Configuration File
Configure APISIX or API7 Ingress Controller logging, leader election, metrics, synchronization, Gateway API, and webhook settings.
API7 Ingress Controller and APISIX Ingress Controller use config.yaml to define core settings such as log level, leader election, observability endpoints, provider synchronization, Gateway API processing, and the admission webhook. The controller reads the file when it starts.
The configuration is typically stored in a Kubernetes ConfigMap and mounted into the controller pod. Update the manifest, chart values, or generator that defines the ConfigMap, then apply it through your deployment workflow. Avoid editing the live ConfigMap directly because the deployment workflow can overwrite the change.
Configuration
The following example shows the available configuration fields. Values in the example are APISIX Ingress Controller defaults; API7 Ingress Controller differences are identified in inline comments. The controller applies a default only when a field is omitted from config.yaml; values explicitly set in the file take precedence.
For Helm installations, the chart renders selected chart values into config.yaml, so the installed values can differ from controller defaults. Chart values that configure Kubernetes resources or deployment behavior are not config.yaml fields. See Helm Charts to compare chart inputs with the rendered controller configuration for an installed release.
The released controller charts render listener_port_match_mode explicitly, so Helm installations use the chart value rather than the controller's omitted-field default:
| Install surface | Effective listener_port_match_mode |
|---|---|
| APISIX or API7 controller binary, field omitted | off |
| API7 Ingress Controller chart | off |
| APISIX Ingress Controller chart, including the APISIX umbrella chart | auto |
The Getting Started APISIX install sets off explicitly so Gateway listener ports such as 80 and 443 are not injected as server_port matches against APISIX container ports 9080 and 9443.
log_level: "info" # The log level of the Ingress Controller.
# The controller default is "info".
controller_name: apisix.apache.org/apisix-ingress-controller # The controller name of the Ingress Controller,
# which is used to identify the controller in the GatewayClass.
# The controller default is "apisix.apache.org/apisix-ingress-controller".
leader_election_id: "apisix-ingress-gateway-leader" # The leader election ID for the Ingress Controller.
# The controller default is "apisix-ingress-gateway-leader".
leader_election:
lease_duration: 30s # lease_duration is the duration a non-leader waits after the last observed
# leadership renewal before attempting to take over leadership.
renew_deadline: 20s # renew_deadline is the time in seconds that the acting controller
# will retry refreshing leadership before giving up.
retry_period: 2s # retry_period is the time in seconds that the acting controller
# will wait between tries of actions with the controller.
disable: false # Whether to disable leader election.
metrics_addr: ":8080" # The address the metrics endpoint binds to.
# The controller default is ":8080".
enable_server: false # Whether to enable the debug API.
# The controller default is false.
server_addr: ":9092" # The debug API address. The controller default binds to all interfaces.
# Before enabling the server, use 127.0.0.1:9092 or restrict network access.
enable_http2: false # Whether to enable HTTP/2 for the server.
# The controller default is false.
probe_addr: ":8081" # The address the probe endpoint binds to.
# The controller default is ":8081".
secure_metrics: false # The secure metrics configuration.
# The controller default is false.
exec_adc_timeout: 15s # The timeout for the ADC to execute.
# The controller default is 15s.
listener_port_match_mode: "off" # Mode for injecting server_port route vars
# from Gateway listener ports for HTTPRoute, GRPCRoute, TCPRoute, and UDPRoute.
# - "auto": API7 injects for an explicit listener target or multiple matched listener ports.
# APISIX injects if a hostname-less listener matches and either a listener target is explicit
# or multiple hostname-less listener ports match.
# - "explicit": API7 injects for an explicit listener target.
# APISIX injects when a listener target is explicit and a hostname-less listener matches.
# - "off": never inject server_port vars.
# The controller default is "off".
provider:
type: "apisix" # Provider type.
# For APISIX Ingress Controller, value can be "apisix" or "apisix-standalone".
# The APISIX controller default is "apisix".
# The API7 controller default is "api7ee".
sync_period: 1h # The period between two consecutive full syncs.
# A positive value is required for apisix and apisix-standalone.
# The APISIX controller default is 1h.
# The API7 controller default is 0s.
init_sync_delay: 20m # The delay before a startup reconciliation.
# The controller default is 20m.
webhook:
enable: false # Whether to enable the webhook server.
# The controller default is false.
tls_cert_file: "tls.crt" # The filename within tls_cert_dir containing the webhook server TLS certificate.
# The controller default is "tls.crt".
tls_key_file: "tls.key" # The filename within tls_cert_dir containing the webhook server TLS private key.
# The controller default is "tls.key".
tls_cert_dir: "/certs" # The directory containing the webhook server TLS certificate files.
# The controller default is "/certs".
port: 9443 # The port for the webhook server to listen on.
# The controller default is 9443.
disable_gateway_api: false # Whether to disable the Gateway API.
# The controller default is false.