fix: complete gateway and ingress chart configuration

charts/gateway/README.md

@@ -295,6 +295,8 @@ apisix:
 | global.imagePullSecrets | list | `[]` | Global Docker registry secret names as an array |
 | graphql.maxSize | int | `1048576` | The maximum size in bytes of GraphQL queries the gateway parses when matching routes by GraphQL attributes (default 1MiB) |
 | initContainer.image | string | `"busybox"` | Init container image |
+| initContainer.resources | object | `{}` | Resource requests and limits for the wait-etcd init container (only used when etcd.enabled is true) |
+| initContainer.securityContext | object | `{}` | Container security context for wait-etcd. Empty by default to inherit applicable apisix.podSecurityContext settings. |
 | initContainer.tag | float | `1.28` | Init container tag |
 | logs.accessLog | string | `"/dev/stdout"` | Access log path |
 | logs.accessLogFormat | string | `"$remote_addr - $remote_user [$time_local] $http_host \\\"$request\\\" $status $body_bytes_sent $request_time \\\"$http_referer\\\" \\\"$http_user_agent\\\" $upstream_addr $upstream_status $upstream_response_time \\\"$upstream_scheme://$upstream_host$upstream_uri\\\""` | Access log format |
@@ -376,3 +378,40 @@ apisix:
 Remove configuration items such as `plugins`, `stream_plugins`, and `custom_plugins` that are no longer needed in API7 EE.
 
 **This version of the helm chart needs to be used with API7 EE gateway version 3.2.16.3 or above.**
+
+## Configure the wait-etcd init container
+
+When `etcd.enabled` is true, `initContainer.resources` and
+`initContainer.securityContext` configure the built-in `wait-etcd` container for
+both Deployment and DaemonSet workloads. They are independent of the `apisix.resources` and `apisix.securityContext`, which configure the gateway container.
+
+Both options default to `{}` and are omitted from the rendered container when
+empty. Applicable `apisix.podSecurityContext` settings still apply to `wait-etcd`.
+For example:
+
+```yaml
+initContainer:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 16Mi
+    limits:
+      cpu: 100m
+      memory: 32Mi
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+```
+
+Adjust resource values for your environment. The default BusyBox image runs as
+root, so `runAsNonRoot: true` also requires a non-zero UID supplied through
+`runAsUser`, `apisix.podSecurityContext`, or an admission policy. On platforms such as
+OpenShift that assign a UID, omit the explicit `runAsUser` value.
+
+These options do not configure `extraInitContainers` and have no effect when
+`etcd.enabled` is false.

charts/gateway/README.md.gotmpl

@@ -123,3 +123,40 @@ apisix:
 Remove configuration items such as `plugins`, `stream_plugins`, and `custom_plugins` that are no longer needed in API7 EE.
 
 **This version of the helm chart needs to be used with API7 EE gateway version 3.2.16.3 or above.**
+
+## Configure the wait-etcd init container
+
+When `etcd.enabled` is true, `initContainer.resources` and
+`initContainer.securityContext` configure the built-in `wait-etcd` container for
+both Deployment and DaemonSet workloads. They are independent of the `apisix.resources` and `apisix.securityContext`, which configure the gateway container.
+
+Both options default to `{}` and are omitted from the rendered container when
+empty. Applicable `apisix.podSecurityContext` settings still apply to `wait-etcd`.
+For example:
+
+```yaml
+initContainer:
+  resources:
+    requests:
+      cpu: 10m
+      memory: 16Mi
+    limits:
+      cpu: 100m
+      memory: 32Mi
+  securityContext:
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop:
+        - ALL
+    readOnlyRootFilesystem: true
+    runAsNonRoot: true
+    runAsUser: 1000
+```
+
+Adjust resource values for your environment. The default BusyBox image runs as
+root, so `runAsNonRoot: true` also requires a non-zero UID supplied through
+`runAsUser`, `apisix.podSecurityContext`, or an admission policy. On platforms such as
+OpenShift that assign a UID, omit the explicit `runAsUser` value.
+
+These options do not configure `extraInitContainers` and have no effect when
+`etcd.enabled` is false.

charts/gateway/templates/_pod.tpl

@@ -276,7 +276,6 @@ spec:
       {{- toYaml .Values.openapiToMcp.resources | nindent 8 }}
     {{- end }}
   {{- if .Values.apisix.hostNetwork }}
-  hostNetwork: true
   dnsPolicy: ClusterFirstWithHostNet
   {{- end }}
   hostNetwork: {{ .Values.apisix.hostNetwork }}
@@ -288,6 +287,14 @@ spec:
     {{- if .Values.etcd.enabled }}
     - name: wait-etcd
       image: {{ .Values.initContainer.image }}:{{ .Values.initContainer.tag }}
+      {{- with .Values.initContainer.resources }}
+      resources:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.initContainer.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.etcd.fullnameOverride }}
       command: ['sh', '-c', "until nc -z {{ .Values.etcd.fullnameOverride }} {{ .Values.etcd.service.port }}; do echo waiting for etcd `date`; sleep 2; done;"]
       {{ else }}

charts/gateway/values.yaml

@@ -742,6 +742,24 @@ initContainer:
   image: busybox
   # -- Init container tag
   tag: 1.28
+  # -- Resource requests and limits for the wait-etcd init container (only used when etcd.enabled is true)
+  resources: {}
+    # requests:
+    #   cpu: 10m
+    #   memory: 16Mi
+    # limits:
+    #   cpu: 100m
+    #   memory: 32Mi
+  # -- Container security context for wait-etcd. Empty by default to inherit applicable apisix.podSecurityContext settings.
+  securityContext: {}
+    # allowPrivilegeEscalation: false
+    # capabilities:
+    #   drop:
+    #     - ALL
+    # readOnlyRootFilesystem: true
+    # runAsNonRoot: true
+    # Set runAsUser to a non-zero UID unless the pod or admission policy supplies one.
+    # runAsUser: 1000
 
 autoscaling:
   # -- Enable HorizontalPodAutoscaler for the gateway (only when apisix.kind is Deployment)

charts/ingress-controller/README.md

@@ -75,6 +75,7 @@ the controller recommends 1.31+ and only warns below it.
 | deployment.nodeSelector | object | `{}` |  |
 | deployment.podAnnotations | object | `{}` |  |
 | deployment.podSecurityContext.fsGroup | int | `2000` |  |
+| deployment.priorityClassName | string | `""` | PriorityClass for ingress controller pods |
 | deployment.replicas | int | `1` |  |
 | deployment.resources | object | `{}` | Set pod resource requests & limits |
 | deployment.securityContext | object | `{}` |  |
@@ -87,6 +88,7 @@ the controller recommends 1.31+ and only warns below it.
 | podDisruptionBudget.enabled | bool | `false` | Enable or disable podDisruptionBudget |
 | podDisruptionBudget.maxUnavailable | int | `1` | Set the maxUnavailable of podDisruptionBudget |
 | podDisruptionBudget.minAvailable | string | `"90%"` | Set the `minAvailable` of podDisruptionBudget. You can specify only one of `maxUnavailable` and `minAvailable` in a single PodDisruptionBudget. See [Specifying a Disruption Budget for your Application](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget) for more details |
+| webhook.annotations | object | `{}` | Annotations for the ValidatingWebhookConfiguration. For cert-manager CA injection, use certificate.provided=true and leave certificate.caBundle unset. |
 | webhook.certificate.provided | bool | `false` | Set to true if you want to provide your own certificate |
 | webhook.enabled | bool | `true` | Enable or disable admission webhook |
 | webhook.failurePolicy | string | `"Ignore"` | Failure policy for the webhook (Fail or Ignore) |

charts/ingress-controller/templates/deployment.yaml

@@ -26,6 +26,9 @@ spec:
       labels:
         {{- include "api7-ingress-controller-manager.selectorLabels" . | nindent 8 }}
     spec:
+      {{- with .Values.deployment.priorityClassName }}
+      priorityClassName: {{ . | quote }}
+      {{- end }}
       containers:
       - env:
         - name: POD_NAMESPACE

charts/ingress-controller/templates/webhook.yaml

@@ -23,6 +23,10 @@ apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: {{ include "api7-ingress-controller-manager.name.fullname" . }}-webhook
+  {{- with .Values.webhook.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   labels:
     {{- include "api7-ingress-controller-manager.labels" . | nindent 4 }}
 webhooks:

charts/ingress-controller/values.yaml

@@ -20,6 +20,8 @@ autoscaling:
   minReplicas: 1
 
 deployment:
+  # -- PriorityClass for ingress controller pods
+  priorityClassName: ""
   annotations: {}
   podAnnotations: {}
   replicas: 1
@@ -73,6 +75,8 @@ config:
 
 # Admission webhook configuration
 webhook:
+  # -- Annotations for the ValidatingWebhookConfiguration. For cert-manager CA injection, use certificate.provided=true and leave certificate.caBundle unset.
+  annotations: {}
   # -- Enable or disable admission webhook
   enabled: true
   # -- The port for the webhook server to listen on
@@ -86,5 +90,5 @@ webhook:
     provided: false
     # -- Secret name containing the certificate (required if provided is true)
     # secretName: "my-webhook-cert"
-    # -- CA bundle in base64 format (required if provided is true)
+    # -- CA bundle in base64 format for a provided certificate; leave unset when a CA injector manages it
     # caBundle: ""