fix(apisix): align bundled controller listener port matching default

.github/workflows/ci.yaml

@@ -33,6 +33,7 @@ jobs:
                && cd ../.. \
                && helm repo add bitnami https://charts.bitnami.com/bitnami \
                && helm repo add apisix https://apache.github.io/apisix-helm-chart \
+               && bash test/umbrella-listener-port-default.sh \
                && ct lint \
                   --validate-maintainers=false \
                   --charts charts/apisix \

charts/apisix/Chart.yaml

@@ -31,7 +31,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.18.2
+version: 2.18.3
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/apisix/README.md

@@ -34,6 +34,10 @@ helm delete [RELEASE_NAME] --namespace ingress-apisix
 
 The command removes all the Kubernetes components associated with the chart and deletes the release.
 
+## Upgrading to 2.18.3
+
+The bundled ingress controller now defaults `ingress-controller.config.listenerPortMatchMode` to `off`, matching the controller 2.2.0 default. This avoids adding `server_port` route predicates based on Gateway listener ports when a Service maps them to different APISIX container ports (for example, 80 to 9080). If your routes rely on listener-port matching, explicitly set this value to `auto` or `explicit` before upgrading.
+
 ## Parameters
 
 ## Values
@@ -252,7 +256,8 @@ The command removes all the Kubernetes components associated with the chart and
 | image.repository | string | `"apache/apisix"` | Apache APISIX image repository |
 | image.tag | string | `"3.19.0-ubuntu"` | Apache APISIX image tag Overrides the image tag whose default is the chart appVersion. |
 | ingress | object | `{"annotations":{},"enabled":false,"hosts":[{"host":"apisix.local","paths":[]}],"servicePort":null,"tls":[]}` | Using ingress access Apache APISIX service |
-| ingress-controller | object | `{"enabled":false,"webhook":{"enabled":false}}` | Ingress controller configuration |
+| ingress-controller | object | `{"config":{"listenerPortMatchMode":"off"},"enabled":false,"webhook":{"enabled":false}}` | Ingress controller configuration |
+| ingress-controller.config.listenerPortMatchMode | string | `"off"` | Controls Gateway listener port matching. Defaults to off to avoid matching Service ports against different APISIX container ports; set auto or explicit to opt in. |
 | ingress-controller.enabled | bool | `false` | Enable the apisix-ingress-controller sub-chart |
 | ingress.annotations | object | `{}` | Ingress annotations |
 | ingress.enabled | bool | `false` | Enable an Ingress resource in front of the APISIX service |

charts/apisix/README.md.gotmpl

@@ -34,6 +34,10 @@ helm delete [RELEASE_NAME] --namespace ingress-apisix
 
 The command removes all the Kubernetes components associated with the chart and deletes the release.
 
+## Upgrading to 2.18.3
+
+The bundled ingress controller now defaults `ingress-controller.config.listenerPortMatchMode` to `off`, matching the controller 2.2.0 default. This avoids adding `server_port` route predicates based on Gateway listener ports when a Service maps them to different APISIX container ports (for example, 80 to 9080). If your routes rely on listener-port matching, explicitly set this value to `auto` or `explicit` before upgrading.
+
 ## Parameters
 
 {{ template "chart.valuesSection" . }}

charts/apisix/values.yaml

@@ -905,6 +905,9 @@ etcd:
 
 # -- Ingress controller configuration
 ingress-controller:
+  config:
+    # -- Controls Gateway listener port matching. Defaults to off to avoid matching Service ports against different APISIX container ports; set auto or explicit to opt in.
+    listenerPortMatchMode: "off"
   # -- Enable the apisix-ingress-controller sub-chart
   enabled: false
   webhook:

test/umbrella-listener-port-default.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+# Exercise the published dependency, not the sibling controller chart.
+chart="charts/apisix"
+render_config() {
+  helm template test "$chart" --set ingress-controller.enabled=true \
+    --show-only charts/ingress-controller/templates/configmap.yaml "$@"
+}
+
+config=$(render_config)
+grep -q '^    listener_port_match_mode: off$' <<<"$config"
+for mode in off auto explicit; do
+  config=$(render_config --set "ingress-controller.config.listenerPortMatchMode=$mode")
+  grep -q "^    listener_port_match_mode: $mode$" <<<"$config"
+done