dip/service-catalog
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

apisix 차트를 2.16.0에서 2.17.0으로 올리고 발행된 3.18.0 자체 빌드 태그를 반영한다

Browse Source 
hardened-containers가 apisix 3.17 라인 EOL로 3.18.0을 게이트 PASS로 새로 발행했다
(hardened-containers 커밋 3518f98: "3.17 line went EOL"). 이게 이 카탈로그의
차트 버전 갱신 트리거다 — appVersion을 3.18로 맞추려면 차트도 2.17.0(appVersion
3.18.0)으로 올려야 한다.

breaking_change_check: breaking=false. 다만 자동 diff가 못 잡는 실제 변경을
수동으로 하나 찾았다 — ingress-controller.enabled=true로 켜서 쓰는
apisix-ingress-controller 서브차트(1.2.0→1.3.0)에 새 CRD
l4routepolicies.apisix.apache.org가 추가됐다. helm_diff는 이 서브차트를 기본값
(off)으로만 렌더링해 애초에 스캔 대상에서 빠뜨린다 — CUSTOM-README.md에 수동
적용 안내를 남기고, 이 사각지대 자체를 catalog-update-pipeline SKILL.md에
기록해 다음 리뷰 때 놓치지 않게 했다.

catalog/image-map/{apisix,apisix-ingress-controller,adc}.env의 CHART_DIRS를
2.17.0으로 교체(2.16.0은 동결)하고, apply-published-tags.py로 발행된 실제 태그
(apisix 3.18.0-20260826, ingress-controller/adc는 최근 재스캔 리빌드분)를 반영했다.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
wbsong111
2026-08-26 16:00:31 +09:00
parent b94db8828c
commit 3d3d508d04
103 changed files with 36071 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manifests/helm/apisix/2.17.0/charts/apisix-ingress-controller/README.md
+176
View File
@@ -0,0 +1,176 @@
# Apache APISIX ingress controller
[APISIX Ingress controller](https://github.com/apache/apisix-ingress-controller/) for Kubernetes using Apache APISIX as a high performance reverse proxy and load balancer.
If you have installed multiple ingress controller, add the `kubernetes.io/ingress.class: apisix` annotation to your Ingress resources.
This chart bootstraps an apisix-ingress-controller deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
## Prerequisites
Apisix ingress controller requires Kubernetes version 1.16+.
## Get Repo Info
```console
helm repo add apisix https://apache.github.io/apisix-helm-chart
helm repo update
```
## Install Chart
**Important:** only helm3 is supported
```console
helm install [RELEASE_NAME] apisix/apisix-ingress-controller --namespace ingress-apisix --create-namespace
```
The command deploys apisix-ingress-controller on the Kubernetes cluster in the default configuration.
_See [configuration](#configuration) below._
_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._
## Uninstall Chart
```console
helm uninstall [RELEASE_NAME] --namespace ingress-apisix
```
This removes all the Kubernetes components associated with the chart and deletes the release.
_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._
## Upgrading Chart
```console
helm upgrade [RELEASE_NAME] [CHART] --install
```
_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
## Configuration
See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments, visit the chart's [values.yaml](./values.yaml), or run these configuration commands:
```console
helm show values apisix/apisix-ingress-controller
```
### Pod priority
`priorityClassName` field referenced a name of a created `PriorityClass` object. Check [here](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption) for more details.
### Security context
A security context provides us with a way to define privilege and access control for a Pod or even at the container level.
Check [here](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core) to see the SecurityContext resource with more detail.
Check also [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) to see a full explanation and some examples to configure the security context.
Right below you have an example of the security context configuration. In this case, we define that all the processes in the container will run with user ID 1000.
```yaml
...
spec:
securityContext:
runAsUser: 1000
runAsGroup: 3000
...
```
The same for the group definition, where we define the primary group of 3000 for all processes.
**It's quite important to know, if the `runAsGroup` is omited, the primary group will be root(0)**, which in some cases goes against some security policies.
To define this configuration at the **pod level**, you need to set:
```yaml
--set podSecurityContext.runAsUser=«VALUE»
--set podSecurityContext.runAsGroup=«VALUE»
...
```
The same for container level, you need to set:
```yaml
--set securityContext.runAsUser=«VALUE»
--set SecurityContext.runAsGroup=«VALUE»
...
```
## Values
| Key | Type | Default | Description |
|-----|------|---------|-------------|
| apisix.adminService.name | string | `"apisix-admin"` | |
| apisix.adminService.namespace | string | `"apisix-ingress"` | |
| apisix.adminService.port | int | `9180` | |
| autoscaling.enabled | bool | `false` | |
| autoscaling.minReplicas | int | `1` | |
| config.controllerName | string | `"apisix.apache.org/apisix-ingress-controller"` | |
| config.disableGatewayAPI | bool | `false` | |
| config.enableHTTP2 | bool | `false` | |
| config.execADCTimeout | string | `"15s"` | |
| config.kubernetes.defaultIngressClass | bool | `false` | |
| config.kubernetes.ingressClass | string | `"apisix"` | |
| config.leaderElection.disable | bool | `false` | |
| config.leaderElection.id | string | `"apisix-ingress-controller-leader"` | |
| config.leaderElection.leaseDuration | string | `"15s"` | |
| config.leaderElection.renewDeadline | string | `"10s"` | |
| config.leaderElection.retryPeriod | string | `"2s"` | |
| config.listenerPortMatchMode | string | `"auto"` | |
| config.logLevel | string | `"info"` | |
| config.metricsAddr | string | `":8080"` | |
| config.probeAddr | string | `":8081"` | |
| config.provider.initSyncDelay | string | `"20m"` | |
| config.provider.syncPeriod | string | `"1m"` | |
| config.provider.type | string | `"apisix"` | |
| config.secureMetrics | bool | `false` | |
| deployment.adcContainer | object | `{"config":{"logLevel":"info"},"image":{"repository":"ghcr.io/api7/adc","tag":"0.27.1"}}` | Set adc sidecar container configuration |
| deployment.affinity | object | `{}` | |
| deployment.annotations | object | `{}` | Add annotations to Apache APISIX ingress controller resource |
| deployment.image.pullPolicy | string | `"IfNotPresent"` | |
| deployment.image.repository | string | `"apache/apisix-ingress-controller"` | |
| deployment.image.tag | string | `"2.2.0"` | |
| deployment.imagePullSecrets | list | `[]` | |
| deployment.nodeSelector | object | `{}` | |
| deployment.podAnnotations | object | `{}` | |
| deployment.podSecurityContext | object | `{"fsGroup":2000}` | Set security context for the pod fsGroup: 2000 ensures containers can share Unix socket files via a common group. |
| deployment.replicas | int | `1` | |
| deployment.resources | object | `{}` | Set pod resource requests & limits |
| deployment.tolerations | list | `[]` | |
| deployment.topologySpreadConstraints | list | `[]` | Topology Spread Constraints for pod assignment spread across your cluster among failure-domains ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods |
| fullnameOverride | string | `""` | |
| gatewayProxy.createDefault | bool | `false` | Controls whether to create a default GatewayProxy custom resource. |
| gatewayProxy.provider | object | `{"controlPlane":{"auth":{"adminKey":{"value":"edd1c9f034335f136f87ad84b625c8f1","valueFrom":{}},"type":"AdminKey"},"endpoints":[],"service":{"name":"","port":9180}},"pluginMetadata":{},"plugins":[],"type":"ControlPlane"}` | Configuration for the GatewayProxy provider connection |
| gatewayProxy.provider.controlPlane | object | `{"auth":{"adminKey":{"value":"edd1c9f034335f136f87ad84b625c8f1","valueFrom":{}},"type":"AdminKey"},"endpoints":[],"service":{"name":"","port":9180}}` | ControlPlane provider specific configuration Either `endpoints` or `service` must be specified, but not both. |
| gatewayProxy.provider.controlPlane.auth | object | `{"adminKey":{"value":"edd1c9f034335f136f87ad84b625c8f1","valueFrom":{}},"type":"AdminKey"}` | Authentication configuration for control plane connection |
| gatewayProxy.provider.controlPlane.auth.adminKey | object | `{"value":"edd1c9f034335f136f87ad84b625c8f1","valueFrom":{}}` | AdminKey authentication configuration. Either `value` or `valueFrom` must be specified, but not both. |
| gatewayProxy.provider.controlPlane.auth.adminKey.value | string | `"edd1c9f034335f136f87ad84b625c8f1"` | The admin key value for authentication. |
| gatewayProxy.provider.controlPlane.auth.adminKey.valueFrom | object | `{}` | Reference to admin key stored in a Kubernetes Secret |
| gatewayProxy.provider.controlPlane.auth.type | string | `AdminKey` | Authentication type. Only `AdminKey` is currently supported. |
| gatewayProxy.provider.controlPlane.endpoints | list | `[]` | List of APISIX control plane Admin API endpoints. example: ["http://apisix-admin.default.svc.cluster.local:9180"] |
| gatewayProxy.provider.controlPlane.service | object | `{"name":"","port":9180}` | Alternatively, reference a Kubernetes Service for the APISIX Admin API. |
| gatewayProxy.provider.pluginMetadata | object | `{}` | Global plugin metadata shared by all instances of the same plugin. |
| gatewayProxy.provider.plugins | list | `[]` | List of global plugins to be enabled on the GatewayProxy. |
| gatewayProxy.provider.type | string | `"ControlPlane"` | Specifies the provider type for the GatewayProxy. |
| labelsOverride | object | `{}` | Override default labels assigned to Apache APISIX ingress controller resource |
| nameOverride | string | `""` | Default values for apisix-ingress-controller. This is a YAML-formatted file. Declare variables to be passed into your templates. |
| podDisruptionBudget | object | `{"enabled":false,"maxUnavailable":1,"minAvailable":"90%"}` | See https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more details |
| podDisruptionBudget.enabled | bool | `false` | Enable or disable podDisruptionBudget |
| podDisruptionBudget.maxUnavailable | int | `1` | Set the maxUnavailable of podDisruptionBudget |
| podDisruptionBudget.minAvailable | string | `"90%"` | Set the `minAvailable` of podDisruptionBudget. You can specify only one of `maxUnavailable` and `minAvailable` in a single PodDisruptionBudget. See [Specifying a Disruption Budget for your Application](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget) for more details |
| serviceMonitor.annotations | object | `{}` | @param serviceMonitor.annotations ServiceMonitor annotations |
| serviceMonitor.enabled | bool | `false` | Enable or disable ServiceMonitor |
| serviceMonitor.interval | string | `"15s"` | @param serviceMonitor.interval Interval at which metrics should be scraped |
| serviceMonitor.labels | object | `{}` | @param serviceMonitor.labels ServiceMonitor extra labels |
| serviceMonitor.metricRelabelings | object | `{}` | @param serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples before ingestion. ref: https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs |
| serviceMonitor.namespace | string | `"monitoring"` | @param serviceMonitor.namespace Namespace in which to create the ServiceMonitor |
| webhook.certificate.provided | bool | `false` | Set to true if you want to provide your own certificate |
| webhook.enabled | bool | `true` | Enable or disable admission webhook |
| webhook.failurePolicy | string | `"Ignore"` | Failure policy for the webhook (Fail or Ignore) |
| webhook.port | int | `9443` | The port for the webhook server to listen on |
| webhook.timeoutSeconds | int | `10` | Timeout in seconds for the webhook |