Ingress Controller 2.2.1

This release is API7 Ingress Controller only. There is no APISIX Ingress Controller 2.2.1: the release was published on the API7 side before the corresponding APISIX release completed its release process, and APISIX Ingress Controller 2.2.0 remains the current stable APISIX release. If you run APISIX Ingress Controller, stay on 2.2.0 and read the 2.2.0 page; nothing in this section applies to your installation.

This patch adds safer secret and certificate handling and corrects route validation, listener matching, and stale data-plane configuration.

Breaking Changes

The following corrections apply to API7 Ingress Controller only. They can stop serving configurations that an earlier API7 Ingress Controller continued to accept or retain; an APISIX Ingress Controller installation is not affected, because the release does not exist on that side.

Routes Stop When They Are No Longer Accepted

The controller now removes a route from the data plane after an edit confirms that the route has no managed Gateway or accepted listener. This includes moving a route to another GatewayClass, removing its selected listener, restricting allowedRoutes, or changing host names until they no longer intersect.

A temporarily unresolved Gateway or GatewayClass does not trigger removal because ownership cannot yet be determined.

Upgrade: Before upgrading, correct any route that should remain active but does not have an accepted parent and listener. Do not rely on previously synchronized configuration remaining active after route ownership or listener admission is revoked.

Routes Stop When Their Plugin Configuration Is Deleted

Deleting an ApisixPluginConfig now removes the configuration for an ApisixRoute or Ingress that still references it. Earlier releases could report the reference as invalid while continuing to serve the last synchronized plugins. Recreating the referenced object allows reconciliation to restore the route.

Upgrade: Apply the reference removal before deleting an ApisixPluginConfig. Keep the object available until every dependent route and Ingress has been updated.

Invalid ApisixRoute Service Ports Are Rejected

An ApisixRoute backend whose servicePort is empty or does not match a port on the referenced Service is now rejected instead of being accepted with an empty upstream. An empty string no longer matches an unnamed port on a single-port Service accidentally.

Upgrade: Confirm that every servicePort is a valid Service port name or number before rollout.

Routes Follow Their Accepted Listener Protocols

HTTPRoute and GRPCRoute resources now serve traffic only over the protocols accepted by their attached listeners. A route attached only to HTTPS listeners no longer answers plaintext HTTP requests, and a route attached only to HTTP listeners no longer answers over TLS. Routes attached to both protocols continue to serve both.

Upgrade: Check clients and health probes against the protocols declared by the route's accepted Gateway listeners.

New Features

This patch makes two options available in API7 Ingress Controller while the corresponding APISIX patch release is pending. Neither is available in APISIX Ingress Controller 2.2.0.

Trust a Private Control Plane CA

GatewayProxy can provide a PEM-encoded certificate bundle in spec.provider.controlPlane.caCert.value. With tlsVerify: true, the controller uses this bundle in place of the system trust store when connecting to a control plane that uses a private or self-signed certificate authority. Invalid certificate material is rejected, and the field has no effect when certificate verification is disabled.

Load Plugin Configuration from Secrets

Plugins in v1alpha1 PluginConfig, Consumer, and L4RoutePolicy resources can reference a same-namespace Secret through secretRef. Secret keys use dot-separated paths into the plugin configuration, values are merged as strings, and Secret values override matching inline fields. Updating the Secret triggers reconciliation. If the Secret is missing, the controller rejects the affected configuration instead of publishing only its inline fields.

Source Releases

• API7 Ingress Controller 2.2.1
• APISIX Ingress Controller: no 2.2.1 release; the current release is APISIX Ingress Controller 2.2.0