Sachkov-Aleksandr commented on issue #9381:
URL: https://github.com/apache/apisix/issues/9381#issuecomment-1525524505
Below my APISIX configmap
`apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "apisix.fullname" . }}
namespace: {{ .Values.namespace }}
data:
config.yaml: |-
apisix: # universal configurations
enable_heartbeat: true
enable_admin: true
enable_admin_cors: true
enable_debug: true
enable_dev_mode: false # Sets nginx
worker_processes to 1 if set to true
enable_reuseport: true # Enable nginx
SO_REUSEPORT switch if set to true.
enable_ipv6: false # Enable nginx IPv6 resolver
enable_server_tokens: false # Whether the APISIX version number
should be shown in Server header
proxy_cache: # Proxy Caching configuration
cache_ttl: 10s # The default caching time if
the upstream does not specify the cache time
zones: # The parameters of a cache
- name: disk_cache_one # The name of the cache,
administrator can be specify
# which cache to use by name in the
admin api
memory_size: 50m # The size of shared memory,
it's used to store the cache index
disk_size: 1G # The size of disk, it's used to
store the cache data
disk_path: "/tmp/disk_cache_one" # The path to store the cache
data
cache_levels: "1:2" # The hierarchy levels of a cache
router:
http: radixtree_uri # radixtree_uri: match route by uri(base on
radixtree)
# radixtree_host_uri: match route by host +
uri(base on radixtree)
# radixtree_uri_with_parameter: match route
by uri with parameters
ssl: 'radixtree_sni' # radixtree_sni: match route by
SNI(base on radixtree)
dns_resolver_valid: 30
resolver_timeout: 5
ssl:
enable: true
listen:
- port: 9443
enable_http2: true
ssl_protocols: "TLSv1.2 TLSv1.3"
ssl_ciphers:
"ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
ssl_trusted_certificate: "/usr/local/apisix/conf/ssl/ca.crt"
ssl_verify_depth: 2
nginx_config: # config for render the template to genarate nginx.conf
error_log: "/dev/stderr"
error_log_level: "error" # warn,error
worker_processes: "auto"
enable_cpu_affinity: true
worker_rlimit_nofile: 20480 # the number of files a worker process
can open, should be larger than worker_connections
event:
worker_connections: 10620
http:
enable_access_log: true
access_log: "/dev/stdout"
access_log_format: '$remote_addr - $remote_user [$time_local]
$http_host \"$request\" $status $body_bytes_sent $request_time
\"$http_referer\" \"$http_user_agent\" $upstream_addr $upstream_status
$upstream_response_time \"$upstream_scheme://$upstream_host$upstream_uri\"'
access_log_format_escape: default
keepalive_timeout: 60s # timeout during which a keep-alive
client connection will stay open on the server side.
client_header_timeout: 60s # timeout for reading client request
header, then 408 (Request Time-out) error is returned to the client
client_body_timeout: 60s # timeout for reading client request
body, then 408 (Request Time-out) error is returned to the client
send_timeout: 10s # timeout for transmitting a
response to the client.then the connection is closed
underscores_in_headers: "on" # default enables the use of
underscores in client request header fields
real_ip_header: "X-Real-IP" #
http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header
real_ip_from: #
http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from
- 127.0.0.1
- 'unix:'
discovery:
plugins: # plugin list
- api-breaker
- authz-keycloak
- basic-auth
- batch-requests
- body-transformer
- consumer-restriction
- cors
- echo
- fault-injection
- file-logger
- grpc-transcode
- grpc-web
- hmac-auth
- http-logger
- ip-restriction
- ua-restriction
- jwt-auth
- kafka-logger
- key-auth
- limit-conn
- limit-count
- limit-req
- node-status
- openid-connect
- authz-casbin
- prometheus
- proxy-cache
- proxy-mirror
- proxy-rewrite
- redirect
- referer-restriction
- request-id
- request-validation
- response-rewrite
- serverless-post-function
- serverless-pre-function
- sls-logger
- syslog
- tcp-logger
- udp-logger
- uri-blocker
- wolf-rbac
- zipkin
- traffic-split
- gzip
- real-ip
- ext-plugin-pre-req
- ext-plugin-post-req
stream_plugins:
- mqtt-proxy
- ip-restriction
- limit-conn
deployment:
role: control_plane
role_control_plane:
config_provider: etcd
conf_server:
listen: 0.0.0.0:9280
cert: "/conf-server-ssl/tls.crt"
cert_key: "/conf-server-ssl/tls.key"
client_ca_cert: "/conf-ca-ssl/ca.crt"
admin:
allow_admin: #
http://nginx.org/en/docs/http/ngx_http_access_module.html#allow
- 0.0.0.0/0
# - "::/64"
admin_listen:
ip: 0.0.0.0
port: 9180
admin_key:
# admin: can everything for configuration data
- name: "admin"
key: edd1c9f034335f136f87ad84b625c8f1
role: admin
# viewer: only can view configuration data
- name: "viewer"
key: 4054f7cf07e344346cd3f287985e76a2
role: viewer
etcd:
host: # it's possible to define multiple
etcd hosts addresses of the same etcd cluster.
- "https://etcd.apisix.svc.cluster.local:2379"; #
multiple etcd address
prefix: "/apisix" # configuration prefix in etcd
timeout: 30 # 30 seconds
tls:
cert: "/etcd-ssl/tls.crt"
key: "/etcd-ssl/tls.key"
verify: true
sni: "etcd.apisix.svc.cluster.local"
certs:
cert: "/conf-client-ssl/tls.crt"
cert_key: "/conf-client-ssl/tls.key"
trusted_ca_cert: "/conf-ca-ssl/ca.crt"
`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
