wbsong111
3d3d508d04
hardened-containers가 apisix 3.17 라인 EOL로 3.18.0을 게이트 PASS로 새로 발행했다
(hardened-containers 커밋 3518f98: "3.17 line went EOL"). 이게 이 카탈로그의
차트 버전 갱신 트리거다 — appVersion을 3.18로 맞추려면 차트도 2.17.0(appVersion
3.18.0)으로 올려야 한다.
breaking_change_check: breaking=false. 다만 자동 diff가 못 잡는 실제 변경을
수동으로 하나 찾았다 — ingress-controller.enabled=true로 켜서 쓰는
apisix-ingress-controller 서브차트(1.2.0→1.3.0)에 새 CRD
l4routepolicies.apisix.apache.org가 추가됐다. helm_diff는 이 서브차트를 기본값
(off)으로만 렌더링해 애초에 스캔 대상에서 빠뜨린다 — CUSTOM-README.md에 수동
적용 안내를 남기고, 이 사각지대 자체를 catalog-update-pipeline SKILL.md에
기록해 다음 리뷰 때 놓치지 않게 했다.
catalog/image-map/{apisix,apisix-ingress-controller,adc}.env의 CHART_DIRS를
2.17.0으로 교체(2.16.0은 동결)하고, apply-published-tags.py로 발행된 실제 태그
(apisix 3.18.0-20260826, ingress-controller/adc는 최근 재스캔 리빌드분)를 반영했다.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
105 lines
3.4 KiB
Go Template
105 lines
3.4 KiB
Go Template
# Apache APISIX ingress controller
|
|
|
|
[APISIX Ingress controller](https://github.com/apache/apisix-ingress-controller/) for Kubernetes using Apache APISIX as a high performance reverse proxy and load balancer.
|
|
|
|
If you have installed multiple ingress controller, add the `kubernetes.io/ingress.class: apisix` annotation to your Ingress resources.
|
|
|
|
This chart bootstraps an apisix-ingress-controller deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager.
|
|
|
|
## Prerequisites
|
|
|
|
Apisix ingress controller requires Kubernetes version 1.16+.
|
|
|
|
## Get Repo Info
|
|
|
|
```console
|
|
helm repo add apisix https://apache.github.io/apisix-helm-chart
|
|
helm repo update
|
|
```
|
|
|
|
## Install Chart
|
|
|
|
**Important:** only helm3 is supported
|
|
|
|
```console
|
|
helm install [RELEASE_NAME] apisix/apisix-ingress-controller --namespace ingress-apisix --create-namespace
|
|
```
|
|
|
|
The command deploys apisix-ingress-controller on the Kubernetes cluster in the default configuration.
|
|
|
|
_See [configuration](#configuration) below._
|
|
|
|
_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._
|
|
|
|
## Uninstall Chart
|
|
|
|
```console
|
|
helm uninstall [RELEASE_NAME] --namespace ingress-apisix
|
|
```
|
|
|
|
This removes all the Kubernetes components associated with the chart and deletes the release.
|
|
|
|
_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._
|
|
|
|
## Upgrading Chart
|
|
|
|
```console
|
|
helm upgrade [RELEASE_NAME] [CHART] --install
|
|
```
|
|
|
|
_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._
|
|
|
|
## Configuration
|
|
|
|
See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). To see all configurable options with detailed comments, visit the chart's [values.yaml](./values.yaml), or run these configuration commands:
|
|
|
|
```console
|
|
helm show values apisix/apisix-ingress-controller
|
|
```
|
|
|
|
### Pod priority
|
|
|
|
`priorityClassName` field referenced a name of a created `PriorityClass` object. Check [here](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption) for more details.
|
|
|
|
### Security context
|
|
|
|
A security context provides us with a way to define privilege and access control for a Pod or even at the container level.
|
|
|
|
Check [here](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#securitycontext-v1-core) to see the SecurityContext resource with more detail.
|
|
|
|
Check also [here](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) to see a full explanation and some examples to configure the security context.
|
|
|
|
Right below you have an example of the security context configuration. In this case, we define that all the processes in the container will run with user ID 1000.
|
|
|
|
```yaml
|
|
...
|
|
|
|
spec:
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 3000
|
|
...
|
|
```
|
|
|
|
The same for the group definition, where we define the primary group of 3000 for all processes.
|
|
|
|
**It's quite important to know, if the `runAsGroup` is omited, the primary group will be root(0)**, which in some cases goes against some security policies.
|
|
|
|
To define this configuration at the **pod level**, you need to set:
|
|
|
|
```yaml
|
|
--set podSecurityContext.runAsUser=«VALUE»
|
|
--set podSecurityContext.runAsGroup=«VALUE»
|
|
...
|
|
```
|
|
|
|
The same for container level, you need to set:
|
|
|
|
```yaml
|
|
--set securityContext.runAsUser=«VALUE»
|
|
--set SecurityContext.runAsGroup=«VALUE»
|
|
...
|
|
```
|
|
|
|
{{ template "chart.valuesSection" . }}
|