chore: upgrade api7 and gateway to v3.10.7

charts/api7/Chart.yaml

@@ -17,13 +17,13 @@ type: application
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's
 # own counter on that line and is decoupled from the app patch (see appVersion).
-version: 3.10.9
+version: 3.10.10
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "3.10.6"
+appVersion: "3.10.7"
 
 maintainers:
   - name: API7

charts/api7/README.md

@@ -1,6 +1,6 @@
 # api7ee3
 
-![Version: 3.10.9](https://img.shields.io/badge/Version-3.10.9-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.10.6](https://img.shields.io/badge/AppVersion-3.10.6-informational?style=flat-square)
+![Version: 3.10.10](https://img.shields.io/badge/Version-3.10.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.10.7](https://img.shields.io/badge/AppVersion-3.10.7-informational?style=flat-square)
 
 A Helm chart for Kubernetes
 
@@ -29,7 +29,7 @@ A Helm chart for Kubernetes
 | dashboard.extraVolumes | list | `[]` |  |
 | dashboard.image.pullPolicy | string | `"Always"` |  |
 | dashboard.image.repository | string | `"api7/api7-ee-3-integrated"` |  |
-| dashboard.image.tag | string | `"v3.10.6"` |  |
+| dashboard.image.tag | string | `"v3.10.7"` |  |
 | dashboard.keyCertSecret | string | `""` |  |
 | dashboard.livenessProbe.failureThreshold | int | `30` |  |
 | dashboard.livenessProbe.initialDelaySeconds | int | `180` |  |
@@ -43,7 +43,6 @@ A Helm chart for Kubernetes
 | dashboard.replicaCount | int | `1` |  |
 | dashboard.topologySpreadConstraints | list | `[]` | Topology Spread Constraints for pod assignment https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ The value is evaluated as a template |
 | dashboard_configuration.audit.retention_days | int | `60` |  |
-| dashboard_configuration.console.addr | string | `"http://127.0.0.1:3000"` |  |
 | dashboard_configuration.console.hybrid_mode | bool | `false` | hybrid_mode hides the license and core-quota UI, for deployments where the license is operated for the user rather than by them. |
 | dashboard_configuration.console.sentry | object | `{"dsn":"","enabled":false,"release":""}` | sentry configures the console's browser error reporting. |
 | dashboard_configuration.consumer_proxy.cache_failure_count | int | `512` |  |
@@ -125,7 +124,7 @@ A Helm chart for Kubernetes
 | developer_portal.extraVolumes | list | `[]` |  |
 | developer_portal.image.pullPolicy | string | `"Always"` |  |
 | developer_portal.image.repository | string | `"api7/api7-ee-developer-portal"` |  |
-| developer_portal.image.tag | string | `"v3.10.6"` |  |
+| developer_portal.image.tag | string | `"v3.10.7"` |  |
 | developer_portal.keyCertSecret | string | `""` |  |
 | developer_portal.livenessProbe.failureThreshold | int | `10` |  |
 | developer_portal.livenessProbe.initialDelaySeconds | int | `60` |  |
@@ -171,13 +170,14 @@ A Helm chart for Kubernetes
 | developer_portal_service.ingress.tls | list | `[]` |  |
 | developer_portal_service.port | int | `4321` |  |
 | developer_portal_service.type | string | `"ClusterIP"` |  |
+| dp_manager.advertiseFromPodIP | bool | `false` | Advertise each replica's own pod IP for diagnostic agent sessions, injected from the downward API. Not needed in the ordinary case: the address is already derived from the connection the agent arrived on. Turn it on where that derivation is wrong -- notably a service mesh whose sidecar re-originates the inbound connection, which leaves the derived address a loopback one. |
 | dp_manager.extraEnvVars | list | `[]` |  |
 | dp_manager.extraInitContainers | list | `[]` |  |
 | dp_manager.extraVolumeMounts | list | `[]` |  |
 | dp_manager.extraVolumes | list | `[]` |  |
 | dp_manager.image.pullPolicy | string | `"Always"` |  |
 | dp_manager.image.repository | string | `"api7/api7-ee-dp-manager"` |  |
-| dp_manager.image.tag | string | `"v3.10.6"` |  |
+| dp_manager.image.tag | string | `"v3.10.7"` |  |
 | dp_manager.livenessProbe.failureThreshold | int | `10` |  |
 | dp_manager.livenessProbe.initialDelaySeconds | int | `60` |  |
 | dp_manager.livenessProbe.periodSeconds | int | `3` |  |
@@ -249,7 +249,7 @@ A Helm chart for Kubernetes
 | file_server.extraVolumes | list | `[]` |  |
 | file_server.image.pullPolicy | string | `"Always"` |  |
 | file_server.image.repository | string | `"api7/api7-ee-file-server"` |  |
-| file_server.image.tag | string | `"v3.10.6"` |  |
+| file_server.image.tag | string | `"v3.10.7"` |  |
 | file_server.livenessProbe.failureThreshold | int | `10` |  |
 | file_server.livenessProbe.initialDelaySeconds | int | `60` |  |
 | file_server.livenessProbe.periodSeconds | int | `3` |  |

charts/api7/templates/dp-manager-configmap.yaml

@@ -1,3 +1,23 @@
+{{- /*
+  Every replica reads this one ConfigMap, so a fixed advertised address makes
+  them all name the same instance. The diagnostic agent console is then routed
+  to whichever one that is, and every request for an agent held by a different
+  replica answers 404 with nothing in any log to say why. Leave it unset: the
+  address is derived per instance from the connection the agent arrived on,
+  which is the pod IP.
+*/ -}}
+{{- /*
+  Only the host has to differ per replica. A port set here is the same for all
+  of them and is correct, which is why advertiseFromPodIP covers the host
+  alone: host from the downward API, port from this file, is a supported
+  multi-replica shape.
+*/ -}}
+{{- $advertise := (.Values.dp_manager_configuration.server).advertise -}}
+{{- if and $advertise $advertise.host -}}
+{{- if and (gt (int .Values.dp_manager.replicaCount) 1) (not .Values.dp_manager.advertiseFromPodIP) -}}
+{{- fail "dp_manager_configuration.server.advertise.host cannot be used with dp_manager.replicaCount > 1: this ConfigMap is shared, so every replica would advertise the same host. Leave it unset (each instance derives its own address), or set dp_manager.advertiseFromPodIP=true to take the host per pod from the downward API." -}}
+{{- end -}}
+{{- end -}}
 kind: ConfigMap
 apiVersion: v1
 metadata:

charts/api7/templates/dp-manager-deploy.yaml

@@ -101,6 +101,15 @@ spec:
             {{- toYaml .Values.resources | nindent 12 }}
             {{- end }}
           env:
+          {{- if .Values.dp_manager.advertiseFromPodIP }}
+          # Each replica advertises its own address for diagnostic agent
+          # sessions. The ConfigMap cannot do this -- every replica reads the
+          # same one -- so it comes from the downward API.
+            - name: API7_DP_MANAGER_ADVERTISE_HOST
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+          {{- end }}
           {{- if .Values.dp_manager.extraEnvVars }}
           {{- include "api7ee3.tplvalues.render" (dict "value" .Values.dp_manager.extraEnvVars "context" $) | nindent 12 }}
           {{- end }}

charts/api7/values.yaml

@@ -18,7 +18,7 @@ dashboard:
     repository: api7/api7-ee-3-integrated
     pullPolicy: Always
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "v3.10.6"
+    tag: "v3.10.7"
   # Resources of the deployment.
   # It has a higher priority than the common resources configuration:
   # when this field is configured, it is used first in the deployment,
@@ -57,7 +57,7 @@ dp_manager:
     repository: api7/api7-ee-dp-manager
     pullPolicy: Always
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "v3.10.6"
+    tag: "v3.10.7"
   # Resources of the deployment.
   # It has a higher priority than the common resources configuration:
   # when this field is configured, it is used first in the deployment,
@@ -75,6 +75,13 @@ dp_manager:
   extraVolumeMounts: []
   extraInitContainers: []
   podLabels: {}
+  # -- Advertise each replica's own pod IP for diagnostic agent sessions,
+  # injected from the downward API. Not needed in the ordinary case: the
+  # address is already derived from the connection the agent arrived on. Turn
+  # it on where that derivation is wrong -- notably a service mesh whose
+  # sidecar re-originates the inbound connection, which leaves the derived
+  # address a loopback one.
+  advertiseFromPodIP: false
   # -- Topology Spread Constraints for pod assignment
   # https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
   # The value is evaluated as a template
@@ -96,7 +103,7 @@ file_server:
   image:
     repository: api7/api7-ee-file-server
     pullPolicy: Always
-    tag: "v3.10.6"
+    tag: "v3.10.7"
 
   extraEnvVars: []
   extraVolumes: []
@@ -120,7 +127,7 @@ developer_portal:
     repository: api7/api7-ee-developer-portal
     pullPolicy: Always
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "v3.10.6"
+    tag: "v3.10.7"
 
   extraEnvVars: []
   extraVolumes: []
@@ -427,7 +434,6 @@ dashboard_configuration:
       - "/api/v1/series"
       - "/api/v1/labels"
   console:
-    addr: "http://127.0.0.1:3000"
     # -- hybrid_mode hides the license and core-quota UI, for deployments where
     # the license is operated for the user rather than by them.
     hybrid_mode: false
@@ -519,6 +525,18 @@ dp_manager_configuration:
       enable: true
       host: "127.0.0.1"
       port: 6060
+    # -- How this dp-manager instance names itself to the other instances, for
+    # diagnostic agent sessions. Leave unset: the address is derived per
+    # instance from the connection the agent arrived on, which is the pod IP.
+    # This ConfigMap is shared by every replica, so a fixed value would make
+    # them all advertise the same address -- setting it with replicaCount > 1
+    # is refused at render time. The dashboard reaches that address directly,
+    # bypassing the Service, so a cluster with default-deny egress needs a
+    # NetworkPolicy allowing dashboard pods to reach dp-manager pods on the
+    # TLS port.
+    # advertise:
+    #   host: ""
+    #   port: ""
   log:
     # -- Allowed values: `debug`, `info`, `warn`, `error`
     level: warn

charts/gateway/Chart.yaml

@@ -16,12 +16,12 @@ type: application
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's
 # own counter on that line and is decoupled from the app patch (see appVersion).
-version: 3.10.13
+version: 3.10.14
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: "3.10.6"
+appVersion: "3.10.7"
 
 maintainers:
   - name: API7

charts/gateway/README.md

@@ -158,7 +158,7 @@ apisix:
 | apisix.httpRouter | string | `"radixtree_host_uri"` | Defines how apisix handles routing: - radixtree_uri: match route by uri(base on radixtree) - radixtree_host_uri: match route by host + uri(base on radixtree) - radixtree_uri_with_parameter: match route by uri with parameters |
 | apisix.image.pullPolicy | string | `"Always"` | API7 Gateway image pull policy |
 | apisix.image.repository | string | `"api7/api7-ee-3-gateway"` | API7 Gateway image repository |
-| apisix.image.tag | string | `"3.10.6"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. |
+| apisix.image.tag | string | `"3.10.7"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. |
 | apisix.kind | string | `"Deployment"` | Use a `DaemonSet` or `Deployment` |
 | apisix.lru | object | `{"secret":{"count":512,"neg_count":512,"neg_ttl":60,"ttl":300}}` | fine tune the parameters of LRU cache for some features like secret |
 | apisix.lru.secret.count | int | `512` | Maximum number of cached secret values |

charts/gateway/templates/configmap.yaml

@@ -90,6 +90,9 @@ data:
           {{- if hasKey . "tls" }}
             tls: {{ .tls }}
           {{- end }}
+          {{- if hasKey . "tls_passthrough" }}
+            tls_passthrough: {{ .tls_passthrough }}
+          {{- end }}
           {{- if hasKey . "proxy_protocol" }}
             proxy_protocol: {{ .proxy_protocol }}
           {{- end }}

charts/gateway/values.yaml

@@ -205,7 +205,7 @@ apisix:
     pullPolicy: Always
     # -- API7 Gateway image tag
     # Overrides the image tag whose default is the chart appVersion.
-    tag: 3.10.6
+    tag: 3.10.7
 
   # -- Use a `DaemonSet` or `Deployment`
   kind: Deployment
@@ -477,6 +477,18 @@ gateway:
       #   proxy_protocol: true              # accept the PROXY protocol on this port only
       #   proxy_protocol_to_upstream: true  # send the PROXY protocol to the upstream on this port only;
       #                                     # both override the global apisix.proxyProtocol.enableTcpPP* defaults
+      # - addr: 9500
+      #   tls_passthrough: true   # forward the TLS stream untouched, picking the upstream from the SNI in the
+      #                           # prereaded ClientHello. The backend terminates the handshake, so
+      #                           # payload-inspecting stream plugins (mqtt-proxy, xrpc, redis) and client
+      #                           # certificate verification do not apply. Every connection on this port is
+      #                           # passed through, whatever the stream_route says.
+      # - addr: 9501
+      #   tls: true               # both flags open a mixed port: the listen only prereads, and each connection
+      #   tls_passthrough: true   # follows `tls_passthrough` on the stream_route it matches (default false).
+      #                           # Costs one internal hop, so prefer a dedicated tls_passthrough port when the
+      #                           # whole port passes through. proxy_protocol_to_upstream is rejected on a mixed
+      #                           # port -- use a dedicated listen instead.
     udp: []
       # - addr: 192.168.31.10:53
       # - addr: 5353