This is an automated email from the ASF dual-hosted git repository.
AlinsRan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix-helm-chart.git
The following commit(s) were added to refs/heads/master by this push:
new f25b0b2 fix(apisix): omit etcd TLS sni when it is empty (#1029)
f25b0b2 is described below
commit f25b0b2f43180d18d9dee013f3432571bd733905
Author: AlinsRan <[email protected]>
AuthorDate: Wed Nov 4 17:25:25 2026 +0800
fix(apisix): omit etcd TLS sni when it is empty (#1029)
---
charts/apisix/README.md | 2 +-
charts/apisix/templates/configmap.yaml | 4 +++-
charts/apisix/values.yaml | 2 +-
3 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/charts/apisix/README.md b/charts/apisix/README.md
index 3bf499f..ed6844c 100644
--- a/charts/apisix/README.md
+++ b/charts/apisix/README.md
@@ -257,7 +257,7 @@ These options do not configure `extraInitContainers` and
have no effect when
| etcd.auth.tls.certKeyFilename | string | `""` | etcd client cert key
filename using in etcd.auth.tls.existingSecret |
| etcd.auth.tls.enabled | bool | `false` | enable etcd client certificate |
| etcd.auth.tls.existingSecret | string | `""` | name of the secret contains
etcd client cert |
-| etcd.auth.tls.sni | string | `""` | specify the TLS Server Name Indication
extension, the ETCD endpoint hostname will be used when this setting is unset. |
+| etcd.auth.tls.sni | string | `""` | specify the TLS Server Name Indication
extension, the ETCD endpoint hostname will be used when this setting is unset.
Set it to a DNS name in the etcd certificate if the etcd endpoints are IP
addresses, since IP SANs are not matched. |
| etcd.auth.tls.verify | bool | `true` | whether to verify the etcd endpoint
certificate when setup a TLS connection to etcd |
| etcd.autoCompactionMode | string | `"periodic"` | Auto compaction mode
(periodic or revision), only used when etcd.enabled is true |
| etcd.autoCompactionRetention | string | `"1h"` | Auto compaction retention
for mvcc key value store, only used when etcd.enabled is true |
diff --git a/charts/apisix/templates/configmap.yaml
b/charts/apisix/templates/configmap.yaml
index edf07b2..a30ec1b 100644
--- a/charts/apisix/templates/configmap.yaml
+++ b/charts/apisix/templates/configmap.yaml
@@ -443,7 +443,9 @@ data:
cert: "/etcd-ssl/{{ .Values.etcd.auth.tls.certFilename }}"
key: "/etcd-ssl/{{ .Values.etcd.auth.tls.certKeyFilename }}"
verify: {{ .Values.etcd.auth.tls.verify }}
- sni: "{{ .Values.etcd.auth.tls.sni }}"
+ {{- with .Values.etcd.auth.tls.sni }}
+ sni: {{ . | quote }}
+ {{- end }}
{{- end }}
{{- end }}
{{- end }}
diff --git a/charts/apisix/values.yaml b/charts/apisix/values.yaml
index b947b18..1f2156a 100644
--- a/charts/apisix/values.yaml
+++ b/charts/apisix/values.yaml
@@ -902,7 +902,7 @@ etcd:
certKeyFilename: ""
# -- whether to verify the etcd endpoint certificate when setup a TLS
connection to etcd
verify: true
- # -- specify the TLS Server Name Indication extension, the ETCD endpoint
hostname will be used when this setting is unset.
+ # -- specify the TLS Server Name Indication extension, the ETCD endpoint
hostname will be used when this setting is unset. Set it to a DNS name in the
etcd certificate if the etcd endpoints are IP addresses, since IP SANs are not
matched.
sni: ""
# -- ref:
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
