shreemaan-abhishek opened a new pull request, #994:
URL: https://github.com/apache/apisix-helm-chart/pull/994
## What this PR does
Paired chart change for apache/apisix-ingress-controller#2826, which adds an
optional `caBundle` to `GatewayProxy.spec.provider.controlPlane` — a
PEM-encoded CA used to verify the control plane in place of the system trust
store, so `tlsVerify: true` can stay on when the control plane uses a
self-signed or private CA.
Two things are needed here for that to work in a normal Helm install:
1. **`crds/apisixic-crds.yaml`** — the bundled CRD must carry the property,
otherwise the API server prunes the unknown field and the controller never
receives it.
2. **`values.yaml`** — the bundle reaches the ADC sidecar as `caCert`, which
lands in **0.29.0** (api7/adc#552). Earlier sidecars accept the option and
silently ignore it, so the field would be set while verification still fails.
Chart `version` goes 1.2.2 -> 1.2.3, following #992. `appVersion` is
unchanged: the controller-side change is not released yet, and the CRD property
is inert without it.
## Changes
- `crds/apisixic-crds.yaml`: `caBundle` on `controlPlane`, plus the CEL rule
that rejects a non-PEM value at admission.
- `values.yaml`: `deployment.adcContainer.image.tag` 0.27.1 -> 0.29.0.
- `Chart.yaml`: `version` 1.2.2 -> 1.2.3.
- `README.md`: regenerated with `make helm-docs`.
## Verification
The CRD edit is not hand-written prose — the property and CEL blocks were
lifted verbatim from `controller-gen` output so the chart cannot drift in
wording or wrapping. Confirmed by parsing both and comparing:
```
provider subtree identical to generated CRD: True
whole GatewayProxy schema identical: True
```
The sidecar bump was exercised against the real image rather than assumed.
Running `ghcr.io/api7/adc:0.29.0` in ingress mode against an HTTPS backend
whose certificate is signed by a private CA, replaying the exact request body
the controller builds:
| request | result |
| --- | --- |
| `tlsSkipVerify: false`, no `caCert` | `Error: unable to verify the first
certificate` |
| `tlsSkipVerify: false` + `caCert` | handshake succeeds, backend's own HTTP
404 surfaces |
Also:
```
helm lint charts/apisix-ingress-controller 1 chart(s) linted, 0 chart(s)
failed
helm template ic charts/apisix-ingress-controller | grep api7/adc
image: "ghcr.io/api7/adc:0.29.0"
```
Happy to split the ADC bump into its own PR if you would rather keep them
separate (as in #987) — I kept them together because neither half delivers the
feature alone.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
