feat: release apisix-ingress-controller 2.2.0

[AlinsRan]

Description

Releases apisix-ingress-controller 2.2.0, tagged as 2.2.0.

• Chart.yaml: appVersion 2.1.0 -> 2.2.0, chart version 1.2.2 -> 1.3.0
• values.yaml and the generated README.md: controller image tag 2.2.0. The ADC sidecar stays at 0.27.1, which is what the release pins.
• crds/: regenerated with make helm-build-crds from the 2.2.0 tag.

Gateway API 1.6.0

The controller moved to Gateway API 1.6.0 in this release, so the bundled CRDs move with it, from v1.3.0. Two things come along with the standard channel that the v1.3.0 bundle did not carry:

• ListenerSet, a new CRD.
• safe-upgrades, a ValidatingAdmissionPolicy and its binding. admissionregistration.k8s.io/v1 is GA from Kubernetes 1.30, and 2.2.0 declares 1.31+ as its supported version, so this is inside the supported range. It does mean a cluster older than 1.30 that could install the previous chart cannot install this one.

RBAC the release needs and the chart did not grant

Comparing the rendered ClusterRole against config/rbac/role.yaml at the 2.2.0 tag turned up three missing resources, all of which would fail quietly:

• l4routepolicies and l4routepolicies/status, for the L4RoutePolicy CRD #2791 adds. The CRD would install and the controller would never reconcile it.
• configmaps, which downstream mTLS #2792 reads the CA from. frontendValidation would fail to resolve its caCertificateRefs.

After the change the rendered role covers everything the controller declares. The three resources the chart grants beyond it (tokenreviews, subjectaccessreviews, endpoints) are the chart's own metrics authentication and endpoint access, unchanged.

Webhook paths the release moved

#2839 reads the L4 routes through gateway.networking.k8s.io/v1, and the webhook paths moved with them. The chart still sent the API server to the v1alpha2 paths, which 2.2.0 does not answer, so every TCPRoute and UDPRoute admission would fail against a path that is not there:

	before	after
name	vtcproute-v1alpha2.kb.io	vtcproute-v1.kb.io
path	/validate-gateway-networking-k8s-io-v1alpha2-tcproute	…-v1-tcproute
rule	apiVersions: ["v1alpha2"]	apiVersions: ["v1"]

Same for udproute. The rendered configuration now matches config/webhook/manifests.yaml at the 2.2.0 tag exactly, all twelve webhooks.

Verification

helm lint passes, helm template renders apache/apisix-ingress-controller:2.2.0 and ghcr.io/api7/adc:0.27.1, the CRD bundles parse and carry 12 and 10 CustomResourceDefinitions with gateway.networking.k8s.io/bundle-version: v1.6.0, and l4routepolicies is present in the bundle. The rendered ClusterRole and ValidatingWebhookConfiguration were both diffed against their sources at the 2.2.0 tag rather than eyeballed.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Releases the Helm chart for apisix-ingress-controller version 2.2.0 by updating image/chart versions, aligning webhook configuration with upstream changes, and regenerating CRDs/RBAC for newly added resources.

Changes:

• Bump chart version/appVersion and default controller image tag to 2.2.0.
• Update validating webhook names/paths and Gateway API versions for TCPRoute/UDPRoute admissions.
• Regenerate CRDs and extend ClusterRole permissions to cover newly introduced resources (e.g., l4routepolicies, configmaps).

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
charts/apisix-ingress-controller/Chart.yaml	Bumps chart and application versions to the 2.2.0 release.
charts/apisix-ingress-controller/values.yaml	Updates the default controller image tag to 2.2.0.
charts/apisix-ingress-controller/README.md	Regenerates docs to reflect the new default image tag.
charts/apisix-ingress-controller/templates/webhook.yaml	Aligns webhook names/paths and apiVersions with Gateway API v1 endpoints used by 2.2.0.
charts/apisix-ingress-controller/templates/cluster_role.yaml	Grants additional permissions required by the 2.2.0 controller features.
charts/apisix-ingress-controller/crds/apisixic-crds.yaml	Updates bundled CRDs (including adding L4RoutePolicy) consistent with the 2.2.0 release.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.