} # default enables the use of underscores in client request header fields + real_ip_header: {{ .Values.apisix.nginx.http.realIpHeader | quote }} # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header + real_ip_recursive: {{ .Values.apisix.nginx.http.realIpRecursive | quote }} # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive real_ip_from: # http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from - - 127.0.0.1 - - 'unix:' + {{- range $ip := .Values.apisix.nginx.http.realIpFrom }} + - {{ $ip | quote }} + {{- end }} + proxy_ssl_server_name: {{ .Values.apisix.nginx.http.proxySslServerName }} # send the server name (SNI) when establishing a TLS connection with the proxied HTTPS upstream + upstream: + keepalive: {{ .Values.apisix.nginx.http.upstream.keepalive }} # The maximum number of idle keepalive connections to upstream servers per worker process + keepalive_requests: {{ .Values.apisix.nginx.http.upstream.keepaliveRequests }} # The maximum number of requests that can be served through one keepalive connection + keepalive_timeout: {{ .Values.apisix.nginx.http.upstream.keepaliveTimeout }} # Timeout during which an idle keepalive connection to an upstream server will stay open + charset: {{ .Values.apisix.nginx.http.charset }} # Adds the specified charset to the "Content-Type" response header field + variables_hash_max_size: {{ .Values.apisix.nginx.http.variablesHashMaxSize }} # Sets the maximum size of the variables hash table {{- if .Values.apisix.nginx.customLuaSharedDicts }} custom_lua_shared_dict: # add custom shared cache to nginx.conf {{- range $dict := .Values.apisix.nginx.customLuaSharedDicts }} @@ -249,6 +287,9 @@ data: stream_configuration_snippet: {{- toYaml .Values.apisix.nginx.configurationSnippet.stream | indent 6 }} {{- end }} + graphql: + max_size: {{ int .Values.apisix.graphql.maxSize }} # the maximum size limitation of graphql in bytes + {{- if .Values.apisix.discovery.enabled }} discovery: {{- range $key, $value := .Values.apisix.discovery.registry }} @@ -390,7 +431,9 @@ data: {{- end}} {{- end }} prefix: {{ .Values.etcd.prefix | quote }} # configuration prefix in etcd - timeout: {{ .Values.etcd.timeout }} # 30 seconds + timeout: {{ .Values.etcd.timeout }} # The timeout in seconds when connect/read/write to etcd + watch_timeout: {{ .Values.etcd.watchTimeout }} # The timeout in seconds when watch etcd + startup_retry: {{ .Values.etcd.startupRetry }} # the number of retry to etcd during the startup {{- if and (not .Values.etcd.enabled) .Values.externalEtcd.user }} user: {{ .Values.externalEtcd.user | quote }} password: "{{ print "${{ APISIX_ETCD_PASSWORD }}" }}" diff --git a/charts/apisix/templates/hpa.yaml b/charts/apisix/templates/hpa.yaml index db3acc56..feb4095b 100644 --- a/charts/apisix/templates/hpa.yaml +++ b/charts/apisix/templates/hpa.yaml @@ -14,7 +14,7 @@ # See the License for the specific language governing permissions and # limitations under the License. -{{- if .Values.autoscaling.enabled }} +{{- if and .Values.autoscaling.enabled (not .Values.useDaemonSet) }} apiVersion: autoscaling/{{ .Values.autoscaling.version }} kind: HorizontalPodAutoscaler diff --git a/charts/apisix/templates/service-gateway.yaml b/charts/apisix/templates/service-gateway.yaml index 7797435a..71b6e6aa 100644 --- a/charts/apisix/templates/service-gateway.yaml +++ b/charts/apisix/templates/service-gateway.yaml @@ -76,6 +76,24 @@ spec: port: {{ .port }} targetPort: {{ .port }} {{- end }} + {{- if .Values.apisix.proxyProtocol.listenHttpPort }} + - name: apisix-gateway-pp + port: {{ .Values.apisix.proxyProtocol.listenHttpPort }} + targetPort: {{ .Values.apisix.proxyProtocol.listenHttpPort }} + {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.apisix.proxyProtocol.listenHttpNodePort))) }} + nodePort: {{ .Values.apisix.proxyProtocol.listenHttpNodePort }} + {{- end }} + protocol: TCP + {{- end }} + {{- if .Values.apisix.proxyProtocol.listenHttpsPort }} + - name: apisix-gateway-pp-tls + port: {{ .Values.apisix.proxyProtocol.listenHttpsPort }} + targetPort: {{ .Values.apisix.proxyProtocol.listenHttpsPort }} + {{- if (and (eq .Values.service.type "NodePort") (not (empty .Values.apisix.proxyProtocol.listenHttpsNodePort))) }} + nodePort: {{ .Values.apisix.proxyProtocol.listenHttpsNodePort }} + {{- end }} + protocol: TCP + {{- end }} {{- if and .Values.service.stream.enabled (or (gt (len .Values.service.stream.tcp) 0) (gt (len .Values.service.stream.udp) 0)) }} {{- with .Values.service.stream }} {{- if (gt (len .tcp) 0) }} diff --git a/charts/apisix/values.yaml b/charts/apisix/values.yaml index f1dc02bd..41a4cd8a 100644 --- a/charts/apisix/values.yaml +++ b/charts/apisix/values.yaml @@ -65,8 +65,6 @@ podDisruptionBudget: # -- Set pod resource requests & limits resources: {} - # -- Use the host's network namespace - # We usually recommend not to specify default resources and to leave this as a conscious # choice for the user. This also increases chances charts run on environments with little # resources, such as Minikube. If you do want to specify resources, uncomment the following @@ -77,6 +75,8 @@ resources: {} # requests: # cpu: 100m # memory: 128Mi + +# -- Use the host's network namespace hostNetwork: false # -- Node labels for Apache APISIX pod assignment @@ -108,6 +108,7 @@ timezone: "" # key: KEY extraEnvVars: [] +# -- Update strategy of the workload (Deployment or DaemonSet), e.g. `type: RollingUpdate` updateStrategy: {} # type: RollingUpdate @@ -119,7 +120,7 @@ extraVolumes: [] # - name: extras # emptyDir: {} -# -- Additional `volume`, See [Kubernetes Volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the detail. +# -- Additional `volumeMounts` for the APISIX container, See [Kubernetes Volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the detail. extraVolumeMounts: [] # - name: extras # mountPath: /usr/share/extras @@ -141,41 +142,55 @@ initContainer: tag: 1.28 autoscaling: + # -- Enable HorizontalPodAutoscaler for APISIX (only when useDaemonSet is false) enabled: false # -- HPA version, the value is "v2" or "v2beta1", default "v2" version: v2 + # -- Minimum number of APISIX replicas minReplicas: 1 + # -- Maximum number of APISIX replicas maxReplicas: 100 + # -- Target average CPU utilization percentage that triggers scaling targetCPUUtilizationPercentage: 80 + # -- Target average memory utilization percentage that triggers scaling targetMemoryUtilizationPercentage: 80 +# -- String to partially override the chart fullname nameOverride: "" +# -- String to fully override the chart fullname fullnameOverride: "" serviceAccount: + # -- Whether a ServiceAccount should be created for the APISIX pods create: false + # -- Annotations to add to the ServiceAccount annotations: {} + # -- Name of the ServiceAccount to use. If not set and create is true, a name is generated from the chart fullname name: "" rbac: + # -- Whether RBAC resources (ClusterRole and ClusterRoleBinding) should be created create: false service: # -- Apache APISIX service type for user access itself type: NodePort - # -- Setting how the Service route external traffic - # If you want to keep the client source IP, you can set this to Local. - + # -- Setting how the Service route external traffic. + # If you want to keep the client source IP, you can set this to Local, # ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip externalTrafficPolicy: Cluster # type: LoadBalancer # annotations: # service.beta.kubernetes.io/aws-load-balancer-type: nlb + # -- IPs for which nodes in the cluster will also accept traffic for the service externalIPs: [] # -- Apache APISIX service settings for http http: + # -- Enable plain HTTP listeners enabled: true + # -- Kubernetes service port for HTTP traffic servicePort: 80 + # -- Container port APISIX listens on for HTTP traffic containerPort: 9080 # -- Support multiple http ports, See [Configuration](https://github.com/apache/apisix/blob/0bc65ea9acd726f79f80ae0abd8f50b7eb172e3d/conf/config-default.yaml#L24) additionalContainerPorts: [] @@ -186,13 +201,17 @@ service: # enable_http2: true # -- Apache APISIX service settings for tls tls: + # -- Kubernetes service port for HTTPS traffic servicePort: 443 # nodePort: 4443 # -- Apache APISIX service settings for stream. L4 proxy (TCP/UDP) stream: + # -- Enable the stream (L4 proxy) subsystem enabled: false + # -- TCP proxy port list, element format: port number, or a map with `addr` and optional `tls` tcp: [] + # -- UDP proxy port list udp: [] # - secretName: apisix-tls # hosts: @@ -205,6 +224,7 @@ service: # -- Using ingress access Apache APISIX service ingress: + # -- Enable an Ingress resource in front of the APISIX service enabled: false # -- (number) Service port to send traffic. Defaults to `service.http.servicePort`. servicePort: @@ -212,9 +232,11 @@ ingress: annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" + # -- Ingress host and path rules hosts: - host: apisix.local paths: [] + # -- Ingress TLS settings tls: [] control: @@ -242,6 +264,7 @@ control: servicePort: 9090 # -- Using ingress access Apache APISIX Control service ingress: + # -- Enable an Ingress resource in front of the Control API service enabled: false # -- Ingress annotations annotations: @@ -250,10 +273,12 @@ control: # kubernetes.io/tls-acme: "true" # -- Ingress Class Name # className: "nginx" + # -- Ingress host and path rules hosts: - host: apisix-control.local paths: - "/*" + # -- Ingress TLS settings tls: [] # - secretName: apisix-tls # hosts: @@ -278,16 +303,87 @@ metrics: apisix: # -- Enable nginx IPv6 resolver enableIPv6: true + # -- Enable HTTP/2 on the HTTP listeners enableHTTP2: true # -- Whether the APISIX version number should be shown in Server header enableServerTokens: true + # -- When true, the upstream status is always written to the `X-APISIX-Upstream-Status` response header; when false, it is written only for 5xx responses + showUpstreamStatusInResponseHeader: false + + # -- PROXY Protocol configuration. + proxyProtocol: + # -- (int) The HTTP port that accepts the PROXY Protocol. It differs from `service.http` ports and `apisix.admin` port: + # this port only accepts HTTP requests carrying the PROXY Protocol, while the other ports only accept plain HTTP + # requests. If you enable the PROXY Protocol, you must use this port to receive HTTP requests with it. + # When set, the port is also exposed on the gateway Service. + listenHttpPort: + # -- (int) The nodePort of the PROXY Protocol HTTP port, only used if service.type is NodePort. + # If not set, a random port will be assigned by Kubernetes. + listenHttpNodePort: + # -- (int) The HTTPS port that accepts the PROXY Protocol. + # When set, the port is also exposed on the gateway Service. + listenHttpsPort: + # -- (int) The nodePort of the PROXY Protocol HTTPS port, only used if service.type is NodePort. + # If not set, a random port will be assigned by Kubernetes. + listenHttpsNodePort: + # -- Accept the PROXY Protocol on every service.stream.tcp port. + enableTcpPP: false + # -- Send the PROXY Protocol to the upstream server on every service.stream.tcp port. + enableTcpPPToUpstream: false + + # -- Proxy caching configuration used by the proxy-cache plugin. + proxyCache: + # -- The default caching time in disk if the upstream does not specify the cache time + cacheTtl: 10s + # -- The parameters of a cache. The `memory_size` field stores the cache index for the + # disk strategy and the cache content for the memory strategy; `disk_size`, `disk_path` + # and `cache_levels` only apply to the disk strategy. + zones: + - name: disk_cache_one + memory_size: 50m + disk_size: 1G + disk_path: "/tmp/disk_cache_one" + cache_levels: "1:2" + - name: memory_cache + memory_size: 50m + + graphql: + # -- The maximum size in bytes of GraphQL queries APISIX parses when matching routes by GraphQL attributes (default 1MiB) + maxSize: 1048576 + + # -- Delete the '/' at the end of the URI + deleteURITailSlash: false + + # -- The URI normalization in servlet is a little different from the RFC's. + # See https://github.com/jakartaee/servlet/blob/master/spec/src/main/asciidoc/servlet-spec-body.adoc#352-uri-path-canonicalization, + # which is used under Tomcat. + # Turn this option on if you want to be compatible with servlet when matching URI path. + normalizeURILikeServlet: false + + # -- fine tune the parameters of LRU cache for some features like secret + lru: + secret: + # -- TTL in seconds for cached secret values + ttl: 300 + # -- Maximum number of cached secret values + count: 512 + # -- TTL in seconds for cached negative (failed lookup) results + neg_ttl: 60 + # -- Maximum number of cached negative (failed lookup) results + neg_count: 512 + + # -- Enable comprehensive request lifecycle tracing (SSL/SNI, rewrite, access, header_filter, body_filter, and log). + # When disabled, OpenTelemetry collects only a single span per request. + tracing: false + # -- Use Pod metadata.uid as the APISIX id. setIDFromPodUID: false # -- Whether to add a custom lua module luaModuleHook: + # -- Enable loading a custom lua module hook enabled: false # -- extend lua_package_path to load third party code luaPath: "" @@ -306,7 +402,9 @@ apisix: path: "" ssl: + # -- Enable HTTPS listeners enabled: false + # -- Container port APISIX listens on for HTTPS traffic containerPort: 9443 # -- Support multiple https ports, See [Configuration](https://github.com/apache/apisix/blob/0bc65ea9acd726f79f80ae0abd8f50b7eb172e3d/conf/config-default.yaml#L99) additionalContainerPorts: [] @@ -317,11 +415,15 @@ apisix: existingCASecret: "" # -- Filename be used in the apisix.ssl.existingCASecret certCAFilename: "" + # -- Enable HTTP/3 (QUIC) on the HTTPS listeners enableHTTP3: false # -- TLS protocols allowed to use. sslProtocols: "TLSv1.2 TLSv1.3" # -- TLS ciphers allowed to use. sslCiphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA" + # -- Enable or disable TLS session tickets. Disabled by default because session tickets + # defeat Perfect Forward Secrecy (see https://github.com/mozilla/server-side-tls/issues/135) + sslSessionTickets: false # -- Define SNI to fallback if none is presented by client fallbackSNI: "" @@ -352,7 +454,7 @@ apisix: # ref: https://apisix.apache.org/docs/apisix/deployment-modes/ role: "traditional" role_traditional: - # enum: etcd, yaml + # -- Config provider for the traditional role. enum: etcd, yaml config_provider: "etcd" # -- Standalone rules configuration @@ -414,29 +516,86 @@ apisix: - 127.0.0.1/24 # -- Using ingress access Apache APISIX admin service ingress: + # -- Enable an Ingress resource in front of the Admin API service enabled: false # -- Ingress annotations annotations: {} # kubernetes.io/ingress.class: nginx # kubernetes.io/tls-acme: "true" + # -- Ingress host and path rules hosts: - host: apisix-admin.local paths: - "/apisix" + # -- Ingress TLS settings tls: [] # - secretName: apisix-tls # hosts: # - chart-example.local nginx: + # -- The number of files a worker process can open, should be larger than apisix.nginx.workerConnections workerRlimitNofile: "20480" + # -- The maximum number of connections that each worker process can open workerConnections: "10620" + # -- The number of nginx worker processes. `auto` means the number of CPU cores workerProcesses: auto + # -- Bind nginx worker processes to CPUs enableCPUAffinity: true + # -- Timeout for a graceful shutdown of worker processes + workerShutdownTimeout: "240s" + # -- Maximum number of pending timers. Increase it if you see "too many pending timers" error + maxPendingTimers: 16384 + # -- Maximum number of running timers. Increase it if you see "lua_max_running_timers are not enough" error + maxRunningTimers: 4096 # -- Timeout during which a keep-alive client connection will stay open on the server side. keepaliveTimeout: 60s + # -- List of environment variable names allowed to be accessed within nginx (rendered as nginx `env` directives) envs: [] + # -- Nginx HTTP subsystem configurations + http: + # -- timeout for reading client request header, then 408 (Request Time-out) error is returned to the client + clientHeaderTimeout: "60s" + # -- timeout for reading client request body, then 408 (Request Time-out) error is returned to the client + clientBodyTimeout: "60s" + # -- timeout for transmitting a response to the client, then the connection is closed + sendTimeout: "10s" + # -- The maximum allowed size of the client request body. + # If exceeded, the 413 (Request Entity Too Large) error is returned to the client. + # Note that unlike Nginx, we don't limit the body size by default (0 means no limit). + clientMaxBodySize: 0 + # -- Enable the use of underscores in client request header fields + underscoresInHeaders: "on" + # -- The request header used to determine the client's real IP address, + # see [real_ip_header](http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header) + realIpHeader: "X-Real-IP" + # -- Whether to search for the real IP recursively when the header set in apisix.nginx.http.realIpHeader contains multiple addresses, + # see [real_ip_recursive](http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive) + realIpRecursive: "off" + # -- Trusted addresses from which the real IP header is honored, + # see [set_real_ip_from](http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from) + realIpFrom: + - 127.0.0.1 + - "unix:" + # -- Enables or disables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066) + # when establishing a connection with the proxied HTTPS server + proxySslServerName: true + # -- Keepalive settings for connections from APISIX to upstream servers + upstream: + # -- Maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. + # When this number is exceeded, the least recently used connections are closed + keepalive: 320 + # -- Maximum number of requests that can be served through one keepalive connection. + # After the maximum number of requests is made, the connection is closed + keepaliveRequests: 1000 + # -- Timeout during which an idle keepalive connection to an upstream server will stay open + keepaliveTimeout: 60s + # -- The charset added to the "Content-Type" response header field, + # see [charset](http://nginx.org/en/docs/http/ngx_http_charset_module.html#charset) + charset: utf-8 + # -- The maximum size of the nginx variables hash table + variablesHashMaxSize: 2048 # access log and error log configuration logs: # -- Enable access log or not, default true @@ -451,18 +610,36 @@ apisix: errorLog: "/dev/stderr" # -- Error log level errorLogLevel: "warn" - # -- Custom configuration snippet. + # -- Stream (L4 proxy) access log configuration + stream: + # -- Enable stream access log or not, default false + enableAccessLog: false + # -- Stream access log path + accessLog: "logs/access_stream.log" + # -- Stream access log format + accessLogFormat: '$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time' + # -- Allows setting json or default characters escaping in variables for stream + accessLogFormatEscape: default + # -- Custom nginx configuration snippets injected into the generated nginx.conf. + # As arbitrary configuration can be added here, it is your responsibility to make sure + # the snippets don't conflict with the configuration generated by APISIX. configurationSnippet: + # -- Snippet added to the nginx `main` (top-level) block main: | + # -- Snippet added to the beginning of the nginx `http` block httpStart: | + # -- Snippet added to the end of the nginx `http` block httpEnd: | + # -- Snippet added to the nginx `server` block that proxies regular traffic httpSrv: | + # -- Snippet added to the nginx `server` block that serves the Admin API httpAdmin: | + # -- Snippet added to the nginx `stream` block stream: | # -- Add custom [lua_shared_dict](https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#lua_shared_dict) settings, @@ -533,15 +710,18 @@ apisix: # This is for allowing the default `host` and `port` of `.discovery.registry.kubernetes.service`. dns: - resolvers: - - 127.0.0.1 - - 172.20.0.10 - - 114.114.114.114 - - 223.5.5.5 - - 1.1.1.1 - - 8.8.8.8 + # -- Nameservers used by APISIX to resolve upstream domain names. + # When empty (default), nameservers are read from `/etc/resolv.conf`, + # which is usually what you want inside Kubernetes + resolvers: [] + # - 127.0.0.1 + # - 8.8.8.8 + # -- Override the TTL in seconds of valid DNS records validity: 30 + # -- DNS resolver timeout in seconds timeout: 5 + # -- Honor the `search` option in `/etc/resolv.conf` when resolving domain names + enableResolvSearchOpt: true vault: # -- Enable or disable the vault integration @@ -556,7 +736,7 @@ apisix: prefix: "" prometheus: - # ref: https://apisix.apache.org/docs/apisix/plugins/prometheus/ + # -- Enable Prometheus metrics. ref: https://apisix.apache.org/docs/apisix/plugins/prometheus/ enabled: false # -- path of the metrics endpoint path: /apisix/prometheus/metrics @@ -583,6 +763,7 @@ apisix: wasm: # -- Enable Wasm Plugins. See [wasm plugin](https://apisix.apache.org/docs/apisix/next/wasm/) enabled: false + # -- List of Wasm plugins, each item with `name`, `priority` and `file` (path or URL of the wasm binary) plugins: [] # -- customPlugins allows you to mount your own HTTP plugins. @@ -608,7 +789,9 @@ apisix: path: "mount-path" status: + # -- The IP address on which the status endpoint (`/status`, `/status/ready`) listens ip: "0.0.0.0" + # -- The port on which the status endpoint listens port: 7085 # -- When configured, APISIX will trust the `X-Forwarded-*` Headers passed in requests from the IP/CIDR in the list. @@ -651,6 +834,10 @@ etcd: prefix: "/apisix" # -- Set the timeout value in seconds for subsequent socket operations from apisix to etcd cluster timeout: 30 + # -- Set the timeout value in seconds for watching etcd + watchTimeout: 50 + # -- The number of retries to etcd during startup + startupRetry: 2 # -- if etcd.enabled is true, set more values of bitnamilegacy/etcd helm chart auth: @@ -679,14 +866,19 @@ etcd: enabled: false service: + # -- etcd client service port port: 2379 + # -- Number of etcd replicas, only used when etcd.enabled is true replicaCount: 3 + # -- Auto compaction retention for mvcc key value store, only used when etcd.enabled is true autoCompactionRetention: "1h" + # -- Auto compaction mode (periodic or revision), only used when etcd.enabled is true autoCompactionMode: "periodic" # -- Ingress controller configuration ingress-controller: + # -- Enable the apisix-ingress-controller sub-chart enabled: false webhook: # Specifies whether to enable the validation webhook.