feat(aisix): render the gateway's startup config from an explicit config block - #397

charts/aisix now declares every gateway setting it deploys in values.yaml and hands it to the gateway as its config file through a ConfigMap, in both modes. Before this, control-plane mode used the image's baked /etc/aisix/config.managed.yaml and the chart pushed its settings in as AISIX_* env, and the only documented way to change anything else was extraEnvVars.

The new config: block mirrors the gateway's startup file one-to-one — same section and key names as config.example.yaml / config.rs — with every key at the gateway's own default (null means "leave it to the gateway"). aisix.configFile renders it and fills in the keys the chart owns for the mode:

• proxy.addr and the metrics address come from containerPorts, and proxy.listeners from listeners
• ratelimit.backend comes from rateLimit.backend
• control-plane mode gets managed.* from controlPlane.* plus the placeholders config.managed.yaml carries (etcd endpoint, admin slot)
• standalone mode gets resources_file and admin.enabled: false, and no etcd / managed sections

Those owned keys, plus the credential-bearing ones, are listed in charts/aisix/config-policy.yaml. Writing any of them under config: fails the render with a message naming the value to use. So does a dotted key anywhere under config (config is nested maps only), which would otherwise slip past those path checks. etcd exposes only dial_timeout_ms / request_timeout_ms, and that is read in control-plane mode only. The retired observability.metrics.otlp / tracing keys aren't listed.

Credentials never go into the ConfigMap:

• The control-plane mTLS bundle (chart-generated or existingSecret) is now mounted as files and read through managed.cp_{cert,key,ca}_file instead of AISIX_MANAGED__CP_*_PEM env. The gateway treats the two forms the same.
• The one exception is a release that sets AISIX_MANAGED__CP_{CERT,KEY,CA}_PEM through extraEnvVars. The gateway rejects a PEM and a file for the same slot, so that release keeps the 1.5.0 wiring: no file keys and no mount, and the chart's own PEM env vars are rendered before the extraEnvVars ones, duplicates included, exactly as 1.5.0 did. Dropping the chart's copy would make the upgrade's three-way merge delete both entries of that name.
• The rate-limit Redis URL stays a secretKeyRef env var from rateLimit.redis.
• The new configSecrets block ({<config path>: {secretName, key}}) wires cache.redis.{url,username,password} and ratelimit.redis.{username,password} from Secrets as secretKeyRef env. Any other path is rejected.

extraEnvVars is now documented as being for system-level env and for variables the standalone resources file references. An AISIX_* variable set there still overrides the file, so existing setups keep working.

Behaviour changes:

• The pod template always carries checksum/config and checksum/secret. Before, control-plane mode with certificate.existingSecret had no checksum at all, and the chart-managed rate-limit Redis URL Secret wasn't checksummed in either mode. So upgrading to this chart rolls the pods once.
• rateLimit.backend: redis with config.ratelimit.redis.mode set to cluster or sentinel no longer requires rateLimit.redis.url.
• The README drops the suggestion to turn on the admin API via extraEnvVars. That path still works; it just isn't the documented way any more.

No values key is renamed, removed or retyped, and every new key has a default. With unchanged values the rendered file loads to the same effective configuration each mode ran before. Templates treat config / configSecrets as possibly absent, because helm upgrade --reuse-values from 1.5.0 carries the old chart's values without the new defaults. In that case the file is simply shorter and the gateway falls back to the same defaults.

CI gains two checks:

• .github/scripts/check-aisix-config-drift.py compares config: key-for-key and default-for-default against config.reference.json from api7/aisix at v<appVersion>, minus config-policy.yaml. It also checks that every sub-key of the blocks that are off unless written (cache.redis, ratelimit.redis) and of list elements (url_rewrites[], client_type_rules[]) is documented, owned, or routed through configSecrets, per config-policy.yaml's optional list. When the tag predates the reference (1.5.0 does), it falls back to main. The reference comes from feat(config): publish config.reference.json for the Helm chart's config drift check aisix#1253 and #1255, so this check stays red until #1255 merges.
• .github/scripts/aisix-render-checks.sh pins the rendering: file vs PEM wiring, configSecrets env, list keys, the standalone sections, and the refusals.
• .github/scripts/aisix-config-boot.sh boots the appVersion image on the rendered file in both modes, using ci/config-values.yaml, which sets list-typed keys (heap_profiling.auto_dump.thresholds, request_id.accept_headers, real_ip.trusted_proxies, url_rewrites, bucket edges, metric labels) through config:. Standalone must answer /livez. Control-plane mode must load the file and stop only at the control-plane certificate step.

AGENTS.md gets a section on the principle and how this chart implements it.

version / appVersion are not bumped; this ships with the next release's chart bump.

🤖 Generated with Claude Code