Skip to content

Commit a390431

Browse files
nic-chennic-chen
authored
feat: update helm chart for API7 Gateway 2.8.2203 (#47)
1 parent 62b7ca1 commit a390431

File tree

3 files changed

+85
-92
lines changed

3 files changed

+85
-92
lines changed

‎chart/api7/templates/configmap.yaml‎

Lines changed: 28 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -97,23 +97,24 @@ data:
9797
listen_port: {{ .Values.gateway.tls.port }}
9898
ssl_protocols: "TLSv1 TLSv1.1 TLSv1.2 TLSv1.3"
9999
ssl_ciphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
100-
{{- if .Values.cloud.domain }}
101-
ssl_trusted_certificate: "/usr/local/apisix/conf/cloud-ssl/{{ .Values.cloud.certCAFilename }}"
102-
{{- else if and .Values.gateway.tls.enabled .Values.gateway.tls.existingCASecret }}
100+
{{- if and .Values.gateway.tls.enabled .Values.gateway.tls.existingCASecret }}
103101
ssl_trusted_certificate: "/usr/local/apisix/conf/ssl/{{ .Values.gateway.tls.certCAFilename }}"
104102
{{- end }}
105103
106104
nginx_config: # config for render the template to genarate nginx.conf
107-
error_log: "/dev/stderr"
108-
error_log_level: "warn" # warn,error
105+
error_log: "{{ .Values.logs.errorLog }}"
106+
error_log_level: "{{ .Values.logs.errorLogLevel }}" # warn,error
109107
worker_processes: {{ .Values.gateway.workerProcesses }}
110108
worker_rlimit_nofile: 20480 # the number of files a worker process can open, should be larger than worker_connections
111109
event:
112110
worker_connections: 10620
113111
http:
114-
access_log: "/dev/stdout"
115-
access_log_format: "$remote_addr - $remote_user [$time_local] $http_host \"$request\" $status $body_bytes_sent $request_time \"$http_referer\" \"$http_user_agent\" $upstream_addr $upstream_status $upstream_response_time \"$upstream_scheme://$upstream_host$upstream_uri\""
116-
access_log_format_escape: default # allows setting json or default characters escaping in variables
112+
enable_access_log: {{ .Values.logs.enableAccessLog }}
113+
{{- if .Values.logs.enableAccessLog }}
114+
access_log: "{{ .Values.logs.accessLog }}"
115+
access_log_format: "{{ .Values.logs.accessLogFormat }}"
116+
access_log_format_escape: {{ .Values.logs.accessLogFormatEscape }}
117+
{{- end }}
117118
118119
keepalive_timeout: 60s # timeout during which a keep-alive client connection will stay open on the server side.
119120
client_header_timeout: 60s # timeout for reading client request header, then 408 (Request Time-out) error is returned to the client
@@ -129,12 +130,14 @@ data:
129130
real_ip_from: # http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
130131
- 127.0.0.1
131132
- 'unix:'
132-
{{- if .Values.cloudProxy.enabled }}
133-
lua_shared_dicts: # add custom shared cache to nginx.conf
134-
etcd_token_cache: 10m
135-
cloud_proxy_lock: 1m
133+
134+
{{- if .Values.customLuaSharedDicts }}
135+
custom_lua_shared_dict: # add custom shared cache to nginx.conf
136+
{{- range $dict := .Values.customLuaSharedDicts }}
137+
{{ $dict.name }}: {{ $dict.size }}
138+
{{- end }}
136139
{{- end }}
137-
# ipc_shared_dict: 100m # custom shared cache, format: `cache-key: cache-size`
140+
138141
{{- if .Values.configurationSnippet.main }}
139142
main_configuration_snippet: {{ toYaml .Values.configurationSnippet.main | indent 6 }}
140143
{{- end }}
@@ -160,13 +163,9 @@ data:
160163
- "http://{{ .Release.Name }}-etcd.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}:{{ .Values.etcd.service.port }}"
161164
{{- else }}
162165
host: # it's possible to define multiple etcd hosts addresses of the same etcd cluster.
163-
{{- if .Values.cloud.domain }}
164-
- "https://{{ .Values.cloud.domain }}:443"
165-
{{- else }}
166166
{{- range $value := .Values.etcd.hosts }}
167167
- "{{ $value }}" # multiple etcd address
168168
{{- end }}
169-
{{- end }}
170169
{{- end }}
171170
prefix: {{ .Values.etcd.prefix | quote }} # apisix configurations prefix
172171
timeout: {{ .Values.etcd.timeout }} # 30 seconds
@@ -179,61 +178,31 @@ data:
179178
cert: "/etcd-ssl/{{ .Values.etcd.auth.tls.certFilename }}"
180179
key: "/etcd-ssl/{{ .Values.etcd.auth.tls.certKeyFilename }}"
181180
verify: {{ .Values.etcd.auth.tls.verify }}
182-
{{- else if .Values.cloud.domain }}
183-
tls:
184-
cert: "/usr/local/apisix/conf/cloud-ssl/{{ .Values.cloud.certFilename }}"
185-
key: "/usr/local/apisix/conf/cloud-ssl/{{ .Values.cloud.certKeyFilename }}"
186-
verify: true
187181
{{- end }}
188182
189-
{{- if or .Values.plugins .Values.cloudProxy.enabled }}
183+
{{- if .Values.discovery.enabled }}
184+
discovery:
185+
{{- range $key, $value := .Values.discovery.registry }}
186+
{{ $key }}:
187+
{{- include "apisix.tplvalues.render" (dict "value" $value "context" $) | nindent 8 }}
188+
{{- end }}
189+
{{- end }}
190+
191+
{{- if .Values.plugins }}
190192
plugins: # plugin list
191193
{{- range $plugin := .Values.plugins }}
192-
{{- if or (not $.Values.cloud.domain) (ne $plugin "prometheus") }}
193194
- {{ $plugin }}
194195
{{- end }}
195196
{{- end }}
196-
{{- end }}
197-
{{- if .Values.cloudProxy.enabled }}
198-
- cloud-proxy
199-
{{- end }}
200-
{{- if .Values.cloud.domain }}
201-
- cloud-prometheus
202-
- cloud
203-
{{- end }}
197+
204198
{{- if .Values.stream_plugins }}
205199
stream_plugins:
206200
{{- range $plugin := .Values.stream_plugins }}
207201
- {{ $plugin }}
208202
{{- end }}
209203
{{- end }}
210-
{{- if or .Values.plugin_attr .Values.cloudProxy.enabled }}
204+
205+
{{- if .Values.plugin_attr }}
211206
plugin_attr: # plugin attr
212-
{{- range $key, $attr := .Values.plugin_attr }}
213-
{{- if or (ne $key "prometheus") (not $.Values.cloud.domain) }}
214-
{{ $key | indent 2 }}: {{- toYaml $attr | nindent 8 }}
215-
{{- end }}
216-
{{- end }}
217-
{{- end }}
218-
{{- if .Values.cloudProxy.enabled }}
219-
cloud-proxy:
220-
domain_suffix: {{ .Values.cloudProxy.domain_suffix }}
221-
org_salt_size: {{ .Values.cloudProxy.organizationSaltSize }}
222-
{{- end }}
223-
{{- if .Values.cloud.domain }}
224-
cloud-promethues:
225-
export_uri: /apisix/prometheus/metrics
226-
enable_export_server: true
227-
export_addr:
228-
ip: "127.0.0.1"
229-
port: 9091
230-
cloud:
231-
domain: {{ .Values.cloud.domain }}
232-
port: 443
233-
cert: "/usr/local/apisix/conf/cloud-ssl/{{ .Values.cloud.certFilename }}"
234-
key: "/usr/local/apisix/conf/cloud-ssl/{{ .Values.cloud.certKeyFilename }}"
235207
{{- toYaml .Values.plugin_attr | nindent 6 }}
236-
cloud-proxy:
237-
domain_suffix: {{ .Values.cloudProxy.domainSuffix }}
238-
org_salt_size: {{ .Values.cloudProxy.organizationSaltSize }}
239208
{{- end }}

‎chart/api7/templates/deployment.yaml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -103,10 +103,6 @@ spec:
103103
- mountPath: /usr/local/apisix/conf/ssl
104104
name: ssl
105105
{{- end }}
106-
{{- if .Values.cloud.domain }}
107-
- mountPath: /usr/local/apisix/conf/cloud-ssl
108-
name: cloud-ssl
109-
{{- end }}
110106
resources:
111107
{{- toYaml .Values.resources | nindent 12 }}
112108
{{- if .Values.etcd.builtin }}
@@ -129,11 +125,6 @@ spec:
129125
secretName: {{ .Values.gateway.tls.existingCASecret | quote }}
130126
name: ssl
131127
{{- end }}
132-
{{- if .Values.cloud.domain }}
133-
- secret:
134-
secretName: {{ .Values.cloud.tlsSecret }}
135-
name: cloud-ssl
136-
{{- end }}
137128
{{- with .Values.nodeSelector }}
138129
nodeSelector:
139130
{{- toYaml . | nindent 8 }}

‎chart/api7/values.yaml‎

Lines changed: 57 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -35,19 +35,23 @@ clusterDomain: cluster.local
3535

3636
podAnnotations: {}
3737

38-
podSecurityContext:
39-
{}
38+
podSecurityContext: {}
4039
# fsGroup: 2000
4140

42-
securityContext:
43-
{}
41+
securityContext: {}
4442
# capabilities:
4543
# drop:
4644
# - ALL
4745
# readOnlyRootFilesystem: true
4846
# runAsNonRoot: true
4947
# runAsUser: 1000
5048

49+
customLuaSharedDicts: []
50+
# - name: foo
51+
# size: 10k
52+
# - name: bar
53+
# size: 1m
54+
5155
gateway:
5256
type: NodePort
5357
# type: LoadBalancer
@@ -93,7 +97,7 @@ etcd:
9397
# install etcd(v3) by default, set false if do not want to install etcd(v3) together,
9498
# in such a case, etcd.host should be configured so that existing ETCD cluster can be
9599
# used.
96-
builtin: true
100+
builtin: false
97101
hosts:
98102
- http://etcd.host:2379 # host or ip e.g. http://172.20.128.89:2379
99103
prefix: "/api7"
@@ -120,6 +124,38 @@ etcd:
120124
certKeyFilename: "tls.key"
121125
verify: true
122126

127+
discovery:
128+
enabled: false
129+
registry:
130+
# Integration service discovery registry. E.g eureka\dns\nacos\consul_kv
131+
# reference:
132+
# https://apisix.apache.org/docs/apisix/discovery#configuration-for-eureka
133+
# https://apisix.apache.org/docs/apisix/discovery/dns#service-discovery-via-dns
134+
# https://apisix.apache.org/docs/apisix/discovery/consul_kv#configuration-for-consul-kv
135+
# https://apisix.apache.org/docs/apisix/discovery/nacos#configuration-for-nacos
136+
#
137+
# an eureka example:
138+
# eureka:
139+
# host:
140+
# - "http://${username}:${password}@${eureka_host1}:${eureka_port1}"
141+
# - "http://${username}:${password}@${eureka_host2}:${eureka_port2}"
142+
# prefix: "/eureka/"
143+
# fetch_interval: 30
144+
# weight: 100
145+
# timeout:
146+
# connect: 2000
147+
# send: 2000
148+
# read: 5000
149+
150+
# access log and error log configuration
151+
logs:
152+
enableAccessLog: true
153+
accessLog: "/dev/stdout"
154+
accessLogFormat: '$remote_addr - $remote_user [$time_local] $http_host \"$request\" $status $body_bytes_sent $request_time \"$http_referer\" \"$http_user_agent\" $upstream_addr $upstream_status $upstream_response_time \"$upstream_scheme://$upstream_host$upstream_uri\"'
155+
accessLogFormatEscape: default
156+
errorLog: "/dev/stderr"
157+
errorLogLevel: "warn"
158+
123159
dns:
124160
resolvers:
125161
- 127.0.0.1
@@ -134,20 +170,28 @@ dns:
134170
# APISIX plugins to be enabled
135171
plugins:
136172
- api-breaker
173+
- authz-casbin
137174
- authz-keycloak
138175
- basic-auth
139-
- batch-requests
176+
# - batch-requests
177+
- client-control
140178
- consumer-restriction
141179
- cors
180+
- dubbo-proxy
142181
- echo
182+
- ext-plugin-pre-req
183+
- ext-plugin-post-req
184+
- error-log-logger
143185
- fault-injection
144186
- grpc-transcode
187+
- gzip
145188
- hmac-auth
146189
- http-logger
147190
- ip-restriction
148191
- jwt-auth
149192
- kafka-logger
150193
- key-auth
194+
- log-rotate
151195
- limit-conn
152196
- limit-count
153197
- limit-req
@@ -157,21 +201,25 @@ plugins:
157201
- proxy-cache
158202
- proxy-mirror
159203
- proxy-rewrite
204+
- real-ip
160205
- redirect
161206
- referer-restriction
162207
- request-id
163208
- request-validation
164209
- response-rewrite
165210
- serverless-post-function
166211
- serverless-pre-function
212+
- skywalking
167213
- sls-logger
168214
- syslog
169215
- tcp-logger
216+
- ua-restriction
170217
- udp-logger
171218
- uri-blocker
172219
- wolf-rbac
173220
- zipkin
174221
- server-info
222+
- traffic-split
175223
stream_plugins:
176224
- mqtt-proxy
177225
plugin_attr:
@@ -185,8 +233,9 @@ plugin_attr:
185233
ip: "0.0.0.0"
186234
port: 9091
187235
server-info:
188-
report_interval: 60 # server info report interval (unit: second)
189-
report_ttl: 3600 # live time for server info in etcd (unit: second)
236+
report_ttl: 60 # live time for server info in etcd (unit: second)
237+
metrics_host: ""
238+
metrics_port: ""
190239
dubbo-proxy:
191240
upstream_multiplex_count: 32
192241

@@ -230,22 +279,6 @@ busybox:
230279
repository: busybox
231280
tag: 1.28
232281

233-
# Whether API7 works in the cloud proxy mode, if so, cloud-proxy plugin will be
234-
# enabled, this plugin intercepts requests.
235-
cloudProxy:
236-
enabled: false
237-
# A valid cluster domain should have such a suffix, e.g. qa.infra0j31xa.cn.api7.cloud,
238-
# the cluster is qa and the organization is infra.
239-
domainSuffix: api7.cloud
240-
organizationSaltSize: 6
241-
242-
cloud:
243-
tlsSecret: "api7-cloud-ssl"
244-
certFilename: "tls.crt"
245-
certKeyFilename: "tls.key"
246-
certCAFilename: "ca.crt"
247-
domain: ""
248-
249282
# Custom configuration snippet.
250283
configurationSnippet:
251284
main: |

0 commit comments

Comments
 (0)