diff --git a/charts/api7/Chart.yaml b/charts/api7/Chart.yaml index 7fd8e572..f9fd5da4 100644 --- a/charts/api7/Chart.yaml +++ b/charts/api7/Chart.yaml @@ -17,13 +17,13 @@ type: application # Versions are expected to follow Semantic Versioning (https://semver.org/) # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's # own counter on that line and is decoupled from the app patch (see appVersion). -version: 3.10.9 +version: 3.10.10 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "3.10.6" +appVersion: "3.10.7" maintainers: - name: API7 diff --git a/charts/api7/README.md b/charts/api7/README.md index ecfdfc65..67155d61 100644 --- a/charts/api7/README.md +++ b/charts/api7/README.md @@ -1,6 +1,6 @@ # api7ee3 -![Version: 3.10.9](https://img.shields.io/badge/Version-3.10.9-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.10.6](https://img.shields.io/badge/AppVersion-3.10.6-informational?style=flat-square) +![Version: 3.10.10](https://img.shields.io/badge/Version-3.10.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.10.7](https://img.shields.io/badge/AppVersion-3.10.7-informational?style=flat-square) A Helm chart for Kubernetes @@ -29,7 +29,7 @@ A Helm chart for Kubernetes | dashboard.extraVolumes | list | `[]` | | | dashboard.image.pullPolicy | string | `"Always"` | | | dashboard.image.repository | string | `"api7/api7-ee-3-integrated"` | | -| dashboard.image.tag | string | `"v3.10.6"` | | +| dashboard.image.tag | string | `"v3.10.7"` | | | dashboard.keyCertSecret | string | `""` | | | dashboard.livenessProbe.failureThreshold | int | `30` | | | dashboard.livenessProbe.initialDelaySeconds | int | `180` | | @@ -43,7 +43,6 @@ A Helm chart for Kubernetes | dashboard.replicaCount | int | `1` | | | dashboard.topologySpreadConstraints | list | `[]` | Topology Spread Constraints for pod assignment https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ The value is evaluated as a template | | dashboard_configuration.audit.retention_days | int | `60` | | -| dashboard_configuration.console.addr | string | `"http://127.0.0.1:3000"` | | | dashboard_configuration.console.hybrid_mode | bool | `false` | hybrid_mode hides the license and core-quota UI, for deployments where the license is operated for the user rather than by them. | | dashboard_configuration.console.sentry | object | `{"dsn":"","enabled":false,"release":""}` | sentry configures the console's browser error reporting. | | dashboard_configuration.consumer_proxy.cache_failure_count | int | `512` | | @@ -125,7 +124,7 @@ A Helm chart for Kubernetes | developer_portal.extraVolumes | list | `[]` | | | developer_portal.image.pullPolicy | string | `"Always"` | | | developer_portal.image.repository | string | `"api7/api7-ee-developer-portal"` | | -| developer_portal.image.tag | string | `"v3.10.6"` | | +| developer_portal.image.tag | string | `"v3.10.7"` | | | developer_portal.keyCertSecret | string | `""` | | | developer_portal.livenessProbe.failureThreshold | int | `10` | | | developer_portal.livenessProbe.initialDelaySeconds | int | `60` | | @@ -171,13 +170,14 @@ A Helm chart for Kubernetes | developer_portal_service.ingress.tls | list | `[]` | | | developer_portal_service.port | int | `4321` | | | developer_portal_service.type | string | `"ClusterIP"` | | +| dp_manager.advertiseFromPodIP | bool | `false` | Advertise each replica's own pod IP for diagnostic agent sessions, injected from the downward API. Not needed in the ordinary case: the address is already derived from the connection the agent arrived on. Turn it on where that derivation is wrong -- notably a service mesh whose sidecar re-originates the inbound connection, which leaves the derived address a loopback one. | | dp_manager.extraEnvVars | list | `[]` | | | dp_manager.extraInitContainers | list | `[]` | | | dp_manager.extraVolumeMounts | list | `[]` | | | dp_manager.extraVolumes | list | `[]` | | | dp_manager.image.pullPolicy | string | `"Always"` | | | dp_manager.image.repository | string | `"api7/api7-ee-dp-manager"` | | -| dp_manager.image.tag | string | `"v3.10.6"` | | +| dp_manager.image.tag | string | `"v3.10.7"` | | | dp_manager.livenessProbe.failureThreshold | int | `10` | | | dp_manager.livenessProbe.initialDelaySeconds | int | `60` | | | dp_manager.livenessProbe.periodSeconds | int | `3` | | @@ -249,7 +249,7 @@ A Helm chart for Kubernetes | file_server.extraVolumes | list | `[]` | | | file_server.image.pullPolicy | string | `"Always"` | | | file_server.image.repository | string | `"api7/api7-ee-file-server"` | | -| file_server.image.tag | string | `"v3.10.6"` | | +| file_server.image.tag | string | `"v3.10.7"` | | | file_server.livenessProbe.failureThreshold | int | `10` | | | file_server.livenessProbe.initialDelaySeconds | int | `60` | | | file_server.livenessProbe.periodSeconds | int | `3` | | diff --git a/charts/api7/templates/dp-manager-configmap.yaml b/charts/api7/templates/dp-manager-configmap.yaml index fc8ad6d2..a42901d9 100644 --- a/charts/api7/templates/dp-manager-configmap.yaml +++ b/charts/api7/templates/dp-manager-configmap.yaml @@ -1,3 +1,23 @@ +{{- /* + Every replica reads this one ConfigMap, so a fixed advertised address makes + them all name the same instance. The diagnostic agent console is then routed + to whichever one that is, and every request for an agent held by a different + replica answers 404 with nothing in any log to say why. Leave it unset: the + address is derived per instance from the connection the agent arrived on, + which is the pod IP. +*/ -}} +{{- /* + Only the host has to differ per replica. A port set here is the same for all + of them and is correct, which is why advertiseFromPodIP covers the host + alone: host from the downward API, port from this file, is a supported + multi-replica shape. +*/ -}} +{{- $advertise := (.Values.dp_manager_configuration.server).advertise -}} +{{- if and $advertise $advertise.host -}} +{{- if and (gt (int .Values.dp_manager.replicaCount) 1) (not .Values.dp_manager.advertiseFromPodIP) -}} +{{- fail "dp_manager_configuration.server.advertise.host cannot be used with dp_manager.replicaCount > 1: this ConfigMap is shared, so every replica would advertise the same host. Leave it unset (each instance derives its own address), or set dp_manager.advertiseFromPodIP=true to take the host per pod from the downward API." -}} +{{- end -}} +{{- end -}} kind: ConfigMap apiVersion: v1 metadata: diff --git a/charts/api7/templates/dp-manager-deploy.yaml b/charts/api7/templates/dp-manager-deploy.yaml index 9135daed..c2bd9efb 100644 --- a/charts/api7/templates/dp-manager-deploy.yaml +++ b/charts/api7/templates/dp-manager-deploy.yaml @@ -101,6 +101,15 @@ spec: {{- toYaml .Values.resources | nindent 12 }} {{- end }} env: + {{- if .Values.dp_manager.advertiseFromPodIP }} + # Each replica advertises its own address for diagnostic agent + # sessions. The ConfigMap cannot do this -- every replica reads the + # same one -- so it comes from the downward API. + - name: API7_DP_MANAGER_ADVERTISE_HOST + valueFrom: + fieldRef: + fieldPath: status.podIP + {{- end }} {{- if .Values.dp_manager.extraEnvVars }} {{- include "api7ee3.tplvalues.render" (dict "value" .Values.dp_manager.extraEnvVars "context" $) | nindent 12 }} {{- end }} diff --git a/charts/api7/values.yaml b/charts/api7/values.yaml index ddaac82c..5eb2f9a1 100644 --- a/charts/api7/values.yaml +++ b/charts/api7/values.yaml @@ -18,7 +18,7 @@ dashboard: repository: api7/api7-ee-3-integrated pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.10.6" + tag: "v3.10.7" # Resources of the deployment. # It has a higher priority than the common resources configuration: # when this field is configured, it is used first in the deployment, @@ -57,7 +57,7 @@ dp_manager: repository: api7/api7-ee-dp-manager pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.10.6" + tag: "v3.10.7" # Resources of the deployment. # It has a higher priority than the common resources configuration: # when this field is configured, it is used first in the deployment, @@ -75,6 +75,13 @@ dp_manager: extraVolumeMounts: [] extraInitContainers: [] podLabels: {} + # -- Advertise each replica's own pod IP for diagnostic agent sessions, + # injected from the downward API. Not needed in the ordinary case: the + # address is already derived from the connection the agent arrived on. Turn + # it on where that derivation is wrong -- notably a service mesh whose + # sidecar re-originates the inbound connection, which leaves the derived + # address a loopback one. + advertiseFromPodIP: false # -- Topology Spread Constraints for pod assignment # https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ # The value is evaluated as a template @@ -96,7 +103,7 @@ file_server: image: repository: api7/api7-ee-file-server pullPolicy: Always - tag: "v3.10.6" + tag: "v3.10.7" extraEnvVars: [] extraVolumes: [] @@ -120,7 +127,7 @@ developer_portal: repository: api7/api7-ee-developer-portal pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.10.6" + tag: "v3.10.7" extraEnvVars: [] extraVolumes: [] @@ -427,7 +434,6 @@ dashboard_configuration: - "/api/v1/series" - "/api/v1/labels" console: - addr: "http://127.0.0.1:3000" # -- hybrid_mode hides the license and core-quota UI, for deployments where # the license is operated for the user rather than by them. hybrid_mode: false @@ -519,6 +525,18 @@ dp_manager_configuration: enable: true host: "127.0.0.1" port: 6060 + # -- How this dp-manager instance names itself to the other instances, for + # diagnostic agent sessions. Leave unset: the address is derived per + # instance from the connection the agent arrived on, which is the pod IP. + # This ConfigMap is shared by every replica, so a fixed value would make + # them all advertise the same address -- setting it with replicaCount > 1 + # is refused at render time. The dashboard reaches that address directly, + # bypassing the Service, so a cluster with default-deny egress needs a + # NetworkPolicy allowing dashboard pods to reach dp-manager pods on the + # TLS port. + # advertise: + # host: "" + # port: "" log: # -- Allowed values: `debug`, `info`, `warn`, `error` level: warn diff --git a/charts/gateway/Chart.yaml b/charts/gateway/Chart.yaml index ce7c07af..163aa0f3 100644 --- a/charts/gateway/Chart.yaml +++ b/charts/gateway/Chart.yaml @@ -16,12 +16,12 @@ type: application # Versions are expected to follow Semantic Versioning (https://semver.org/) # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's # own counter on that line and is decoupled from the app patch (see appVersion). -version: 3.10.13 +version: 3.10.14 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. -appVersion: "3.10.6" +appVersion: "3.10.7" maintainers: - name: API7 diff --git a/charts/gateway/README.md b/charts/gateway/README.md index 05b78533..ce206cf3 100644 --- a/charts/gateway/README.md +++ b/charts/gateway/README.md @@ -158,7 +158,7 @@ apisix: | apisix.httpRouter | string | `"radixtree_host_uri"` | Defines how apisix handles routing: - radixtree_uri: match route by uri(base on radixtree) - radixtree_host_uri: match route by host + uri(base on radixtree) - radixtree_uri_with_parameter: match route by uri with parameters | | apisix.image.pullPolicy | string | `"Always"` | API7 Gateway image pull policy | | apisix.image.repository | string | `"api7/api7-ee-3-gateway"` | API7 Gateway image repository | -| apisix.image.tag | string | `"3.10.6"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. | +| apisix.image.tag | string | `"3.10.7"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. | | apisix.kind | string | `"Deployment"` | Use a `DaemonSet` or `Deployment` | | apisix.lru | object | `{"secret":{"count":512,"neg_count":512,"neg_ttl":60,"ttl":300}}` | fine tune the parameters of LRU cache for some features like secret | | apisix.lru.secret.count | int | `512` | Maximum number of cached secret values | diff --git a/charts/gateway/templates/configmap.yaml b/charts/gateway/templates/configmap.yaml index 132d94d6..dcaf663e 100644 --- a/charts/gateway/templates/configmap.yaml +++ b/charts/gateway/templates/configmap.yaml @@ -90,6 +90,9 @@ data: {{- if hasKey . "tls" }} tls: {{ .tls }} {{- end }} + {{- if hasKey . "tls_passthrough" }} + tls_passthrough: {{ .tls_passthrough }} + {{- end }} {{- if hasKey . "proxy_protocol" }} proxy_protocol: {{ .proxy_protocol }} {{- end }} diff --git a/charts/gateway/values.yaml b/charts/gateway/values.yaml index 7c8bd26d..a880f437 100644 --- a/charts/gateway/values.yaml +++ b/charts/gateway/values.yaml @@ -205,7 +205,7 @@ apisix: pullPolicy: Always # -- API7 Gateway image tag # Overrides the image tag whose default is the chart appVersion. - tag: 3.10.6 + tag: 3.10.7 # -- Use a `DaemonSet` or `Deployment` kind: Deployment @@ -477,6 +477,18 @@ gateway: # proxy_protocol: true # accept the PROXY protocol on this port only # proxy_protocol_to_upstream: true # send the PROXY protocol to the upstream on this port only; # # both override the global apisix.proxyProtocol.enableTcpPP* defaults + # - addr: 9500 + # tls_passthrough: true # forward the TLS stream untouched, picking the upstream from the SNI in the + # # prereaded ClientHello. The backend terminates the handshake, so + # # payload-inspecting stream plugins (mqtt-proxy, xrpc, redis) and client + # # certificate verification do not apply. Every connection on this port is + # # passed through, whatever the stream_route says. + # - addr: 9501 + # tls: true # both flags open a mixed port: the listen only prereads, and each connection + # tls_passthrough: true # follows `tls_passthrough` on the stream_route it matches (default false). + # # Costs one internal hop, so prefer a dedicated tls_passthrough port when the + # # whole port passes through. proxy_protocol_to_upstream is rejected on a mixed + # # port -- use a dedicated listen instead. udp: [] # - addr: 192.168.31.10:53 # - addr: 5353