guoqqqi opened a new pull request, #1034: URL: https://github.com/apache/apisix-helm-chart/pull/1034
When external etcd uses HTTPS with `etcd.auth.tls.enabled: false`, the chart currently drops both `sni` and `verify` from the APISIX configuration. This prevents server-only TLS from supplying a certificate DNS name for an IP endpoint, even when the server CA is trusted. This change renders `verify` and a non-empty `sni` independently of client certificate authentication. Only `cert`, `key`, and their existing Secret mounts remain conditional on `etcd.auth.tls.enabled`. It preserves the empty-SNI omission introduced in #1029. - Document server-only TLS with an IP endpoint, a CA Secret, and an explicit SNI. - Add rendering regressions to CI for Deployment/DaemonSet, server-only TLS, mTLS, empty SNI, and existing HTTP configurations. - Bump the APISIX chart to `2.18.3`; keep `appVersion: 3.19.0` and dependencies unchanged. The existing Release Charts workflow can publish the new chart after merge to master. Validation: - The new tests reproduce the missing TLS configuration on the original template. - All 5 test methods (10 rendering cases) pass after the fix. - `helm lint charts/apisix --strict` passes. - README regenerated with `helm-docs v1.11.0`; `git diff --check` passes. - Local rendering used Helm v4.0.1 with PyYAML. CI runs the same tests in the existing chart-testing container with Helm 3. - No live etcd/Kubernetes TLS handshake test was performed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
