@@ -18,14 +18,92 @@ appendReleaseNameToResources: false
1818
1919# webappDomain: webapp.example.com
2020
21- ingress :
21+ routing :
22+ # `routing.enabled` controls whether the chart renders the shared HTTP Service
23+ # plus either an Ingress (nginx mode) or Gateway API resources (envoy or
24+ # migration mode). `ingress.enabled` remains a deprecated alias for one
25+ # release so older values files keep working during the rename.
2226 enabled : false
27+ # Controller mode for web traffic:
28+ # - nginx: render only a Kubernetes Ingress
29+ # - envoy: render only a Gateway API HTTPRoute
30+ # - migration: render both and split external-dns weights between them
31+ mode : nginx
32+ migration :
33+ # Which controller should receive external-dns weight 100 during migration.
34+ # The other resource receives weight 0.
35+ primary : nginx
36+
37+ ingress :
38+ # nginx Ingress settings.
2339 className : nginx
2440 annotations : {}
41+ # nginx-only override for proxy-side CSP injection. The webapp server already
42+ # emits CSP headers itself, so Envoy mode does not need a proxy-side CSP path.
2543 renderCSPInIngress : false
2644
45+ gateway :
46+ # Envoy Gateway / Gateway API expectations when routing.mode is envoy or migration:
47+ # - ListenerSet is a Gateway API standard-channel resource as of Gateway API v1.5.0.
48+ # - Use an Envoy Gateway release that supports ListenerSet in your cluster; recent
49+ # Envoy Gateway 1.8.x release notes and tests use the stable `ListenerSet` API.
50+ # - If you are running an older Envoy Gateway release, check that release's docs for
51+ # any feature gate or compatibility notes before enabling this chart.
52+ # - A Gateway (gateway.networking.k8s.io/v1) must already exist, or be created separately.
53+ # - In the shared setup we use in staging, the Gateway lives in a dedicated
54+ # namespace such as `web-gateway` and the chart's ListenerSet points there
55+ # via `gateway.namespace`.
56+ # - spec.gatewayClassName must point at the Envoy Gateway GatewayClass.
57+ # - spec.allowedListeners must allow ListenerSet attachments from this chart's namespace.
58+ # `namespaces.from: All` is the broadest choice if you want to permit any namespace.
59+ # - ExternalDNS must run with `--gateway-listener-sets` so it follows the ListenerSet
60+ # parentRef and publishes DNS targets for envoy or migration mode. Without it,
61+ # Envoy may accept the route while ExternalDNS emits no target, which breaks the
62+ # weighted migration path. That flag is disabled by default and requires Gateway
63+ # API v1.5+ CRDs.
64+ # Example:
65+ # apiVersion: gateway.networking.k8s.io/v1
66+ # kind: Gateway
67+ # metadata:
68+ # name: webapp-gateway
69+ # namespace: web-gateway
70+ # spec:
71+ # gatewayClassName: envoy # use the GatewayClass installed by Envoy Gateway
72+ # allowedListeners:
73+ # namespaces:
74+ # from: All
75+ # listeners:
76+ # - name: http
77+ # protocol: HTTP
78+ # port: 80
79+ # allowedRoutes:
80+ # namespaces:
81+ # from: All
82+ # - This chart creates a ListenerSet in the release namespace and an HTTPRoute that
83+ # attaches to it. When using a shared Gateway namespace, set `gateway.namespace`
84+ # to that namespace.
85+ # - If tls.useCertManager=true and you rely on the default HTTP01 solver, cert-manager's
86+ # Gateway API integration must be enabled. When `gateway.namespace` differs from the
87+ # release namespace, the port 80 listener must also allow routes from the Certificate
88+ # namespace, for example with `allowedRoutes.namespaces.from: All`.
89+ # Gateway name used when routing.mode is envoy or migration.
90+ name : " "
91+ # Optional namespace of the Gateway. Defaults to the release namespace.
92+ # Set this to a shared Gateway namespace like `web-gateway` when you keep the
93+ # Envoy Gateway entrypoint separate from the application namespace.
94+ namespace : " "
95+ # Listener section name used by the ListenerSet and HTTPRoute parentRef.
96+ # Defaults to https when tls.enabled=true, otherwise http.
97+ sectionName : " "
98+ # HTTPRoute-specific annotations.
99+ httpRouteAnnotations : {}
100+
27101tls :
28102 enabled : false
103+ # Set this to true when cert-manager should provision the certificate using
104+ # its Gateway API HTTP-01 solver. This requires cert-manager's Gateway API
105+ # integration to be enabled, and the Gateway listener must allow the solver
106+ # namespace when the Gateway lives outside the release namespace.
29107 useCertManager : false
30108 createIssuer : false
31109 # existingSecretName: "" # set this if you created e.g. a wildcard cert outside this chart
0 commit comments