From a5c7b2a60bd14ce3e2f23bd9a7c2b829738b5a17 Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@api7.ai>
Date: Thu, 29 Oct 2026 09:30:34 +0000
Subject: [PATCH 1/6] chore(aisix-cp): sync helm/aisix-cp from AISIX-Cloud
 v1.8.0-rc.1

Carries AISIX-Cloud#1949: drops the chart-1.5.0 compatibility layer (_legacy-env.tpl and its _env.tpl branch, apiEnvFromUI, the <release>-ui Service, ui.service and ui.extraEnvVars). Public adaptations (docker.io registries, tag defaulting to appVersion, NOTES gateway image, README) are kept.
---
 charts/aisix-cp/README.md                     |  8 +-
 charts/aisix-cp/templates/_env.tpl            | 45 +++------
 charts/aisix-cp/templates/_legacy-env.tpl     | 99 -------------------
 charts/aisix-cp/templates/api-deployment.yaml | 19 +---
 charts/aisix-cp/templates/dpm-deployment.yaml |  2 +-
 charts/aisix-cp/templates/ui-service.yaml     | 22 -----
 charts/aisix-cp/values.yaml                   | 33 +------
 7 files changed, 19 insertions(+), 209 deletions(-)
 delete mode 100644 charts/aisix-cp/templates/_legacy-env.tpl
 delete mode 100644 charts/aisix-cp/templates/ui-service.yaml

diff --git a/charts/aisix-cp/README.md b/charts/aisix-cp/README.md
index b92c4d0..9a9021c 100644
--- a/charts/aisix-cp/README.md
+++ b/charts/aisix-cp/README.md
@@ -410,7 +410,7 @@ plane and hands out the gateway image from the same release as the chart.
 | api.deploymentMode | string | `"on-premises"` | How this control plane is deployed: `on-premises` or `saas`. `on-premises` serves one company's organizations: nobody signs up on their own (accounts come from invitations), organizations cannot be created, billing is off, and cp-api's outbound calls may reach private addresses unless api.outbound.ssrfProtection says otherwise. `saas` is the multi-tenant hosted service — open sign-up, organization creation and billing — and requires twoDSN.enabled, which `on-premises` refuses |
 | api.dpImage | string | `""` | Gateway image the console hands out in the install snippets it generates for a new data plane. Empty uses cp-api's own default: the gateway of the same release, docker.io/api7/aisix:<cp-api version>, or ghcr.io/api7/aisix:dev on a build that is not a release. The Helm snippet takes only its repository; the gateway chart's appVersion picks the tag |
 | api.dpmgrBaseURL | string | `""` | dp-manager /dp/* mTLS endpoint that data-plane hosts dial, as baked into the generated install snippets. Also passed to the dpm deployment, which seeds this host into the TLS server certificate it presents — so an IP address works here, not only a DNS name. When dpm.service.type is NodePort, use https://<node-ip>:<dpm-node-port>. |
-| api.extraEnvVars | list | `[]` | Extra environment for cp-api: system-level settings only (for example TZ). Every cp-api setting has its own value in this section; an env var set here for one of them still overrides the rendered config file, which is how values set this way before those keys existed keep working. Overriding a name the chart itself sets is only a compatibility path for existing deployments. For a name chart 1.5.0 already set, the chart keeps its own entry ahead of yours, so the name appears twice and Helm 4's server-side apply rejects the install. New installs set the value in this file instead. |
+| api.extraEnvVars | list | `[]` | Extra environment for cp-api: system-level settings only (for example TZ). Every cp-api setting has its own value in this section; an env var set here for one of them still overrides the rendered config file, which is how values set this way before those keys existed keep working. Overriding a name the chart itself sets is only a compatibility path for existing deployments: the chart then drops its own entry for that name. New installs set the value in this file instead. |
 | api.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | api.image.repository | string | `"docker.io/api7/aisix-cp-api"` | cp-api image repository |
 | api.image.tag | string | `""` | Image tag |
@@ -457,7 +457,7 @@ plane and hands out the gateway image from the same release as the chart.
 | api.trustedOrigins | list | `[]` | Extra origins the console accepts sign-in from, as bare origins (https://host[:port]) or `https://*<suffix>` patterns. The api.publicBaseURL origin and its loopback twin are always trusted; add another hostname of this console here, or the local address of a port-forward that differs from api.publicBaseURL. An entry cp-api cannot read as an origin is logged and ignored. |
 | api.trustedProxies | list | `[]` | Reverse proxies (CIDRs, e.g. `10.0.0.0/8`) in front of cp-api whose X-Forwarded-For cp-api believes. Console sign-in and password reset rate limiting, and the client address recorded on a session, then use the first address from the right that is not one of these proxies. Empty — the default — uses the address of whatever connected to cp-api, so behind an ingress every client shares the ingress's rate-limit budget. List only proxies you run: a range listed here can name any client address it likes. |
 | dpm.affinity | object | `{}` | Affinity rules for the dp-manager pod |
-| dpm.extraEnvVars | list | `[]` | Extra environment for dp-manager: system-level settings only (for example TZ). An env var set here for a dp-manager setting still overrides the rendered config file. Overriding a name the chart itself sets is only a compatibility path for existing deployments. For a name chart 1.5.0 already set, the chart keeps its own entry ahead of yours, so the name appears twice and Helm 4's server-side apply rejects the install. New installs set the value in this file instead. |
+| dpm.extraEnvVars | list | `[]` | Extra environment for dp-manager: system-level settings only (for example TZ). An env var set here for a dp-manager setting still overrides the rendered config file. Overriding a name the chart itself sets is only a compatibility path for existing deployments: the chart then drops its own entry for that name. New installs set the value in this file instead. |
 | dpm.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | dpm.image.repository | string | `"docker.io/api7/aisix-cp-dpm"` | dp-manager image repository |
 | dpm.image.tag | string | `""` | Image tag |
@@ -512,7 +512,3 @@ plane and hands out the gateway image from the same release as the chart.
 | twoDSN.existingSecretKey | string | `"serving-password"` | Key inside twoDSN.existingSecret holding the serving password |
 | twoDSN.servingPassword | string | `""` | Password cp-api assigns to the cp_api_app serving role and uses in the serving DSN. Required when enabled unless existingSecret is set. Use a URL-safe value, from `openssl rand -hex 24`: it is embedded in a `postgres://` DSN, so `+`, `/` and `=` corrupt URL parsing |
 | ui.defaultLocale | string | `"en"` | Default language for this deployment. Supported: "en", "zh". It is the fallback the console and the emails cp-api sends use when none of the console's language picker, the organization's language setting or the browser's own language names a supported language (default English). |
-| ui.extraEnvVars | list | `[]` | Kept for installs upgraded from chart 1.5.0, which ran a separate dashboard. Of what that release was told to set here, AISIX_TRUSTED_ORIGINS and AISIX_AUTH_BEARER_SESSIONS are carried to cp-api (unless api.extraEnvVars sets the same name); nothing else is read. Set api.extraEnvVars instead. |
-| ui.service.nodePort | string | `""` | Optional fixed NodePort. Used only when type is NodePort; leave empty to let Kubernetes allocate a port dynamically. This plain-HTTP endpoint reaches cp-api exactly as the api Service does; terminate TLS in front of it unless it is on a trusted network. |
-| ui.service.port | int | `3000` | Port of the dashboard Service kept from chart 1.5.0; it forwards to cp-api |
-| ui.service.type | string | `"ClusterIP"` | Type of the dashboard Service kept from chart 1.5.0 |
diff --git a/charts/aisix-cp/templates/_env.tpl b/charts/aisix-cp/templates/_env.tpl
index 2a678f1..7a576af 100644
--- a/charts/aisix-cp/templates/_env.tpl
+++ b/charts/aisix-cp/templates/_env.tpl
@@ -1,53 +1,30 @@
 {{/*
 A container's env list. Arguments:
   chart   the entries the chart renders now (a rendered YAML list)
-  legacy  the entries chart 1.5.0 rendered ("aisix-cp.legacyEnv.<component>")
   extra   the component's extraEnvVars, emitted last, verbatim and in order
 
-When extraEnvVars sets a name the chart also renders, what happens to the
-chart's entry depends on whether 1.5.0 rendered that name:
+When extraEnvVars sets a name the chart also renders, the chart's entry is
+omitted: a duplicate env name breaks `helm rollback` followed by an
+env-changing upgrade and is rejected by Helm 4's server-side apply. Unless
+something between the two, or the override itself, expands `$(NAME)`: the
+kubelet resolves a reference only against entries defined earlier, so it
+has always resolved to the chart's value, and the entry stays so that it
+still does.
 
-- It did: the chart still emits an entry before the user's — its current one,
-  or, for a name that moved into the config file, the 1.5.0 entry. A 1.5.0
-  install carries that name twice, and an upgrade that renders it fewer times
-  loses the user's override (see _legacy-env.tpl).
-- It did not: the chart's entry is omitted. A duplicate env name breaks
-  `helm rollback` followed by an env-changing upgrade and is rejected by
-  Helm 4's server-side apply. Unless something between the two, or the
-  override itself, expands `$(NAME)`: the kubelet resolves a reference only against entries defined
-  earlier, so it has always resolved to the chart's value, and the entry
-  stays so that it still does.
-
-Either way the user's later entry is the one that takes effect, exactly as
-before.
+Either way the user's later entry is the one that takes effect.
 */}}
 {{- define "aisix-cp.env" -}}
 {{- $chart := .chart | fromYamlArray }}
 {{- $extra := .extra | default list }}
-{{- $legacy := .legacy | fromYamlArray }}
-{{- $legacyNames := dict }}
-{{- range $legacy }}
-{{- $_ := set $legacyNames .name true }}
-{{- end }}
-{{- $chartNames := dict }}
-{{- range $chart }}
-{{- $_ := set $chartNames .name true }}
-{{- end }}
 {{- $userNames := dict }}
 {{- range $extra }}
 {{- $_ := set $userNames .name true }}
 {{- end }}
-{{- $moved := list }}
-{{- range $legacy }}
-{{- if and (hasKey $userNames .name) (not (hasKey $chartNames .name)) }}
-{{- $moved = append $moved . }}
-{{- end }}
-{{- end }}
-{{- $all := concat $chart $moved $extra }}
+{{- $all := concat $chart $extra }}
 {{- $out := list }}
 {{- range $i, $entry := $chart }}
 {{- $keep := true }}
-{{- if and (hasKey $userNames $entry.name) (not (hasKey $legacyNames $entry.name)) }}
+{{- if hasKey $userNames $entry.name }}
 {{- $override := 0 }}
 {{- range $j, $e := $all }}
 {{- if and (eq $override 0) (gt $j $i) (eq $e.name $entry.name) }}
@@ -66,7 +43,7 @@ before.
 {{- $out = append $out $entry }}
 {{- end }}
 {{- end }}
-{{- with concat $out $moved $extra }}
+{{- with concat $out $extra }}
 {{- toYaml . }}
 {{- end }}
 {{- end }}
diff --git a/charts/aisix-cp/templates/_legacy-env.tpl b/charts/aisix-cp/templates/_legacy-env.tpl
deleted file mode 100644
index 06c4d8d..0000000
--- a/charts/aisix-cp/templates/_legacy-env.tpl
+++ /dev/null
@@ -1,99 +0,0 @@
-{{/*
-The env block each Deployment rendered in chart 1.5.0, under the same
-conditions and with the same values — the last release that passed
-application settings as env. Nothing renders these lists directly: the
-"aisix-cp.env" helper reads their names, and emits one of these entries only
-when the component's extraEnvVars sets that name and the current chart no
-longer does.
-
-That is what keeps a 1.5.0 install's override across the upgrade. Its
-Deployment carries the name twice (the chart's entry, then the user's), and
-when the upgraded manifest carries it fewer times, Helm 3's three-way patch
-deletes both — the override is lost until a second upgrade puts it back.
-
-Freeze these: they describe a released chart, not the current one.
-AISIX_CLOUD_DP_IMAGE is rendered always, because 1.5.0 defaulted api.dpImage
-to an image where this chart defaults it to empty; the default here is the
-one 1.5.0 carried. At the release-time sync to the public chart it takes the
-public 1.5.0 default, docker.io/api7/aisix:1.5.0.
-*/}}
-{{- define "aisix-cp.legacyEnv.api" -}}
-- name: PGPASSWORD
-{{- if .Values.twoDSN.enabled }}
-- name: SERVING_PGPASSWORD
-{{- end }}
-- name: AISIX_CLOUD_LISTEN
-  value: ":8080"
-{{- if .Values.api.metrics.enabled }}
-- name: AISIX_CLOUD_METRICS_LISTEN
-  value: {{ printf ":%v" .Values.api.metrics.port | quote }}
-{{- end }}
-{{- if .Values.twoDSN.enabled }}
-- name: AISIX_CLOUD_ADMIN_DATABASE_URL
-  value: {{ include "aisix-cp.legacyDatabaseURL" . }}
-- name: AISIX_CLOUD_DATABASE_URL
-  value: postgres://cp_api_app:$(SERVING_PGPASSWORD)@{{ include "aisix-cp.pgHost" . }}:{{ include "aisix-cp.pgPort" . }}/{{ include "aisix-cp.pgDatabase" . }}?sslmode={{ include "aisix-cp.pgSSLMode" . }}
-{{- else }}
-- name: AISIX_CLOUD_DATABASE_URL
-  value: {{ include "aisix-cp.legacyDatabaseURL" . }}
-{{- end }}
-- name: AISIX_CLOUD_PUBLIC_BASE_URL
-  value: {{ .Values.api.publicBaseURL | quote }}
-{{- with .Values.api.corsAllowedOrigins }}
-- name: AISIX_CLOUD_CORS_ALLOWED_ORIGINS
-  value: {{ join "," . | quote }}
-{{- end }}
-- name: AISIX_CLOUD_MASTER_KEY
-- name: AISIX_CLOUD_MASTER_KEY_ID
-  value: {{ .Values.secrets.masterKeyID | quote }}
-- name: AISIX_CLOUD_DASHBOARD_URL
-  value: "http://{{ include "aisix-cp.fullname" . }}-ui:{{ .Values.ui.service.port }}"
-{{- if .Values.api.dpmgrBaseURL }}
-- name: AISIX_CLOUD_DPMGR_BASE_URL
-  value: {{ .Values.api.dpmgrBaseURL | quote }}
-{{- end }}
-- name: AISIX_CLOUD_OAUTH_ENABLED
-  value: {{ .Values.api.oauthEnabled | quote }}
-{{- if .Values.api.playgroundAllowPrivateIPs }}
-- name: AISIX_PLAYGROUND_ALLOW_PRIVATE_IPS
-  value: "1"
-{{- end }}
-{{- if .Values.api.notifyAllowPrivateURLs }}
-- name: AISIX_CLOUD_NOTIFY_ALLOW_PRIVATE_URLS
-  value: "true"
-{{- end }}
-- name: AISIX_CLOUD_DP_IMAGE
-  value: {{ .Values.api.dpImage | default "docker.io/api7/aisix:1.5.0" | quote }}
-{{- end }}
-
-{{- define "aisix-cp.legacyEnv.dpm" -}}
-- name: PGPASSWORD
-- name: AISIX_DPMGR_LISTEN
-  value: ":7944"
-- name: AISIX_DPMGR_HEALTH_LISTEN
-  value: {{ .Values.dpm.service.healthListen | quote }}
-{{- if .Values.api.dpmgrBaseURL }}
-- name: AISIX_DPMGR_BASE_URL
-  value: {{ .Values.api.dpmgrBaseURL | quote }}
-{{- end }}
-- name: AISIX_DPMGR_DATABASE_URL
-  value: {{ include "aisix-cp.legacyDatabaseURL" . }}
-- name: AISIX_DPMGR_MASTER_KEY
-- name: AISIX_DPMGR_MASTER_KEY_ID
-  value: {{ .Values.secrets.masterKeyID | quote }}
-{{- end }}
-
-{{- define "aisix-cp.legacyEnv.ui" -}}
-- name: PGPASSWORD
-- name: BETTER_AUTH_URL
-  value: {{ .Values.api.publicBaseURL | quote }}
-- name: BETTER_AUTH_SECRET
-- name: AISIX_CLOUD_DATABASE_URL
-  value: {{ include "aisix-cp.legacyDatabaseURL" . }}
-- name: AISIX_DASHBOARD_LOCALE
-  value: {{ .Values.ui.defaultLocale | quote }}
-{{- end }}
-
-{{- define "aisix-cp.legacyDatabaseURL" -}}
-postgres://{{ include "aisix-cp.pgUser" . }}:$(PGPASSWORD)@{{ include "aisix-cp.pgHost" . }}:{{ include "aisix-cp.pgPort" . }}/{{ include "aisix-cp.pgDatabase" . }}?sslmode={{ include "aisix-cp.pgSSLMode" . }}
-{{- end }}
diff --git a/charts/aisix-cp/templates/api-deployment.yaml b/charts/aisix-cp/templates/api-deployment.yaml
index 0d43d02..d4883a6 100644
--- a/charts/aisix-cp/templates/api-deployment.yaml
+++ b/charts/aisix-cp/templates/api-deployment.yaml
@@ -51,7 +51,7 @@ spec:
               protocol: TCP
             {{- end }}
           env:
-            {{- include "aisix-cp.env" (dict "chart" (include "aisix-cp.apiEnv" .) "legacy" (include "aisix-cp.legacyEnv.api" .) "extra" (concat (include "aisix-cp.apiEnvFromUI" . | fromYamlArray) (.Values.api.extraEnvVars | default list))) | nindent 12 }}
+            {{- include "aisix-cp.env" (dict "chart" (include "aisix-cp.apiEnv" .) "extra" .Values.api.extraEnvVars) | nindent 12 }}
           # cp-api runs the schema migration (db.OpenAndMigrate) before
           # it binds :8080, so /healthz does not answer for the whole
           # migration. On an upgrade against a populated database that
@@ -218,20 +218,3 @@ spec:
       key: {{ include "aisix-cp.servingPasswordSecretKey" . }}
 {{- end }}
 {{- end }}
-
-{{- /*
-COMPAT-SINCE: 1.5.0 #1756 — console sign-in moved from the dashboard to cp-api, and a 1.5.0 install was told (NOTES.txt) to put AISIX_TRUSTED_ORIGINS in ui.extraEnvVars (a preview upstream AISIX_AUTH_BEARER_SESSIONS); carry those to cp-api, ahead of api.extraEnvVars and only when that does not set the same name, so an upgraded install keeps its extra sign-in origins. Remove once no supported install can still carry 1.5.0 values.
-*/}}
-{{- define "aisix-cp.apiEnvFromUI" -}}
-{{- $apiNames := list }}
-{{- range .Values.api.extraEnvVars }}
-{{- $apiNames = append $apiNames .name }}
-{{- end }}
-{{- $out := list }}
-{{- range .Values.ui.extraEnvVars }}
-{{- if and (has .name (list "AISIX_TRUSTED_ORIGINS" "AISIX_AUTH_BEARER_SESSIONS")) (not (has .name $apiNames)) }}
-{{- $out = append $out . }}
-{{- end }}
-{{- end }}
-{{- toYaml $out }}
-{{- end }}
diff --git a/charts/aisix-cp/templates/dpm-deployment.yaml b/charts/aisix-cp/templates/dpm-deployment.yaml
index 538cd99..bbcdc7c 100644
--- a/charts/aisix-cp/templates/dpm-deployment.yaml
+++ b/charts/aisix-cp/templates/dpm-deployment.yaml
@@ -51,7 +51,7 @@ spec:
               protocol: TCP
             {{- end }}
           env:
-            {{- include "aisix-cp.env" (dict "chart" (include "aisix-cp.dpmEnv" .) "legacy" (include "aisix-cp.legacyEnv.dpm" .) "extra" .Values.dpm.extraEnvVars) | nindent 12 }}
+            {{- include "aisix-cp.env" (dict "chart" (include "aisix-cp.dpmEnv" .) "extra" .Values.dpm.extraEnvVars) | nindent 12 }}
           # Probe the plain-HTTP /healthz (poller liveness), not the
           # mTLS port: a kubelet cannot present a client cert, and a
           # TCP check on 7944 stays green even if the outbox poller is
diff --git a/charts/aisix-cp/templates/ui-service.yaml b/charts/aisix-cp/templates/ui-service.yaml
deleted file mode 100644
index f421139..0000000
--- a/charts/aisix-cp/templates/ui-service.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
-{{- /*
-COMPAT-SINCE: 1.5.0 #1758 — chart 1.5.0 ran the dashboard behind this Service, and offered it as a NodePort for a same-origin proxy that sends pages here and /api/* to cp-api. cp-api serves the dashboard itself now, so the Service keeps its name, type, port and nodePort but selects the api pods; such a proxy keeps working unchanged. Remove once no supported install can still carry 1.5.0 values.
-*/ -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "aisix-cp.fullname" . }}-ui
-  labels:
-    {{- include "aisix-cp.labels" . | nindent 4 }}
-    {{- include "aisix-cp.selectorLabels" (dict "root" . "component" "ui") | nindent 4 }}
-spec:
-  type: {{ .Values.ui.service.type }}
-  ports:
-    - port: {{ .Values.ui.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-      {{- if and (eq .Values.ui.service.type "NodePort") .Values.ui.service.nodePort }}
-      nodePort: {{ .Values.ui.service.nodePort }}
-      {{- end }}
-  selector:
-    {{- include "aisix-cp.selectorLabels" (dict "root" . "component" "api") | nindent 4 }}
diff --git a/charts/aisix-cp/values.yaml b/charts/aisix-cp/values.yaml
index 4bd3f6b..7421b6d 100644
--- a/charts/aisix-cp/values.yaml
+++ b/charts/aisix-cp/values.yaml
@@ -116,10 +116,8 @@ api:
   # set here for one of them still overrides the rendered config file, which
   # is how values set this way before those keys existed keep working.
   # Overriding a name the chart itself sets is only a compatibility path for
-  # existing deployments. For a name chart 1.5.0 already set, the chart keeps
-  # its own entry ahead of yours, so the name appears twice and Helm 4's
-  # server-side apply rejects the install. New installs set the value in this
-  # file instead.
+  # existing deployments: the chart then drops its own entry for that name.
+  # New installs set the value in this file instead.
   extraEnvVars: []
   # -- Publicly reachable cp-api URL. Console sign-in trusts this origin (and
   # its localhost/127.0.0.1 twin), so a value that does not match the address
@@ -436,10 +434,8 @@ dpm:
   # example TZ). An env var set here for a dp-manager setting still
   # overrides the rendered config file.
   # Overriding a name the chart itself sets is only a compatibility path for
-  # existing deployments. For a name chart 1.5.0 already set, the chart keeps
-  # its own entry ahead of yours, so the name appears twice and Helm 4's
-  # server-side apply rejects the install. New installs set the value in this
-  # file instead.
+  # existing deployments: the chart then drops its own entry for that name.
+  # New installs set the value in this file instead.
   extraEnvVars: []
 
 ## @section dashboard
@@ -453,27 +449,6 @@ ui:
   # the browser's own language names a supported language (default
   # English).
   defaultLocale: "en"
-  ## Chart 1.5.0 ran the dashboard behind its own Service, and a same-origin
-  ## proxy may still send pages to it. The Service stays, under the same
-  ## name, and now reaches cp-api, which serves the console at every path —
-  ## so pointing such a proxy (or anything else) at the api Service instead
-  ## is equivalent. New installs do not need it.
-  service:
-    # -- Type of the dashboard Service kept from chart 1.5.0
-    type: ClusterIP
-    # -- Port of the dashboard Service kept from chart 1.5.0; it forwards to cp-api
-    port: 3000
-    # -- Optional fixed NodePort. Used only when type is NodePort; leave empty
-    # to let Kubernetes allocate a port dynamically. This plain-HTTP endpoint
-    # reaches cp-api exactly as the api Service does; terminate TLS in front
-    # of it unless it is on a trusted network.
-    nodePort: ""
-  # -- Kept for installs upgraded from chart 1.5.0, which ran a separate
-  # dashboard. Of what that release was told to set here, AISIX_TRUSTED_ORIGINS
-  # and AISIX_AUTH_BEARER_SESSIONS are carried to cp-api (unless
-  # api.extraEnvVars sets the same name); nothing else is read. Set
-  # api.extraEnvVars instead.
-  extraEnvVars: []
 
 ## @section ServiceAccount
 serviceAccount:

From 50c190cbd937731f9191e7d9bf3806c6216cc011 Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@api7.ai>
Date: Wed, 28 Oct 2026 08:08:16 +0000
Subject: [PATCH 2/6] feat(aisix): add config.proxy.expose_debug_headers

---
 charts/aisix/README.md   | 1 +
 charts/aisix/values.yaml | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/charts/aisix/README.md b/charts/aisix/README.md
index 9358ac9..70abfd2 100644
--- a/charts/aisix/README.md
+++ b/charts/aisix/README.md
@@ -567,6 +567,7 @@ rejects. New installs set the value in its own key in `values.yaml` or under
 | config.observability.service_name | string | `"aisix"` | Service name reported in telemetry |
 | config.outbound.ssrf_protection.allowed_hosts | list | `[]` | Hosts such a fetch may reach although they resolve to a non-public address, as `host` or `host:port` (IPv6 with a port as `[addr]:port`). Behind a fake-ip DNS that maps public names into 198.18.0.0/15, list those hosts here |
 | config.outbound.ssrf_protection.enabled | bool | `true` | Only reach publicly routable addresses when fetching a URL an API caller supplied (today the media download). false turns the check off and ignores `allowed_hosts` |
+| config.proxy.expose_debug_headers | bool | `false` | Send the debug response headers on `/v1/chat/completions` (`x-aisix-call-id`, `x-aisix-served-by`, `x-aisix-route`, `x-aisix-cache*`). Off by default because they reveal which model behind a model group answered |
 | config.proxy.real_ip.header | string | `"x-forwarded-for"` | Header carrying the client IP |
 | config.proxy.real_ip.recursive | bool | `false` | Walk the header right to left past every trusted proxy |
 | config.proxy.real_ip.trusted_proxies | list | `[]` | CIDRs (or bare IPs) of proxies trusted to set the client-IP header |
diff --git a/charts/aisix/values.yaml b/charts/aisix/values.yaml
index 94c6dbf..5e665ff 100644
--- a/charts/aisix/values.yaml
+++ b/charts/aisix/values.yaml
@@ -254,6 +254,10 @@ config:
     # -- Entry-level URL rewrite rules, first match wins, e.g.
     # `[{name: per-server-mcp, match: "^/mcp-servers/([^/]+)/mcp$", rewrite: "/mcp/$1"}]`
     url_rewrites: []
+    # -- Send the debug response headers on `/v1/chat/completions`
+    # (`x-aisix-call-id`, `x-aisix-served-by`, `x-aisix-route`, `x-aisix-cache*`).
+    # Off by default because they reveal which model behind a model group answered
+    expose_debug_headers: false
   observability:
     # -- Service name reported in telemetry
     service_name: aisix

From 286c0bb97a00b2215e9c5d34579ce11c2e5d9fe1 Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@api7.ai>
Date: Thu, 29 Oct 2026 07:52:58 +0000
Subject: [PATCH 3/6] docs(aisix): trusted_proxies peers may send a PROXY
 protocol header

---
 charts/aisix/README.md   | 2 +-
 charts/aisix/values.yaml | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/charts/aisix/README.md b/charts/aisix/README.md
index 70abfd2..c5cde03 100644
--- a/charts/aisix/README.md
+++ b/charts/aisix/README.md
@@ -570,7 +570,7 @@ rejects. New installs set the value in its own key in `values.yaml` or under
 | config.proxy.expose_debug_headers | bool | `false` | Send the debug response headers on `/v1/chat/completions` (`x-aisix-call-id`, `x-aisix-served-by`, `x-aisix-route`, `x-aisix-cache*`). Off by default because they reveal which model behind a model group answered |
 | config.proxy.real_ip.header | string | `"x-forwarded-for"` | Header carrying the client IP |
 | config.proxy.real_ip.recursive | bool | `false` | Walk the header right to left past every trusted proxy |
-| config.proxy.real_ip.trusted_proxies | list | `[]` | CIDRs (or bare IPs) of proxies trusted to set the client-IP header |
+| config.proxy.real_ip.trusted_proxies | list | `[]` | CIDRs (or bare IPs) of proxies trusted to set the client-IP header. A peer in this list may also open the connection with a PROXY protocol v1/v2 header (an L4 load balancer that rewrites the source address); the header's source address then stands in for the TCP peer, including for the client-IP header trust check. Detection is automatic on every proxy listener; a header from any other peer closes the connection |
 | config.proxy.request_body_limit_bytes | int | `0` | Request-body size cap in bytes. 0 means no cap |
 | config.proxy.request_id.accept_headers | list | `["x-aisix-request-id"]` | Headers a caller may supply its own request id in. Add `x-request-id` only when no proxy in front stamps it |
 | config.proxy.thread_per_core | bool | `nil` | Thread-per-core serving topology. Null uses the gateway default (on for Linux) |
diff --git a/charts/aisix/values.yaml b/charts/aisix/values.yaml
index 5e665ff..43c16bf 100644
--- a/charts/aisix/values.yaml
+++ b/charts/aisix/values.yaml
@@ -235,7 +235,12 @@ config:
     # -- Request-body size cap in bytes. 0 means no cap
     request_body_limit_bytes: 0
     real_ip:
-      # -- CIDRs (or bare IPs) of proxies trusted to set the client-IP header
+      # -- CIDRs (or bare IPs) of proxies trusted to set the client-IP header.
+      # A peer in this list may also open the connection with a PROXY protocol
+      # v1/v2 header (an L4 load balancer that rewrites the source address); the
+      # header's source address then stands in for the TCP peer, including for
+      # the client-IP header trust check. Detection is automatic on every proxy
+      # listener; a header from any other peer closes the connection
       trusted_proxies: []
       # -- Walk the header right to left past every trusted proxy
       recursive: false

From b71b9c86e58bcaeb14cd970a79e1d4f6b16c8faf Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@api7.ai>
Date: Thu, 29 Oct 2026 09:33:09 +0000
Subject: [PATCH 4/6] docs(aisix-cp): replace the 1.5.0 upgrade notes with
 1.8.0 ones

The chart-1.5.0 compatibility layer is gone (AISIX-Cloud#1949), so the old section described behaviour this chart no longer has. The new one covers the 1.6.0 database floor, moving chart-1.5.0 ui.extraEnvVars sign-in settings and the removed <release>-ui Service, and the one-time loss of an extraEnvVars override of a name chart 1.5.0 rendered.
---
 charts/aisix-cp/README.md        | 38 +++++++++++++++++++++-----------
 charts/aisix-cp/README.md.gotmpl | 38 +++++++++++++++++++++-----------
 2 files changed, 50 insertions(+), 26 deletions(-)

diff --git a/charts/aisix-cp/README.md b/charts/aisix-cp/README.md
index 9a9021c..ee07156 100644
--- a/charts/aisix-cp/README.md
+++ b/charts/aisix-cp/README.md
@@ -209,19 +209,6 @@ the release was installed with.
 Wait for the `cp-api` pods to become ready before upgrading the gateways: the
 schema migration runs on first start under the new version.
 
-Upgrading from 1.5.0 changes the following. The dashboard no longer runs as
-its own Deployment: `cp-api` serves it, and the `aisix-cp-ui` Service is kept,
-now selecting the `cp-api` pods, so a proxy still pointed at it keeps working.
-`secrets.betterAuthSecret` and the dashboard's image, resource and volume values
-are no longer read; a private database CA that was mounted into the dashboard
-goes in `externalDatabase.sslRootCert` instead. Settings 1.5.0 took as
-environment variables through `extraEnvVars` now have values of their own — `api.trustedOrigins`,
-`api.allowUnsupportedUpgrade` and the rest in the [Parameters](#parameters)
-table. An existing override keeps working across the upgrade, but move it into
-the value; `extraEnvVars` is for system-level environment such as `TZ`.
-Self sign-up is off in a self-hosted install, so accounts added after the
-upgrade come from invitations.
-
 `cp-api` refuses to start when the database was last run by a release older
 than this one supports upgrading from, naming the version it found and the
 oldest it accepts. Upgrade to a supported version first; to proceed anyway,
@@ -229,6 +216,31 @@ after taking a backup, set `api.allowUnsupportedUpgrade: true` for that one
 upgrade and set it back afterwards. See
 [Upgrade](https://docs.api7.ai/ai-gateway/on-premises/upgrade).
 
+### Upgrading to 1.8.0
+
+`cp-api` 1.8.0 refuses to start on a database last run by a control plane older
+than 1.6.0. Upgrade to 1.6.x or 1.7.x first; to proceed anyway, take a database
+backup, then set `api.allowUnsupportedUpgrade: true` for that one upgrade and
+set it back afterwards.
+
+An install that still carries chart 1.5.0 values moves `AISIX_TRUSTED_ORIGINS`
+and `AISIX_AUTH_BEARER_SESSIONS` from `ui.extraEnvVars` to `api.extraEnvVars`
+before upgrading — or better, sets `api.trustedOrigins` / `api.bearerSessions` —
+since the chart no longer copies them to `cp-api`. The `<release>-ui` Service is
+removed: point any NodePort, ingress or proxy that used it at the
+`<release>-api` Service, which serves the console at every path.
+
+Whenever the release was first installed: if `api.extraEnvVars` or
+`dpm.extraEnvVars` overrides an environment variable chart 1.5.0 itself
+rendered (for example `AISIX_CLOUD_PUBLIC_BASE_URL` or
+`AISIX_CLOUD_DATABASE_URL`), the first `helm upgrade` to 1.8.0 removes that
+variable from the Deployment, because the 1.6.x and 1.7.x charts rendered the
+name twice and this one renders it once. Run `helm upgrade` again with the same
+values to restore it, or better, move the setting to its key in `values.yaml`.
+
+See [Upgrade](https://docs.api7.ai/ai-gateway/on-premises/upgrade) for the full
+procedure.
+
 ## Uninstall
 
 ```sh
diff --git a/charts/aisix-cp/README.md.gotmpl b/charts/aisix-cp/README.md.gotmpl
index fdbac1c..720a318 100644
--- a/charts/aisix-cp/README.md.gotmpl
+++ b/charts/aisix-cp/README.md.gotmpl
@@ -201,19 +201,6 @@ the release was installed with.
 Wait for the `cp-api` pods to become ready before upgrading the gateways: the
 schema migration runs on first start under the new version.
 
-Upgrading from 1.5.0 changes the following. The dashboard no longer runs as
-its own Deployment: `cp-api` serves it, and the `aisix-cp-ui` Service is kept,
-now selecting the `cp-api` pods, so a proxy still pointed at it keeps working.
-`secrets.betterAuthSecret` and the dashboard's image, resource and volume values
-are no longer read; a private database CA that was mounted into the dashboard
-goes in `externalDatabase.sslRootCert` instead. Settings 1.5.0 took as
-environment variables through `extraEnvVars` now have values of their own — `api.trustedOrigins`,
-`api.allowUnsupportedUpgrade` and the rest in the [Parameters](#parameters)
-table. An existing override keeps working across the upgrade, but move it into
-the value; `extraEnvVars` is for system-level environment such as `TZ`.
-Self sign-up is off in a self-hosted install, so accounts added after the
-upgrade come from invitations.
-
 `cp-api` refuses to start when the database was last run by a release older
 than this one supports upgrading from, naming the version it found and the
 oldest it accepts. Upgrade to a supported version first; to proceed anyway,
@@ -221,6 +208,31 @@ after taking a backup, set `api.allowUnsupportedUpgrade: true` for that one
 upgrade and set it back afterwards. See
 [Upgrade](https://docs.api7.ai/ai-gateway/on-premises/upgrade).
 
+### Upgrading to 1.8.0
+
+`cp-api` 1.8.0 refuses to start on a database last run by a control plane older
+than 1.6.0. Upgrade to 1.6.x or 1.7.x first; to proceed anyway, take a database
+backup, then set `api.allowUnsupportedUpgrade: true` for that one upgrade and
+set it back afterwards.
+
+An install that still carries chart 1.5.0 values moves `AISIX_TRUSTED_ORIGINS`
+and `AISIX_AUTH_BEARER_SESSIONS` from `ui.extraEnvVars` to `api.extraEnvVars`
+before upgrading — or better, sets `api.trustedOrigins` / `api.bearerSessions` —
+since the chart no longer copies them to `cp-api`. The `<release>-ui` Service is
+removed: point any NodePort, ingress or proxy that used it at the
+`<release>-api` Service, which serves the console at every path.
+
+Whenever the release was first installed: if `api.extraEnvVars` or
+`dpm.extraEnvVars` overrides an environment variable chart 1.5.0 itself
+rendered (for example `AISIX_CLOUD_PUBLIC_BASE_URL` or
+`AISIX_CLOUD_DATABASE_URL`), the first `helm upgrade` to 1.8.0 removes that
+variable from the Deployment, because the 1.6.x and 1.7.x charts rendered the
+name twice and this one renders it once. Run `helm upgrade` again with the same
+values to restore it, or better, move the setting to its key in `values.yaml`.
+
+See [Upgrade](https://docs.api7.ai/ai-gateway/on-premises/upgrade) for the full
+procedure.
+
 ## Uninstall
 
 ```sh

From 338c83740e70ddbfe6b1c83a449c48cf72bf251b Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@api7.ai>
Date: Thu, 29 Oct 2026 14:57:18 +0000
Subject: [PATCH 5/6] release(aisix): 1.8.0

Bump charts/aisix-cp and charts/aisix to version/appVersion 1.8.0.
---
 charts/aisix-cp/Chart.yaml |  4 ++--
 charts/aisix-cp/README.md  | 10 +++++-----
 charts/aisix/Chart.yaml    |  4 ++--
 charts/aisix/README.md     |  2 +-
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/charts/aisix-cp/Chart.yaml b/charts/aisix-cp/Chart.yaml
index 074838b..c3f6217 100644
--- a/charts/aisix-cp/Chart.yaml
+++ b/charts/aisix-cp/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: aisix-cp
 description: Helm chart for AISIX control plane (cp-api, dp-manager, dashboard)
 type: application
-version: 1.7.1
-appVersion: "1.7.1"
+version: 1.8.0
+appVersion: "1.8.0"
 
 maintainers:
   - name: API7
diff --git a/charts/aisix-cp/README.md b/charts/aisix-cp/README.md
index ee07156..05e378a 100644
--- a/charts/aisix-cp/README.md
+++ b/charts/aisix-cp/README.md
@@ -1,6 +1,6 @@
 # aisix-cp
 
-![Version: 1.7.1](https://img.shields.io/badge/Version-1.7.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square)
+![Version: 1.8.0](https://img.shields.io/badge/Version-1.8.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.0](https://img.shields.io/badge/AppVersion-1.8.0-informational?style=flat-square)
 
 Helm chart for AISIX control plane (cp-api, dp-manager, dashboard)
 
@@ -102,7 +102,7 @@ helm repo add api7 https://charts.api7.ai
 helm repo update
 
 helm install aisix-cp api7/aisix-cp --namespace aisix --create-namespace \
-  --version 1.7.1 \
+  --version 1.8.0 \
   -f cp-values.yaml
 ```
 
@@ -111,7 +111,7 @@ same install, as long as you record what you generated:
 
 ```sh
 helm install aisix-cp api7/aisix-cp --namespace aisix --create-namespace \
-  --version 1.7.1 \
+  --version 1.8.0 \
   --set secrets.masterKey="$(openssl rand -base64 32)" \
   --set postgresql.auth.postgresPassword="$(openssl rand -hex 24)" \
   --set postgresql.auth.password="$(openssl rand -hex 24)"
@@ -181,7 +181,7 @@ fails the handshake with nothing logged to say why.
 
 The console's generated commands carry a gateway image, taken from
 `api.dpImage`. Left empty — the default — `cp-api` hands out the gateway of its
-own release, so this release hands out `docker.io/api7/aisix:1.7.1`.
+own release, so this release hands out `docker.io/api7/aisix:1.8.0`.
 Set it only to pin a different image, and remember that a value set explicitly
 carries forward across upgrades, so gateways added later come up on the old
 image.
@@ -355,7 +355,7 @@ install time:
 
 ```sh
 helm install aisix-cp api7/aisix-cp --namespace aisix --create-namespace \
-  --version 1.7.1 \
+  --version 1.8.0 \
   -f cp-values.yaml \
   --set postgresql.primary.podSecurityContext.enabled=false \
   --set postgresql.primary.containerSecurityContext.enabled=false
diff --git a/charts/aisix/Chart.yaml b/charts/aisix/Chart.yaml
index 47572c7..d25cb4f 100644
--- a/charts/aisix/Chart.yaml
+++ b/charts/aisix/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: aisix
 description: Helm chart for the AISIX AI gateway data plane
 type: application
-version: 1.7.1
-appVersion: "1.7.1"
+version: 1.8.0
+appVersion: "1.8.0"
 
 keywords:
   - ai-gateway
diff --git a/charts/aisix/README.md b/charts/aisix/README.md
index c5cde03..c11dbf7 100644
--- a/charts/aisix/README.md
+++ b/charts/aisix/README.md
@@ -1,6 +1,6 @@
 # aisix
 
-![Version: 1.7.1](https://img.shields.io/badge/Version-1.7.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.7.1](https://img.shields.io/badge/AppVersion-1.7.1-informational?style=flat-square)
+![Version: 1.8.0](https://img.shields.io/badge/Version-1.8.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.8.0](https://img.shields.io/badge/AppVersion-1.8.0-informational?style=flat-square)
 
 Helm chart for the AISIX AI gateway data plane
 

From cda09c7948e59474d6c1c95b502fa7137623288d Mon Sep 17 00:00:00 2001
From: Jarvis <jarvis@api7.ai>
Date: Thu, 29 Oct 2026 15:11:16 +0000
Subject: [PATCH 6/6] docs(aisix-cp): move an overridden chart-1.5.0 env name
 before upgrading to 1.8.0

While the first upgrade has dropped the override, cp-api runs on the chart-derived value; for the database URL that is the chart's database, which it migrates on start. Recommend moving the setting first and keep the second upgrade as recovery.
---
 charts/aisix-cp/README.md        | 8 ++++++--
 charts/aisix-cp/README.md.gotmpl | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/charts/aisix-cp/README.md b/charts/aisix-cp/README.md
index 05e378a..1bc7664 100644
--- a/charts/aisix-cp/README.md
+++ b/charts/aisix-cp/README.md
@@ -235,8 +235,12 @@ Whenever the release was first installed: if `api.extraEnvVars` or
 rendered (for example `AISIX_CLOUD_PUBLIC_BASE_URL` or
 `AISIX_CLOUD_DATABASE_URL`), the first `helm upgrade` to 1.8.0 removes that
 variable from the Deployment, because the 1.6.x and 1.7.x charts rendered the
-name twice and this one renders it once. Run `helm upgrade` again with the same
-values to restore it, or better, move the setting to its key in `values.yaml`.
+name twice and this one renders it once, so until it is restored `cp-api` runs
+on the value the chart derives from `values.yaml` — for the database URL, that
+is the chart's database, which `cp-api` migrates on start. Move such a setting
+to its key in `values.yaml` before upgrading, and check that the rendered
+database is the one you mean. If an upgrade already dropped an override, run
+`helm upgrade` again with the same values to restore it.
 
 See [Upgrade](https://docs.api7.ai/ai-gateway/on-premises/upgrade) for the full
 procedure.
diff --git a/charts/aisix-cp/README.md.gotmpl b/charts/aisix-cp/README.md.gotmpl
index 720a318..e553614 100644
--- a/charts/aisix-cp/README.md.gotmpl
+++ b/charts/aisix-cp/README.md.gotmpl
@@ -227,8 +227,12 @@ Whenever the release was first installed: if `api.extraEnvVars` or
 rendered (for example `AISIX_CLOUD_PUBLIC_BASE_URL` or
 `AISIX_CLOUD_DATABASE_URL`), the first `helm upgrade` to 1.8.0 removes that
 variable from the Deployment, because the 1.6.x and 1.7.x charts rendered the
-name twice and this one renders it once. Run `helm upgrade` again with the same
-values to restore it, or better, move the setting to its key in `values.yaml`.
+name twice and this one renders it once, so until it is restored `cp-api` runs
+on the value the chart derives from `values.yaml` — for the database URL, that
+is the chart's database, which `cp-api` migrates on start. Move such a setting
+to its key in `values.yaml` before upgrading, and check that the rendered
+database is the one you mean. If an upgrade already dropped an override, run
+`helm upgrade` again with the same values to restore it.
 
 See [Upgrade](https://docs.api7.ai/ai-gateway/on-premises/upgrade) for the full
 procedure.