diff --git a/apis/installer/v1alpha1/ace_ace_types.go b/apis/installer/v1alpha1/ace_ace_types.go
index 3408ae6fa..17e56ec90 100644
--- a/apis/installer/v1alpha1/ace_ace_types.go
+++ b/apis/installer/v1alpha1/ace_ace_types.go
@@ -149,6 +149,8 @@ type AceIngressNginx struct {
type AceGateway struct {
Enabled bool `json:"enabled"`
*GatewaySpec `json:",inline,omitempty"`
+ // +optional
+ LoadBalancer *GatewayLoadBalancer `json:"loadBalancer,omitempty"`
}
type AceIngressDns struct {
diff --git a/apis/installer/v1alpha1/s3proxy.go b/apis/installer/v1alpha1/s3proxy.go
index 4bf961bef..ae7fd7cf1 100644
--- a/apis/installer/v1alpha1/s3proxy.go
+++ b/apis/installer/v1alpha1/s3proxy.go
@@ -75,7 +75,7 @@ type S3proxySpec struct {
Persistence PersistenceSpec `json:"persistence"`
StorageClass LocalObjectReference `json:"storageClass"`
Ingress S3proxyIngress `json:"ingress"`
- Gateway AppGateway `json:"gateway"`
+ Gateway S3proxyGateway `json:"gateway"`
S3proxy S3proxyConfig `json:"s3proxy"`
// +optional
Distro shared.DistroSpec `json:"distro"`
@@ -88,6 +88,12 @@ type S3proxyIngress struct {
Domain string `json:"domain"`
}
+type S3proxyGateway struct {
+ AppGateway `json:",inline"`
+ // +optional
+ LoadBalancer *GatewayLoadBalancer `json:"loadBalancer,omitempty"`
+}
+
type S3proxyConfig struct {
Auth S3proxyAuth `json:"auth"`
TLS S3proxyTLS `json:"tls"`
diff --git a/apis/installer/v1alpha1/shared_types.go b/apis/installer/v1alpha1/shared_types.go
index 61369349c..a072c1b5d 100644
--- a/apis/installer/v1alpha1/shared_types.go
+++ b/apis/installer/v1alpha1/shared_types.go
@@ -29,6 +29,10 @@ type GatewaySpec struct {
TLS *GatewayTLS `json:"tls"`
}
+type GatewayLoadBalancer struct {
+ Annotations map[string]string `json:"annotations"`
+}
+
type GatewayTLS struct {
Enabled bool `json:"enabled"`
Secret *LocalObjectReference `json:"secret"`
diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go
index 2877f9c99..9bb266d5d 100644
--- a/apis/installer/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/installer/v1alpha1/zz_generated.deepcopy.go
@@ -648,6 +648,11 @@ func (in *AceGateway) DeepCopyInto(out *AceGateway) {
*out = new(GatewaySpec)
(*in).DeepCopyInto(*out)
}
+ if in.LoadBalancer != nil {
+ in, out := &in.LoadBalancer, &out.LoadBalancer
+ *out = new(GatewayLoadBalancer)
+ (*in).DeepCopyInto(*out)
+ }
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AceGateway.
@@ -4230,6 +4235,28 @@ func (in *GatewayHost) DeepCopy() *GatewayHost {
return out
}
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GatewayLoadBalancer) DeepCopyInto(out *GatewayLoadBalancer) {
+ *out = *in
+ if in.Annotations != nil {
+ in, out := &in.Annotations, &out.Annotations
+ *out = make(map[string]string, len(*in))
+ for key, val := range *in {
+ (*out)[key] = val
+ }
+ }
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayLoadBalancer.
+func (in *GatewayLoadBalancer) DeepCopy() *GatewayLoadBalancer {
+ if in == nil {
+ return nil
+ }
+ out := new(GatewayLoadBalancer)
+ in.DeepCopyInto(out)
+ return out
+}
+
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *GatewayPath) DeepCopyInto(out *GatewayPath) {
*out = *in
@@ -11224,6 +11251,27 @@ func (in *S3proxyConfig) DeepCopy() *S3proxyConfig {
return out
}
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *S3proxyGateway) DeepCopyInto(out *S3proxyGateway) {
+ *out = *in
+ in.AppGateway.DeepCopyInto(&out.AppGateway)
+ if in.LoadBalancer != nil {
+ in, out := &in.LoadBalancer, &out.LoadBalancer
+ *out = new(GatewayLoadBalancer)
+ (*in).DeepCopyInto(*out)
+ }
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new S3proxyGateway.
+func (in *S3proxyGateway) DeepCopy() *S3proxyGateway {
+ if in == nil {
+ return nil
+ }
+ out := new(S3proxyGateway)
+ in.DeepCopyInto(out)
+ return out
+}
+
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *S3proxyIngress) DeepCopyInto(out *S3proxyIngress) {
*out = *in
diff --git a/charts/acaas/templates/gateway-backends.yaml b/charts/acaas/templates/gateway-backends.yaml
index 03ceaa296..41c5c1c4a 100644
--- a/charts/acaas/templates/gateway-backends.yaml
+++ b/charts/acaas/templates/gateway-backends.yaml
@@ -19,6 +19,12 @@ spec:
- fqdn:
hostname: {{ $rule.upstream }}
port: 443
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy), so TLS is set on the Backend there. */}}
+{{- if eq (include "distro.openshift" $) "true" }}
+ tls:
+ sni: {{ $rule.upstream }}
+ wellKnownCACertificates: System
+{{- else }}
---
# BackendTLSPolicy: makes Envoy originate TLS to the Backend above. Without it
# Envoy connects in plaintext on 443 and the upstream (which terminates TLS on
@@ -42,3 +48,4 @@ spec:
wellKnownCACertificates: System
{{- end }}
{{- end }}
+{{- end }}
diff --git a/charts/ace/README.md b/charts/ace/README.md
index a47eb6159..1757e1f0e 100644
--- a/charts/ace/README.md
+++ b/charts/ace/README.md
@@ -57,6 +57,7 @@ The following table lists the configurable parameters of the `ace` chart and the
| gateway.enabled | | false |
| gateway.tls.enabled | | true |
| gateway.tls.secret.name | | "ace-cert" |
+| gateway.loadBalancer.annotations | | {} |
| ingress-nginx.enabled | | false |
| ingress-dns.enabled | | false |
| nats.enabled | | false |
diff --git a/charts/ace/templates/db/pgpool.yaml b/charts/ace/templates/db/pgpool.yaml
index 2965a153f..b19edb4dd 100644
--- a/charts/ace/templates/db/pgpool.yaml
+++ b/charts/ace/templates/db/pgpool.yaml
@@ -30,7 +30,7 @@ spec:
{{- toYaml .Values.settings.pgpool.resources | nindent 10 }}
{{- if eq (include "distro.openshift" $) "true" }}
securityContext:
- runAsGroup: {{ .Values.securityContext.runAsUser }}
+ runAsGroup: 0
runAsUser: {{ .Values.securityContext.runAsUser }}
capabilities:
drop:
@@ -41,12 +41,31 @@ spec:
securityContext:
fsGroup: {{ .Values.securityContext.runAsUser }}
runAsUser: {{ .Values.securityContext.runAsUser }}
- runAsGroup: {{ .Values.securityContext.runAsUser }}
+ runAsGroup: 0
{{- end }}
{{- if .Values.global.monitoring }}
monitor:
agent: {{ .Values.global.monitoring.agent }}
prometheus:
+ {{- if or .Values.global.monitoring.exporter.resources (eq (include "distro.openshift" $) "true") }}
+ exporter:
+ {{- with .Values.global.monitoring.exporter.resources }}
+ resources:
+ {{- toYaml . | nindent 10 }}
+ {{- end }}
+ {{- if eq (include "distro.openshift" $) "true" }}
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ runAsGroup: {{ .Values.securityContext.runAsUser }}
+ runAsNonRoot: true
+ runAsUser: {{ .Values.securityContext.runAsUser }}
+ seccompProfile:
+ type: RuntimeDefault
+ {{- end }}
+ {{- end }}
serviceMonitor:
interval: 30s
labels:
diff --git a/charts/ace/templates/gateway/gateway.yaml b/charts/ace/templates/gateway/gateway.yaml
index 5a427bdba..e46d75741 100644
--- a/charts/ace/templates/gateway/gateway.yaml
+++ b/charts/ace/templates/gateway/gateway.yaml
@@ -31,6 +31,8 @@ spec:
allowedRoutes:
namespaces:
from: Same
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (TCPRoute), so NATS and s3proxy use their own LoadBalancer Services there. */}}
+{{- if ne (include "distro.openshift" .) "true" }}
- allowedRoutes:
namespaces:
from: Same
@@ -50,3 +52,4 @@ spec:
port: 4224
protocol: TCP
{{- end }}
+{{- end }}
diff --git a/charts/ace/templates/gateway/route-nats.yaml b/charts/ace/templates/gateway/route-nats.yaml
index 8acde567b..eb9208757 100644
--- a/charts/ace/templates/gateway/route-nats.yaml
+++ b/charts/ace/templates/gateway/route-nats.yaml
@@ -35,6 +35,43 @@ spec:
type: ReplacePrefixMatch
replacePrefixMatch: /
backendRefs:
+{{- if eq (include "distro.openshift" .) "true" }}
+ - group: gateway.envoyproxy.io
+ kind: Backend
+ name: {{ include "ace.fullname" . }}-nats
+ namespace: {{ .Release.Namespace }}
+ weight: 1
+---
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy, TCPRoute). */}}
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+ name: {{ include "ace.fullname" . }}-nats
+ namespace: {{ .Release.Namespace }}
+spec:
+ endpoints:
+ - fqdn:
+ hostname: {{ include "ace.fullname" . }}-nats.{{ .Release.Namespace }}.svc
+ port: 443
+ tls:
+ caCertificateRefs:
+ {{- if and
+ (or (eq .Values.global.infra.tls.issuer "letsencrypt") (eq .Values.global.infra.tls.issuer "letsencrypt-staging"))
+ (index .Values "gateway" "enabled") }}
+ - group: ""
+ kind: Secret
+ name: {{ include "ace.fullname" . }}-acme-ca-cert
+ {{- else }}
+ - group: ""
+ kind: Secret
+ name: {{ include "ace.fullname" . }}-gw-cert
+ {{- end }}
+ {{- if eq (index .Values "global" "platform" "hostType") "ip" }}
+ sni: {{ include "ace.fullname" . }}-nats
+ {{- else }}
+ sni: {{ printf "%s" .Values.global.platform.host }}
+ {{- end }}
+{{- else }}
- group: ""
kind: Service
name: {{ include "ace.fullname" . }}-nats
@@ -93,3 +130,4 @@ spec:
port: 4222
weight: 1
{{- end }}
+{{- end }}
diff --git a/charts/ace/templates/gateway/service-nats-lb.yaml b/charts/ace/templates/gateway/service-nats-lb.yaml
new file mode 100644
index 000000000..e6df31468
--- /dev/null
+++ b/charts/ace/templates/gateway/service-nats-lb.yaml
@@ -0,0 +1,23 @@
+{{- if and (index .Values "gateway" "enabled") .Values.nats.enabled (not .Values.nats.nats.externalAccess) (eq (include "distro.openshift" .) "true") }}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "ace.fullname" . }}-nats-lb
+ namespace: {{ .Release.Namespace }}
+ labels:
+ {{- include "ace.labels" . | nindent 4 }}
+ {{- with .Values.gateway.loadBalancer.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ type: LoadBalancer
+ ports:
+ - name: client
+ port: 4222
+ targetPort: 4222
+ protocol: TCP
+ selector:
+ app.kubernetes.io/name: {{ default "nats" .Values.nats.nameOverride }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
diff --git a/charts/ace/values.openapiv3_schema.yaml b/charts/ace/values.openapiv3_schema.yaml
index 7c0da04d5..67d3deae9 100644
--- a/charts/ace/values.openapiv3_schema.yaml
+++ b/charts/ace/values.openapiv3_schema.yaml
@@ -1329,6 +1329,15 @@ properties:
type: object
enabled:
type: boolean
+ loadBalancer:
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ required:
+ - annotations
+ type: object
tls:
properties:
enabled:
@@ -23993,6 +24002,15 @@ properties:
- paths
type: object
type: array
+ loadBalancer:
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ required:
+ - annotations
+ type: object
tls:
properties:
enabled:
diff --git a/charts/ace/values.yaml b/charts/ace/values.yaml
index e2015798e..e3f42a0ea 100644
--- a/charts/ace/values.yaml
+++ b/charts/ace/values.yaml
@@ -27,6 +27,10 @@ gateway:
enabled: true
secret:
name: "ace-cert"
+ # OpenShift only: NATS (4222) is exposed by its own LoadBalancer Service.
+ # Use the same IP-sharing annotations as the Envoy Service to share its IP.
+ loadBalancer:
+ annotations: {}
ingress-nginx:
enabled: false
diff --git a/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml b/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml
index be1ea4ea4..91b9b6f2e 100644
--- a/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml
+++ b/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml
@@ -8,6 +8,10 @@ deployment:
repository: %s
gateway-converter:
registryFQDN: %s
+config:
+ envoyGateway:
+ extensionApis:
+ enableBackend: true
`
(include "image.ghcr" (merge (dict "_repo" "voyagermesh/gateway") $))
(include "image.ghcr" (merge (dict "_repo" "appscode/kube-rbac-proxy") $))
diff --git a/charts/s3proxy/README.md b/charts/s3proxy/README.md
index 79ad2b115..9b01be787 100644
--- a/charts/s3proxy/README.md
+++ b/charts/s3proxy/README.md
@@ -68,6 +68,7 @@ The following table lists the configurable parameters of the `s3proxy` chart and
| gateway.tls.enabled | | true |
| gateway.tls.secret.name | | "ace-cert" |
| gateway.hosts | | [] |
+| gateway.loadBalancer.annotations | | {} |
| resources | | {} |
| service.type | | ClusterIP |
| service.port | | 4224 |
diff --git a/charts/s3proxy/templates/httproute.yaml b/charts/s3proxy/templates/httproute.yaml
index cb1849a8f..11c47f9a2 100644
--- a/charts/s3proxy/templates/httproute.yaml
+++ b/charts/s3proxy/templates/httproute.yaml
@@ -42,6 +42,13 @@ spec:
type: PathPrefix
value: {{ .path }}
backendRefs:
+ {{- if eq (include "distro.openshift" $) "true" }}
+ - group: gateway.envoyproxy.io
+ kind: Backend
+ name: {{ include "s3proxy.fullname" $ }}
+ namespace: {{ $.Release.Namespace }}
+ weight: 1
+ {{- else }}
- group: ""
kind: Service
name: {{ include "s3proxy.fullname" $ }}
@@ -49,9 +56,41 @@ spec:
port: {{ $.Values.service.port }}
weight: 1
{{- end }}
+ {{- end }}
{{- end }}
---
+{{- if eq (include "distro.openshift" .) "true" }}
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy, TCPRoute). */}}
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+ name: {{ include "s3proxy.fullname" . }}
+ namespace: {{ .Release.Namespace }}
+spec:
+ endpoints:
+ - fqdn:
+ hostname: {{ include "s3proxy.fullname" . }}.{{ .Release.Namespace }}.svc
+ port: {{ .Values.service.port }}
+ tls:
+ caCertificateRefs:
+ {{- if and
+ (or (eq .Values.global.infra.tls.issuer "letsencrypt") (eq .Values.global.infra.tls.issuer "letsencrypt-staging"))
+ (index .Values "gateway" "enabled") }}
+ - group: ""
+ kind: Secret
+ name: {{ include "ace.fullname" . }}-acme-ca-cert
+ {{- else }}
+ - group: ""
+ kind: Secret
+ name: {{ include "ace.fullname" . }}-gw-cert
+ {{- end }}
+ {{- if eq (index .Values "global" "platform" "hostType") "ip" }}
+ sni: {{ include "ace.fullname" . }}-s3proxy
+ {{- else }}
+ sni: {{ .Values.global.platform.host }}
+ {{- end }}
+{{- else }}
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
@@ -81,6 +120,9 @@ spec:
hostname: {{ .Values.global.platform.host }}
{{- end }}
{{- end }}
+{{- end }}
+
+{{- if ne (include "distro.openshift" .) "true" }}
---
apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -104,3 +146,4 @@ spec:
port: 4224
weight: 1
{{- end }}
+{{- end }}
diff --git a/charts/s3proxy/templates/service-lb.yaml b/charts/s3proxy/templates/service-lb.yaml
new file mode 100644
index 000000000..049857a8f
--- /dev/null
+++ b/charts/s3proxy/templates/service-lb.yaml
@@ -0,0 +1,22 @@
+{{- if and (index .Values "gateway" "enabled") (eq (include "distro.openshift" .) "true") }}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "s3proxy.fullname" . }}-lb
+ namespace: {{ .Release.Namespace }}
+ labels:
+ {{- include "s3proxy.labels" . | nindent 4 }}
+ {{- with .Values.gateway.loadBalancer.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ type: LoadBalancer
+ ports:
+ - name: api
+ port: 4224
+ targetPort: 4224
+ protocol: TCP
+ selector:
+ {{- include "s3proxy.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/charts/s3proxy/values.openapiv3_schema.yaml b/charts/s3proxy/values.openapiv3_schema.yaml
index c4cc8ecef..99f9e8a9f 100644
--- a/charts/s3proxy/values.openapiv3_schema.yaml
+++ b/charts/s3proxy/values.openapiv3_schema.yaml
@@ -485,6 +485,15 @@ properties:
- paths
type: object
type: array
+ loadBalancer:
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ required:
+ - annotations
+ type: object
tls:
properties:
enabled:
diff --git a/charts/s3proxy/values.yaml b/charts/s3proxy/values.yaml
index ecf205e61..f21ceaf40 100644
--- a/charts/s3proxy/values.yaml
+++ b/charts/s3proxy/values.yaml
@@ -58,6 +58,10 @@ gateway:
# paths:
# - path: /
# pathType: ImplementationSpecific
+ # OpenShift only: s3proxy (4224) is exposed by its own LoadBalancer Service.
+ # Use the same IP-sharing annotations as the Envoy Service to share its IP.
+ loadBalancer:
+ annotations: {}
resources: {}
# We usually recommend not to specify default resources and to leave this as a conscious
diff --git a/charts/service-gateway-presets/README.md b/charts/service-gateway-presets/README.md
index 09f6473b9..03e199300 100644
--- a/charts/service-gateway-presets/README.md
+++ b/charts/service-gateway-presets/README.md
@@ -72,6 +72,7 @@ The following table lists the configurable parameters of the `service-gateway-pr
| gateway.gateway-converter.enabled | | false |
| gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace |
| gateway.config.envoyGateway.extensionApis.enableEnvoyPatchPolicy | | true |
+| gateway.config.envoyGateway.extensionApis.enableBackend | | true |
| gateway.deployment.priorityClassName | | "" |
| gateway.hpa.enabled | | false |
| gateway.hpa.behavior | | {} |
diff --git a/charts/service-gateway-presets/values.yaml b/charts/service-gateway-presets/values.yaml
index 3d97d2bf0..9e2f79cf9 100644
--- a/charts/service-gateway-presets/values.yaml
+++ b/charts/service-gateway-presets/values.yaml
@@ -70,6 +70,7 @@ gateway:
controllerName: gateway.voyagermesh.com/ace
extensionApis:
enableEnvoyPatchPolicy: true
+ enableBackend: true
deployment:
priorityClassName: ""
hpa:
diff --git a/charts/service-gateway/README.md b/charts/service-gateway/README.md
index d2957e6c3..8bbf6bd16 100644
--- a/charts/service-gateway/README.md
+++ b/charts/service-gateway/README.md
@@ -72,6 +72,7 @@ The following table lists the configurable parameters of the `service-gateway` c
| gateway.gateway-converter.enabled | | false |
| gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace |
| gateway.config.envoyGateway.extensionApis.enableEnvoyPatchPolicy | | true |
+| gateway.config.envoyGateway.extensionApis.enableBackend | | true |
| gateway.deployment.priorityClassName | | "" |
| gateway.hpa.enabled | | false |
| gateway.hpa.behavior | | {} |
diff --git a/charts/service-gateway/values.yaml b/charts/service-gateway/values.yaml
index 2cde7d167..f3b11d8a0 100644
--- a/charts/service-gateway/values.yaml
+++ b/charts/service-gateway/values.yaml
@@ -71,6 +71,7 @@ gateway:
controllerName: gateway.voyagermesh.com/ace
extensionApis:
enableEnvoyPatchPolicy: true
+ enableBackend: true
deployment:
priorityClassName: ""
hpa: