apiVersion: apps/v1 kind: Deployment metadata: name: apisix namespace: apisix labels: app: apisix spec: replicas: 1 selector: matchLabels: app: apisix template: metadata: labels: app: apisix spec: initContainers: - name: wait-etcd image: busybox:1.28 imagePullPolicy: IfNotPresent command: - sh - '-c' - >- until nc -z apisix-etcd.apisix.svc.cluster.local 2379; do echo waiting for etcd `date`; sleep 2; done; resources: { } terminationMessagePath: /dev/termination-log terminationMessagePolicy: File containers: - name: apisix image: apache/apisix:3.2.0-debian imagePullPolicy: IfNotPresent ports: - name: http containerPort: 9080 protocol: TCP - name: tls containerPort: 9443 protocol: TCP - name: http2 containerPort: 9081 protocol: TCP - name: admin containerPort: 9180 protocol: TCP readinessProbe: failureThreshold: 6 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 tcpSocket: port: 9080 timeoutSeconds: 1 lifecycle: preStop: exec: command: - /bin/sh - -c - "sleep 30" volumeMounts: - name: apisix-config mountPath: /usr/local/apisix/conf/config.yaml subPath: config.yaml - name: ssl-certs mountPath: /ssl readOnly: true resources: requests: cpu: 250m memory: 512Mi limits: cpu: 250m memory: 512Mi restartPolicy: Always terminationGracePeriodSeconds: 30 dnsPolicy: ClusterFirst volumes: - name: apisix-config configMap: name: apisix-conf defaultMode: 420 - name: ssl-certs secret: secretName: apisix-secret --- apiVersion: v1 kind: ConfigMap metadata: name: apisix-conf namespace: apisix data: config.yaml: |- apisix: node_listen: - port: 9080 enable_http2: false - port: 9081 enable_http2: true node_listen: 9080 # APISIX listening port enable_admin: true enable_dev_mode: false # Sets nginx worker_processes to 1 if set to true enable_reuseport: true # Enable nginx SO_REUSEPORT switch if set to true. show_upstream_status_in_response_header: false # when true all upstream status write to `X-APISIX-Upstream-Status` otherwise only 5xx code enable_ipv6: false enable_server_tokens: true # Whether the APISIX version number should be shown in Server header. proxy_cache: # Proxy Caching configuration cache_ttl: 10s # The default caching time in disk if the upstream does not specify the cache time zones: # The parameters of a cache - name: disk_cache_one # The name of the cache, administrator can specify # which cache to use by name in the admin api (disk|memory) memory_size: 50m # The size of shared memory, it's used to store the cache index for # disk strategy, store cache content for memory strategy (disk|memory) disk_size: 1G # The size of disk, it's used to store the cache data (disk) disk_path: /tmp/disk_cache_one # The path to store the cache data (disk) cache_levels: 1:2 # The hierarchy levels of a cache (disk) - name: memory_cache memory_size: 50m router: http: 'radixtree_uri' # radixtree_uri: match route by uri(base on radixtree) # radixtree_host_uri: match route by host + uri(base on radixtree) ssl: 'radixtree_sni' # radixtree_sni: match route by SNI(base on radixtree) resolver_timeout: 5 enable_resolv_search_opt: true ssl: enable: true listen: - port: 9443 enable_http2: true cert: /ssl/tls.crt key: /ssl/tls.key ssl_protocols: TLSv1.2 TLSv1.3 ssl_ciphers: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_session_tickets: false nginx_config: error_log: logs/error.log error_log_level: warn # warn,error worker_processes: auto # if you want to use multiple cores in container, you can inject the number of cpu as environment variable "APISIX_WORKER_PROCESSES" enable_cpu_affinity: false # disable CPU affinity by default, if APISIX is deployed on a physical machine, it can be enabled and work well. worker_rlimit_nofile: 20480 # the number of files a worker process can open, should be larger than worker_connections worker_shutdown_timeout: 240s # timeout for a graceful shutdown of worker processes max_pending_timers: 16384 # increase it if you see "too many pending timers" error max_running_timers: 4096 # increase it if you see "lua_max_running_timers are not enough" error event: worker_connections: 10620 meta: lua_shared_dict: prometheus-metrics: 15m stream: enable_access_log: false # enable access log or not, default false access_log: logs/access_stream.log access_log_format: "$remote_addr [$time_local] $protocol $status $bytes_sent $bytes_received $session_time" # create your custom log format by visiting http://nginx.org/en/docs/varindex.html access_log_format_escape: default # allows setting json or default characters escaping in variables lua_shared_dict: etcd-cluster-health-check-stream: 10m lrucache-lock-stream: 10m plugin-limit-conn-stream: 10m http: enable_access_log: true # enable access log or not, default true access_log: logs/access.log access_log_format: "$remote_addr - $remote_user [$time_local] $http_host \"$request\" $status $body_bytes_sent $request_time \"$http_referer\" \"$http_user_agent\" $upstream_addr $upstream_status $upstream_response_time \"$upstream_scheme://$upstream_host$upstream_uri\"" access_log_format_escape: default # allows setting json or default characters escaping in variables keepalive_timeout: 60s # timeout during which a keep-alive client connection will stay open on the server side. client_header_timeout: 60s # timeout for reading client request header, then 408 (Request Time-out) error is returned to the client client_body_timeout: 60s # timeout for reading client request body, then 408 (Request Time-out) error is returned to the client client_max_body_size: 0 # The maximum allowed size of the client request body. # If exceeded, the 413 (Request Entity Too Large) error is returned to the client. # Note that unlike Nginx, we don't limit the body size by default. send_timeout: 10s # timeout for transmitting a response to the client.then the connection is closed underscores_in_headers: "on" # default enables the use of underscores in client request header fields real_ip_header: X-Real-IP # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header real_ip_recursive: "off" # http://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive real_ip_from: # http://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from - 127.0.0.1 - "unix:" proxy_ssl_server_name: true upstream: keepalive: 320 # Sets the maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. keepalive_requests: 1000 # Sets the maximum number of requests that can be served through one keepalive connection. keepalive_timeout: 60s # Sets a timeout during which an idle keepalive connection to an upstream server will stay open. charset: utf-8 # Adds the specified charset to the "Content-Type" response header field, see variables_hash_max_size: 2048 # Sets the maximum size of the variables hash table. lua_shared_dict: internal-status: 10m plugin-limit-req: 10m plugin-limit-count: 10m prometheus-metrics: 10m plugin-limit-conn: 10m upstream-healthcheck: 10m worker-events: 10m lrucache-lock: 10m balancer-ewma: 10m balancer-ewma-locks: 10m balancer-ewma-last-touched-at: 10m plugin-limit-count-redis-cluster-slot-lock: 1m tracing_buffer: 10m plugin-api-breaker: 10m etcd-cluster-health-check: 10m discovery: 1m jwks: 1m introspection: 10m access-tokens: 1m ext-plugin: 1m tars: 1m cas-auth: 10m graphql: max_size: 1048576 # the maximum size limitation of graphql in bytes, default 1MiB plugins: # plugin list (sorted by priority) - real-ip # priority: 23000 - ai # priority: 22900 - client-control # priority: 22000 - proxy-control # priority: 21990 - request-id # priority: 12015 - zipkin # priority: 12011 - ext-plugin-pre-req # priority: 12000 - fault-injection # priority: 11000 - mocking # priority: 10900 - serverless-pre-function # priority: 10000 - cors # priority: 4000 - ip-restriction # priority: 3000 - ua-restriction # priority: 2999 - referer-restriction # priority: 2990 - csrf # priority: 2980 - uri-blocker # priority: 2900 - request-validation # priority: 2800 - openid-connect # priority: 2599 - cas-auth # priority: 2597 - authz-casbin # priority: 2560 - authz-casdoor # priority: 2559 - wolf-rbac # priority: 2555 - ldap-auth # priority: 2540 - hmac-auth # priority: 2530 - basic-auth # priority: 2520 - jwt-auth # priority: 2510 - key-auth # priority: 2500 - consumer-restriction # priority: 2400 - forward-auth # priority: 2002 - opa # priority: 2001 - authz-keycloak # priority: 2000 - proxy-mirror # priority: 1010 - proxy-cache # priority: 1009 - proxy-rewrite # priority: 1008 - workflow # priority: 1006 - api-breaker # priority: 1005 - limit-conn # priority: 1003 - limit-count # priority: 1002 - limit-req # priority: 1001 - gzip # priority: 995 - server-info # priority: 990 - traffic-split # priority: 966 - redirect # priority: 900 - response-rewrite # priority: 899 - kafka-proxy # priority: 508 - grpc-transcode # priority: 506 - grpc-web # priority: 505 - public-api # priority: 501 - prometheus # priority: 500 - datadog # priority: 495 - elasticsearch-logger # priority: 413 - echo # priority: 412 - loggly # priority: 411 - http-logger # priority: 410 - splunk-hec-logging # priority: 409 - skywalking-logger # priority: 408 - google-cloud-logging # priority: 407 - sls-logger # priority: 406 - tcp-logger # priority: 405 - kafka-logger # priority: 403 - rocketmq-logger # priority: 402 - syslog # priority: 401 - udp-logger # priority: 400 - file-logger # priority: 399 - clickhouse-logger # priority: 398 - tencent-cloud-cls # priority: 397 - inspect # priority: 200 - example-plugin # priority: 0 - aws-lambda # priority: -1899 - azure-functions # priority: -1900 - openwhisk # priority: -1901 - openfunction # priority: -1902 - serverless-post-function # priority: -2000 - ext-plugin-post-req # priority: -3000 - ext-plugin-post-resp # priority: -4000 stream_plugins: # sorted by priority - ip-restriction # priority: 3000 - limit-conn # priority: 1003 - mqtt-proxy # priority: 1000 - syslog # priority: 401 plugin_attr: server-info: report_ttl: 60 # live time for server info in etcd (unit: second) log-rotate: interval: 3600 # rotate interval (unit: second) max_kept: 168 # max number of log files will be kept max_size: -1 # max size bytes of log files to be rotated, size check would be skipped with a value less than 0 enable_compression: false # enable log file compression(gzip) or not, default false prometheus: export_uri: /apisix/prometheus/metrics metric_prefix: apisix_ enable_export_server: true export_addr: ip: 127.0.0.1 port: 9091 deployment: role: traditional role_traditional: config_provider: etcd admin: admin_key: - name: "admin" key: wJk3P6dFqRl+El5CQL+66H1xEapmM6M496aJk4xjgQo role: admin - name: "viewer" key: 4054f7cf07e344346cd3f287985e76a2 role: viewer enable_admin_cors: true # Admin API support CORS response headers. allow_admin: - 0.0.0.0/0 # If we don't set any IP list, then any IP access is allowed by default. admin_listen: # use a separate port ip: 0.0.0.0 # Specific IP, if not set, the default value is `0.0.0.0`. port: 9180 # Specific port, which must be different from node_listen's port. admin_api_version: v3 # The version of admin api, the latest version is v3. etcd: host: - "http://apisix-etcd.apisix.svc.cluster.local:2379" prefix: /apisix # configuration prefix in etcd use_grpc: false # enable the experimental configuration sync via gRPC timeout: 30 # 30 seconds. Use a much higher timeout (like an hour) if the `use_grpc` is true. startup_retry: 2 # the number of retry to etcd during the startup, default to 2 --- apiVersion: v1 kind: Service metadata: name: apisix-admin namespace: apisix labels: app: apisix spec: ports: - name: apisix-admin protocol: TCP port: 9180 targetPort: 9180 selector: app: apisix type: ClusterIP --- apiVersion: v1 kind: Service metadata: name: apisix-gateway namespace: apisix labels: app: apisix spec: ports: - name: apisix-gateway-http protocol: TCP port: 80 targetPort: 9080 - name: apisix-gateway-https protocol: TCP port: 443 targetPort: 9443 - name: apisix-gateway-http2 protocol: TCP port: 81 targetPort: 9081 selector: app: apisix type: LoadBalancer externalTrafficPolicy: Cluster