This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix-helm-chart.git
The following commit(s) were added to refs/heads/master by this push:
new 32583b1 feat(apisix): configure wait-etcd resources and security
context (#1028)
32583b1 is described below
commit 32583b1c80acc275cd46fb4aa2da91002afdca8f
Author: AlinsRan <[email protected]>
AuthorDate: Mon Oct 26 14:33:11 2026 +0800
feat(apisix): configure wait-etcd resources and security context (#1028)
---
charts/apisix/README.md | 40 +++++++++++++++++++++++++++++++++
charts/apisix/README.md.gotmpl | 38 +++++++++++++++++++++++++++++++
charts/apisix/templates/deployment.yaml | 8 +++++++
charts/apisix/values.yaml | 18 +++++++++++++++
4 files changed, 104 insertions(+)
diff --git a/charts/apisix/README.md b/charts/apisix/README.md
index aa8ad38..3bf499f 100644
--- a/charts/apisix/README.md
+++ b/charts/apisix/README.md
@@ -34,6 +34,44 @@ helm delete [RELEASE_NAME] --namespace ingress-apisix
The command removes all the Kubernetes components associated with the chart
and deletes the release.
+## Configure the wait-etcd init container
+
+When `etcd.enabled` is true, `initContainer.resources` and
+`initContainer.securityContext` configure the built-in `wait-etcd` container
for
+both Deployment and DaemonSet workloads. They are independent of the top-level
+`resources` and `securityContext`, which configure the APISIX container.
+
+Both options default to `{}` and are omitted from the rendered container when
+empty. Applicable `podSecurityContext` settings still apply to `wait-etcd`.
+For example:
+
+```yaml
+initContainer:
+ resources:
+ requests:
+ cpu: 10m
+ memory: 16Mi
+ limits:
+ cpu: 100m
+ memory: 32Mi
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+```
+
+Adjust resource values for your environment. The default BusyBox image runs as
+root, so `runAsNonRoot: true` also requires a non-zero UID supplied through
+`runAsUser`, `podSecurityContext`, or an admission policy. On platforms such as
+OpenShift that assign a UID, omit the explicit `runAsUser` value.
+
+These options do not configure `extraInitContainers` and have no effect when
+`etcd.enabled` is false.
+
## Parameters
## Values
@@ -260,6 +298,8 @@ The command removes all the Kubernetes components
associated with the chart and
| ingress.servicePort | number | `nil` | Service port to send traffic.
Defaults to `service.http.servicePort`. |
| ingress.tls | list | `[]` | Ingress TLS settings |
| initContainer.image | string | `"busybox"` | Init container image |
+| initContainer.resources | object | `{}` | Resource requests and limits for
the wait-etcd init container (only used when etcd.enabled is true) |
+| initContainer.securityContext | object | `{}` | Container security context
for wait-etcd. Empty by default to inherit applicable podSecurityContext
settings. |
| initContainer.tag | float | `1.28` | Init container tag |
| lifecycle | object | `{"preStop":{"exec":{"command":["/bin/sh","-c","sleep
30"]}}}` | Lifecycle hooks for the Apache APISIX container |
| metrics | object |
`{"serviceMonitor":{"annotations":{},"enabled":false,"interval":"15s","labels":{},"name":"","namespace":""}}`
| Observability configuration. |
diff --git a/charts/apisix/README.md.gotmpl b/charts/apisix/README.md.gotmpl
index 8e451c2..dad784c 100644
--- a/charts/apisix/README.md.gotmpl
+++ b/charts/apisix/README.md.gotmpl
@@ -34,6 +34,44 @@ helm delete [RELEASE_NAME] --namespace ingress-apisix
The command removes all the Kubernetes components associated with the chart
and deletes the release.
+## Configure the wait-etcd init container
+
+When `etcd.enabled` is true, `initContainer.resources` and
+`initContainer.securityContext` configure the built-in `wait-etcd` container
for
+both Deployment and DaemonSet workloads. They are independent of the top-level
+`resources` and `securityContext`, which configure the APISIX container.
+
+Both options default to `{}` and are omitted from the rendered container when
+empty. Applicable `podSecurityContext` settings still apply to `wait-etcd`.
+For example:
+
+```yaml
+initContainer:
+ resources:
+ requests:
+ cpu: 10m
+ memory: 16Mi
+ limits:
+ cpu: 100m
+ memory: 32Mi
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+```
+
+Adjust resource values for your environment. The default BusyBox image runs as
+root, so `runAsNonRoot: true` also requires a non-zero UID supplied through
+`runAsUser`, `podSecurityContext`, or an admission policy. On platforms such as
+OpenShift that assign a UID, omit the explicit `runAsUser` value.
+
+These options do not configure `extraInitContainers` and have no effect when
+`etcd.enabled` is false.
+
## Parameters
{{ template "chart.valuesSection" . }}
diff --git a/charts/apisix/templates/deployment.yaml
b/charts/apisix/templates/deployment.yaml
index 3a592f1..e7abaef 100644
--- a/charts/apisix/templates/deployment.yaml
+++ b/charts/apisix/templates/deployment.yaml
@@ -247,6 +247,14 @@ spec:
{{- if .Values.etcd.enabled }}
- name: wait-etcd
image: {{ .Values.initContainer.image }}:{{
.Values.initContainer.tag }}
+ {{- with .Values.initContainer.resources }}
+ resources:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.initContainer.securityContext }}
+ securityContext:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
{{- if .Values.etcd.fullnameOverride }}
command: ['sh', '-c', "until nc -z {{ .Values.etcd.fullnameOverride
}} {{ .Values.etcd.service.port }}; do echo waiting for etcd `date`; sleep 2;
done;"]
{{ else }}
diff --git a/charts/apisix/values.yaml b/charts/apisix/values.yaml
index 6c2e9d6..b947b18 100644
--- a/charts/apisix/values.yaml
+++ b/charts/apisix/values.yaml
@@ -153,6 +153,24 @@ initContainer:
image: busybox
# -- Init container tag
tag: 1.28
+ # -- Resource requests and limits for the wait-etcd init container (only
used when etcd.enabled is true)
+ resources: {}
+ # requests:
+ # cpu: 10m
+ # memory: 16Mi
+ # limits:
+ # cpu: 100m
+ # memory: 32Mi
+ # -- Container security context for wait-etcd. Empty by default to inherit
applicable podSecurityContext settings.
+ securityContext: {}
+ # allowPrivilegeEscalation: false
+ # capabilities:
+ # drop:
+ # - ALL
+ # readOnlyRootFilesystem: true
+ # runAsNonRoot: true
+ # Set runAsUser to a non-zero UID unless the pod or admission policy
supplies one.
+ # runAsUser: 1000
autoscaling:
# -- Enable HorizontalPodAutoscaler for APISIX (only when useDaemonSet is
false)
