Ports and Endpoints

The ports an ingress controller pod listens on, the gateway ports it pushes configuration to, and how Gateway listener ports relate to the gateway's container ports.

Applies to:API7 Ingress Controller (drives API7 Gateway)APISIX Ingress Controller (drives Apache APISIX)

Both controllers read the same config.yaml fields, so the controller ports below are the same for API7 Ingress Controller and APISIX Ingress Controller. What differs is the gateway side: an APISIX Ingress Controller pushes configuration to an Apache APISIX Admin API in the cluster, and an API7 Ingress Controller pushes it to an API7 Gateway control plane whose address the API7 Dashboard writes into the generated GatewayProxy.

Every field named here is defined in Configuration File, and the chart values that render it are in Helm Charts.

Controller ports

The metrics and probe listeners are always on. The debug API is off until a field turns it on. The admission webhook is off in the controller binary's own defaults and on in both standalone charts, so a standalone-chart installation opens three ports and an APISIX umbrella-chart installation opens two.

Port	Protocol	What it serves	Default	Set by
`8080`	HTTP	The metrics endpoint.	On	`metrics_addr: ":8080"`
`8081`	HTTP	The probe endpoint a Deployment's liveness and readiness probes use.	On	`probe_addr: ":8081"`
`9092`	HTTP	The debug API. Off unless `enable_server: true`; bind it to `127.0.0.1:9092` or restrict network access before enabling it, because the controller default binds to every interface.	Off, on every surface	`server_addr: ":9092"`, gated by `enable_server` in `config.yaml`. The API7 chart exposes the pair as `config.serverAddr` and `config.enableServer`; the APISIX controller chart exposes neither — see Diagnose Configuration Synchronization.
`9443`	HTTPS	The admission webhook server. It needs `tls.crt` and `tls.key` in `tls_cert_dir` — see Understand the Admission Webhook.	On with either standalone chart; off in the controller binary and in the APISIX umbrella chart	`webhook.port: 9443`, gated by `webhook.enable` in `config.yaml`. The chart value is spelled `webhook.enabled`, and `ingress-controller.webhook.enabled` in the APISIX umbrella chart.

secure_metrics is a separate field, false by default. What it requires, the metrics endpoint's path, and the metric names the controller publishes are not stated in this documentation — see What is not published here.

The webhook is the field where the binary and the charts disagree, so the surface decides the answer: the standalone APISIX and API7 Ingress Controller charts render webhook.enabled=true, the APISIX umbrella chart leaves it disabled unless ingress-controller.webhook.enabled=true, and the controller binary with the field omitted is off. Both installation paths in this documentation set use a standalone chart, and both GitOps paths keep the webhook on — see Manage with Argo CD.

The webhook's 9443 and an Apache APISIX HTTPS listener's 9443 are the same number in two different pods. They do not collide, because each belongs to its own pod's network namespace; a NetworkPolicy or a Service that names 9443 has to say which workload it means.

Gateway ports the controller connects to

Port	Protocol	Direction	What it is
`9180`	HTTP	Controller → Apache APISIX	The APISIX Admin API the controller pushes translated configuration to. It is a Service the controller is pointed at by name, namespace, and port — `apisix.adminService.{namespace,name,port}` as chart values, or `spec.provider.controlPlane.service` in the `GatewayProxy` the chart renders.
`7943`	HTTPS, mTLS	API7 Gateway instance → API7 Gateway control plane	Not the controller's connection: the API7 Gateway data plane the controller configures reaches its control plane's DP Manager here, as `etcd.host[0]` in the gateway's own installation — for example `https://api7ee3-dp-manager.<namespace>.svc.cluster.local:7943`, as in Install API7 Ingress Controller on OpenShift. The full list is in Ports and Endpoints (opens in API7 Gateway docs) for API7 Gateway.

For an API7 Ingress Controller, the control-plane endpoint the controller itself uses is carried by the GatewayProxy that API7 Dashboard generates for the gateway group, together with that group's admin key. This documentation does not publish a fixed port for it: read the applied GatewayProxy rather than assuming one.

Gateway listener ports and container ports

A Gateway listener's port is a Gateway API declaration. It does not open a port on the gateway, and it is not the port a request arrives on.

Number	Where it lives	What it means
`80`, `443`	A `Gateway` listener, and the `Service` in front of the gateway	The port a client connects to. The listener declares the protocol and hostname the controller matches on.
`9080`, `9443`	The Apache APISIX container	The ports the gateway process itself listens on, and the ports a `Service` port targets.

The two sets differ, which is why listener_port_match_mode exists: in auto or explicit mode a listener's port can be injected into the translated route as a server_port match, and a route that carries server_port: 80 never matches a request that arrived on container port 9080. Both installation paths in this documentation set the mode to off for that reason, and the controller's own default with the field omitted is off as well — but the APISIX chart writes auto into the rendered file, so an APISIX chart installation that does not set it explicitly gets auto. The per-surface table is in Configuration File.

Gateway stream ports

Stream mode is off until a gateway chart value turns it on, and the TCP and UDP listeners are separate lists. The numbers below are the ones this documentation set uses in its L4 guides, not defaults the chart applies on its own.

Number	Protocol	Set by	What it is
`9100`	TCP	`service.stream.tcp[]` in the APISIX chart, `gateway.stream.tcp[]` in the API7 Gateway chart, both gated by `stream.enabled`	The gateway's TCP listener a `TCPRoute` or `TLSRoute` is served on. The entry is a bare port for plain TCP and `{addr, tls: true}` for TCP over TLS — see Proxy TCP Traffic and Proxy TCP Traffic over TLS.
`9300`	UDP	`service.stream.udp[]` in the APISIX chart, `gateway.stream.udp[]` in the API7 Gateway chart, both gated by `stream.enabled`	The gateway's UDP listener a `UDPRoute` is served on — see Proxy UDP Traffic.

The API7 Gateway chart also takes gateway.stream.only, which both L4 guides set to false so the gateway keeps its HTTP listeners. Stream plugins are attached to these routes with an L4RoutePolicy rather than with a listener field — see Apply Plugins to L4 Routes.

Gateway metrics port

Number	Protocol	Set by	What it is
`9091`	HTTP	`pluginAttrs.prometheus.export_addr` in the API7 Gateway chart, with `enable_export_server: true`; `apisix.prometheus.enabled` in the APISIX chart	The gateway's Prometheus endpoint, at `/apisix/prometheus/metrics`. Not a controller port: it is scraped from the gateway pods, with `prometheus.io/scrape`, `prometheus.io/port` and `prometheus.io/path` pod annotations — see Progressive Delivery with Flagger. The API7 Gateway chart's default binds the endpoint inside the gateway pod, so a Prometheus pod needs the export address set explicitly.

The full API7 Gateway port list, including the control-plane side, is in Ports and Endpoints (opens in API7 Gateway docs); the Apache APISIX list is in Port Reference (opens in Apache APISIX docs).

What is not published here

These are the questions this page cannot answer from the documentation set. Read the values out of the installed release rather than assuming them.

The metrics path and metric names on metrics_addr, and what secure_metrics: true requires.
The paths served on probe_addr, and which of them is the readiness signal.
The API7 control-plane endpoint and port an API7 Ingress Controller uses: it comes from the Dashboard-generated GatewayProxy.

To read the effective values of a running controller, print the configuration its Deployment mounts:

export NAMESPACE="aic"   # the namespace the controller was installed into
export CONFIGMAP="$(kubectl -n "${NAMESPACE}" get deployment \
  -o jsonpath='{.items[*].spec.template.spec.volumes[*].configMap.name}')"
kubectl -n "${NAMESPACE}" get configmap "${CONFIGMAP}" -o jsonpath='{.data}'

The mounted file is the oracle for metrics_addr, probe_addr, server_addr, webhook.port, and listener_port_match_mode, because a chart can render a value the binary would not have defaulted to.

Configuration File — every controller field, with the default each binary applies when the field is omitted.
Helm Charts — the chart values that render those fields, per product.
Ports and Endpoints (opens in API7 Gateway docs) — the API7 Gateway control-plane and data-plane ports an API7 Ingress Controller deployment sits beside.
Port Reference (opens in Apache APISIX docs) — the Apache APISIX ports an APISIX Ingress Controller deployment sits beside.
High Availability — the leader-election Lease and the replica settings that decide which controller pod is writing to those gateway ports.