This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix-helm-chart.git
The following commit(s) were added to refs/heads/master by this push:
new e1f8bf6 feat(ingress-controller): support annotations on the webhook
configuration (#1004)
e1f8bf6 is described below
commit e1f8bf6c6d8c9fbdc6a283d903419d020d0edabd
Author: Ahmed Gaber <[email protected]>
AuthorDate: Mon Oct 26 05:39:31 2026 +0000
feat(ingress-controller): support annotations on the webhook configuration
(#1004)
---
charts/apisix-ingress-controller/Chart.yaml | 2 +-
charts/apisix-ingress-controller/README.md | 1 +
charts/apisix-ingress-controller/templates/webhook.yaml | 4 ++++
charts/apisix-ingress-controller/values.yaml | 8 +++++++-
4 files changed, 13 insertions(+), 2 deletions(-)
diff --git a/charts/apisix-ingress-controller/Chart.yaml
b/charts/apisix-ingress-controller/Chart.yaml
index 581c6f8..d2bee2f 100644
--- a/charts/apisix-ingress-controller/Chart.yaml
+++ b/charts/apisix-ingress-controller/Chart.yaml
@@ -24,7 +24,7 @@ keywords:
- nginx
- crd
type: application
-version: 1.4.0
+version: 1.4.1
appVersion: 2.2.0
sources:
- https://github.com/apache/apisix-helm-chart
diff --git a/charts/apisix-ingress-controller/README.md
b/charts/apisix-ingress-controller/README.md
index bcf2630..4fa6d39 100644
--- a/charts/apisix-ingress-controller/README.md
+++ b/charts/apisix-ingress-controller/README.md
@@ -172,6 +172,7 @@ The same for container level, you need to set:
| serviceMonitor.labels | object | `{}` | @param serviceMonitor.labels
ServiceMonitor extra labels |
| serviceMonitor.metricRelabelings | object | `{}` | @param
serviceMonitor.metricRelabelings MetricRelabelConfigs to apply to samples
before ingestion. ref:
https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs
|
| serviceMonitor.namespace | string | `"monitoring"` | @param
serviceMonitor.namespace Namespace in which to create the ServiceMonitor |
+| webhook.annotations | object | `{}` | Annotations for the
ValidatingWebhookConfiguration, e.g. `cert-manager.io/inject-ca-from:
<namespace>/<certificate>` so cert-manager's cainjector maintains the webhook
caBundle. Only use CA injection with `certificate.provided: true` and
`certificate.caBundle` unset; otherwise the injected CA replaces the
chart-generated one and the webhook TLS handshake fails. |
| webhook.certificate.provided | bool | `false` | Set to true if you want to
provide your own certificate |
| webhook.enabled | bool | `true` | Enable or disable admission webhook |
| webhook.failurePolicy | string | `"Ignore"` | Failure policy for the webhook
(Fail or Ignore) |
diff --git a/charts/apisix-ingress-controller/templates/webhook.yaml
b/charts/apisix-ingress-controller/templates/webhook.yaml
index 8944ea4..d1bc479 100644
--- a/charts/apisix-ingress-controller/templates/webhook.yaml
+++ b/charts/apisix-ingress-controller/templates/webhook.yaml
@@ -39,6 +39,10 @@ apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingWebhookConfiguration
metadata:
name: {{ include "apisix-ingress-controller-manager.name.fullname" .
}}-webhook
+ {{- with .Values.webhook.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
labels:
{{- include "apisix-ingress-controller-manager.labels" . | nindent 4 }}
webhooks:
diff --git a/charts/apisix-ingress-controller/values.yaml
b/charts/apisix-ingress-controller/values.yaml
index 90ad5bb..819365e 100644
--- a/charts/apisix-ingress-controller/values.yaml
+++ b/charts/apisix-ingress-controller/values.yaml
@@ -105,6 +105,12 @@ config:
webhook:
# -- Enable or disable admission webhook
enabled: true
+ # -- Annotations for the ValidatingWebhookConfiguration, e.g.
+ # `cert-manager.io/inject-ca-from: <namespace>/<certificate>` so
+ # cert-manager's cainjector maintains the webhook caBundle.
+ # Only use CA injection with `certificate.provided: true` and
`certificate.caBundle` unset;
+ # otherwise the injected CA replaces the chart-generated one and the webhook
TLS handshake fails.
+ annotations: {}
# -- The port for the webhook server to listen on
port: 9443
# -- Failure policy for the webhook (Fail or Ignore)
@@ -116,7 +122,7 @@ webhook:
provided: false
# -- Secret name containing the certificate (required if provided is true)
# secretName: "my-webhook-cert"
- # -- CA bundle in base64 format (required if provided is true)
+ # -- CA bundle in base64 format (required if provided is true, unless
injected via webhook.annotations)
# caBundle: ""
# The GatewayProxy resource configures gateway proxy instances including
networking,
