This is an automated email from the ASF dual-hosted git repository.
guoqqqi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix-helm-chart.git
The following commit(s) were added to refs/heads/master by this push:
new 7bc1e97 fix(apisix): support etcd TLS without client certificates
(#1034)
7bc1e97 is described below
commit 7bc1e97fcf566cd1bce4dfed4a50a69b728c6808
Author: Qi Guo <[email protected]>
AuthorDate: Wed Nov 11 11:29:25 2026 +0800
fix(apisix): support etcd TLS without client certificates (#1034)
---
charts/apisix/Chart.yaml | 2 +-
charts/apisix/README.md | 63 +++++++++++++++++++++++++++++----
charts/apisix/README.md.gotmpl | 51 ++++++++++++++++++++++++++
charts/apisix/templates/_helpers.tpl | 17 +++++++++
charts/apisix/templates/configmap.yaml | 2 ++
charts/apisix/templates/deployment.yaml | 4 +--
charts/apisix/values.yaml | 12 +++----
7 files changed, 136 insertions(+), 15 deletions(-)
diff --git a/charts/apisix/Chart.yaml b/charts/apisix/Chart.yaml
index f442860..b0a1a21 100644
--- a/charts/apisix/Chart.yaml
+++ b/charts/apisix/Chart.yaml
@@ -31,7 +31,7 @@ type: application
# This is the chart version. This version number should be incremented each
time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.18.2
+version: 2.18.3
# This is the version number of the application being deployed. This version
number should be
# incremented each time you make changes to the application. Versions are not
expected to
diff --git a/charts/apisix/README.md b/charts/apisix/README.md
index ed6844c..2632d5f 100644
--- a/charts/apisix/README.md
+++ b/charts/apisix/README.md
@@ -72,6 +72,57 @@ OpenShift that assign a UID, omit the explicit `runAsUser`
value.
These options do not configure `extraInitContainers` and have no effect when
`etcd.enabled` is false.
+## Connect to external etcd with server-only TLS
+
+For external etcd, use `https://` endpoints in `externalEtcd.host` and set
+`etcd.auth.tls.enabled: true` to configure TLS verification and SNI. Client
+certificates are optional: leave `existingSecret`, `certFilename` and
+`certKeyFilename` empty when etcd does not require a client certificate.
+
+For example, to connect to an IP endpoint using a CA stored in a Secret:
+
+```yaml
+apisix:
+ ssl:
+ enabled: true
+ existingCASecret: etcd-ca
+ certCAFilename: ca.crt
+etcd:
+ enabled: false
+ auth:
+ tls:
+ enabled: true
+ existingSecret: ""
+ certFilename: ""
+ certKeyFilename: ""
+ verify: true
+ sni: etcd.example.test
+externalEtcd:
+ host:
+ - https://192.0.2.10:2379
+ user: "" # This example assumes etcd username/password authentication is
disabled.
+```
+
+Replace the endpoint, Secret name, CA key and SNI with your actual values. The
CA
+Secret must be in the same namespace as APISIX. If etcd username/password
+authentication is enabled, configure `externalEtcd.user` and its password or
+password Secret as usual.
+
+The SNI must be a DNS name covered by every endpoint's server certificate. It
+does not change the connection address or require DNS resolution when the
+endpoints are IP addresses. An empty SNI is omitted from the APISIX
configuration
+so the client can use the endpoint hostname.
+
+For mTLS, keep `etcd.auth.tls.enabled: true` and set `existingSecret`,
+`certFilename` and `certKeyFilename` under `etcd.auth.tls`. The certificate
and key
+must be configured together. When TLS is enabled, a non-empty `existingSecret`
+is mounted at `/etcd-ssl`, including when certificate paths are supplied
through
+`apisix.fullCustomConfig`. The CA Secret above is configured separately.
+
+With `etcd.auth.tls.enabled: false`, the APISIX etcd TLS settings and
+client-certificate mount are omitted as before. This flag does not rewrite
+external endpoint URLs; use `http://` endpoints for HTTP connections.
+
## Parameters
## Values
@@ -253,12 +304,12 @@ These options do not configure `extraInitContainers` and
have no effect when
| etcd.auth | object |
`{"rbac":{"create":false,"rootPassword":""},"tls":{"certFilename":"","certKeyFilename":"","enabled":false,"existingSecret":"","sni":"","verify":true}}`
| if etcd.enabled is true, set more values of bitnamilegacy/etcd helm chart |
| etcd.auth.rbac.create | bool | `false` | No authentication by default.
Switch to enable RBAC authentication |
| etcd.auth.rbac.rootPassword | string | `""` | root password for etcd.
Requires etcd.auth.rbac.create to be true. |
-| etcd.auth.tls.certFilename | string | `""` | etcd client cert filename using
in etcd.auth.tls.existingSecret |
-| etcd.auth.tls.certKeyFilename | string | `""` | etcd client cert key
filename using in etcd.auth.tls.existingSecret |
-| etcd.auth.tls.enabled | bool | `false` | enable etcd client certificate |
-| etcd.auth.tls.existingSecret | string | `""` | name of the secret contains
etcd client cert |
-| etcd.auth.tls.sni | string | `""` | specify the TLS Server Name Indication
extension, the ETCD endpoint hostname will be used when this setting is unset.
Set it to a DNS name in the etcd certificate if the etcd endpoints are IP
addresses, since IP SANs are not matched. |
-| etcd.auth.tls.verify | bool | `true` | whether to verify the etcd endpoint
certificate when setup a TLS connection to etcd |
+| etcd.auth.tls.certFilename | string | `""` | Client certificate filename in
existingSecret. Set together with certKeyFilename for mTLS; leave both empty
for server-only TLS. |
+| etcd.auth.tls.certKeyFilename | string | `""` | Client private key filename
in existingSecret. Required when certFilename is set. |
+| etcd.auth.tls.enabled | bool | `false` | Enable TLS settings for the APISIX
etcd connection. For external etcd, also use https:// endpoints in
externalEtcd.host. Client certificates are optional. |
+| etcd.auth.tls.existingSecret | string | `""` | Secret containing the
optional etcd client certificate and key. Mounted when TLS is enabled and the
name is non-empty, including with fullCustomConfig. Required when certFilename
and certKeyFilename are set. |
+| etcd.auth.tls.sni | string | `""` | TLS server name used when
etcd.auth.tls.enabled is true. Omitted when empty so the endpoint hostname is
used. For IP endpoints, set a DNS name covered by every endpoint certificate,
since IP SANs are not matched. |
+| etcd.auth.tls.verify | bool | `true` | Whether to verify the etcd endpoint
certificate when etcd.auth.tls.enabled is true. |
| etcd.autoCompactionMode | string | `"periodic"` | Auto compaction mode
(periodic or revision), only used when etcd.enabled is true |
| etcd.autoCompactionRetention | string | `"1h"` | Auto compaction retention
for mvcc key value store, only used when etcd.enabled is true |
| etcd.containerSecurityContext | object | `{"enabled":false}` | added for
backward compatibility with old kubernetes versions, as seccompProfile is not
supported in kubernetes < 1.19 |
diff --git a/charts/apisix/README.md.gotmpl b/charts/apisix/README.md.gotmpl
index dad784c..94a88e9 100644
--- a/charts/apisix/README.md.gotmpl
+++ b/charts/apisix/README.md.gotmpl
@@ -72,6 +72,57 @@ OpenShift that assign a UID, omit the explicit `runAsUser`
value.
These options do not configure `extraInitContainers` and have no effect when
`etcd.enabled` is false.
+## Connect to external etcd with server-only TLS
+
+For external etcd, use `https://` endpoints in `externalEtcd.host` and set
+`etcd.auth.tls.enabled: true` to configure TLS verification and SNI. Client
+certificates are optional: leave `existingSecret`, `certFilename` and
+`certKeyFilename` empty when etcd does not require a client certificate.
+
+For example, to connect to an IP endpoint using a CA stored in a Secret:
+
+```yaml
+apisix:
+ ssl:
+ enabled: true
+ existingCASecret: etcd-ca
+ certCAFilename: ca.crt
+etcd:
+ enabled: false
+ auth:
+ tls:
+ enabled: true
+ existingSecret: ""
+ certFilename: ""
+ certKeyFilename: ""
+ verify: true
+ sni: etcd.example.test
+externalEtcd:
+ host:
+ - https://192.0.2.10:2379
+ user: "" # This example assumes etcd username/password authentication is
disabled.
+```
+
+Replace the endpoint, Secret name, CA key and SNI with your actual values. The
CA
+Secret must be in the same namespace as APISIX. If etcd username/password
+authentication is enabled, configure `externalEtcd.user` and its password or
+password Secret as usual.
+
+The SNI must be a DNS name covered by every endpoint's server certificate. It
+does not change the connection address or require DNS resolution when the
+endpoints are IP addresses. An empty SNI is omitted from the APISIX
configuration
+so the client can use the endpoint hostname.
+
+For mTLS, keep `etcd.auth.tls.enabled: true` and set `existingSecret`,
+`certFilename` and `certKeyFilename` under `etcd.auth.tls`. The certificate
and key
+must be configured together. When TLS is enabled, a non-empty `existingSecret`
+is mounted at `/etcd-ssl`, including when certificate paths are supplied
through
+`apisix.fullCustomConfig`. The CA Secret above is configured separately.
+
+With `etcd.auth.tls.enabled: false`, the APISIX etcd TLS settings and
+client-certificate mount are omitted as before. This flag does not rewrite
+external endpoint URLs; use `http://` endpoints for HTTP connections.
+
## Parameters
{{ template "chart.valuesSection" . }}
diff --git a/charts/apisix/templates/_helpers.tpl
b/charts/apisix/templates/_helpers.tpl
index 0dfa4e9..53d8c84 100644
--- a/charts/apisix/templates/_helpers.tpl
+++ b/charts/apisix/templates/_helpers.tpl
@@ -112,6 +112,23 @@ Scheme to use while connecting etcd
{{- end }}
{{- end }}
+{{/*
+Return true when etcd client certificates are configured, otherwise an empty
string.
+Validate the credentials used by the generated APISIX configuration.
+*/}}
+{{- define "apisix.etcd.tls.clientCertEnabled" -}}
+{{- $tls := .Values.etcd.auth.tls -}}
+{{- if and $tls.enabled (or $tls.certFilename $tls.certKeyFilename) -}}
+{{- if not (and $tls.certFilename $tls.certKeyFilename) -}}
+{{- fail "etcd.auth.tls.certFilename and etcd.auth.tls.certKeyFilename must be
set together" -}}
+{{- end -}}
+{{- if not $tls.existingSecret -}}
+{{- fail "etcd.auth.tls.existingSecret is required when configuring etcd
client certificates" -}}
+{{- end -}}
+true
+{{- end -}}
+{{- end -}}
+
{{/*
Return the name of etcd password secret
*/}}
diff --git a/charts/apisix/templates/configmap.yaml
b/charts/apisix/templates/configmap.yaml
index a30ec1b..1ded831 100644
--- a/charts/apisix/templates/configmap.yaml
+++ b/charts/apisix/templates/configmap.yaml
@@ -440,8 +440,10 @@ data:
{{- end }}
{{- if .Values.etcd.auth.tls.enabled }}
tls:
+ {{- if include "apisix.etcd.tls.clientCertEnabled" . }}
cert: "/etcd-ssl/{{ .Values.etcd.auth.tls.certFilename }}"
key: "/etcd-ssl/{{ .Values.etcd.auth.tls.certKeyFilename }}"
+ {{- end }}
verify: {{ .Values.etcd.auth.tls.verify }}
{{- with .Values.etcd.auth.tls.sni }}
sni: {{ . | quote }}
diff --git a/charts/apisix/templates/deployment.yaml
b/charts/apisix/templates/deployment.yaml
index 602eb69..f387491 100644
--- a/charts/apisix/templates/deployment.yaml
+++ b/charts/apisix/templates/deployment.yaml
@@ -212,7 +212,7 @@ spec:
subPath: {{ .Values.apisix.ssl.certCAFilename }}
{{- end }}
- {{- if .Values.etcd.auth.tls.enabled }}
+ {{- if and .Values.etcd.auth.tls.enabled
.Values.etcd.auth.tls.existingSecret }}
- mountPath: /etcd-ssl
name: etcd-ssl
{{- end }}
@@ -281,7 +281,7 @@ spec:
secretName: {{ .Values.apisix.ssl.existingCASecret | quote }}
name: ssl
{{- end }}
- {{- if .Values.etcd.auth.tls.enabled }}
+ {{- if and .Values.etcd.auth.tls.enabled
.Values.etcd.auth.tls.existingSecret }}
- secret:
secretName: {{ .Values.etcd.auth.tls.existingSecret | quote }}
name: etcd-ssl
diff --git a/charts/apisix/values.yaml b/charts/apisix/values.yaml
index 1f2156a..8c592f8 100644
--- a/charts/apisix/values.yaml
+++ b/charts/apisix/values.yaml
@@ -892,17 +892,17 @@ etcd:
# -- root password for etcd. Requires etcd.auth.rbac.create to be true.
rootPassword: ""
tls:
- # -- enable etcd client certificate
+ # -- Enable TLS settings for the APISIX etcd connection. For external
etcd, also use https:// endpoints in externalEtcd.host. Client certificates are
optional.
enabled: false
- # -- name of the secret contains etcd client cert
+ # -- Secret containing the optional etcd client certificate and key.
Mounted when TLS is enabled and the name is non-empty, including with
fullCustomConfig. Required when certFilename and certKeyFilename are set.
existingSecret: ""
- # -- etcd client cert filename using in etcd.auth.tls.existingSecret
+ # -- Client certificate filename in existingSecret. Set together with
certKeyFilename for mTLS; leave both empty for server-only TLS.
certFilename: ""
- # -- etcd client cert key filename using in etcd.auth.tls.existingSecret
+ # -- Client private key filename in existingSecret. Required when
certFilename is set.
certKeyFilename: ""
- # -- whether to verify the etcd endpoint certificate when setup a TLS
connection to etcd
+ # -- Whether to verify the etcd endpoint certificate when
etcd.auth.tls.enabled is true.
verify: true
- # -- specify the TLS Server Name Indication extension, the ETCD endpoint
hostname will be used when this setting is unset. Set it to a DNS name in the
etcd certificate if the etcd endpoints are IP addresses, since IP SANs are not
matched.
+ # -- TLS server name used when etcd.auth.tls.enabled is true. Omitted
when empty so the endpoint hostname is used. For IP endpoints, set a DNS name
covered by every endpoint certificate, since IP SANs are not matched.
sni: ""
# -- ref:
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
