Skip to content

Commit 5596f32

Browse files
Tronix117Tronix117
committed
Merge branch feat/apigateway
2 parents e7a16cd + 7d0dc1a commit 5596f32

11 files changed

Lines changed: 1062 additions & 2 deletions

File tree

‎.github/workflows/release.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,7 @@ jobs:
346346
347347
- name: Sign chart in Harbor (keyless)
348348
if: steps.version-bump.outputs.skip != 'true' && vars.HARBOR_REGISTRY != ''
349+
continue-on-error: true
349350
env:
350351
COSIGN_EXPERIMENTAL: "1"
351352
run: |

‎charts/wik-webservice/Chart.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ keywords:
1919
- webservice
2020
- deployment
2121
- ingress
22+
- httproute
23+
- gateway-api
2224
- service
2325
annotations:
2426
artifacthub.io/license: MIT

‎charts/wik-webservice/README.md.gotmpl‎

Lines changed: 246 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ It creates:
1414
- **Deployment** with configurable containers, probes, and resources
1515
- **Service** with optional metrics port and Prometheus annotations
1616
- **Ingress** with configurable hosts and annotations
17+
- **HTTPRoute** for Gateway API routing (alternative to Ingress)
18+
- **ListenerSet** for automatic TLS listener provisioning (Gateway API)
1719
- **PVC** for persistent storage
1820

1921
## Installation
@@ -38,7 +40,7 @@ helm install my-app ./wik-webservice -f values.yaml
3840
| `webservice.imagePullPolicy` | Image pull policy | `Always` |
3941
| `webservice.replicas` | Number of replicas | `1` |
4042
| `webservice.port` | Container port | `80` |
41-
| `webservice.hosts` | Ingress hostnames | `[]` |
43+
| `webservice.hosts` | Hostnames (used by Ingress and/or HTTPRoute) | `[]` |
4244
| `webservice.command` | Override container command | `[]` |
4345
| `webservice.args` | Override container args | `[]` |
4446

@@ -64,6 +66,232 @@ helm install my-app ./wik-webservice -f values.yaml
6466
| `webservice.ingress.enabled` | Create an Ingress | `true` |
6567
| `webservice.ingress.annotations` | Ingress annotations | `{}` |
6668

69+
### HTTPRoute (Gateway API)
70+
71+
The chart supports [Gateway API](https://gateway-api.sigs.k8s.io/) HTTPRoute as an alternative to Ingress. Gateway API CRDs must be installed on the cluster.
72+
73+
| Parameter | Description | Default |
74+
|-----------|-------------|---------|
75+
| `webservice.httpRoute.enabled` | Create an HTTPRoute | `false` |
76+
| `webservice.httpRoute.parentRefs` | Gateway parent references (omitted if empty) | `[]` |
77+
| `webservice.httpRoute.tls` | Auto-create a ListenerSet for TLS (like `ingress.tlsAcme`) | `false` |
78+
| `webservice.httpRoute.annotations` | HTTPRoute annotations | `{}` |
79+
| `webservice.httpRoute.labels` | HTTPRoute labels | `{}` |
80+
| `webservice.httpRoute.filters` | Filters for the default rule | `[]` |
81+
| `webservice.httpRoute.additionalRules` | Extra routing rules | `[]` |
82+
| `webservice.additionalHttpRoutes` | Additional HTTPRoute resources with custom hosts | `[]` |
83+
84+
```yaml
85+
# Simple HTTPRoute (uses webservice.hosts)
86+
webservice:
87+
image: myapp:latest
88+
hosts:
89+
- app.example.com
90+
ingress:
91+
enabled: false
92+
httpRoute:
93+
enabled: true
94+
parentRefs:
95+
- name: main-gateway
96+
97+
# HTTPRoute with TLS (auto-creates ListenerSet)
98+
webservice:
99+
httpRoute:
100+
enabled: true
101+
parentRefs:
102+
- name: main-gateway
103+
tls: true
104+
105+
# Additional HTTPRoutes with custom hosts
106+
webservice:
107+
httpRoute:
108+
enabled: true
109+
parentRefs:
110+
- name: public-gateway
111+
additionalHttpRoutes:
112+
- name: internal
113+
parentRefs:
114+
- name: internal-gateway
115+
hosts:
116+
- internal.example.com
117+
```
118+
119+
### ListenerSet (Gateway API TLS)
120+
121+
When `httpRoute.tls: true`, the chart auto-creates a ListenerSet that adds HTTPS listeners to the referenced Gateway for each host in `webservice.hosts`. Advanced configuration is available via `webservice.listenerSet`.
122+
123+
> **Note**: ListenerSet uses `gateway.networking.k8s.io/v1` (ListenerSet) when available, falling back to `gateway.networking.x-k8s.io/v1alpha1` (XListenerSet) on older clusters.
124+
125+
| Parameter | Description | Default |
126+
|-----------|-------------|---------|
127+
| `webservice.listenerSet.gatewayRef` | Gateway to attach listeners to (defaults to `httpRoute.parentRefs[0]`) | `{}` |
128+
| `webservice.listenerSet.port` | Listener port | `443` |
129+
| `webservice.listenerSet.protocol` | Listener protocol | `HTTPS` |
130+
| `webservice.listenerSet.tls.mode` | TLS mode | `Terminate` |
131+
| `webservice.listenerSet.tls.certificateRefs` | Certificate references (defaults to `Secret/<fullname>-tls`) | `[]` |
132+
| `webservice.listenerSet.annotations` | ListenerSet annotations | `{}` |
133+
| `webservice.listenerSet.labels` | ListenerSet labels | `{}` |
134+
135+
```yaml
136+
# Minimal TLS (all defaults)
137+
webservice:
138+
httpRoute:
139+
enabled: true
140+
parentRefs:
141+
- name: main-gateway
142+
tls: true
143+
# Auto-creates ListenerSet:
144+
# - gatewayRef from httpRoute.parentRefs[0]
145+
# - certificateRef: Secret/<fullname>-tls
146+
147+
# With cert-manager auto-provisioning
148+
webservice:
149+
httpRoute:
150+
enabled: true
151+
parentRefs:
152+
- name: main-gateway
153+
tls: true
154+
listenerSet:
155+
annotations:
156+
cert-manager.io/cluster-issuer: letsencrypt-prod
157+
158+
# Custom TLS certificate
159+
webservice:
160+
httpRoute:
161+
enabled: true
162+
parentRefs:
163+
- name: main-gateway
164+
tls: true
165+
listenerSet:
166+
tls:
167+
certificateRefs:
168+
- kind: Secret
169+
name: my-custom-cert
170+
```
171+
172+
### Migrating from Ingress to Gateway API
173+
174+
In Gateway API, cross-cutting concerns (timeouts, auth, rate limiting) move from per-route annotations to **Policy CRDs** managed alongside the Gateway infrastructure. TLS termination moves from per-Ingress config to **Gateway Listeners** (or **ListenerSet**).
175+
176+
#### Proxy settings (timeouts, body size, buffering)
177+
178+
**Before (Ingress + nginx annotations):**
179+
180+
```yaml
181+
webservice:
182+
ingress:
183+
enabled: true
184+
className: nginx
185+
annotations:
186+
nginx.ingress.kubernetes.io/proxy-body-size: "0"
187+
nginx.ingress.kubernetes.io/proxy-connect-timeout: "3600"
188+
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
189+
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
190+
nginx.ingress.kubernetes.io/proxy-next-upstream: "off"
191+
nginx.ingress.kubernetes.io/proxy-request-buffering: "off"
192+
```
193+
194+
**After (HTTPRoute + BackendTrafficPolicy):**
195+
196+
Chart values:
197+
```yaml
198+
webservice:
199+
ingress:
200+
enabled: false
201+
httpRoute:
202+
enabled: true
203+
parentRefs:
204+
- name: main-gateway
205+
```
206+
207+
Policy to create alongside (Envoy Gateway example):
208+
```yaml
209+
apiVersion: gateway.envoyproxy.io/v1alpha1
210+
kind: BackendTrafficPolicy
211+
metadata:
212+
name: my-app-timeouts
213+
spec:
214+
targetRefs:
215+
- group: gateway.networking.k8s.io
216+
kind: HTTPRoute
217+
name: my-app # matches your release fullname
218+
timeout:
219+
http:
220+
connectionIdleTimeout: 3600s
221+
requestTimeout: 3600s
222+
proxyProtocol:
223+
requestBuffering:
224+
disabled: true
225+
maxRequestBodySize: 0 # unlimited
226+
```
227+
228+
#### Basic authentication
229+
230+
**Before (Ingress + nginx annotations):**
231+
232+
```yaml
233+
webservice:
234+
ingress:
235+
enabled: true
236+
annotations:
237+
nginx.ingress.kubernetes.io/auth-realm: Authentication Required
238+
nginx.ingress.kubernetes.io/auth-secret: basic-auth
239+
nginx.ingress.kubernetes.io/auth-type: basic
240+
```
241+
242+
**After (HTTPRoute + SecurityPolicy):**
243+
244+
Chart values:
245+
```yaml
246+
webservice:
247+
ingress:
248+
enabled: false
249+
httpRoute:
250+
enabled: true
251+
```
252+
253+
Policy to create alongside (Envoy Gateway example):
254+
```yaml
255+
apiVersion: gateway.envoyproxy.io/v1alpha1
256+
kind: SecurityPolicy
257+
metadata:
258+
name: my-app-basic-auth
259+
spec:
260+
targetRefs:
261+
- group: gateway.networking.k8s.io
262+
kind: HTTPRoute
263+
name: my-app
264+
basicAuth:
265+
users:
266+
name: basic-auth # reference to existing Secret
267+
```
268+
269+
#### TLS (tlsAcme)
270+
271+
**Before (Ingress + tlsAcme):**
272+
273+
```yaml
274+
webservice:
275+
ingress:
276+
enabled: true
277+
tlsAcme: true
278+
```
279+
280+
**After (HTTPRoute + TLS):**
281+
282+
```yaml
283+
webservice:
284+
ingress:
285+
enabled: false
286+
httpRoute:
287+
enabled: true
288+
parentRefs:
289+
- name: main-gateway
290+
tls: true
291+
# Auto-creates a ListenerSet with HTTPS listeners for each host
292+
# certificateRefs defaults to Secret/<fullname>-tls
293+
```
294+
67295
### Resources & Probes
68296

69297
| Parameter | Description | Default |
@@ -615,6 +843,23 @@ webservice:
615843
password: mypassword
616844
```
617845
846+
### With Gateway API (HTTPRoute)
847+
848+
```yaml
849+
webservice:
850+
image: myapp:latest
851+
hosts:
852+
- app.example.com
853+
ingress:
854+
enabled: false
855+
httpRoute:
856+
enabled: true
857+
parentRefs:
858+
- name: main-gateway
859+
namespace: gateway-system
860+
tls: true
861+
```
862+
618863
### With init and sidecar containers
619864
620865
```yaml

‎charts/wik-webservice/ci/full-values.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,24 @@ webservice:
2828
annotations:
2929
nginx.ingress.kubernetes.io/proxy-body-size: 200m
3030

31+
httpRoute:
32+
enabled: true
33+
parentRefs:
34+
- name: test-gateway
35+
namespace: gateway-system
36+
tls: true
37+
annotations:
38+
example.com/test: "true"
39+
labels:
40+
routing: gateway-api
41+
42+
additionalHttpRoutes:
43+
- name: internal
44+
parentRefs:
45+
- name: internal-gateway
46+
hosts:
47+
- internal.example.com
48+
3149
additionalLabels:
3250
app.kubernetes.io/component: frontend
3351

‎charts/wik-webservice/templates/NOTES.txt‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
kubectl get deployment {{ include "fullname" . }} -n {{ .Release.Namespace }}
88
kubectl get pods -l app=wik-webservice,release={{ .Release.Name }} -n {{ .Release.Namespace }}
99

10-
{{- if .Values.webservice.hosts }}
10+
{{- if and .Values.webservice.hosts .Values.webservice.ingress.enabled }}
1111

1212
🌐 INGRESS
1313
{{- range .Values.webservice.hosts }}
@@ -17,6 +17,33 @@
1717
kubectl get ingress {{ include "fullname" $ }} -n {{ $.Release.Namespace }}
1818
{{- end }}
1919

20+
{{- if .Values.webservice.httpRoute.enabled }}
21+
22+
🔀 HTTPROUTE (Gateway API)
23+
{{- range .Values.webservice.hosts }}
24+
https://{{ . }}
25+
{{- end }}
26+
27+
kubectl get httproute {{ include "fullname" $ }} -n {{ $.Release.Namespace }}
28+
{{- end }}
29+
30+
{{- range .Values.webservice.additionalHttpRoutes }}
31+
32+
🔀 HTTPROUTE ({{ .name }})
33+
{{- range .hosts }}
34+
https://{{ . }}
35+
{{- end }}
36+
37+
kubectl get httproute {{ include "fullname" $ }}-{{ .name }} -n {{ $.Release.Namespace }}
38+
{{- end }}
39+
40+
{{- if .Values.webservice.httpRoute.tls }}
41+
42+
🔒 LISTENERSET (TLS)
43+
44+
kubectl get listenerset {{ include "fullname" $ }} -n {{ $.Release.Namespace }}
45+
{{- end }}
46+
2047
{{- if .Values.webservice.service.enabled }}
2148

2249
🔌 SERVICE

0 commit comments

Comments
 (0)