apisix

#

# Licensed to the Apache Software Foundation (ASF) under one or more

# contributor license agreements. See the NOTICE file distributed with

# this work for additional information regarding copyright ownership.

# The ASF licenses this file to You under the Apache License, Version 2.0

# (the "License"); you may not use this file except in compliance with

# the License. You may obtain a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

global:

# e.g.

# imagePullSecrets:

# - my-registry-secrets

# - other-registry-secrets

# -- Global Docker registry secret names as an array

imagePullSecrets: []

image:

# -- Apache APISIX image repository

repository: chainreg.biz/chainguard-private/apache-apisix

# -- Apache APISIX image pull policy

pullPolicy: IfNotPresent

# -- Apache APISIX image tag

# Overrides the image tag whose default is the chart appVersion.

tag: 3.19.0-r1@sha256:4ffc3c314e15e13c1e6cfe5f30cf6e4b9ea118460af9d65294c16599bf87cccd

# -- set false to use `Deployment`, set true to use `DaemonSet`

useDaemonSet: false

# -- if useDaemonSet is true or autoscaling.enabled is true, replicaCount not become effective

replicaCount: 1

# -- Set [priorityClassName](https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/#pod-priority) for Apache APISIX pods

priorityClassName: ""

# -- Annotations to add to each pod

podAnnotations: {}

# -- Labels to add to each pod

podLabels: {}

# -- Set the securityContext for Apache APISIX pods

podSecurityContext: {}

# fsGroup: 2000

# -- Number of seconds Kubernetes waits for Apache APISIX to terminate gracefully

terminationGracePeriodSeconds: 30

# -- Set the securityContext for Apache APISIX container

securityContext: {}

# capabilities:

# drop:

# - ALL

# readOnlyRootFilesystem: true

# runAsNonRoot: true

# runAsUser: 1000

# -- Lifecycle hooks for the Apache APISIX container

lifecycle:

preStop:

exec:

command:

- /bin/sh

- -c

- "sleep 30"

# -- See https://kubernetes.io/docs/tasks/run-application/configure-pdb/ for more details

podDisruptionBudget:

# -- Enable or disable podDisruptionBudget

enabled: false

# -- Set the `minAvailable` of podDisruptionBudget. You can specify only one of `maxUnavailable` and `minAvailable` in a single PodDisruptionBudget.

# See [Specifying a Disruption Budget for your Application](https://kubernetes.io/docs/tasks/run-application/configure-pdb/#specifying-a-poddisruptionbudget)

# for more details

minAvailable: 90%

# -- Set the maxUnavailable of podDisruptionBudget

maxUnavailable: 1

# -- Set pod resource requests & limits

resources: {}

# We usually recommend not to specify default resources and to leave this as a conscious

# choice for the user. This also increases chances charts run on environments with little

# resources, such as Minikube. If you do want to specify resources, uncomment the following

# lines, adjust them as necessary, and remove the curly braces after 'resources:'.

# limits:

# cpu: 100m

# memory: 128Mi

# requests:

# cpu: 100m

# memory: 128Mi

# -- Use the host's network namespace

hostNetwork: false

# -- Node labels for Apache APISIX pod assignment

nodeSelector: {}

# -- List of node taints to tolerate

tolerations: []

# -- Set affinity for Apache APISIX deploy

affinity: {}

# -- Topology Spread Constraints for pod assignment spread across your cluster among failure-domains

# ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/#spread-constraints-for-pods

topologySpreadConstraints: []

# -- timezone is the timezone where apisix uses.

# For example: "UTC" or "Asia/Shanghai"

# This value will be set on apisix container's environment variable TZ.

# You may need to set the timezone to be consistent with your local time zone,

# otherwise the apisix's logs may used to retrieve event maybe in wrong timezone.

timezone: ""

# -- extraEnvVars An array to add extra env vars

# e.g:

# extraEnvVars:

# - name: FOO

# value: "bar"

# - name: FOO2

# valueFrom:

# secretKeyRef:

# name: SECRET_NAME

# key: KEY

extraEnvVars: []

# -- Update strategy of the workload (Deployment or DaemonSet), e.g. `type: RollingUpdate`

updateStrategy: {}

# type: RollingUpdate

# -- Additional Kubernetes resources to deploy with the release.

extraDeploy: []

# -- Additional `volume`, See [Kubernetes Volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the detail.

extraVolumes: []

# - name: extras

# emptyDir: {}

# -- Additional `volumeMounts` for the APISIX container, See [Kubernetes Volumes](https://kubernetes.io/docs/concepts/storage/volumes/) for the detail.

extraVolumeMounts: []

# - name: extras

# mountPath: /usr/share/extras

# readOnly: true

# -- Additional `initContainers`, See [Kubernetes initContainers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) for the detail.

extraInitContainers: []

# - name: init-myservice

# image: busybox:1.28

# command: ['sh', '-c', "until nslookup myservice.$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace).svc.cluster.local; do echo waiting for myservice; sleep 2; done"]

# -- Additional `containers`, See [Kubernetes containers](https://kubernetes.io/docs/concepts/containers/) for the detail.

extraContainers: []

initContainer:

# -- Init container image

image: chainreg.biz/chainguard-private/netcat

# -- Init container tag

tag: 1.238-r1@sha256:b961470bd7a9a1ece5f8bf51b2accd244cebc7a83767ab08da80821e403eb140

autoscaling:

# -- Enable HorizontalPodAutoscaler for APISIX (only when useDaemonSet is false)

enabled: false

# -- HPA version, the value is "v2" or "v2beta1", default "v2"

version: v2

# -- Minimum number of APISIX replicas

minReplicas: 1

# -- Maximum number of APISIX replicas

maxReplicas: 100

# -- Target average CPU utilization percentage that triggers scaling

targetCPUUtilizationPercentage: 80

# -- Target average memory utilization percentage that triggers scaling

targetMemoryUtilizationPercentage: 80

# -- String to partially override the chart fullname

nameOverride: ""

# -- String to fully override the chart fullname

fullnameOverride: ""

serviceAccount:

# -- Whether a ServiceAccount should be created for the APISIX pods

create: false

# -- Annotations to add to the ServiceAccount

annotations: {}

# -- Name of the ServiceAccount to use. If not set and create is true, a name is generated from the chart fullname

name: ""

rbac:

# -- Whether RBAC resources (ClusterRole and ClusterRoleBinding) should be created

create: false

service:

# -- Apache APISIX service type for user access itself

type: NodePort

# -- Setting how the Service route external traffic.

# If you want to keep the client source IP, you can set this to Local,

# ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip

externalTrafficPolicy: Cluster

# type: LoadBalancer

# annotations:

# service.beta.kubernetes.io/aws-load-balancer-type: nlb

# -- IPs for which nodes in the cluster will also accept traffic for the service

externalIPs: []

# -- Apache APISIX service settings for http

http:

# -- Enable plain HTTP listeners

enabled: true

# -- Kubernetes service port for HTTP traffic

servicePort: 80

# -- Container port APISIX listens on for HTTP traffic

containerPort: 9080

# -- (number) Bind the APISIX HTTP container port to a host port.

hostPort:

# -- Support multiple http ports, See [Configuration](https://github.com/apache/apisix/blob/0bc65ea9acd726f79f80ae0abd8f50b7eb172e3d/conf/config-default.yaml#L24)

additionalContainerPorts: []

# - port: 9081

# enable_http2: true # If not set, the default value is `false`.

# - ip: 127.0.0.2 # Specific IP, If not set, the default value is `0.0.0.0`.

# port: 9082

# enable_http2: true

# -- Apache APISIX service settings for tls

tls:

# -- Kubernetes service port for HTTPS traffic

servicePort: 443

# nodePort: 4443

# -- Apache APISIX service settings for stream. L4 proxy (TCP/UDP)

stream:

# -- Enable the stream (L4 proxy) subsystem

enabled: false

# -- TCP proxy port list, element format: port number, or a map with `addr` and optional `tls` / `tls_passthrough`

tcp: []

# -- UDP proxy port list

udp: []

# - secretName: apisix-tls

# hosts:

# - chart-example.local

# -- Override default labels assigned to Apache APISIX gateway resources

labelsOverride: {}

# labelsOverride:

# app.kubernetes.io/name: "{{ .Release.Name }}"

# app.kubernetes.io/instance: '{{ include "apisix.name" . }}'

# -- Using ingress access Apache APISIX service

ingress:

# -- Enable an Ingress resource in front of the APISIX service

enabled: false

# -- (number) Service port to send traffic. Defaults to `service.http.servicePort`.

servicePort:

# -- Ingress annotations

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: "true"

# -- Ingress host and path rules

hosts:

- host: apisix.local

paths: []

# -- Ingress TLS settings

tls: []

control:

# -- Enable Control API

enabled: true

service:

# -- Control annotations

annotations: {}

# -- Control service type

type: ClusterIP

# loadBalancerIP: a.b.c.d

# loadBalancerSourceRanges:

# - "143.231.0.0/16"

# -- IPs for which nodes in the cluster will also accept traffic for the servic

externalIPs: []

# -- NodePort (only if control.service.type is NodePort)

# nodePort: 32000

# -- which ip to listen on for Apache APISIX Control API

ip: "127.0.0.1"

# -- which port to use for Apache APISIX Control API

port: 9090

# -- Service port to use for Apache APISIX Control API

servicePort: 9090

# -- Using ingress access Apache APISIX Control service

ingress:

# -- Enable an Ingress resource in front of the Control API service

enabled: false

# -- Ingress annotations

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: "true"

# -- Ingress Class Name

# className: "nginx"

# -- Ingress host and path rules

hosts:

- host: apisix-control.local

paths:

- "/*"

# -- Ingress TLS settings

tls: []

# - secretName: apisix-tls

# hosts:

# - chart-example.local

# -- Observability configuration.

metrics:

serviceMonitor:

# -- Enable or disable Apache APISIX serviceMonitor

enabled: false

# -- namespace where the serviceMonitor is deployed, by default, it is the same as the namespace of the apisix

namespace: ""

# -- name of the serviceMonitor, by default, it is the same as the apisix fullname

name: ""

# -- interval at which metrics should be scraped

interval: 15s

# -- @param serviceMonitor.labels ServiceMonitor extra labels

labels: {}

# -- @param serviceMonitor.annotations ServiceMonitor annotations

annotations: {}

apisix:

# -- Enable nginx IPv6 resolver

enableIPv6: true

# -- Enable HTTP/2 on the HTTP listeners

enableHTTP2: true

# -- Whether the APISIX version number should be shown in Server header

enableServerTokens: true

# -- When true, the upstream status is always written to the `X-APISIX-Upstream-Status` response header; when false, it is written only for 5xx responses

showUpstreamStatusInResponseHeader: false

# -- PROXY Protocol configuration.

proxyProtocol:

# -- (int) The HTTP port that accepts the PROXY Protocol. It differs from `service.http` ports and `apisix.admin` port:

# this port only accepts HTTP requests carrying the PROXY Protocol, while the other ports only accept plain HTTP

# requests. If you enable the PROXY Protocol, you must use this port to receive HTTP requests with it.

# When set, the port is also exposed on the gateway Service.

listenHttpPort:

# -- (int) The nodePort of the PROXY Protocol HTTP port, only used if service.type is NodePort.

# If not set, a random port will be assigned by Kubernetes.

listenHttpNodePort:

# -- (int) The HTTPS port that accepts the PROXY Protocol.

# When set, the port is also exposed on the gateway Service.

listenHttpsPort:

# -- (int) The nodePort of the PROXY Protocol HTTPS port, only used if service.type is NodePort.

# If not set, a random port will be assigned by Kubernetes.

listenHttpsNodePort:

# -- Accept the PROXY Protocol on every service.stream.tcp port.

enableTcpPP: false

# -- Send the PROXY Protocol to the upstream server on every service.stream.tcp port.

enableTcpPPToUpstream: false

# -- Proxy caching configuration used by the proxy-cache plugin.

proxyCache:

# -- The default caching time in disk if the upstream does not specify the cache time

cacheTtl: 10s

# -- The parameters of a cache. The `memory_size` field stores the cache index for the

# disk strategy and the cache content for the memory strategy; `disk_size`, `disk_path`

# and `cache_levels` only apply to the disk strategy.

zones:

- name: disk_cache_one

memory_size: 50m

disk_size: 1G

disk_path: "/tmp/disk_cache_one"

cache_levels: "1:2"

- name: memory_cache

memory_size: 50m

graphql:

# -- The maximum size in bytes of GraphQL queries APISIX parses when matching routes by GraphQL attributes (default 1MiB)

maxSize: 1048576

# -- Delete the '/' at the end of the URI

deleteURITailSlash: false

# -- The URI normalization in servlet is a little different from the RFC's.

# See https://github.com/jakartaee/servlet/blob/master/spec/src/main/asciidoc/servlet-spec-body.adoc#352-uri-path-canonicalization,

# which is used under Tomcat.

# Turn this option on if you want to be compatible with servlet when matching URI path.

normalizeURILikeServlet: false

# -- fine tune the parameters of LRU cache for some features like secret

lru:

secret:

# -- TTL in seconds for cached secret values

ttl: 300

# -- Maximum number of cached secret values

count: 512

# -- TTL in seconds for cached negative (failed lookup) results

neg_ttl: 60

# -- Maximum number of cached negative (failed lookup) results

neg_count: 512

# -- Enable comprehensive request lifecycle tracing (SSL/SNI, rewrite, access, header_filter, body_filter, and log).

# When disabled, OpenTelemetry collects only a single span per request.

tracing: false

# -- Use Pod metadata.uid as the APISIX id.

setIDFromPodUID: false

# -- Whether to add a custom lua module

luaModuleHook:

# -- Enable loading a custom lua module hook

enabled: false

# -- extend lua_package_path to load third party code

luaPath: ""

# -- the hook module which will be used to inject third party code into APISIX

# use the lua require style like: "module.say_hello"

hookPoint: ""

# -- configmap that stores the codes

configMapRef:

# -- Name of the ConfigMap where the lua module codes store

name: ""

# mounts decides how to mount the codes to the container.

mounts:

# -- Name of the ConfigMap key, for setting the mapping relationship between ConfigMap key and the lua module code path.

- key: ""

# -- Filepath of the plugin code, for setting the mapping relationship between ConfigMap key and the lua module code path.

path: ""

ssl:

# -- Enable HTTPS listeners

enabled: false

# -- Container port APISIX listens on for HTTPS traffic

containerPort: 9443

# -- (number) Bind the APISIX HTTPS container port to a host port.

hostPort:

# -- Support multiple https ports, See [Configuration](https://github.com/apache/apisix/blob/0bc65ea9acd726f79f80ae0abd8f50b7eb172e3d/conf/config-default.yaml#L99)

additionalContainerPorts: []

# - ip: 127.0.0.3 # Specific IP, If not set, the default value is `0.0.0.0`.

# port: 9445

# enable_http3: true

# -- Specifies the name of Secret contains trusted CA certificates in the PEM format used to verify the certificate when APISIX needs to do SSL/TLS handshaking with external services (e.g. etcd)

existingCASecret: ""

# -- Filename be used in the apisix.ssl.existingCASecret

certCAFilename: ""

# -- Enable HTTP/3 (QUIC) on the HTTPS listeners

enableHTTP3: false

# -- TLS protocols allowed to use.

sslProtocols: "TLSv1.2 TLSv1.3"

# -- TLS ciphers allowed to use.

sslCiphers: "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"

# -- Enable or disable TLS session tickets. Disabled by default because session tickets

# defeat Perfect Forward Secrecy (see https://github.com/mozilla/server-side-tls/issues/135)

sslSessionTickets: false

# -- Define SNI to fallback if none is presented by client

fallbackSNI: ""

router:

# -- Defines how apisix handles routing:

# - radixtree_uri: match route by uri(base on radixtree)

# - radixtree_host_uri: match route by host + uri(base on radixtree)

# - radixtree_uri_with_parameter: match route by uri with parameters

http: radixtree_host_uri

fullCustomConfig:

# -- Enable full customized config.yaml

enabled: false

# -- If apisix.fullCustomConfig.enabled is true, full customized config.yaml.

# Please note that other settings about APISIX config will be ignored

config: {}

deployment:

# -- Apache APISIX deployment mode

# Optional: traditional, decoupled, standalone

#

# ref: https://apisix.apache.org/docs/apisix/deployment-modes/

mode: traditional

# -- Deployment role

# Optional: traditional, data_plane, control_plane

#

# ref: https://apisix.apache.org/docs/apisix/deployment-modes/

role: "traditional"

role_traditional:

# -- Config provider for the traditional role. enum: etcd, yaml

config_provider: "etcd"

# -- Standalone rules configuration

#

# ref: https://apisix.apache.org/docs/apisix/deployment-modes/#standalone

standalone:

# -- Rules which are set to the default apisix.yaml configmap.

# If apisix.delpoyment.standalone.existingConfigMap is empty, these are used.

config: |

routes:

-

uri: /hi

upstream:

nodes:

"127.0.0.1:1980": 1

type: roundrobin

# -- Specifies the name of the ConfigMap that contains the rule configurations.

# The configuration must be set to the key named `apisix.yaml` in the configmap.

existingConfigMap: ""

admin:

# -- Enable Admin API

enabled: true

# -- Enable Embedded Admin UI

enable_admin_ui: true

# -- admin service type

type: ClusterIP

# loadBalancerIP: a.b.c.d

# loadBalancerSourceRanges:

# - "143.231.0.0/16"

# -- IPs for which nodes in the cluster will also accept traffic for the servic

externalIPs: []

# -- which ip to listen on for Apache APISIX admin API. Set to `"[::]"` when on IPv6 single stack

ip: 0.0.0.0

# -- which port to use for Apache APISIX admin API

port: 9180

# -- Service port to use for Apache APISIX admin API

servicePort: 9180

# -- Admin API support CORS response headers

cors: true

# -- Admin API credentials

credentials:

# -- Apache APISIX admin API admin role credentials

admin: edd1c9f034335f136f87ad84b625c8f1

# -- Apache APISIX admin API viewer role credentials

viewer: 4054f7cf07e344346cd3f287985e76a2

# -- The APISIX Helm chart supports storing user credentials in a secret.

# The secret needs to contain two keys, admin and viewer, with their respective values set.

secretName: ""

# -- Name of the admin role key in the secret, overrides the default key name "admin"

secretAdminKey: ""

# -- Name of the viewer role key in the secret, overrides the default key name "viewer"

secretViewerKey: ""

allow:

# -- The client IP CIDR allowed to access Apache APISIX Admin API service.

ipList:

- 127.0.0.1/24

# -- Using ingress access Apache APISIX admin service

ingress:

# -- Enable an Ingress resource in front of the Admin API service

enabled: false

# -- Ingress annotations

annotations: {}

# kubernetes.io/ingress.class: nginx

# kubernetes.io/tls-acme: "true"

# -- Ingress host and path rules

hosts:

- host: apisix-admin.local

paths:

- "/apisix"

# -- Ingress TLS settings

tls: []

# - secretName: apisix-tls

# hosts:

# - chart-example.local

nginx:

# -- The number of files a worker process can open, should be larger than apisix.nginx.workerConnections

workerRlimitNofile: "20480"

# -- The maximum number of connections that each worker process can open

workerConnections: "10620"

# -- The number of nginx worker processes. `auto` means the number of CPU cores

workerProcesses: auto

# -- Bind nginx worker processes to CPUs

enableCPUAffinity: true

# -- Timeout for a graceful shutdown of worker processes

workerShutdownTimeout: "240s"

# -- Maximum number of pending timers. Increase it if you see "too many pending timers" error

maxPendingTimers: 16384

# -- Maximum number of running timers. Increase it if you see "lua_max_running_timers are not enough" error

maxRunningTimers: 4096

# -- Timeout during which a keep-alive client connection will stay open on the server side.

keepaliveTimeout: 60s

# -- List of environment variable names allowed to be accessed within nginx (rendered as nginx `env` directives)

envs: []

# -- Nginx HTTP subsystem configurations

http:

# -- timeout for reading client request header, then 408 (Request Time-out) error is returned to the client

clientHeaderTimeout: "60s"

# -- timeout for reading client request body, then 408 (Request Time-out) error is returned to the client

clientBodyTimeout: "60s"

# -- timeout for transmitting a response to the client, then the connection is closed

sendTimeout: "10s"

# -- The maximum allowed size of the client request body.

# If exceeded, the 413 (Request Entity Too Large) error is returned to the client.

# Note that unlike Nginx, we don't limit the body size by default (0 means no limit).

clientMaxBodySize: 0

# -- Enable the use of underscores in client request header fields

underscoresInHeaders: "on"

# -- The request header used to determine the client's real IP address,

# see [real_ip_header](http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header)

realIpHeader: "X-Real-IP"

# -- Whether to search for the real IP recursively when the header set in apisix.nginx.http.realIpHeader contains multiple addresses,

# see [real_ip_recursive](http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive)

realIpRecursive: "off"

# -- Trusted addresses from which the real IP header is honored,

# see [set_real_ip_from](http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from)

realIpFrom:

- 127.0.0.1

- "unix:"

# -- Enables or disables passing of the server name through TLS Server Name Indication extension (SNI, RFC 6066)

# when establishing a connection with the proxied HTTPS server

proxySslServerName: true

# -- Keepalive settings for connections from APISIX to upstream servers

upstream:

# -- Maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process.

# When this number is exceeded, the least recently used connections are closed

keepalive: 320

# -- Maximum number of requests that can be served through one keepalive connection.

# After the maximum number of requests is made, the connection is closed

keepaliveRequests: 1000

# -- Timeout during which an idle keepalive connection to an upstream server will stay open

keepaliveTimeout: 60s

# -- The charset added to the "Content-Type" response header field,

# see [charset](http://nginx.org/en/docs/http/ngx_http_charset_module.html#charset)

charset: utf-8

# -- The maximum size of the nginx variables hash table

variablesHashMaxSize: 2048

# access log and error log configuration

logs:

# -- Enable access log or not, default true

enableAccessLog: true

# -- Access log path

accessLog: "/dev/stdout"

# -- Access log format

accessLogFormat: '$remote_addr - $remote_user [$time_local] $http_host \"$request\" $status $body_bytes_sent $request_time \"$http_referer\" \"$http_user_agent\" $upstream_addr $upstream_status $upstream_response_time \"$upstream_scheme://$upstream_host$upstream_uri\"'

# -- Allows setting json or default characters escaping in variables

accessLogFormatEscape: default

# -- Error log path

errorLog: "/dev/stderr"

# -- Error log level

errorLogLevel: "warn"

# -- Stream (L4 proxy) access log configuration

stream:

# -- Enable stream access log or not, default false

enableAccessLog: false

# -- Stream access log path

accessLog: "logs/access_stream.log"

# -- Stream access log format

accessLogFormat: '$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time'

# -- Allows setting json or default characters escaping in variables for stream

accessLogFormatEscape: default

# -- Custom nginx configuration snippets injected into the generated nginx.conf.

# As arbitrary configuration can be added here, it is your responsibility to make sure

# the snippets don't conflict with the configuration generated by APISIX.

configurationSnippet:

# -- Snippet added to the nginx `main` (top-level) block

main: ""

# -- Snippet added to the beginning of the nginx `http` block

httpStart: ""

# -- Snippet added to the end of the nginx `http` block

httpEnd: ""

# -- Snippet added to the nginx `server` block that proxies regular traffic

httpSrv: ""

# -- Snippet added to the nginx `server` block that serves the Admin API

httpAdmin: ""

# -- Snippet added to the nginx `stream` block

stream: ""

# -- Add custom [lua_shared_dict](https://github.com/openresty/lua-nginx-module?tab=readme-ov-file#lua_shared_dict) settings,

# click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict

customLuaSharedDicts: []

# - name: foo

# size: 10k

# - name: bar

# size: 1m

# -- Override default [lua_shared_dict](https://github.com/apache/apisix/blob/master/conf/config.yaml.example#L250-L276) settings,

# click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict

luaSharedDicts: []

# - name: prometheus-metrics

# size: 20m

# -- Override default meta-level [lua_shared_dict](https://github.com/apache/apisix/blob/master/conf/config.yaml.example) settings,

# meta-level shared dicts are shared across both HTTP and stream subsystems.

# Since APISIX 3.16.0, `upstream-healthcheck` is a meta-level shared dict.

# click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict

metaLuaSharedDicts: []

# - name: upstream-healthcheck

# size: 10m

discovery:

# -- Enable or disable Apache APISIX integration service discovery

enabled: false

# -- Service discovery registry. Refer to [configuration under discovery](https://github.com/apache/apisix/blob/master/conf/config.yaml.example#L307) for example.

# Also see [example of using external service discovery](https://apisix.apache.org/docs/ingress-controller/1.8.0/tutorials/external-service-discovery/).

registry: {}

# Integration service discovery registry. E.g eureka\dns\nacos\consul_kv

# reference:

# https://apisix.apache.org/docs/apisix/discovery/#configuration-for-eureka

# https://apisix.apache.org/docs/apisix/discovery/dns/#service-discovery-via-dns

# https://apisix.apache.org/docs/apisix/discovery/consul_kv/#configuration-for-consul-kv

# https://apisix.apache.org/docs/apisix/discovery/nacos/#configuration-for-nacos

# https://apisix.apache.org/docs/apisix/discovery/kubernetes/#configuration

#

# an eureka example:

# ```

# eureka:

# host:

# - "http://${username}:${password}@${eureka_host1}:${eureka_port1}"

# - "http://${username}:${password}@${eureka_host2}:${eureka_port2}"

# prefix: "/eureka/"

# fetch_interval: 30

# weight: 100

# timeout:

# connect: 2000

# send: 2000

# read: 5000

# ```

#

# the minimal Kubernetes example:

# ```

# kubernetes: {}

# ```

#

# The prerequisites for the above minimal Kubernetes example:

# 1. [Optional] Set `.serviceAccount.create` to `true` to create a dedicated ServiceAccount.

# It is recommended to do so, otherwise the default ServiceAccount "default" will be used.

# 2. [Required] Set `.rbac.create` to `true` to create and bind the necessary RBAC resources.

# This grants the ServiceAccount in use to List-Watch Kubernetes Endpoints resources.

# 3. [Required] Include the following environment variables in `.nginx.envs` to pass them into

# nginx worker processes (https://nginx.org/en/docs/ngx_core_module.html#env):

# - KUBERNETES_SERVICE_HOST

# - KUBERNETES_SERVICE_PORT

# This is for allowing the default `host` and `port` of `.discovery.registry.kubernetes.service`.

dns:

# -- Nameservers used by APISIX to resolve upstream domain names.

# When empty (default), nameservers are read from `/etc/resolv.conf`,

# which is usually what you want inside Kubernetes

resolvers: []

# - 127.0.0.1

# - 8.8.8.8

# -- Override the TTL in seconds of valid DNS records

validity: 30

# -- DNS resolver timeout in seconds

timeout: 5

# -- Honor the `search` option in `/etc/resolv.conf` when resolving domain names

enableResolvSearchOpt: true

vault:

# -- Enable or disable the vault integration

enabled: false

# -- The host address where the vault server is running.

host: ""

# -- HTTP timeout for each request.

timeout: 10

# -- The generated token from vault instance that can grant access to read data from the vault.

token: ""

# -- Prefix allows you to better enforcement of policies.

prefix: ""

prometheus:

# -- Enable Prometheus metrics. ref: https://apisix.apache.org/docs/apisix/plugins/prometheus/

enabled: false

# -- path of the metrics endpoint

path: /apisix/prometheus/metrics

# -- prefix of the metrics

metricPrefix: apisix_

# -- container port where the metrics are exposed

containerPort: 9091

# -- Customize the list of APISIX plugins to enable. By default, APISIX's [default plugins](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua#L196) are automatically used.

plugins: []

# -- Customize the list of APISIX stream_plugins to enable. By default, APISIX's [default stream_plugins](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua#L294) are automatically used.

stream_plugins: []

# -- Set APISIX plugin attributes. By default, APISIX's [plugin_attr](https://github.com/apache/apisix/blob/master/apisix/cli/config.lua#L295) are automatically used.

# See [configuration example](https://github.com/apache/apisix/blob/master/conf/config.yaml.example#L591).

pluginAttrs: {}

extPlugin:

# -- Enable External Plugins. See [external plugin](https://apisix.apache.org/docs/apisix/next/external-plugin/)

enabled: false

# -- the command and its arguements to run as a subprocess

cmd: ["/path/to/apisix-plugin-runner/runner", "run"]

wasm:

# -- Enable Wasm Plugins. See [wasm plugin](https://apisix.apache.org/docs/apisix/next/wasm/)

enabled: false

# -- List of Wasm plugins, each item with `name`, `priority` and `file` (path or URL of the wasm binary)

plugins: []

# -- customPlugins allows you to mount your own HTTP plugins.

customPlugins:

# -- Whether to configure some custom plugins

enabled: false

# -- the lua_path that tells APISIX where it can find plugins,

# note the last ';' is required.

luaPath: "/opts/custom_plugins/?.lua"

plugins:

# -- plugin name.

- name: "plugin-name"

# -- plugin attrs

attrs: {}

# -- plugin codes can be saved inside configmap object.

configMap:

# -- name of configmap.

name: "configmap-name"

# -- since keys in configmap is flat, mountPath allows to define the mount

# path, so that plugin codes can be mounted hierarchically.

mounts:

- key: "the-file-name"

path: "mount-path"

status:

# -- The IP address on which the status endpoint (`/status`, `/status/ready`) listens

ip: "0.0.0.0"

# -- The port on which the status endpoint listens

port: 7085

# -- When configured, APISIX will trust the `X-Forwarded-*` Headers passed in requests from the IP/CIDR in the list.

trustedAddresses:

- 127.0.0.1

# -- external etcd configuration. If etcd.enabled is false, these configuration will be used.

externalEtcd:

# -- if etcd.enabled is false, use external etcd, support multiple address, if your etcd cluster enables TLS, please use https scheme, e.g. https://127.0.0.1:2379.

host:

# host or ip e.g. http://172.20.128.89:2379

- http://etcd.host:2379

# -- if etcd.enabled is false, user for external etcd. Set empty to disable authentication

user: root

# -- if etcd.enabled is true, use etcd.auth.rbac.rootPassword instead.

# -- if etcd.enabled is false and externalEtcd.existingSecret is not empty, the password should store in the corresponding secret

# -- if etcd.enabled is false and externalEtcd.existingSecret is empty, externalEtcd.password is the passsword for external etcd.

password: ""

# -- if externalEtcd.existingSecret is the name of secret containing the external etcd password

existingSecret: ""

# -- externalEtcd.secretPasswordKey Key inside the secret containing the external etcd password

secretPasswordKey: "etcd-root-password"

# -- etcd configuration

# use the FQDN address or the IP of the etcd

etcd:

# -- install built-in etcd by default, set false if do not want to install built-in etcd together,

# this etcd is based on bitnamilegacy/etcd helm chart and latest bitnami docker image, only for development and testing purposes,

# if you want to use etcd in production, we recommend you to install etcd by yourself and use `externalEtcd` to connect it.

enabled: true

# -- docker image for built-in etcd

image:

registry: docker.io

repository: bitnamilegacy/etcd

# -- `bitnamilegacy/etcd` only provide `latest` tag now, ref: https://github.com/bitnami/containers/issues/83267,

# you can switch `etcd.image.repository` to `bitnamilegacy/etcd` to use old versioned tags.

tag: latest

# -- apisix configurations prefix

prefix: "/apisix"

# -- Set the timeout value in seconds for subsequent socket operations from apisix to etcd cluster

timeout: 30

# -- Set the timeout value in seconds for watching etcd

watchTimeout: 50

# -- The number of retries to etcd during startup

startupRetry: 2

# -- if etcd.enabled is true, set more values of bitnamilegacy/etcd helm chart

auth:

rbac:

# -- No authentication by default. Switch to enable RBAC authentication

create: false

# -- root password for etcd. Requires etcd.auth.rbac.create to be true.

rootPassword: ""

tls:

# -- enable etcd client certificate

enabled: false

# -- name of the secret contains etcd client cert

existingSecret: ""

# -- etcd client cert filename using in etcd.auth.tls.existingSecret

certFilename: ""

# -- etcd client cert key filename using in etcd.auth.tls.existingSecret

certKeyFilename: ""

# -- whether to verify the etcd endpoint certificate when setup a TLS connection to etcd

verify: true

# -- specify the TLS Server Name Indication extension, the ETCD endpoint hostname will be used when this setting is unset.

sni: ""

# -- ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

# -- added for backward compatibility with old kubernetes versions, as seccompProfile is not supported in kubernetes < 1.19

containerSecurityContext:

enabled: false

service:

# -- etcd client service port

port: 2379

# -- Number of etcd replicas, only used when etcd.enabled is true

replicaCount: 3

# -- Auto compaction retention for mvcc key value store, only used when etcd.enabled is true

autoCompactionRetention: "1h"

# -- Auto compaction mode (periodic or revision), only used when etcd.enabled is true

autoCompactionMode: "periodic"

# -- Ingress controller configuration

ingress-controller:

# -- Enable the apisix-ingress-controller sub-chart

enabled: false

webhook:

# Specifies whether to enable the validation webhook.

# Note: This feature relies on the '/apisix/admin/configs/validate' endpoint.

# It requires APISIX version 3.17.0 or later to function correctly.

# Ensure your cluster's APISIX deployment meets this version requirement before enabling.

enabled: false