From 4c5de5f0c620089b5f8620532ffc220700fa67cf Mon Sep 17 00:00:00 2001 From: AlinsRan Date: Fri, 23 Oct 2026 16:00:06 +0800 Subject: [PATCH] feat: complete gateway and ingress chart settings --- charts/gateway/README.md | 39 +++++++++++++++++++ charts/gateway/README.md.gotmpl | 37 ++++++++++++++++++ charts/gateway/templates/_pod.tpl | 9 ++++- charts/gateway/values.yaml | 18 +++++++++ charts/ingress-controller/README.md | 2 + .../templates/deployment.yaml | 3 ++ .../ingress-controller/templates/webhook.yaml | 4 ++ charts/ingress-controller/values.yaml | 6 ++- 8 files changed, 116 insertions(+), 2 deletions(-) diff --git a/charts/gateway/README.md b/charts/gateway/README.md index 45ce4590..cea88680 100644 --- a/charts/gateway/README.md +++ b/charts/gateway/README.md @@ -295,6 +295,8 @@ apisix: | global.imagePullSecrets | list | `[]` | Global Docker registry secret names as an array | | graphql.maxSize | int | `1048576` | The maximum size in bytes of GraphQL queries the gateway parses when matching routes by GraphQL attributes (default 1MiB) | | initContainer.image | string | `"busybox"` | Init container image | +| initContainer.resources | object | `{}` | Resource requests and limits for the wait-etcd init container (only used when etcd.enabled is true) | +| initContainer.securityContext | object | `{}` | Container security context for wait-etcd. Empty by default to inherit applicable apisix.podSecurityContext settings. | | initContainer.tag | float | `1.28` | Init container tag | | logs.accessLog | string | `"/dev/stdout"` | Access log path | | logs.accessLogFormat | string | `"$remote_addr - $remote_user [$time_local] $http_host \\\"$request\\\" $status $body_bytes_sent $request_time \\\"$http_referer\\\" \\\"$http_user_agent\\\" $upstream_addr $upstream_status $upstream_response_time \\\"$upstream_scheme://$upstream_host$upstream_uri\\\""` | Access log format | @@ -376,3 +378,40 @@ apisix: Remove configuration items such as `plugins`, `stream_plugins`, and `custom_plugins` that are no longer needed in API7 EE. **This version of the helm chart needs to be used with API7 EE gateway version 3.2.16.3 or above.** + +## Configure the wait-etcd init container + +When `etcd.enabled` is true, `initContainer.resources` and +`initContainer.securityContext` configure the built-in `wait-etcd` container for +both Deployment and DaemonSet workloads. They are independent of the `apisix.resources` and `apisix.securityContext`, which configure the gateway container. + +Both options default to `{}` and are omitted from the rendered container when +empty. Applicable `apisix.podSecurityContext` settings still apply to `wait-etcd`. +For example: + +```yaml +initContainer: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 +``` + +Adjust resource values for your environment. The default BusyBox image runs as +root, so `runAsNonRoot: true` also requires a non-zero UID supplied through +`runAsUser`, `apisix.podSecurityContext`, or an admission policy. On platforms such as +OpenShift that assign a UID, omit the explicit `runAsUser` value. + +These options do not configure `extraInitContainers` and have no effect when +`etcd.enabled` is false. diff --git a/charts/gateway/README.md.gotmpl b/charts/gateway/README.md.gotmpl index 294b1c59..ab138601 100644 --- a/charts/gateway/README.md.gotmpl +++ b/charts/gateway/README.md.gotmpl @@ -123,3 +123,40 @@ apisix: Remove configuration items such as `plugins`, `stream_plugins`, and `custom_plugins` that are no longer needed in API7 EE. **This version of the helm chart needs to be used with API7 EE gateway version 3.2.16.3 or above.** + +## Configure the wait-etcd init container + +When `etcd.enabled` is true, `initContainer.resources` and +`initContainer.securityContext` configure the built-in `wait-etcd` container for +both Deployment and DaemonSet workloads. They are independent of the `apisix.resources` and `apisix.securityContext`, which configure the gateway container. + +Both options default to `{}` and are omitted from the rendered container when +empty. Applicable `apisix.podSecurityContext` settings still apply to `wait-etcd`. +For example: + +```yaml +initContainer: + resources: + requests: + cpu: 10m + memory: 16Mi + limits: + cpu: 100m + memory: 32Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1000 +``` + +Adjust resource values for your environment. The default BusyBox image runs as +root, so `runAsNonRoot: true` also requires a non-zero UID supplied through +`runAsUser`, `apisix.podSecurityContext`, or an admission policy. On platforms such as +OpenShift that assign a UID, omit the explicit `runAsUser` value. + +These options do not configure `extraInitContainers` and have no effect when +`etcd.enabled` is false. diff --git a/charts/gateway/templates/_pod.tpl b/charts/gateway/templates/_pod.tpl index a2fdeb0a..0fc1785e 100644 --- a/charts/gateway/templates/_pod.tpl +++ b/charts/gateway/templates/_pod.tpl @@ -276,7 +276,6 @@ spec: {{- toYaml .Values.openapiToMcp.resources | nindent 8 }} {{- end }} {{- if .Values.apisix.hostNetwork }} - hostNetwork: true dnsPolicy: ClusterFirstWithHostNet {{- end }} hostNetwork: {{ .Values.apisix.hostNetwork }} @@ -288,6 +287,14 @@ spec: {{- if .Values.etcd.enabled }} - name: wait-etcd image: {{ .Values.initContainer.image }}:{{ .Values.initContainer.tag }} + {{- with .Values.initContainer.resources }} + resources: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.initContainer.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} {{- if .Values.etcd.fullnameOverride }} command: ['sh', '-c', "until nc -z {{ .Values.etcd.fullnameOverride }} {{ .Values.etcd.service.port }}; do echo waiting for etcd `date`; sleep 2; done;"] {{ else }} diff --git a/charts/gateway/values.yaml b/charts/gateway/values.yaml index cb70e4a8..038cfc39 100644 --- a/charts/gateway/values.yaml +++ b/charts/gateway/values.yaml @@ -742,6 +742,24 @@ initContainer: image: busybox # -- Init container tag tag: 1.28 + # -- Resource requests and limits for the wait-etcd init container (only used when etcd.enabled is true) + resources: {} + # requests: + # cpu: 10m + # memory: 16Mi + # limits: + # cpu: 100m + # memory: 32Mi + # -- Container security context for wait-etcd. Empty by default to inherit applicable apisix.podSecurityContext settings. + securityContext: {} + # allowPrivilegeEscalation: false + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # Set runAsUser to a non-zero UID unless the pod or admission policy supplies one. + # runAsUser: 1000 autoscaling: # -- Enable HorizontalPodAutoscaler for the gateway (only when apisix.kind is Deployment) diff --git a/charts/ingress-controller/README.md b/charts/ingress-controller/README.md index bbb7fa94..ee99ac01 100644 --- a/charts/ingress-controller/README.md +++ b/charts/ingress-controller/README.md @@ -75,6 +75,7 @@ the controller recommends 1.31+ and only warns below it. | deployment.nodeSelector | object | `{}` | | | deployment.podAnnotations | object | `{}` | | | deployment.podSecurityContext.fsGroup | int | `2000` | | +| deployment.priorityClassName | string | `""` | PriorityClass for ingress controller pods | | deployment.replicas | int | `1` | | | deployment.resources | object | `{}` | Set pod resource requests & limits | | deployment.securityContext | object | `{}` | | @@ -87,6 +88,7 @@ the controller recommends 1.31+ and only warns below it. | podDisruptionBudget.enabled | bool | `false` | Enable or disable podDisruptionBudget | | podDisruptionBudget.maxUnavailable | int | `1` | Set the maxUnavailable of podDisruptionBudget | | podDisruptionBudget.minAvailable | string | `"90%"` | Set the `minAvailable` of podDisruptionBudget. You can specify only one of `maxUnavailable` and `minAvailable` in a single PodDisruptionBudget. See [Specifying a Disruption Budget for your Application](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget) for more details | +| webhook.annotations | object | `{}` | Annotations for the ValidatingWebhookConfiguration. For cert-manager CA injection, use certificate.provided=true and leave certificate.caBundle unset. | | webhook.certificate.provided | bool | `false` | Set to true if you want to provide your own certificate | | webhook.enabled | bool | `true` | Enable or disable admission webhook | | webhook.failurePolicy | string | `"Ignore"` | Failure policy for the webhook (Fail or Ignore) | diff --git a/charts/ingress-controller/templates/deployment.yaml b/charts/ingress-controller/templates/deployment.yaml index ac6bb15c..2789d595 100644 --- a/charts/ingress-controller/templates/deployment.yaml +++ b/charts/ingress-controller/templates/deployment.yaml @@ -26,6 +26,9 @@ spec: labels: {{- include "api7-ingress-controller-manager.selectorLabels" . | nindent 8 }} spec: + {{- with .Values.deployment.priorityClassName }} + priorityClassName: {{ . | quote }} + {{- end }} containers: - env: - name: POD_NAMESPACE diff --git a/charts/ingress-controller/templates/webhook.yaml b/charts/ingress-controller/templates/webhook.yaml index 55ac9bc5..be54355b 100644 --- a/charts/ingress-controller/templates/webhook.yaml +++ b/charts/ingress-controller/templates/webhook.yaml @@ -23,6 +23,10 @@ apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: {{ include "api7-ingress-controller-manager.name.fullname" . }}-webhook + {{- with .Values.webhook.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} labels: {{- include "api7-ingress-controller-manager.labels" . | nindent 4 }} webhooks: diff --git a/charts/ingress-controller/values.yaml b/charts/ingress-controller/values.yaml index 4cadbde4..f3484233 100644 --- a/charts/ingress-controller/values.yaml +++ b/charts/ingress-controller/values.yaml @@ -20,6 +20,8 @@ autoscaling: minReplicas: 1 deployment: + # -- PriorityClass for ingress controller pods + priorityClassName: "" annotations: {} podAnnotations: {} replicas: 1 @@ -73,6 +75,8 @@ config: # Admission webhook configuration webhook: + # -- Annotations for the ValidatingWebhookConfiguration. For cert-manager CA injection, use certificate.provided=true and leave certificate.caBundle unset. + annotations: {} # -- Enable or disable admission webhook enabled: true # -- The port for the webhook server to listen on @@ -86,5 +90,5 @@ webhook: provided: false # -- Secret name containing the certificate (required if provided is true) # secretName: "my-webhook-cert" - # -- CA bundle in base64 format (required if provided is true) + # -- CA bundle in base64 format for a provided certificate; leave unset when a CA injector manages it # caBundle: ""