From 8e187e26f5d6977aad1d434f2df61cce8fa1ce5b Mon Sep 17 00:00:00 2001 From: Jarvis Date: Fri, 10 Jul 2026 13:46:02 +0800 Subject: [PATCH 1/3] feat(gateway): raise prometheus-metrics and tracing_buffer shared-dict defaults Align the chart's overridden shared-dict sizes with the new gateway defaults so Helm-deployed gateways get the larger, non-evictable dicts without manual values overrides: - meta.luaSharedDict.prometheus-metrics: 15m -> 256m - http.luaSharedDict.tracing_buffer: 10m -> 32m Discovery (kubernetes/nacos/consul) and api-calls-for-portal are not templated by the chart, so they inherit the new image defaults directly. Regenerated README via helm-docs; bumped chart version 3.10.4 -> 3.10.5. Fixes api7/api7-ee-3-gateway#1869 --- charts/gateway/Chart.yaml | 2 +- charts/gateway/README.md | 4 ++-- charts/gateway/values.yaml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/charts/gateway/Chart.yaml b/charts/gateway/Chart.yaml index 348853a..05c25e5 100644 --- a/charts/gateway/Chart.yaml +++ b/charts/gateway/Chart.yaml @@ -16,7 +16,7 @@ type: application # Versions are expected to follow Semantic Versioning (https://semver.org/) # major.minor mirrors the API7 EE release line (3.10.x), patch is this chart's # own counter on that line and is decoupled from the app patch (see appVersion). -version: 3.10.4 +version: 3.10.5 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to diff --git a/charts/gateway/README.md b/charts/gateway/README.md index 4139cde..a7f2693 100644 --- a/charts/gateway/README.md +++ b/charts/gateway/README.md @@ -75,7 +75,7 @@ The command removes all the Kubernetes components associated with the chart and | apisix.extraLuaCPath | string | `""` | Extend lua_package_cpath to load third party Lua C libraries | | apisix.extraLuaPath | string | `""` | Extend lua_package_path to load third party Lua code | | apisix.hostNetwork | bool | `false` | Use the host's network namespace | -| apisix.http.luaSharedDict | object | `{"access-tokens":"1m","balancer-ewma":"10m","balancer-ewma-last-touched-at":"10m","balancer-ewma-locks":"10m","cas-auth":"10m","discovery":"1m","etcd-cluster-health-check":"10m","internal-status":"10m","introspection":"10m","jwks":"1m","lrucache-lock":"10m","plugin-ai-rate-limiting":"10m","plugin-ai-rate-limiting-reset-header":"10m","plugin-api-breaker":"10m","plugin-graphql-limit-count":"10m","plugin-graphql-limit-count-reset-header":"10m","plugin-limit-conn":"10m","plugin-limit-conn-redis-cluster-slot-lock":"1m","plugin-limit-count":"10m","plugin-limit-count-advanced":"10m","plugin-limit-count-advanced-redis-cluster-slot-lock":"1m","plugin-limit-count-redis-cluster-slot-lock":"1m","plugin-limit-req":"10m","plugin-limit-req-redis-cluster-slot-lock":"1m","status_report":"1m","tars":"1m","tracing_buffer":"10m","upstream-healthcheck":"10m","worker-events":"10m"}` | Shared dict settings for the HTTP subsystem | +| apisix.http.luaSharedDict | object | `{"access-tokens":"1m","balancer-ewma":"10m","balancer-ewma-last-touched-at":"10m","balancer-ewma-locks":"10m","cas-auth":"10m","discovery":"1m","etcd-cluster-health-check":"10m","internal-status":"10m","introspection":"10m","jwks":"1m","lrucache-lock":"10m","plugin-ai-rate-limiting":"10m","plugin-ai-rate-limiting-reset-header":"10m","plugin-api-breaker":"10m","plugin-graphql-limit-count":"10m","plugin-graphql-limit-count-reset-header":"10m","plugin-limit-conn":"10m","plugin-limit-conn-redis-cluster-slot-lock":"1m","plugin-limit-count":"10m","plugin-limit-count-advanced":"10m","plugin-limit-count-advanced-redis-cluster-slot-lock":"1m","plugin-limit-count-redis-cluster-slot-lock":"1m","plugin-limit-req":"10m","plugin-limit-req-redis-cluster-slot-lock":"1m","status_report":"1m","tars":"1m","tracing_buffer":"32m","upstream-healthcheck":"10m","worker-events":"10m"}` | Shared dict settings for the HTTP subsystem | | apisix.httpRouter | string | `"radixtree_host_uri"` | Defines how apisix handles routing: - radixtree_uri: match route by uri(base on radixtree) - radixtree_host_uri: match route by host + uri(base on radixtree) - radixtree_uri_with_parameter: match route by uri with parameters | | apisix.image.pullPolicy | string | `"Always"` | API7 Gateway image pull policy | | apisix.image.repository | string | `"api7/api7-ee-3-gateway"` | API7 Gateway image repository | @@ -87,7 +87,7 @@ The command removes all the Kubernetes components associated with the chart and | apisix.lru.secret.neg_ttl | int | `60` | TTL in seconds for cached negative (failed lookup) results | | apisix.lru.secret.ttl | int | `300` | TTL in seconds for cached secret values | | apisix.maxPostArgsReadableSize | int | `64` | Cap (in MB) on the request body read when matching `post_arg.*` route predicates for JSON and multipart requests. Set to 0 to disable the limit. | -| apisix.meta.luaSharedDict | object | `{"prometheus-metrics":"15m"}` | Shared dict settings for the `meta` context (used by both HTTP and stream subsystems) | +| apisix.meta.luaSharedDict | object | `{"prometheus-metrics":"256m"}` | Shared dict settings for the `meta` context (used by both HTTP and stream subsystems) | | apisix.nodeSelector | object | `{}` | Node labels for API7 Gateway pod assignment | | apisix.normalizeURILikeServlet | bool | `false` | The URI normalization in servlet is a little different from the RFC's. See https://github.com/jakartaee/servlet/blob/master/spec/src/main/asciidoc/servlet-spec-body.adoc#352-uri-path-canonicalization, which is used under Tomcat. Turn this option on if you want to be compatible with servlet when matching URI path. | | apisix.podAnnotations | object | `{}` | Annotations to add to each pod | diff --git a/charts/gateway/values.yaml b/charts/gateway/values.yaml index ce9a3dd..44fc1dc 100644 --- a/charts/gateway/values.yaml +++ b/charts/gateway/values.yaml @@ -99,7 +99,7 @@ apisix: meta: # -- Shared dict settings for the `meta` context (used by both HTTP and stream subsystems) luaSharedDict: - prometheus-metrics: 15m + prometheus-metrics: 256m stream: # -- Shared dict settings for the stream (L4 proxy) subsystem @@ -134,7 +134,7 @@ apisix: plugin-limit-count-redis-cluster-slot-lock: 1m plugin-limit-count-advanced: 10m plugin-limit-count-advanced-redis-cluster-slot-lock: 1m - tracing_buffer: 10m + tracing_buffer: 32m plugin-api-breaker: 10m etcd-cluster-health-check: 10m discovery: 1m From a939cc6385a8a27b2e6d3bf98b3aa0113034e504 Mon Sep 17 00:00:00 2001 From: Jarvis Date: Fri, 10 Jul 2026 14:24:31 +0800 Subject: [PATCH 2/3] feat(gateway): expose service discovery and portal shared dicts as chart values Add the service-discovery (kubernetes / nacos / consul) and api-calls-for-portal shared dicts as first-class chart values so operators can size them without knowing the raw config passthrough: - customLuaSharedDicts now defaults to kubernetes / nacos / consul at 64m - http.luaSharedDict gains api-calls-for-portal at 64m These match the gateway image defaults; custom_lua_shared_dict is deep-merged over the image config, so unlisted dicts (e.g. config) are preserved. --- charts/gateway/README.md | 4 ++-- charts/gateway/values.yaml | 15 ++++++++------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/charts/gateway/README.md b/charts/gateway/README.md index a7f2693..a4a9777 100644 --- a/charts/gateway/README.md +++ b/charts/gateway/README.md @@ -61,7 +61,7 @@ The command removes all the Kubernetes components associated with the chart and | api7ee.status_endpoint.ip | string | `"0.0.0.0"` | The IP address and port on which the status endpoint will listen. | | api7ee.status_endpoint.port | int | `7085` | The port on which the status endpoint will listen. | | apisix.affinity | object | `{}` | Set affinity for API7 Gateway deploy | -| apisix.customLuaSharedDicts | list | `[]` | Add custom [lua_shared_dict](https://github.com/openresty/lua-nginx-module#toc88) settings, click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict | +| apisix.customLuaSharedDicts | list | `[{"name":"kubernetes","size":"64m"},{"name":"nacos","size":"64m"},{"name":"consul","size":"64m"}]` | Add custom [lua_shared_dict](https://github.com/openresty/lua-nginx-module#toc88) settings, click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict | | apisix.customizedConfig | object | `{}` | If apisix.enableCustomizedConfig is true, full customized config.yaml. Please note that other settings about APISIX config will be ignored | | apisix.deleteURITailSlash | bool | `false` | Delete the '/' at the end of the URI | | apisix.dnsConfig | object | `{}` | Custom DNS settings for the APISIX pods | @@ -75,7 +75,7 @@ The command removes all the Kubernetes components associated with the chart and | apisix.extraLuaCPath | string | `""` | Extend lua_package_cpath to load third party Lua C libraries | | apisix.extraLuaPath | string | `""` | Extend lua_package_path to load third party Lua code | | apisix.hostNetwork | bool | `false` | Use the host's network namespace | -| apisix.http.luaSharedDict | object | `{"access-tokens":"1m","balancer-ewma":"10m","balancer-ewma-last-touched-at":"10m","balancer-ewma-locks":"10m","cas-auth":"10m","discovery":"1m","etcd-cluster-health-check":"10m","internal-status":"10m","introspection":"10m","jwks":"1m","lrucache-lock":"10m","plugin-ai-rate-limiting":"10m","plugin-ai-rate-limiting-reset-header":"10m","plugin-api-breaker":"10m","plugin-graphql-limit-count":"10m","plugin-graphql-limit-count-reset-header":"10m","plugin-limit-conn":"10m","plugin-limit-conn-redis-cluster-slot-lock":"1m","plugin-limit-count":"10m","plugin-limit-count-advanced":"10m","plugin-limit-count-advanced-redis-cluster-slot-lock":"1m","plugin-limit-count-redis-cluster-slot-lock":"1m","plugin-limit-req":"10m","plugin-limit-req-redis-cluster-slot-lock":"1m","status_report":"1m","tars":"1m","tracing_buffer":"32m","upstream-healthcheck":"10m","worker-events":"10m"}` | Shared dict settings for the HTTP subsystem | +| apisix.http.luaSharedDict | object | `{"access-tokens":"1m","api-calls-for-portal":"64m","balancer-ewma":"10m","balancer-ewma-last-touched-at":"10m","balancer-ewma-locks":"10m","cas-auth":"10m","discovery":"1m","etcd-cluster-health-check":"10m","internal-status":"10m","introspection":"10m","jwks":"1m","lrucache-lock":"10m","plugin-ai-rate-limiting":"10m","plugin-ai-rate-limiting-reset-header":"10m","plugin-api-breaker":"10m","plugin-graphql-limit-count":"10m","plugin-graphql-limit-count-reset-header":"10m","plugin-limit-conn":"10m","plugin-limit-conn-redis-cluster-slot-lock":"1m","plugin-limit-count":"10m","plugin-limit-count-advanced":"10m","plugin-limit-count-advanced-redis-cluster-slot-lock":"1m","plugin-limit-count-redis-cluster-slot-lock":"1m","plugin-limit-req":"10m","plugin-limit-req-redis-cluster-slot-lock":"1m","status_report":"1m","tars":"1m","tracing_buffer":"32m","upstream-healthcheck":"10m","worker-events":"10m"}` | Shared dict settings for the HTTP subsystem | | apisix.httpRouter | string | `"radixtree_host_uri"` | Defines how apisix handles routing: - radixtree_uri: match route by uri(base on radixtree) - radixtree_host_uri: match route by host + uri(base on radixtree) - radixtree_uri_with_parameter: match route by uri with parameters | | apisix.image.pullPolicy | string | `"Always"` | API7 Gateway image pull policy | | apisix.image.repository | string | `"api7/api7-ee-3-gateway"` | API7 Gateway image repository | diff --git a/charts/gateway/values.yaml b/charts/gateway/values.yaml index 44fc1dc..e20503d 100644 --- a/charts/gateway/values.yaml +++ b/charts/gateway/values.yaml @@ -144,6 +144,7 @@ apisix: tars: 1m cas-auth: 10m status_report: 1m + api-calls-for-portal: 64m # -- fine tune the parameters of LRU cache for some features like secret lru: @@ -163,15 +164,15 @@ apisix: # -- Add custom [lua_shared_dict](https://github.com/openresty/lua-nginx-module#toc88) settings, # click [here](https://github.com/apache/apisix-helm-chart/blob/master/charts/apisix/values.yaml#L27-L30) to learn the format of a shared dict - customLuaSharedDicts: [] - # - name: kubernetes - # size: 20m - # - name: nacos - # size: 20m + customLuaSharedDicts: + - name: kubernetes + size: 64m + - name: nacos + size: 64m + - name: consul + size: 64m # - name: foo # size: 10k - # - name: bar - # size: 1m # -- Extend lua_package_path to load third party Lua code extraLuaPath: "" From 22a4877091de357a5e678602e9057149b88f9f9e Mon Sep 17 00:00:00 2001 From: Jarvis Date: Fri, 10 Jul 2026 14:47:11 +0800 Subject: [PATCH 3/3] fix(gateway): raise nacos-stream shared dict to 64m to match http nacos Keep stream-mode Nacos discovery sized in line with the http nacos dict so it does not reject newly discovered nodes at scale. --- charts/gateway/README.md | 2 +- charts/gateway/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/gateway/README.md b/charts/gateway/README.md index a4a9777..8f4f2af 100644 --- a/charts/gateway/README.md +++ b/charts/gateway/README.md @@ -113,7 +113,7 @@ The command removes all the Kubernetes components associated with the chart and | apisix.securityContext | object | `{}` | Set the securityContext for API7 Gateway container | | apisix.setIDFromPodUID | bool | `false` | Use Pod metadata.uid as the APISIX id. | | apisix.showUpstreamStatusInResponseHeader | bool | `false` | When true, the upstream status is always written to the `X-APISIX-Upstream-Status` response header; when false, it is written only for 5xx responses | -| apisix.stream.luaSharedDict | object | `{"config-stream":"5m","etcd-cluster-health-check-stream":"10m","lrucache-lock-stream":"10m","nacos-stream":"20m","plugin-limit-conn-stream":"10m","tars-stream":"1m","worker-events-stream":"10m"}` | Shared dict settings for the stream (L4 proxy) subsystem | +| apisix.stream.luaSharedDict | object | `{"config-stream":"5m","etcd-cluster-health-check-stream":"10m","lrucache-lock-stream":"10m","nacos-stream":"64m","plugin-limit-conn-stream":"10m","tars-stream":"1m","worker-events-stream":"10m"}` | Shared dict settings for the stream (L4 proxy) subsystem | | apisix.terminationGracePeriodSeconds | int | `30` | termination grace period for API7 Gateway pods | | apisix.timezone | string | `""` | timezone is the timezone where apisix uses. For example: "UTC" or "Asia/Shanghai" This value will be set on apisix container's environment variable TZ. You may need to set the timezone to be consistent with your local time zone, otherwise the apisix's logs may used to retrieve event maybe in wrong timezone. | | apisix.tolerations | list | `[]` | List of node taints to tolerate | diff --git a/charts/gateway/values.yaml b/charts/gateway/values.yaml index e20503d..58e44cf 100644 --- a/charts/gateway/values.yaml +++ b/charts/gateway/values.yaml @@ -110,7 +110,7 @@ apisix: worker-events-stream: 10m tars-stream: 1m config-stream: 5m - nacos-stream: 20m + nacos-stream: 64m http: # -- Shared dict settings for the HTTP subsystem