NiuBlibing opened a new pull request, #1038:
URL: https://github.com/apache/apisix-helm-chart/pull/1038
## What this PR does
This PR makes the Apache APISIX Helm chart usable as a single-release
production deployment for decoupled APISIX, while keeping `traditional` mode
available as an explicit compatibility option.
### Main changes
- Deploy control plane and data plane workloads from one release with
component-specific names, replicas, ConfigMaps, Services, PDBs, HPAs, and
metrics.
- Prefer external etcd by default and support pinned image tags plus
optional immutable digests.
- Add default Pod/Container security contexts and disable ServiceAccount
token mounting by default.
- Use APISIX `/status/ready` for readiness and add startup/liveness probes.
- Increase the default termination grace period and make preStop draining
configurable.
- Make the bundled Ingress Controller associate automatically with the
release's control-plane Admin Service, GatewayProxy, and generated credentials
Secret.
- Avoid the default Admin API allow list of `0.0.0.0/0` and `::/0`; allow
private cluster ranges by default and keep explicit CIDR configuration
available.
- Add independently configurable NetworkPolicies for APISIX, bundled etcd,
and the Ingress Controller.
- Add an independent `etcd.auth.tls.caSecret`, without requiring
`apisix.ssl` to trust etcd.
- Expose selected newer APISIX configuration fields and allow mounting a
complete APISIX `config.yaml` from an existing ConfigMap.
- Scope PDB, HPA, and ServiceMonitor resources correctly in decoupled mode.
- Make CRD install and upgrade behavior explicit, retain CRDs on uninstall,
and support platform-managed CRDs.
The changes are split into small, topic-focused commits so they can be
reviewed or split further by maintainers.
## Compatibility and migration
- The default deployment mode changes to `decoupled`. Existing users can
preserve the current behavior with:
```yaml
apisix:
deployment:
mode: traditional
```
- Bundled etcd is disabled by default. Production installations should
configure `externalEtcd`.
- Existing Admin credentials can still be supplied through
`apisix.admin.credentials.secretName`.
- CRD upgrades are opt-in with `ingress-controller.crds.upgrade.enabled`.
## Validation
- `helm lint charts/apisix --strict`
- `helm lint charts/apisix-ingress-controller --strict`
- Rendered default decoupled mode, control-plane-only, data-plane-only,
traditional mode, external etcd TLS, Ingress Controller integration,
ServiceMonitor, NetworkPolicy, and CRD upgrade scenarios.
- `git diff --check`
Image digests remain configurable but are not hard-coded to an unverified
registry digest; release automation or downstream registries should inject and
verify the digest for the selected image tag.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
