From fc15348c79b609b838e739090d93c25addb169c6 Mon Sep 17 00:00:00 2001 From: Jarvis Date: Tue, 11 Aug 2026 21:34:25 +0800 Subject: [PATCH] chore: upgrade api7 and gateway to v3.10.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Version bumps: - charts/api7: chart 3.10.4 -> 3.10.5, appVersion 3.10.5, and the dashboard, dp_manager, developer_portal and file_server image tags to v3.10.5. - charts/gateway: chart 3.10.10 -> 3.10.11, appVersion 3.10.5, and the gateway image tag to 3.10.5. Structural change synced from control-plane helm/values.yaml: - developer_portal_configuration.security.ssrf_protection — the developer portal process now installs the SSRF guard (control-plane #2897), so the chart has to expose the policy it reads. Disabled by default, matching the previous behavior. The configmap forwards the whole map with toYaml, so no template change is needed. The other control-plane chart changes in this range are already present here: extraInitContainers, file_server.extraEnvVars and the file_server_service nodePort example were reconciled upstream against this copy (#2890), and the model catalog keys removed by #2891 were never carried downstream. The gateway config-default.yaml change in this range only adds ldap-auth-advanced to the plugin list, which this chart does not manage. Verified: helm lint clean on both charts; the rendered developer portal configmap carries the new block in both the default and the enabled state; the rendered gateway config.yaml passes `apisix init` inside api7/api7-ee-3-gateway:3.10.5; values.yaml parses with a duplicate-key-raising loader; READMEs regenerated with make helm-docs. --- charts/api7/Chart.yaml | 4 ++-- charts/api7/README.md | 13 ++++++++----- charts/api7/values.yaml | 19 +++++++++++++++---- charts/gateway/Chart.yaml | 4 ++-- charts/gateway/README.md | 2 +- charts/gateway/values.yaml | 2 +- 6 files changed, 29 insertions(+), 15 deletions(-) diff --git a/charts/api7/Chart.yaml b/charts/api7/Chart.yaml index 8f3d50a..42bfab1 100644 --- a/charts/api7/Chart.yaml +++ b/charts/api7/Chart.yaml @@ -17,13 +17,13 @@ type: application # Versions are expected to follow Semantic Versioning (https://semver.org/) # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's # own counter on that line and is decoupled from the app patch (see appVersion). -version: 3.10.4 +version: 3.10.5 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "3.10.4" +appVersion: "3.10.5" maintainers: - name: API7 diff --git a/charts/api7/README.md b/charts/api7/README.md index 764a62a..b1391d9 100644 --- a/charts/api7/README.md +++ b/charts/api7/README.md @@ -1,6 +1,6 @@ # api7ee3 -![Version: 3.10.4](https://img.shields.io/badge/Version-3.10.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.10.4](https://img.shields.io/badge/AppVersion-3.10.4-informational?style=flat-square) +![Version: 3.10.5](https://img.shields.io/badge/Version-3.10.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.10.5](https://img.shields.io/badge/AppVersion-3.10.5-informational?style=flat-square) A Helm chart for Kubernetes @@ -29,7 +29,7 @@ A Helm chart for Kubernetes | dashboard.extraVolumes | list | `[]` | | | dashboard.image.pullPolicy | string | `"Always"` | | | dashboard.image.repository | string | `"api7/api7-ee-3-integrated"` | | -| dashboard.image.tag | string | `"v3.10.4"` | | +| dashboard.image.tag | string | `"v3.10.5"` | | | dashboard.keyCertSecret | string | `""` | | | dashboard.livenessProbe.failureThreshold | int | `30` | | | dashboard.livenessProbe.initialDelaySeconds | int | `180` | | @@ -123,7 +123,7 @@ A Helm chart for Kubernetes | developer_portal.extraVolumes | list | `[]` | | | developer_portal.image.pullPolicy | string | `"Always"` | | | developer_portal.image.repository | string | `"api7/api7-ee-developer-portal"` | | -| developer_portal.image.tag | string | `"v3.10.4"` | | +| developer_portal.image.tag | string | `"v3.10.5"` | | | developer_portal.keyCertSecret | string | `""` | | | developer_portal.livenessProbe.failureThreshold | int | `10` | | | developer_portal.livenessProbe.initialDelaySeconds | int | `60` | | @@ -143,6 +143,9 @@ A Helm chart for Kubernetes | developer_portal_configuration.log.access_log | string | `"stdout"` | | | developer_portal_configuration.log.level | string | `"warn"` | Allowed values: `debug`, `info`, `warn`, `error` | | developer_portal_configuration.log.output | string | `"stderr"` | | +| developer_portal_configuration.security.ssrf_protection | object | `{"allow_list":[],"deny_list":[],"enable":false}` | ssrf_protection restricts the destinations the developer portal connects to when it requests a user-configured network endpoint (approval webhooks, the DCR client registration bridge). Disabled by default so internal endpoints keep working; enable to block SSRF to internal, loopback, link-local and cloud-metadata addresses. | +| developer_portal_configuration.security.ssrf_protection.allow_list | list | `[]` | CIDRs always permitted even if otherwise internal | +| developer_portal_configuration.security.ssrf_protection.deny_list | list | `[]` | extra CIDRs to block on top of the built-in internal ranges | | developer_portal_configuration.server.listen.host | string | `"0.0.0.0"` | | | developer_portal_configuration.server.listen.port | int | `4321` | | | developer_portal_configuration.server.listen.tls.cert_file | string | `""` | | @@ -170,7 +173,7 @@ A Helm chart for Kubernetes | dp_manager.extraVolumes | list | `[]` | | | dp_manager.image.pullPolicy | string | `"Always"` | | | dp_manager.image.repository | string | `"api7/api7-ee-dp-manager"` | | -| dp_manager.image.tag | string | `"v3.10.4"` | | +| dp_manager.image.tag | string | `"v3.10.5"` | | | dp_manager.livenessProbe.failureThreshold | int | `10` | | | dp_manager.livenessProbe.initialDelaySeconds | int | `60` | | | dp_manager.livenessProbe.periodSeconds | int | `3` | | @@ -238,7 +241,7 @@ A Helm chart for Kubernetes | file_server.extraEnvVars | list | `[]` | | | file_server.image.pullPolicy | string | `"Always"` | | | file_server.image.repository | string | `"api7/api7-ee-file-server"` | | -| file_server.image.tag | string | `"v3.10.4"` | | +| file_server.image.tag | string | `"v3.10.5"` | | | file_server.livenessProbe.failureThreshold | int | `10` | | | file_server.livenessProbe.initialDelaySeconds | int | `60` | | | file_server.livenessProbe.periodSeconds | int | `3` | | diff --git a/charts/api7/values.yaml b/charts/api7/values.yaml index c2b0c1a..e79a1ab 100644 --- a/charts/api7/values.yaml +++ b/charts/api7/values.yaml @@ -18,7 +18,7 @@ dashboard: repository: api7/api7-ee-3-integrated pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.10.4" + tag: "v3.10.5" # Resources of the deployment. # It has a higher priority than the common resources configuration: # when this field is configured, it is used first in the deployment, @@ -55,7 +55,7 @@ dp_manager: repository: api7/api7-ee-dp-manager pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.10.4" + tag: "v3.10.5" # Resources of the deployment. # It has a higher priority than the common resources configuration: # when this field is configured, it is used first in the deployment, @@ -92,7 +92,7 @@ file_server: image: repository: api7/api7-ee-file-server pullPolicy: Always - tag: "v3.10.4" + tag: "v3.10.5" extraEnvVars: [] livenessProbe: @@ -112,7 +112,7 @@ developer_portal: repository: api7/api7-ee-developer-portal pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.10.4" + tag: "v3.10.5" extraEnvVars: [] extraVolumes: [] @@ -615,6 +615,17 @@ developer_portal_configuration: # tls: # ca_cert: "" # insecure: false + security: + # -- ssrf_protection restricts the destinations the developer portal connects to when it + # requests a user-configured network endpoint (approval webhooks, the DCR client + # registration bridge). Disabled by default so internal endpoints keep working; enable to + # block SSRF to internal, loopback, link-local and cloud-metadata addresses. + ssrf_protection: + enable: false + # -- CIDRs always permitted even if otherwise internal + allow_list: [] + # -- extra CIDRs to block on top of the built-in internal ranges + deny_list: [] file_server_configuration: file_server: diff --git a/charts/gateway/Chart.yaml b/charts/gateway/Chart.yaml index d8631f0..bfb95b5 100644 --- a/charts/gateway/Chart.yaml +++ b/charts/gateway/Chart.yaml @@ -16,12 +16,12 @@ type: application # Versions are expected to follow Semantic Versioning (https://semver.org/) # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's # own counter on that line and is decoupled from the app patch (see appVersion). -version: 3.10.10 +version: 3.10.11 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. -appVersion: "3.10.4" +appVersion: "3.10.5" maintainers: - name: API7 diff --git a/charts/gateway/README.md b/charts/gateway/README.md index 87e320f..c7235e5 100644 --- a/charts/gateway/README.md +++ b/charts/gateway/README.md @@ -158,7 +158,7 @@ apisix: | apisix.httpRouter | string | `"radixtree_host_uri"` | Defines how apisix handles routing: - radixtree_uri: match route by uri(base on radixtree) - radixtree_host_uri: match route by host + uri(base on radixtree) - radixtree_uri_with_parameter: match route by uri with parameters | | apisix.image.pullPolicy | string | `"Always"` | API7 Gateway image pull policy | | apisix.image.repository | string | `"api7/api7-ee-3-gateway"` | API7 Gateway image repository | -| apisix.image.tag | string | `"3.10.4"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. | +| apisix.image.tag | string | `"3.10.5"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. | | apisix.kind | string | `"Deployment"` | Use a `DaemonSet` or `Deployment` | | apisix.lru | object | `{"secret":{"count":512,"neg_count":512,"neg_ttl":60,"ttl":300}}` | fine tune the parameters of LRU cache for some features like secret | | apisix.lru.secret.count | int | `512` | Maximum number of cached secret values | diff --git a/charts/gateway/values.yaml b/charts/gateway/values.yaml index 9877f84..1bea694 100644 --- a/charts/gateway/values.yaml +++ b/charts/gateway/values.yaml @@ -205,7 +205,7 @@ apisix: pullPolicy: Always # -- API7 Gateway image tag # Overrides the image tag whose default is the chart appVersion. - tag: 3.10.4 + tag: 3.10.5 # -- Use a `DaemonSet` or `Deployment` kind: Deployment