[jarvis9443]

This declares three new gateway startup settings in charts/aisix/values.yaml, each with the gateway's own default. They reach the config file through the ConfigMap the same way the rest of config does.

config:
  upstream:
    media_fetch:
      enabled: true
      max_bytes: 52428800
    bedrock:
      mantle_endpoint: null
  outbound:
    ssrf_protection:
      enabled: true
      allowed_hosts: []

upstream.media_fetch controls the media download. When the target upstream can't read a chat request's media URL itself, the gateway downloads it and sends the bytes inline. Pairs with api7/aisix#1314.

outbound.ssrf_protection is the product-wide SSRF setting for URLs supplied by an API caller that the gateway fetches, which today means only the media download. When it's on, those fetches reach only publicly routable addresses, and allowed_hosts is the exception list. enabled: false turns the check off. This replaces the earlier upstream.media_fetch.allowed_hosts, which was never released. Pairs with api7/aisix#1327.

upstream.bedrock.mantle_endpoint is the Bedrock Mantle base URL. When bedrock-runtime's CountTokens refuses a Claude model, /v1/messages/count_tokens falls back to it. Null derives https://bedrock-mantle.{region}.api.aws from the provider key's region; set it for a VPC endpoint or GovCloud. Pairs with api7/aisix#1318.

Hold this until the release that ships these changes. A gateway older than them refuses a config file that carries these keys.

🤖 Generated with Claude Code

Fixes api7/AISIX-Cloud#1885

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[jarvis9443]

Folded into the 1.7.0 chart release in #408, which is now merged.