From 79bbdc78e28a1bb17cdeb9439938fbeece80a601 Mon Sep 17 00:00:00 2001 From: AlinsRan Date: Fri, 31 Jul 2026 08:54:12 +0800 Subject: [PATCH 1/2] chore: allow L4 upstream schemes (tcp/tls/udp) in ingress-controller CRDs APISIX accepts `tcp`, `tls` and `udp` as upstream schemes for L4 proxying, and `scheme: tls` is what makes the gateway establish the TLS session with a stream upstream. The bundled CRDs still restricted `ApisixUpstream.spec.scheme` and `BackendTrafficPolicy.spec.scheme` to the L7 set, so the API server rejected those values before the controller could see them. Syncs the scheme field of charts/apisix-ingress-controller/crds/apisixic-crds.yaml with apache/apisix-ingress-controller#2830. --- .../crds/apisixic-crds.yaml | 24 ++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) diff --git a/charts/apisix-ingress-controller/crds/apisixic-crds.yaml b/charts/apisix-ingress-controller/crds/apisixic-crds.yaml index 70141547..575d5f0d 100644 --- a/charts/apisix-ingress-controller/crds/apisixic-crds.yaml +++ b/charts/apisix-ingress-controller/crds/apisixic-crds.yaml @@ -2033,12 +2033,18 @@ spec: description: |- Scheme is the protocol used to communicate with the upstream. Default is `http`. - Can be `http`, `https`, `grpc`, or `grpcs`. + For L7 proxy, it can be `http`, `https`, `grpc`, or `grpcs`. + For L4 proxy, it can be `tcp`, `tls`, or `udp`. + The L4 values apply to stream routes only; using them for an HTTP route + makes the upstream unreachable. enum: - http - https - grpc - grpcs + - tcp + - tls + - udp type: string subsets: description: |- @@ -2112,12 +2118,18 @@ spec: description: |- Scheme is the protocol used to communicate with the upstream. Default is `http`. - Can be `http`, `https`, `grpc`, or `grpcs`. + For L7 proxy, it can be `http`, `https`, `grpc`, or `grpcs`. + For L4 proxy, it can be `tcp`, `tls`, or `udp`. + The L4 values apply to stream routes only; using them for an HTTP route + makes the upstream unreachable. enum: - http - https - grpc - grpcs + - tcp + - tls + - udp type: string subsets: description: |- @@ -2529,12 +2541,18 @@ spec: description: |- Scheme is the protocol used to communicate with the upstream. Default is `http`. - Can be `http`, `https`, `grpc`, or `grpcs`. + For L7 proxy, it can be `http`, `https`, `grpc`, or `grpcs`. + For L4 proxy, it can be `tcp`, `tls`, or `udp`. + The L4 values apply to stream routes only; using them for an HTTP route + makes the upstream unreachable. enum: - http - https - grpc - grpcs + - tcp + - tls + - udp type: string targetRefs: description: |- From 0f0fac76d4c4961955081193eb08c35cca07aa73 Mon Sep 17 00:00:00 2001 From: AlinsRan Date: Mon, 3 Aug 2026 09:57:44 +0800 Subject: [PATCH 2/2] chore: bump apisix-ingress-controller chart to 1.2.2 --- charts/apisix-ingress-controller/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/apisix-ingress-controller/Chart.yaml b/charts/apisix-ingress-controller/Chart.yaml index bdf27e43..65c719fb 100644 --- a/charts/apisix-ingress-controller/Chart.yaml +++ b/charts/apisix-ingress-controller/Chart.yaml @@ -24,7 +24,7 @@ keywords: - nginx - crd type: application -version: 1.2.1 +version: 1.2.2 appVersion: 2.1.0 sources: - https://github.com/apache/apisix-helm-chart