Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update to apisix 3.9.1 and enable etcd port in ingress-controller if using etcd adapter #761

Closed
wants to merge 4 commits into from
Closed

Update to apisix 3.9.1 and enable etcd port in ingress-controller if using etcd adapter #761

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d427db4
Update to apisix 3.9.1 and enable service for etcd adapter in apisix-…
gamer22026 Jun 6, 2024
846c5fe
Use enableHTTP2 as variable to match what apisix helm chart uses
gamer22026 Jun 6, 2024
86d2840
Revert update apisix-ingress-controller chart version in apisix chart
gamer22026 Jun 7, 2024
fd0cf13
Don't need http2 if apisix running as control plane only
gamer22026 Jun 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions charts/apisix-ingress-controller/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,8 @@ keywords:
- nginx
- crd
type: application
version: 0.14.0
appVersion: 1.8.0
version: 0.14.1
appVersion: 1.8.2
sources:
- https://github.com/apache/apisix-helm-chart

Expand Down
1 change: 0 additions & 1 deletion charts/apisix-ingress-controller/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,6 @@ The same for container level, you need to set:
| gateway.tls.enabled | bool | `false` | |
| gateway.tls.existingCASecret | string | `""` | Specifies the name of Secret contains trusted CA certificates in the PEM format used to verify the certificate when APISIX needs to do SSL/TLS handshaking with external services (e.g. etcd) |
| gateway.tls.fallbackSNI | string | `""` | Define SNI to fallback if none is presented by client |
| gateway.tls.http2.enabled | bool | `true` | |
| gateway.tls.servicePort | int | `443` | |
| gateway.tls.sslProtocols | string | `"TLSv1.2 TLSv1.3"` | TLS protocols allowed to use. |
| gateway.type | string | `"NodePort"` | Apache APISIX service type for user access itself |
Expand Down
1 change: 0 additions & 1 deletion charts/apisix-ingress-controller/templates/apisix-configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,6 @@ data:
enable: {{ .Values.gateway.tls.enabled }}
listen:
- port: {{ .Values.gateway.tls.containerPort }}
enable_http2: {{ .Values.gateway.tls.http2.enabled }}
{{- with .Values.gateway.tls.additionalContainerPorts }}
{{- toYaml . | nindent 10}}
{{- end }}
Expand Down
6 changes: 6 additions & 0 deletions charts/apisix-ingress-controller/templates/service.yaml
View file
Open in desktop
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The service change is unnecessary, as the container is embedded in the same pod/network namespace. This change exposes the insecure port to the rest of the cluster, which is not what you want.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm trying to implement the architecture diagrammed here: https://static.apiseven.com/apisix-webp/uploads/2023/10/24/UbKWYGar_APISIX-Ingress-4.webp but what I ended up with using the latest helm chart was the ingress controller/with embedded apisix running as the control plane, and a separate pod cluster running apisix as the data plane. (which is why I was exposing the service port so the apisix pods running the data plane had an etcd to connect to). Is there something I missed in the helm config to get the ingress controllers to embed both the apisix control plane and the data plane together as the diagram shows?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The composite architecture using the same pod has been implemented for a while. Your current changes doesn't have a separate pod running apisix, AFAICT. Using a separate pod is problematic anyway, as it means that you have to reinvent security between etcd and apisix.

Original file line number Diff line number Diff line change
Expand Up @@ -28,5 +28,11 @@ spec:
targetPort: {{ (.Values.config.httpListen | split ":")._1 }}
protocol: TCP
name: http
{{- if .Values.config.etcdserver.enabled }}
- port: 12379
targetPort: 12379
protocol: TCP
name: etcd
{{- end }}
selector:
{{- include "apisix-ingress-controller.selectorLabels" . | nindent 4 }}
5 changes: 1 addition & 4 deletions charts/apisix-ingress-controller/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ config:
pullPolicy: IfNotPresent
# -- Apache APISIX image tag
# Overrides the image tag whose default is the chart appVersion.
tag: 3.5.0-debian
tag: 3.9.1-debian
# -- the error log level, default is info, optional values are: debug, info, warn, error, panic, fatal
logLevel: "info"
# -- the output file path of error log, default is stderr, when
Expand Down Expand Up @@ -263,13 +263,10 @@ gateway:
additionalContainerPorts: []
# - ip: 127.0.0.3 # Specific IP, If not set, the default value is `0.0.0.0`.
# port: 9445
# enable_http2: true
# -- Specifies the name of Secret contains trusted CA certificates in the PEM format used to verify the certificate when APISIX needs to do SSL/TLS handshaking with external services (e.g. etcd)
existingCASecret: ""
# -- Filename be used in the gateway.tls.existingCASecret
certCAFilename: ""
http2:
enabled: true
# -- TLS protocols allowed to use.
sslProtocols: "TLSv1.2 TLSv1.3"
# -- Define SNI to fallback if none is presented by client
Expand Down
Loading