This is an automated email from the ASF dual-hosted git repository. shreemaan-abhishek pushed a commit to branch feat/gatewayproxy-cabundle in repository https://gitbox.apache.org/repos/asf/apisix-helm-chart.git
commit 638e02da10b76cf7ae781b9720a7a5048703ecc7 Author: Abhishek Choudhary <[email protected]> AuthorDate: Wed Aug 12 21:28:46 2026 +0545 chore: add GatewayProxy caBundle to ingress-controller CRDs, pin ADC 0.29.0 GatewayProxy grows an optional caBundle on the control plane provider, a PEM-encoded CA used to verify the control plane in place of the system trust store (apache/apisix-ingress-controller#2826). The bundled CRD has to carry the property, otherwise the API server prunes it in a Helm install and the controller never sees it. The bundle reaches the ADC sidecar as caCert, which lands in 0.29.0 (api7/adc#552). Earlier sidecars accept the option and ignore it, so the field would be set while verification still fails. --- charts/apisix-ingress-controller/Chart.yaml | 2 +- charts/apisix-ingress-controller/README.md | 2 +- charts/apisix-ingress-controller/crds/apisixic-crds.yaml | 10 ++++++++++ charts/apisix-ingress-controller/values.yaml | 2 +- 4 files changed, 13 insertions(+), 3 deletions(-) diff --git a/charts/apisix-ingress-controller/Chart.yaml b/charts/apisix-ingress-controller/Chart.yaml index 65c719f..43c45a7 100644 --- a/charts/apisix-ingress-controller/Chart.yaml +++ b/charts/apisix-ingress-controller/Chart.yaml @@ -24,7 +24,7 @@ keywords: - nginx - crd type: application -version: 1.2.2 +version: 1.2.3 appVersion: 2.1.0 sources: - https://github.com/apache/apisix-helm-chart diff --git a/charts/apisix-ingress-controller/README.md b/charts/apisix-ingress-controller/README.md index 5e08b59..9225ed6 100644 --- a/charts/apisix-ingress-controller/README.md +++ b/charts/apisix-ingress-controller/README.md @@ -129,7 +129,7 @@ The same for container level, you need to set: | config.provider.syncPeriod | string | `"1m"` | | | config.provider.type | string | `"apisix"` | | | config.secureMetrics | bool | `false` | | -| deployment.adcContainer | object | `{"config":{"logLevel":"info"},"image":{"repository":"ghcr.io/api7/adc","tag":"0.27.1"}}` | Set adc sidecar container configuration | +| deployment.adcContainer | object | `{"config":{"logLevel":"info"},"image":{"repository":"ghcr.io/api7/adc","tag":"0.29.0"}}` | Set adc sidecar container configuration | | deployment.affinity | object | `{}` | | | deployment.annotations | object | `{}` | Add annotations to Apache APISIX ingress controller resource | | deployment.image.pullPolicy | string | `"IfNotPresent"` | | diff --git a/charts/apisix-ingress-controller/crds/apisixic-crds.yaml b/charts/apisix-ingress-controller/crds/apisixic-crds.yaml index 575d5f0..656f73d 100644 --- a/charts/apisix-ingress-controller/crds/apisixic-crds.yaml +++ b/charts/apisix-ingress-controller/crds/apisixic-crds.yaml @@ -3258,6 +3258,13 @@ spec: - message: adminKey must be specified when type is AdminKey rule: 'self.type == ''AdminKey'' ? has(self.adminKey) : true' + caBundle: + description: |- + CaBundle is a PEM-encoded CA certificate (or bundle) used to verify the + control plane's TLS certificate, in place of the system trust store. + Set it when the control plane uses a self-signed or private CA certificate. + It has no effect when tlsVerify is false. + type: string endpoints: description: Endpoints specifies the list of control plane endpoints. @@ -3296,6 +3303,9 @@ spec: - message: mode is immutable rule: oldSelf == null || (!has(self.mode) && !has(oldSelf.mode)) || self.mode == oldSelf.mode + - message: caBundle must be a PEM-encoded certificate + rule: '!has(self.caBundle) || self.caBundle.contains(''-----BEGIN + CERTIFICATE-----'')' type: description: Type specifies the type of provider. Can only be `ControlPlane`. diff --git a/charts/apisix-ingress-controller/values.yaml b/charts/apisix-ingress-controller/values.yaml index e15438a..e65518b 100644 --- a/charts/apisix-ingress-controller/values.yaml +++ b/charts/apisix-ingress-controller/values.yaml @@ -73,7 +73,7 @@ deployment: adcContainer: image: repository: ghcr.io/api7/adc - tag: "0.27.1" + tag: "0.29.0" config: logLevel: "info"
