fix(gateway): HPA/DaemonSet conflict, expose PROXY protocol ports on Service (#307)

Author: jarvis9443

charts/gateway/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's
 # own counter on that line and is decoupled from the app patch (see appVersion).
-version: 3.10.3
+version: 3.10.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/gateway/README.md

@@ -101,11 +101,13 @@ The command removes all the Kubernetes components associated with the chart and
 | apisix.proxyCache | object | `{"cacheTtl":"10s","zones":[{"cache_levels":"1:2","disk_path":"/tmp/disk_cache_one","disk_size":"1G","memory_size":"50m","name":"disk_cache_one"},{"memory_size":"50m","name":"memory_cache"}]}` | Proxy caching configuration used by the proxy-cache plugin. |
 | apisix.proxyCache.cacheTtl | string | `"10s"` | The default caching time in disk if the upstream does not specify the cache time |
 | apisix.proxyCache.zones | list | `[{"cache_levels":"1:2","disk_path":"/tmp/disk_cache_one","disk_size":"1G","memory_size":"50m","name":"disk_cache_one"},{"memory_size":"50m","name":"memory_cache"}]` | The parameters of a cache. The `memory_size` field stores the cache index for the disk strategy and the cache content for the memory strategy; `disk_size`, `disk_path` and `cache_levels` only apply to the disk strategy. |
-| apisix.proxyProtocol | object | `{"enableTcpPP":false,"enableTcpPPToUpstream":false,"listenHttpPort":null,"listenHttpsPort":null}` | PROXY Protocol configuration. |
+| apisix.proxyProtocol | object | `{"enableTcpPP":false,"enableTcpPPToUpstream":false,"listenHttpNodePort":null,"listenHttpPort":null,"listenHttpsNodePort":null,"listenHttpsPort":null}` | PROXY Protocol configuration. |
 | apisix.proxyProtocol.enableTcpPP | bool | `false` | Accept the PROXY Protocol on every gateway.stream.tcp port. Acts as the default; override per port with the `proxy_protocol` field on a gateway.stream.tcp entry. |
 | apisix.proxyProtocol.enableTcpPPToUpstream | bool | `false` | Send the PROXY Protocol to the upstream server on every gateway.stream.tcp port. Acts as the default; override per port with the `proxy_protocol_to_upstream` field on a gateway.stream.tcp entry. |
-| apisix.proxyProtocol.listenHttpPort | int | `nil` | The HTTP port that accepts the PROXY Protocol. It differs from `gateway.http` ports and `admin` port: this port only accepts HTTP requests carrying the PROXY Protocol, while the other ports only accept plain HTTP requests. If you enable the PROXY Protocol, you must use this port to receive HTTP requests with it. |
-| apisix.proxyProtocol.listenHttpsPort | int | `nil` | The HTTPS port that accepts the PROXY Protocol. |
+| apisix.proxyProtocol.listenHttpNodePort | int | `nil` | The nodePort of the PROXY Protocol HTTP port, only used if gateway.type is NodePort. If not set, a random port will be assigned by Kubernetes. |
+| apisix.proxyProtocol.listenHttpPort | int | `nil` | The HTTP port that accepts the PROXY Protocol. It differs from `gateway.http` ports and `admin` port: this port only accepts HTTP requests carrying the PROXY Protocol, while the other ports only accept plain HTTP requests. If you enable the PROXY Protocol, you must use this port to receive HTTP requests with it. When set, the port is also exposed on the gateway Service. |
+| apisix.proxyProtocol.listenHttpsNodePort | int | `nil` | The nodePort of the PROXY Protocol HTTPS port, only used if gateway.type is NodePort. If not set, a random port will be assigned by Kubernetes. |
+| apisix.proxyProtocol.listenHttpsPort | int | `nil` | The HTTPS port that accepts the PROXY Protocol. When set, the port is also exposed on the gateway Service. |
 | apisix.replicaCount | int | `1` | kind is DaemonSet, replicaCount not become effective |
 | apisix.resources | object | `{}` | Set pod resource requests & limits |
 | apisix.securityContext | object | `{}` | Set the securityContext for API7 Gateway container |

charts/gateway/templates/configmap.yaml

@@ -41,7 +41,7 @@ data:
       enable_reuseport: true                       # Enable nginx SO_REUSEPORT switch if set to true.
       enable_ipv6: {{ .Values.apisix.enableIPv6 }} # Enable nginx IPv6 resolver
       enable_server_tokens: {{ .Values.apisix.enableServerTokens }} # Whether the APISIX version number should be shown in Server header
-      show_upstream_status_in_response_header: {{ .Values.apisix.showUpstreamStatusInResponseHeader }} # when true all upstream status write to `X-APISIX-Upstream-Status` otherwise only 5xx code
+      show_upstream_status_in_response_header: {{ .Values.apisix.showUpstreamStatusInResponseHeader }} # when true, all upstream statuses are written to `X-APISIX-Upstream-Status`; otherwise only 5xx codes
 
       {{- with .Values.apisix.trustedAddresses }}
       trusted_addresses:    # When configured, APISIX will trust the `X-Forwarded-*` Headers passed in requests from the IP/CIDR in the list.

charts/gateway/templates/hpa.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.apisix.enabled .Values.autoscaling.enabled }}
+{{- if and .Values.apisix.enabled .Values.autoscaling.enabled (eq .Values.apisix.kind "Deployment") }}
 
 apiVersion: autoscaling/{{ .Values.autoscaling.version }}
 kind: HorizontalPodAutoscaler

charts/gateway/templates/service-gateway.yaml

@@ -73,6 +73,24 @@ spec:
     nodePort: {{ .nodePort }}
     {{- end }}
   {{- end }}
+  {{- if .Values.apisix.proxyProtocol.listenHttpPort }}
+  - name: apisix-gateway-pp
+    port: {{ .Values.apisix.proxyProtocol.listenHttpPort }}
+    targetPort: {{ .Values.apisix.proxyProtocol.listenHttpPort }}
+    {{- if (and (eq .Values.gateway.type "NodePort") (not (empty .Values.apisix.proxyProtocol.listenHttpNodePort))) }}
+    nodePort: {{ .Values.apisix.proxyProtocol.listenHttpNodePort }}
+    {{- end }}
+    protocol: TCP
+  {{- end }}
+  {{- if .Values.apisix.proxyProtocol.listenHttpsPort }}
+  - name: apisix-gateway-pp-tls
+    port: {{ .Values.apisix.proxyProtocol.listenHttpsPort }}
+    targetPort: {{ .Values.apisix.proxyProtocol.listenHttpsPort }}
+    {{- if (and (eq .Values.gateway.type "NodePort") (not (empty .Values.apisix.proxyProtocol.listenHttpsNodePort))) }}
+    nodePort: {{ .Values.apisix.proxyProtocol.listenHttpsNodePort }}
+    {{- end }}
+    protocol: TCP
+  {{- end }}
   {{- if .Values.serviceMonitor.enabled }}
   - name: prometheus
     port: {{ .Values.serviceMonitor.containerPort }}

charts/gateway/values.yaml

@@ -59,9 +59,17 @@ apisix:
     # -- (int) The HTTP port that accepts the PROXY Protocol. It differs from `gateway.http` ports and `admin` port:
     # this port only accepts HTTP requests carrying the PROXY Protocol, while the other ports only accept plain HTTP
     # requests. If you enable the PROXY Protocol, you must use this port to receive HTTP requests with it.
+    # When set, the port is also exposed on the gateway Service.
     listenHttpPort:
+    # -- (int) The nodePort of the PROXY Protocol HTTP port, only used if gateway.type is NodePort.
+    # If not set, a random port will be assigned by Kubernetes.
+    listenHttpNodePort:
     # -- (int) The HTTPS port that accepts the PROXY Protocol.
+    # When set, the port is also exposed on the gateway Service.
     listenHttpsPort:
+    # -- (int) The nodePort of the PROXY Protocol HTTPS port, only used if gateway.type is NodePort.
+    # If not set, a random port will be assigned by Kubernetes.
+    listenHttpsNodePort:
     # -- Accept the PROXY Protocol on every gateway.stream.tcp port. Acts as the default;
     # override per port with the `proxy_protocol` field on a gateway.stream.tcp entry.
     enableTcpPP: false