Configuration File
API7 Ingress Controller and APISIX Ingress Controller use config.yaml to define core settings such as log level, leader election, observability endpoints, provider synchronization, Gateway API processing, and the admission webhook. The controller reads the file when it starts.
The configuration is typically stored in a Kubernetes ConfigMap and mounted into the controller pod. Update the manifest, chart values, or generator that defines the ConfigMap, then apply it through your deployment workflow. Avoid editing the live ConfigMap directly because the deployment workflow can overwrite the change.
Configuration
The following example shows the available configuration fields. Values in the example are APISIX Ingress Controller defaults; API7 Ingress Controller differences are identified in inline comments. The controller applies a default only when a field is omitted from config.yaml; values explicitly set in the file take precedence.
For Helm installations, the chart renders selected chart values into config.yaml, so the installed values can differ from controller defaults. Chart values that configure Kubernetes resources or deployment behavior are not config.yaml fields. See Helm Charts to compare chart inputs with the rendered controller configuration for an installed release.
log_level: "info" # The log level of the Ingress Controller.
# The controller default is "info".
controller_name: apisix.apache.org/apisix-ingress-controller # The controller name of the Ingress Controller,
# which is used to identify the controller in the GatewayClass.
# The controller default is "apisix.apache.org/apisix-ingress-controller".
leader_election_id: "apisix-ingress-gateway-leader" # The leader election ID for the Ingress Controller.
# The controller default is "apisix-ingress-gateway-leader".
leader_election:
lease_duration: 30s # lease_duration is the duration a non-leader waits after the last observed
# leadership renewal before attempting to take over leadership.
renew_deadline: 20s # renew_deadline is the time in seconds that the acting controller
# will retry refreshing leadership before giving up.
retry_period: 2s # retry_period is the time in seconds that the acting controller
# will wait between tries of actions with the controller.
disable: false # Whether to disable leader election.
metrics_addr: ":8080" # The address the metrics endpoint binds to.
# The controller default is ":8080".
enable_server: false # Whether to enable the debug API.
# The controller default is false.
server_addr: ":9092" # The debug API address. The controller default binds to all interfaces.
# Before enabling the server, use 127.0.0.1:9092 or restrict network access.
enable_http2: false # Whether to enable HTTP/2 for the server.
# The controller default is false.
probe_addr: ":8081" # The address the probe endpoint binds to.
# The controller default is ":8081".
secure_metrics: false # The secure metrics configuration.
# The controller default is false.
exec_adc_timeout: 15s # The timeout for the ADC to execute.
# The controller default is 15s.
listener_port_match_mode: "off" # Mode for injecting server_port route vars
# from Gateway listener ports for HTTPRoute, GRPCRoute, TCPRoute, and UDPRoute.
# - "auto": inject when parentRefs explicitly target listeners (sectionName/port) or when multiple listener ports are matched.
# - "explicit": inject only when parentRefs explicitly target listeners.
# - "off": never inject server_port vars.
# The controller default is "off".
provider:
type: "apisix" # Provider type.
# For APISIX Ingress Controller, value can be "apisix" or "apisix-standalone".
# The APISIX controller default is "apisix".
# The API7 controller default is "api7ee".
sync_period: 1h # The period between two consecutive full syncs.
# A positive value is required for apisix and apisix-standalone.
# The APISIX controller default is 1h.
# The API7 controller default is 0s.
init_sync_delay: 20m # The delay before a startup reconciliation.
# The controller default is 20m.
webhook:
enable: false # Whether to enable the webhook server.
# The controller default is false.
tls_cert_file: "tls.crt" # The filename within tls_cert_dir containing the webhook server TLS certificate.
# The controller default is "tls.crt".
tls_key_file: "tls.key" # The filename within tls_cert_dir containing the webhook server TLS private key.
# The controller default is "tls.key".
tls_cert_dir: "/certs" # The directory containing the webhook server TLS certificate files.
# The controller default is "/certs".
port: 9443 # The port for the webhook server to listen on.
# The controller default is 9443.
disable_gateway_api: false # Whether to disable the Gateway API.
# The controller default is false.