[jarvis9443]

Upgrade the api7 and gateway charts to API7 Enterprise 3.10.10.

Draft until the v3.10.10 images are published: ct install pulls every image the charts pin and cannot pass before then.

Chart	version	appVersion	Images
api7	3.10.13 -> 3.10.14	3.10.9 -> 3.10.10	dashboard, dp_manager, developer_portal, file_server v3.10.10
gateway	3.10.18 -> 3.10.19	3.10.9 -> 3.10.10	api7/api7-ee-3-gateway:3.10.10

Structural change:

• gateway: new apisix.maxRequestHeadersReadable (default 100), rendered as apisix.max_request_headers_readable, the gateway setting added in 3.10.10 (api7-ee-3-gateway#2363) that caps how many request headers plugins can read; 0 disables the limit. Rendered with the default and with 0, and both configs pass apisix init in ghcr.io/api7/api7-ee-3-gateway:3.10.10; a string value is rejected there.

Not chart-exposed: the new plugin_attr.forward-auth.http_client (api7-ee-3-gateway#2369) keeps its default and can already be set through pluginAttrs. The control-plane helm/ directory has no changes between v3.10.9 and 3.10.10.

READMEs regenerated with helm-docs v1.13.1 built by go install.

Summary by CodeRabbit

• New Features
  • Added a configurable limit on how many request headers plugins can read. The default is 100; additional headers are still forwarded upstream but aren’t visible to plugins. Set the limit to 0 to disable it.
• Updates
  • Updated API7 Gateway and API7 Portal component image versions to 3.10.10.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The API7 and Gateway Helm charts update their chart and application versions and image tags. The Gateway chart also adds a configurable request-header read limit and renders that setting in its ConfigMap.

Changes: Chart release and Gateway configuration

Layer / File(s)	Summary
Chart release versions and image tags charts/api7/Chart.yaml, charts/api7/README.md, charts/api7/values.yaml, charts/gateway/Chart.yaml, charts/gateway/README.md, charts/gateway/values.yaml	Both charts update their chart and application versions. Default image tags change to 3.10.10. The API7 README and values update the component image tags.
Gateway request-header read limit charts/gateway/values.yaml, charts/gateway/templates/configmap.yaml, charts/gateway/README.md	The Gateway chart adds apisix.maxRequestHeadersReadable, defaulting to 100, and renders it as max_request_headers_readable. The README documents that headers above the limit are hidden from plugins but forwarded upstream, and that 0 disables the limit.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• api7/api7-helm-chart#417: Updates the same charts to v3.10.9 and precedes this release update to v3.10.10.

Suggested reviewers: alinsran, nic-6443

Merge Risk: Minimal · up to 841e8

No identified configuration issue blocks merging after normal chart checks.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Failed checks: 2 inconclusive

Check name	Status	Explanation	Resolution
E2e Test Quality Review		The PR adds apisix.maxRequestHeadersReadable, but the visible chart CI only installs the gateway; it does not test header handling through a plugin and upstream. The PR describes startup checks, not…	Provide E2E test evidence for the chart-deployed gateway and upstream, including the default limit, 0, and critical boundary and invalid inputs. Provide access to relevant linked-repository tests if they supply this coverage.
Security Check		The chart sets max_request_headers_readable to 100 (charts/gateway/values.yaml:57-59, templates/configmap.yaml:52). The documentation says later headers remain forwarded but are invisible to plu…	Provide the gateway implementations for versions 3.10.9 and 3.10.10, including header enumeration, authentication, header removal, and logging plugins. Verify whether headers beyond the limit can bypass authorization or leak credentials, an…

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: upgrading the api7 and gateway charts to v3.10.10.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: E2e Test Quality Review

Explanation

The PR adds apisix.maxRequestHeadersReadable, but the visible chart CI only installs the gateway; it does not test header handling through a plugin and upstream. The PR describes startup checks, not a full-flow test. Linked-repository test evidence is unavailable, so full E2E coverage cannot be determined.

Resolution

Provide E2E test evidence for the chart-deployed gateway and upstream, including the default limit, 0, and critical boundary and invalid inputs. Provide access to relevant linked-repository tests if they supply this coverage.

Full details: Security Check

Explanation

The chart sets max_request_headers_readable to 100 (charts/gateway/values.yaml:57-59, templates/configmap.yaml:52). The documentation says later headers remain forwarded but are invisible to plugins. The gateway implementation is unavailable, so the review cannot determine whether this change introduces credential leakage or an authorization bypass, or whether the behavior existed before the upgrade. 1. Sensitive data exposure: Inconclusive. 2. Unencrypted database secrets: No issues found in the chart changes. 3. Authorization bypass: Inconclusive. 4. Ownership validation: No issues found in the chart changes. 5. TLS and cryptography: No issues found in the chart changes. 6. Resource isolation: No issues found in the chart changes. 7. Secret reference resolution: No issues found in the chart changes.

Resolution

Provide the gateway implementations for versions 3.10.9 and 3.10.10, including header enumeration, authentication, header removal, and logging plugins. Verify whether headers beyond the limit can bypass authorization or leak credentials, and whether any such behavior is new or worsened by this PR.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 12c1ec5a-d202-429b-8030-534eafe2b087

Commits

Reviewing files that changed from the base of the PR and between 54e92e0 and 841e8a1.

Files selected for processing: 7

• charts/api7/Chart.yaml
• charts/api7/README.md
• charts/api7/values.yaml
• charts/gateway/Chart.yaml
• charts/gateway/README.md
• charts/gateway/templates/configmap.yaml
• charts/gateway/values.yaml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.