AlinsRan opened a new pull request, #1030: URL: https://github.com/apache/apisix-helm-chart/pull/1030
Ref #865 ### What Bitnami no longer publishes updates for the etcd images, and the built-in etcd currently runs `bitnamilegacy/etcd:latest`. This PR adds an opt-in built-in etcd, `etcd-next`, based on the [CloudPirates etcd chart](https://github.com/CloudPirates-io/helm-charts/tree/main/charts/etcd) (Apache-2.0), which runs the official `gcr.io/etcd-development/etcd` image. The default is unchanged: `etcd.enabled: true` still deploys the Bitnami etcd, so existing releases render the same manifests as before. To use it: ```yaml etcd: enabled: false etcd-next: enabled: true ``` ### How - `etcd-next` is the alias of a second `etcd` dependency, so its values live under its own key. Helm rejects two dependencies with the same name or alias, and the two charts use different value schemas, so they cannot share `etcd:`. - The APISIX-side settings stay under `etcd` and apply to both: `prefix`, `timeout`, `watchTimeout`, `startupRetry`, `auth.tls`. - New helpers `apisix.etcd.builtin`, `apisix.etcd.builtin.host` and `apisix.etcd.builtin.port` replace the `.Values.etcd.enabled` checks that meant "a built-in etcd is deployed" (etcd host, `wait-etcd`, external etcd user/secret). - Rendering fails fast for unsupported combinations: - `etcd.enabled` and `etcd-next.enabled` both set; - `etcd.auth.rbac.create` with `etcd-next` (the CloudPirates chart has no RBAC/root password support); - `etcd-next.auth.enabled` not matching `etcd.auth.tls.enabled` (APISIX would use the wrong scheme or no client certificate). - The Bitnami dependency is now fetched from `oci://registry-1.docker.io/bitnamicharts`. With one dependency from an HTTP repository and another with the same chart name from OCI, `helm dependency update` fails with `no cached repository for oci://registry-1.docker.io/cloudpirates found`. The `etcd-12.0.18.tgz` pulled from OCI is byte-identical to the one already in the repository. - `ci/default-values.yaml` and `ci/etcd-next-values.yaml` make `ct install` cover both built-in etcd variants. Switching an existing release from `etcd` to `etcd-next` creates a new etcd cluster. Data is not migrated, and the PVCs of the previous etcd are kept. ### Verification - `helm template` with default values, `etcd.fullnameOverride` + `etcd.auth.rbac.create`, and external etcd with user/password: output identical to master, except random secrets, checksums and one blank line. - `ct lint` (chart-testing v3.13.0): passed for both CI values files. - kind (Kubernetes 1.32): - fresh install with `etcd-next`: 3-member etcd 3.7.2 cluster formed, route created via Admin API, request through the gateway returned 200; - `helm install` with defaults (Bitnami), then `helm upgrade` to `etcd-next`: upgrade succeeded and APISIX switched to `etcd-next`; - `etcd-next.auth.enabled` with a server certificate secret plus `etcd.auth.tls` client certificate: APISIX connected over mTLS, route stored and served (200), and etcd rejected clients without a certificate. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
