From baa0b0a6ea4b1ca11bc7e0e604ce6dd920d1fdc0 Mon Sep 17 00:00:00 2001 From: Jarvis Date: Wed, 12 Aug 2026 17:40:35 +0800 Subject: [PATCH] chore: upgrade api7 and gateway to v3.9.18 3.9.18 is a patch on the 3.9 line, so the charts are bumped on release/3.9: api7 3.9.4 -> 3.9.5 and gateway 3.9.8 -> 3.9.9, each line's own counter, with appVersion and the image tags moved to 3.9.18. Adds developer_portal_configuration.security.ssrf_protection, matching what the 3.10.5 chart exposed for the same Control Plane change: the SSRF guard is now installed in the developer portal process, so the setting has to be reachable from the chart. Default stays false, so a default render is unchanged. The remaining Control Plane chart changes in this range (extraInitContainers, the file server nodePort example, the connection max lifetime comment) reconciled the upstream copy against this chart and are already present here. The gateway's config-default.yaml did not change. --- charts/api7/Chart.yaml | 4 ++-- charts/api7/README.md | 13 ++++++++----- charts/api7/values.yaml | 19 +++++++++++++++---- charts/gateway/Chart.yaml | 4 ++-- charts/gateway/README.md | 2 +- charts/gateway/values.yaml | 2 +- 6 files changed, 29 insertions(+), 15 deletions(-) diff --git a/charts/api7/Chart.yaml b/charts/api7/Chart.yaml index 5a71c20..05839f4 100644 --- a/charts/api7/Chart.yaml +++ b/charts/api7/Chart.yaml @@ -17,13 +17,13 @@ type: application # Versions are expected to follow Semantic Versioning (https://semver.org/) # major.minor mirrors the API7 EE release line (3.9.x), patch is this chart's # own counter on that line and is decoupled from the app patch (see appVersion). -version: 3.9.4 +version: 3.9.5 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. # It is recommended to use it with quotes. -appVersion: "3.9.17" +appVersion: "3.9.18" maintainers: - name: API7 diff --git a/charts/api7/README.md b/charts/api7/README.md index d14eebd..dfc44ae 100644 --- a/charts/api7/README.md +++ b/charts/api7/README.md @@ -1,6 +1,6 @@ # api7ee3 -![Version: 3.9.4](https://img.shields.io/badge/Version-3.9.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.9.17](https://img.shields.io/badge/AppVersion-3.9.17-informational?style=flat-square) +![Version: 3.9.5](https://img.shields.io/badge/Version-3.9.5-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 3.9.18](https://img.shields.io/badge/AppVersion-3.9.18-informational?style=flat-square) A Helm chart for Kubernetes @@ -29,7 +29,7 @@ A Helm chart for Kubernetes | dashboard.extraVolumes | list | `[]` | | | dashboard.image.pullPolicy | string | `"Always"` | | | dashboard.image.repository | string | `"api7/api7-ee-3-integrated"` | | -| dashboard.image.tag | string | `"v3.9.17"` | | +| dashboard.image.tag | string | `"v3.9.18"` | | | dashboard.keyCertSecret | string | `""` | | | dashboard.livenessProbe.failureThreshold | int | `30` | | | dashboard.livenessProbe.initialDelaySeconds | int | `180` | | @@ -123,7 +123,7 @@ A Helm chart for Kubernetes | developer_portal.extraVolumes | list | `[]` | | | developer_portal.image.pullPolicy | string | `"Always"` | | | developer_portal.image.repository | string | `"api7/api7-ee-developer-portal"` | | -| developer_portal.image.tag | string | `"v3.9.17"` | | +| developer_portal.image.tag | string | `"v3.9.18"` | | | developer_portal.keyCertSecret | string | `""` | | | developer_portal.livenessProbe.failureThreshold | int | `10` | | | developer_portal.livenessProbe.initialDelaySeconds | int | `60` | | @@ -143,6 +143,9 @@ A Helm chart for Kubernetes | developer_portal_configuration.log.access_log | string | `"stdout"` | | | developer_portal_configuration.log.level | string | `"warn"` | Allowed values: `debug`, `info`, `warn`, `error` | | developer_portal_configuration.log.output | string | `"stderr"` | | +| developer_portal_configuration.security.ssrf_protection | object | `{"allow_list":[],"deny_list":[],"enable":false}` | ssrf_protection restricts the destinations the developer portal connects to when it requests a user-configured network endpoint (approval webhooks, the DCR client registration bridge). Disabled by default so internal endpoints keep working; enable to block SSRF to internal, loopback, link-local and cloud-metadata addresses. | +| developer_portal_configuration.security.ssrf_protection.allow_list | list | `[]` | CIDRs always permitted even if otherwise internal | +| developer_portal_configuration.security.ssrf_protection.deny_list | list | `[]` | extra CIDRs to block on top of the built-in internal ranges | | developer_portal_configuration.server.listen.host | string | `"0.0.0.0"` | | | developer_portal_configuration.server.listen.port | int | `4321` | | | developer_portal_configuration.server.listen.tls.cert_file | string | `""` | | @@ -170,7 +173,7 @@ A Helm chart for Kubernetes | dp_manager.extraVolumes | list | `[]` | | | dp_manager.image.pullPolicy | string | `"Always"` | | | dp_manager.image.repository | string | `"api7/api7-ee-dp-manager"` | | -| dp_manager.image.tag | string | `"v3.9.17"` | | +| dp_manager.image.tag | string | `"v3.9.18"` | | | dp_manager.livenessProbe.failureThreshold | int | `10` | | | dp_manager.livenessProbe.initialDelaySeconds | int | `60` | | | dp_manager.livenessProbe.periodSeconds | int | `3` | | @@ -238,7 +241,7 @@ A Helm chart for Kubernetes | file_server.extraEnvVars | list | `[]` | | | file_server.image.pullPolicy | string | `"Always"` | | | file_server.image.repository | string | `"api7/api7-ee-file-server"` | | -| file_server.image.tag | string | `"v3.9.17"` | | +| file_server.image.tag | string | `"v3.9.18"` | | | file_server.livenessProbe.failureThreshold | int | `10` | | | file_server.livenessProbe.initialDelaySeconds | int | `60` | | | file_server.livenessProbe.periodSeconds | int | `3` | | diff --git a/charts/api7/values.yaml b/charts/api7/values.yaml index 82fe0f2..db202f5 100644 --- a/charts/api7/values.yaml +++ b/charts/api7/values.yaml @@ -18,7 +18,7 @@ dashboard: repository: api7/api7-ee-3-integrated pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.9.17" + tag: "v3.9.18" # Resources of the deployment. # It has a higher priority than the common resources configuration: # when this field is configured, it is used first in the deployment, @@ -55,7 +55,7 @@ dp_manager: repository: api7/api7-ee-dp-manager pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.9.17" + tag: "v3.9.18" # Resources of the deployment. # It has a higher priority than the common resources configuration: # when this field is configured, it is used first in the deployment, @@ -92,7 +92,7 @@ file_server: image: repository: api7/api7-ee-file-server pullPolicy: Always - tag: "v3.9.17" + tag: "v3.9.18" extraEnvVars: [] livenessProbe: @@ -112,7 +112,7 @@ developer_portal: repository: api7/api7-ee-developer-portal pullPolicy: Always # Overrides the image tag whose default is the chart appVersion. - tag: "v3.9.17" + tag: "v3.9.18" extraEnvVars: [] extraVolumes: [] @@ -615,6 +615,17 @@ developer_portal_configuration: # tls: # ca_cert: "" # insecure: false + security: + # -- ssrf_protection restricts the destinations the developer portal connects to when it + # requests a user-configured network endpoint (approval webhooks, the DCR client + # registration bridge). Disabled by default so internal endpoints keep working; enable to + # block SSRF to internal, loopback, link-local and cloud-metadata addresses. + ssrf_protection: + enable: false + # -- CIDRs always permitted even if otherwise internal + allow_list: [] + # -- extra CIDRs to block on top of the built-in internal ranges + deny_list: [] file_server_configuration: file_server: diff --git a/charts/gateway/Chart.yaml b/charts/gateway/Chart.yaml index f50ef53..40aeb26 100644 --- a/charts/gateway/Chart.yaml +++ b/charts/gateway/Chart.yaml @@ -16,12 +16,12 @@ type: application # Versions are expected to follow Semantic Versioning (https://semver.org/) # major.minor mirrors the API7 EE release line (3.9.x), patch is this chart's # own counter on that line and is decoupled from the app patch (see appVersion). -version: 3.9.8 +version: 3.9.9 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to # follow Semantic Versioning. They should reflect the version the application is using. -appVersion: "3.9.17" +appVersion: "3.9.18" maintainers: - name: API7 diff --git a/charts/gateway/README.md b/charts/gateway/README.md index 3c896d1..0276fbf 100644 --- a/charts/gateway/README.md +++ b/charts/gateway/README.md @@ -178,7 +178,7 @@ apisix: | apisix.httpRouter | string | `"radixtree_host_uri"` | Defines how apisix handles routing: - radixtree_uri: match route by uri(base on radixtree) - radixtree_host_uri: match route by host + uri(base on radixtree) - radixtree_uri_with_parameter: match route by uri with parameters | | apisix.image.pullPolicy | string | `"Always"` | API7 Gateway image pull policy | | apisix.image.repository | string | `"api7/api7-ee-3-gateway"` | API7 Gateway image repository | -| apisix.image.tag | string | `"3.9.17"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. | +| apisix.image.tag | string | `"3.9.18"` | API7 Gateway image tag Overrides the image tag whose default is the chart appVersion. | | apisix.kind | string | `"Deployment"` | Use a `DaemonSet` or `Deployment` | | apisix.lru | object | `{"secret":{"count":512,"neg_count":512,"neg_ttl":60,"ttl":300}}` | fine tune the parameters of LRU cache for some features like secret | | apisix.lru.secret.neg_ttl | int | `60` | in seconds | diff --git a/charts/gateway/values.yaml b/charts/gateway/values.yaml index 5c8e5cf..8b1bd4d 100644 --- a/charts/gateway/values.yaml +++ b/charts/gateway/values.yaml @@ -137,7 +137,7 @@ apisix: pullPolicy: Always # -- API7 Gateway image tag # Overrides the image tag whose default is the chart appVersion. - tag: 3.9.17 + tag: 3.9.18 # -- Use a `DaemonSet` or `Deployment` kind: Deployment