[AlinsRan]

The gateway chart cannot configure resource requirements or container security settings for wait-etcd, and enabling host networking renders hostNetwork twice. The ingress controller chart also lacks webhook annotations and pod priority configuration.

• Add optional initContainer.resources and initContainer.securityContext, with empty defaults and non-root configuration examples.
• Emit hostNetwork once while preserving ClusterFirstWithHostNet.
• Add deployment.priorityClassName and webhook.annotations, documenting the provided-certificate requirement for CA injection.
• Regenerate chart documentation with helm-docs v1.13.1. Chart versions remain unchanged.

Validation: both charts pass helm lint; 10 rendering scenarios cover Deployment/DaemonSet, default/custom/null init settings, etcd disabled, duplicate YAML keys, priority classes, and webhook CA-injection annotations. No live cluster installation was performed.

Related upstream work: apache/apisix-helm-chart#1028, apache/apisix-helm-chart#1004, apache/apisix-helm-chart#957, apache/apisix-helm-chart#776.

Summary by CodeRabbit

• New Features
  • Added configuration options for the built-in etcd-waiting container’s resource limits and security context.
  • Added options to assign a PriorityClass to ingress-controller pods and annotations to the validating webhook configuration.
  • Documented configuration guidance for rootless and OpenShift environments, and for managing webhook CA bundles with a CA injector.
• Bug Fixes
  • The gateway’s host-network setting now follows its configured value instead of being forced on.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 09c83ace-9248-4541-9dbb-2793e8d3ea79

📥 Commits

Reviewing files that changed from the base of the PR and between 0803243 and 4c5de5f.

📒 Files selected for processing: 8

• charts/gateway/README.md
• charts/gateway/README.md.gotmpl
• charts/gateway/templates/_pod.tpl
• charts/gateway/values.yaml
• charts/ingress-controller/README.md
• charts/ingress-controller/templates/deployment.yaml
• charts/ingress-controller/templates/webhook.yaml
• charts/ingress-controller/values.yaml

Included review availability: This review used your included allowance. 4 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📝 Walkthrough

The gateway chart adds configurable resources and security context for its built-in wait-etcd init container and removes a hardcoded host-network value. The ingress-controller chart adds optional pod priority and webhook annotations settings, with corresponding template and documentation updates.

Changes: Gateway wait-etcd settings

Layer / File(s)	Summary
Configure wait-etcd resources and security context charts/gateway/values.yaml, charts/gateway/templates/_pod.tpl, charts/gateway/README.md, charts/gateway/README.md.gotmpl	The chart adds resource and security-context values for wait-etcd and renders them when configured. The documentation describes defaults, workload scope, pod security context behavior, and configuration limits.

Gateway host networking

Layer / File(s)	Summary
Retain the configured host-network value charts/gateway/templates/_pod.tpl	The host-network conditional no longer sets hostNetwork: true directly. The pod field continues to use .Values.apisix.hostNetwork.

Ingress-controller pod priority

Layer / File(s)	Summary
Set the ingress-controller PriorityClass charts/ingress-controller/values.yaml, charts/ingress-controller/templates/deployment.yaml, charts/ingress-controller/README.md	The chart adds an optional deployment.priorityClassName value and conditionally renders it in the Deployment pod spec. The README documents the setting.

Webhook annotations

Layer / File(s)	Summary
Configure webhook annotations charts/ingress-controller/values.yaml, charts/ingress-controller/templates/webhook.yaml, charts/ingress-controller/README.md	The chart adds an optional webhook.annotations value and renders it in the ValidatingWebhookConfiguration metadata. The README documents cert-manager CA-injection settings, and the caBundle guidance now says to leave the value unset when a CA injector manages it.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~12 minutes

Change: Feature

Possibly related issues

• api7/docs#2573: The changes overlap with the issue’s Helm-values and annotation documentation audit, but the provided issue summary does not establish whether this pull request addresses its specific objectives.

Suggested reviewers: nic-6443, ronething

Merge Risk: ⚪ Minimal · up to 4c5de

The chart changes are ready to merge; normal lint and rendering checks remain appropriate.

Pre-merge checks: 4 · 1 · 1

Failed checks: 1 warning · 1 inconclusive

Check name	Status	Explanation	Resolution
E2e Test Quality Review		Blocking: the PR adds no E2E tests for the new chart behavior. The authoritative diff contains only eight chart and documentation files. Existing CI runs generic ct lint and ct install; the gatewa…	Add committed E2E coverage that installs or renders both charts and asserts the Kubernetes resources. Cover gateway Deployment and DaemonSet modes with etcd enabled, custom/default/null init-container settings, etcd disabled, `extraInitCont…
Title check		The title "fix: complete gateway and ingress chart configuration" is only partially related to the changeset. The PR adds init container resource and security context options for the gateway chart, re…	Name the main change in the title. For example: "feat(gateway): add wait-etcd initContainer resources and securityContext" or "feat: add initContainer, priorityClassName, and webhook annotation options to charts". Use a single concise sente…

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Security Check		PASS. The PR changes only Helm chart values, pod templates, webhook metadata, priority scheduling, documentation, and duplicate hostNetwork rendering. No security finding was introduced. 1. Sensitive …

Full details: Security Check

Explanation

PASS. The PR changes only Helm chart values, pod templates, webhook metadata, priority scheduling, documentation, and duplicate hostNetwork rendering. No security finding was introduced. 1. Sensitive Data Exposure in Logs & Responses — No issues found. No logging, response serialization, credential handling, or sensitive-header handling changed. 2. Secrets Stored Unencrypted in Database — No issues found. No database models, persistence, or migrations changed. 3. Authorization & Permission Bypass — No issues found. No HTTP handlers or permission checks changed. 4. Cross-Resource Access / Missing Ownership Validation — No issues found. No resource access or ownership logic changed. 5. TLS / Cryptographic Configuration Errors — No issues found. The webhook change adds optional metadata annotations for CA injection. It does not change TLS protocol, cipher, verification, or certificate-collision logic. 6. Resource Isolation & Shared Resource Safety — No issues found. No shared-resource or cascade operations changed. 7. Secret Reference Resolution — No issues found. The gateway additions configure resources and Kubernetes security context for wait-etcd. The ingress additions configure PriorityClass and ValidatingWebhookConfiguration annotations. No secret-reference resolution path changed. The added security-context values default to empty and the added webhook annotations default to empty. The diff does not introduce plaintext secret storage, secret logging, authorization bypasses, or unsafe cryptographic defaults.

Full details: E2e Test Quality Review

Explanation

Blocking: the PR adds no E2E tests for the new chart behavior. The authoritative diff contains only eight chart and documentation files. Existing CI runs generic ct lint and ct install; the gateway install enables etcd but does not set or assert initContainer.resources, initContainer.securityContext, or hostNetwork, and the ingress install does not set or assert deployment.priorityClassName or webhook.annotations. The implementation changes are scoped to the stated chart problems, and no separate correctness, error-handling, or concurrency defect is evident.

Resolution

Add committed E2E coverage that installs or renders both charts and asserts the Kubernetes resources. Cover gateway Deployment and DaemonSet modes with etcd enabled, custom/default/null init-container settings, etcd disabled, extraInitContainers isolation, and host-network output (hostNetwork appears once with ClusterFirstWithHostNet). Cover ingress defaults and custom priorityClassName and webhook annotations, including the certificate/CA-injector combination. Make assertions structured and independent of test order, and fail clearly on Helm, Kubernetes, or assertion errors.

Full details: Title check

Explanation

The title "fix: complete gateway and ingress chart configuration" is only partially related to the changeset. The PR adds init container resource and security context options for the gateway chart, removes a duplicate hostNetwork output, and adds priorityClassName and webhook annotations for the ingress controller chart. The title names both charts but does not name the main changes. The word "complete" is vague, and the title does not say what was fixed or added. The changes are real, so the title is not off-topic.

Resolution

Name the main change in the title. For example: "feat(gateway): add wait-etcd initContainer resources and securityContext" or "feat: add initContainer, priorityClassName, and webhook annotation options to charts". Use a single concise sentence. Remove the vague word "complete" unless it refers to a specific fix.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}