From 9c2a6d8a64c8e730b3475b316805496b8d07f995 Mon Sep 17 00:00:00 2001 From: Arnob Kumar Saha Date: Thu, 29 Oct 2026 12:13:13 +0600 Subject: [PATCH 1/5] Use LoadBalancer Services and Envoy Backend TLS on OpenShift OpenShift's ingress operator marks itself Degraded when unmanaged gateway.networking.k8s.io CRDs (TCPRoute, BackendTLSPolicy) exist. On OpenShift, expose NATS and s3proxy via dedicated LoadBalancer Services and use Envoy Gateway Backend TLS instead. Always enable the Envoy Gateway Backend extension API. Signed-off-by: Arnob Kumar Saha --- apis/installer/v1alpha1/ace_ace_types.go | 2 + apis/installer/v1alpha1/s3proxy.go | 8 +++- apis/installer/v1alpha1/shared_types.go | 5 ++ .../v1alpha1/zz_generated.deepcopy.go | 48 +++++++++++++++++++ charts/acaas/templates/gateway-backends.yaml | 7 +++ charts/ace/templates/gateway/gateway.yaml | 3 ++ charts/ace/templates/gateway/route-nats.yaml | 38 +++++++++++++++ .../templates/gateway/service-nats-lb.yaml | 26 ++++++++++ charts/ace/values.openapiv3_schema.yaml | 24 ++++++++++ charts/ace/values.yaml | 5 ++ .../opscenter-networking/voyager-gateway.yaml | 4 ++ charts/s3proxy/templates/httproute.yaml | 43 +++++++++++++++++ charts/s3proxy/templates/service-lb.yaml | 25 ++++++++++ charts/s3proxy/values.openapiv3_schema.yaml | 12 +++++ charts/s3proxy/values.yaml | 5 ++ 15 files changed, 254 insertions(+), 1 deletion(-) create mode 100644 charts/ace/templates/gateway/service-nats-lb.yaml create mode 100644 charts/s3proxy/templates/service-lb.yaml diff --git a/apis/installer/v1alpha1/ace_ace_types.go b/apis/installer/v1alpha1/ace_ace_types.go index 3408ae6fa7..17e56ec90b 100644 --- a/apis/installer/v1alpha1/ace_ace_types.go +++ b/apis/installer/v1alpha1/ace_ace_types.go @@ -149,6 +149,8 @@ type AceIngressNginx struct { type AceGateway struct { Enabled bool `json:"enabled"` *GatewaySpec `json:",inline,omitempty"` + // +optional + LoadBalancer *GatewayLoadBalancer `json:"loadBalancer,omitempty"` } type AceIngressDns struct { diff --git a/apis/installer/v1alpha1/s3proxy.go b/apis/installer/v1alpha1/s3proxy.go index 4bf961befe..ae7fd7cf1d 100644 --- a/apis/installer/v1alpha1/s3proxy.go +++ b/apis/installer/v1alpha1/s3proxy.go @@ -75,7 +75,7 @@ type S3proxySpec struct { Persistence PersistenceSpec `json:"persistence"` StorageClass LocalObjectReference `json:"storageClass"` Ingress S3proxyIngress `json:"ingress"` - Gateway AppGateway `json:"gateway"` + Gateway S3proxyGateway `json:"gateway"` S3proxy S3proxyConfig `json:"s3proxy"` // +optional Distro shared.DistroSpec `json:"distro"` @@ -88,6 +88,12 @@ type S3proxyIngress struct { Domain string `json:"domain"` } +type S3proxyGateway struct { + AppGateway `json:",inline"` + // +optional + LoadBalancer *GatewayLoadBalancer `json:"loadBalancer,omitempty"` +} + type S3proxyConfig struct { Auth S3proxyAuth `json:"auth"` TLS S3proxyTLS `json:"tls"` diff --git a/apis/installer/v1alpha1/shared_types.go b/apis/installer/v1alpha1/shared_types.go index 61369349c7..932f84a925 100644 --- a/apis/installer/v1alpha1/shared_types.go +++ b/apis/installer/v1alpha1/shared_types.go @@ -29,6 +29,11 @@ type GatewaySpec struct { TLS *GatewayTLS `json:"tls"` } +type GatewayLoadBalancer struct { + Annotations map[string]string `json:"annotations"` + LoadBalancerIP string `json:"loadBalancerIP"` +} + type GatewayTLS struct { Enabled bool `json:"enabled"` Secret *LocalObjectReference `json:"secret"` diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go index 2877f9c99d..9bb266d5d2 100644 --- a/apis/installer/v1alpha1/zz_generated.deepcopy.go +++ b/apis/installer/v1alpha1/zz_generated.deepcopy.go @@ -648,6 +648,11 @@ func (in *AceGateway) DeepCopyInto(out *AceGateway) { *out = new(GatewaySpec) (*in).DeepCopyInto(*out) } + if in.LoadBalancer != nil { + in, out := &in.LoadBalancer, &out.LoadBalancer + *out = new(GatewayLoadBalancer) + (*in).DeepCopyInto(*out) + } } // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AceGateway. @@ -4230,6 +4235,28 @@ func (in *GatewayHost) DeepCopy() *GatewayHost { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *GatewayLoadBalancer) DeepCopyInto(out *GatewayLoadBalancer) { + *out = *in + if in.Annotations != nil { + in, out := &in.Annotations, &out.Annotations + *out = make(map[string]string, len(*in)) + for key, val := range *in { + (*out)[key] = val + } + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GatewayLoadBalancer. +func (in *GatewayLoadBalancer) DeepCopy() *GatewayLoadBalancer { + if in == nil { + return nil + } + out := new(GatewayLoadBalancer) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *GatewayPath) DeepCopyInto(out *GatewayPath) { *out = *in @@ -11224,6 +11251,27 @@ func (in *S3proxyConfig) DeepCopy() *S3proxyConfig { return out } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *S3proxyGateway) DeepCopyInto(out *S3proxyGateway) { + *out = *in + in.AppGateway.DeepCopyInto(&out.AppGateway) + if in.LoadBalancer != nil { + in, out := &in.LoadBalancer, &out.LoadBalancer + *out = new(GatewayLoadBalancer) + (*in).DeepCopyInto(*out) + } +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new S3proxyGateway. +func (in *S3proxyGateway) DeepCopy() *S3proxyGateway { + if in == nil { + return nil + } + out := new(S3proxyGateway) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *S3proxyIngress) DeepCopyInto(out *S3proxyIngress) { *out = *in diff --git a/charts/acaas/templates/gateway-backends.yaml b/charts/acaas/templates/gateway-backends.yaml index 03ceaa296c..41c5c1c4a4 100644 --- a/charts/acaas/templates/gateway-backends.yaml +++ b/charts/acaas/templates/gateway-backends.yaml @@ -19,6 +19,12 @@ spec: - fqdn: hostname: {{ $rule.upstream }} port: 443 +{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy), so TLS is set on the Backend there. */}} +{{- if eq (include "distro.openshift" $) "true" }} + tls: + sni: {{ $rule.upstream }} + wellKnownCACertificates: System +{{- else }} --- # BackendTLSPolicy: makes Envoy originate TLS to the Backend above. Without it # Envoy connects in plaintext on 443 and the upstream (which terminates TLS on @@ -42,3 +48,4 @@ spec: wellKnownCACertificates: System {{- end }} {{- end }} +{{- end }} diff --git a/charts/ace/templates/gateway/gateway.yaml b/charts/ace/templates/gateway/gateway.yaml index 5a427bdba7..e46d75741b 100644 --- a/charts/ace/templates/gateway/gateway.yaml +++ b/charts/ace/templates/gateway/gateway.yaml @@ -31,6 +31,8 @@ spec: allowedRoutes: namespaces: from: Same +{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (TCPRoute), so NATS and s3proxy use their own LoadBalancer Services there. */}} +{{- if ne (include "distro.openshift" .) "true" }} - allowedRoutes: namespaces: from: Same @@ -50,3 +52,4 @@ spec: port: 4224 protocol: TCP {{- end }} +{{- end }} diff --git a/charts/ace/templates/gateway/route-nats.yaml b/charts/ace/templates/gateway/route-nats.yaml index 8acde567bd..eb92087579 100644 --- a/charts/ace/templates/gateway/route-nats.yaml +++ b/charts/ace/templates/gateway/route-nats.yaml @@ -35,6 +35,43 @@ spec: type: ReplacePrefixMatch replacePrefixMatch: / backendRefs: +{{- if eq (include "distro.openshift" .) "true" }} + - group: gateway.envoyproxy.io + kind: Backend + name: {{ include "ace.fullname" . }}-nats + namespace: {{ .Release.Namespace }} + weight: 1 +--- +{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy, TCPRoute). */}} +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: Backend +metadata: + name: {{ include "ace.fullname" . }}-nats + namespace: {{ .Release.Namespace }} +spec: + endpoints: + - fqdn: + hostname: {{ include "ace.fullname" . }}-nats.{{ .Release.Namespace }}.svc + port: 443 + tls: + caCertificateRefs: + {{- if and + (or (eq .Values.global.infra.tls.issuer "letsencrypt") (eq .Values.global.infra.tls.issuer "letsencrypt-staging")) + (index .Values "gateway" "enabled") }} + - group: "" + kind: Secret + name: {{ include "ace.fullname" . }}-acme-ca-cert + {{- else }} + - group: "" + kind: Secret + name: {{ include "ace.fullname" . }}-gw-cert + {{- end }} + {{- if eq (index .Values "global" "platform" "hostType") "ip" }} + sni: {{ include "ace.fullname" . }}-nats + {{- else }} + sni: {{ printf "%s" .Values.global.platform.host }} + {{- end }} +{{- else }} - group: "" kind: Service name: {{ include "ace.fullname" . }}-nats @@ -93,3 +130,4 @@ spec: port: 4222 weight: 1 {{- end }} +{{- end }} diff --git a/charts/ace/templates/gateway/service-nats-lb.yaml b/charts/ace/templates/gateway/service-nats-lb.yaml new file mode 100644 index 0000000000..ab810593d1 --- /dev/null +++ b/charts/ace/templates/gateway/service-nats-lb.yaml @@ -0,0 +1,26 @@ +{{- if and (index .Values "gateway" "enabled") .Values.nats.enabled (not .Values.nats.nats.externalAccess) (eq (include "distro.openshift" .) "true") }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "ace.fullname" . }}-nats-lb + namespace: {{ .Release.Namespace }} + labels: + {{- include "ace.labels" . | nindent 4 }} + {{- with .Values.gateway.loadBalancer.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: LoadBalancer + {{- with .Values.gateway.loadBalancer.loadBalancerIP }} + loadBalancerIP: {{ . }} + {{- end }} + ports: + - name: client + port: 4222 + targetPort: 4222 + protocol: TCP + selector: + app.kubernetes.io/name: {{ default "nats" .Values.nats.nameOverride }} + app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/charts/ace/values.openapiv3_schema.yaml b/charts/ace/values.openapiv3_schema.yaml index 7c0da04d5f..ac1032fff2 100644 --- a/charts/ace/values.openapiv3_schema.yaml +++ b/charts/ace/values.openapiv3_schema.yaml @@ -1329,6 +1329,18 @@ properties: type: object enabled: type: boolean + loadBalancer: + properties: + annotations: + additionalProperties: + type: string + type: object + loadBalancerIP: + type: string + required: + - annotations + - loadBalancerIP + type: object tls: properties: enabled: @@ -23993,6 +24005,18 @@ properties: - paths type: object type: array + loadBalancer: + properties: + annotations: + additionalProperties: + type: string + type: object + loadBalancerIP: + type: string + required: + - annotations + - loadBalancerIP + type: object tls: properties: enabled: diff --git a/charts/ace/values.yaml b/charts/ace/values.yaml index e2015798e6..8f565c7a43 100644 --- a/charts/ace/values.yaml +++ b/charts/ace/values.yaml @@ -27,6 +27,11 @@ gateway: enabled: true secret: name: "ace-cert" + # OpenShift only: NATS (4222) is exposed by its own LoadBalancer Service. + # Set loadBalancerIP / annotations to share the Envoy LoadBalancer IP. + loadBalancer: + annotations: {} + loadBalancerIP: "" ingress-nginx: enabled: false diff --git a/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml b/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml index be1ea4ea48..91b9b6f2e6 100644 --- a/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml +++ b/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml @@ -8,6 +8,10 @@ deployment: repository: %s gateway-converter: registryFQDN: %s +config: + envoyGateway: + extensionApis: + enableBackend: true ` (include "image.ghcr" (merge (dict "_repo" "voyagermesh/gateway") $)) (include "image.ghcr" (merge (dict "_repo" "appscode/kube-rbac-proxy") $)) diff --git a/charts/s3proxy/templates/httproute.yaml b/charts/s3proxy/templates/httproute.yaml index cb1849a8ff..11c47f9a24 100644 --- a/charts/s3proxy/templates/httproute.yaml +++ b/charts/s3proxy/templates/httproute.yaml @@ -42,6 +42,13 @@ spec: type: PathPrefix value: {{ .path }} backendRefs: + {{- if eq (include "distro.openshift" $) "true" }} + - group: gateway.envoyproxy.io + kind: Backend + name: {{ include "s3proxy.fullname" $ }} + namespace: {{ $.Release.Namespace }} + weight: 1 + {{- else }} - group: "" kind: Service name: {{ include "s3proxy.fullname" $ }} @@ -49,9 +56,41 @@ spec: port: {{ $.Values.service.port }} weight: 1 {{- end }} + {{- end }} {{- end }} --- +{{- if eq (include "distro.openshift" .) "true" }} +{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy, TCPRoute). */}} +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: Backend +metadata: + name: {{ include "s3proxy.fullname" . }} + namespace: {{ .Release.Namespace }} +spec: + endpoints: + - fqdn: + hostname: {{ include "s3proxy.fullname" . }}.{{ .Release.Namespace }}.svc + port: {{ .Values.service.port }} + tls: + caCertificateRefs: + {{- if and + (or (eq .Values.global.infra.tls.issuer "letsencrypt") (eq .Values.global.infra.tls.issuer "letsencrypt-staging")) + (index .Values "gateway" "enabled") }} + - group: "" + kind: Secret + name: {{ include "ace.fullname" . }}-acme-ca-cert + {{- else }} + - group: "" + kind: Secret + name: {{ include "ace.fullname" . }}-gw-cert + {{- end }} + {{- if eq (index .Values "global" "platform" "hostType") "ip" }} + sni: {{ include "ace.fullname" . }}-s3proxy + {{- else }} + sni: {{ .Values.global.platform.host }} + {{- end }} +{{- else }} apiVersion: gateway.networking.k8s.io/v1 kind: BackendTLSPolicy metadata: @@ -81,6 +120,9 @@ spec: hostname: {{ .Values.global.platform.host }} {{- end }} {{- end }} +{{- end }} + +{{- if ne (include "distro.openshift" .) "true" }} --- apiVersion: gateway.networking.k8s.io/v1alpha2 @@ -104,3 +146,4 @@ spec: port: 4224 weight: 1 {{- end }} +{{- end }} diff --git a/charts/s3proxy/templates/service-lb.yaml b/charts/s3proxy/templates/service-lb.yaml new file mode 100644 index 0000000000..ed41a52ff7 --- /dev/null +++ b/charts/s3proxy/templates/service-lb.yaml @@ -0,0 +1,25 @@ +{{- if and (index .Values "gateway" "enabled") (eq (include "distro.openshift" .) "true") }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "s3proxy.fullname" . }}-lb + namespace: {{ .Release.Namespace }} + labels: + {{- include "s3proxy.labels" . | nindent 4 }} + {{- with .Values.gateway.loadBalancer.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: LoadBalancer + {{- with .Values.gateway.loadBalancer.loadBalancerIP }} + loadBalancerIP: {{ . }} + {{- end }} + ports: + - name: api + port: 4224 + targetPort: 4224 + protocol: TCP + selector: + {{- include "s3proxy.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/s3proxy/values.openapiv3_schema.yaml b/charts/s3proxy/values.openapiv3_schema.yaml index c4cc8ecefd..a08a008c2e 100644 --- a/charts/s3proxy/values.openapiv3_schema.yaml +++ b/charts/s3proxy/values.openapiv3_schema.yaml @@ -485,6 +485,18 @@ properties: - paths type: object type: array + loadBalancer: + properties: + annotations: + additionalProperties: + type: string + type: object + loadBalancerIP: + type: string + required: + - annotations + - loadBalancerIP + type: object tls: properties: enabled: diff --git a/charts/s3proxy/values.yaml b/charts/s3proxy/values.yaml index ecf205e615..5dbc2bcfe9 100644 --- a/charts/s3proxy/values.yaml +++ b/charts/s3proxy/values.yaml @@ -58,6 +58,11 @@ gateway: # paths: # - path: / # pathType: ImplementationSpecific + # OpenShift only: s3proxy (4224) is exposed by its own LoadBalancer Service. + # Set loadBalancerIP / annotations to share the Envoy LoadBalancer IP. + loadBalancer: + annotations: {} + loadBalancerIP: "" resources: {} # We usually recommend not to specify default resources and to leave this as a conscious From 64c6e853a2757a5edad79b144aaad14aa71195c1 Mon Sep 17 00:00:00 2001 From: Arnob Kumar Saha Date: Thu, 29 Oct 2026 15:48:46 +0600 Subject: [PATCH 2/5] Share the Envoy LB IP via annotations only Signed-off-by: Arnob Kumar Saha --- apis/installer/v1alpha1/shared_types.go | 3 +-- charts/ace/README.md | 1 + charts/ace/templates/gateway/service-nats-lb.yaml | 3 --- charts/ace/values.openapiv3_schema.yaml | 6 ------ charts/ace/values.yaml | 3 +-- charts/s3proxy/README.md | 1 + charts/s3proxy/templates/service-lb.yaml | 3 --- charts/s3proxy/values.openapiv3_schema.yaml | 3 --- charts/s3proxy/values.yaml | 3 +-- 9 files changed, 5 insertions(+), 21 deletions(-) diff --git a/apis/installer/v1alpha1/shared_types.go b/apis/installer/v1alpha1/shared_types.go index 932f84a925..a072c1b5df 100644 --- a/apis/installer/v1alpha1/shared_types.go +++ b/apis/installer/v1alpha1/shared_types.go @@ -30,8 +30,7 @@ type GatewaySpec struct { } type GatewayLoadBalancer struct { - Annotations map[string]string `json:"annotations"` - LoadBalancerIP string `json:"loadBalancerIP"` + Annotations map[string]string `json:"annotations"` } type GatewayTLS struct { diff --git a/charts/ace/README.md b/charts/ace/README.md index a47eb6159b..1757e1f0e4 100644 --- a/charts/ace/README.md +++ b/charts/ace/README.md @@ -57,6 +57,7 @@ The following table lists the configurable parameters of the `ace` chart and the | gateway.enabled | | false | | gateway.tls.enabled | | true | | gateway.tls.secret.name | | "ace-cert" | +| gateway.loadBalancer.annotations | | {} | | ingress-nginx.enabled | | false | | ingress-dns.enabled | | false | | nats.enabled | | false | diff --git a/charts/ace/templates/gateway/service-nats-lb.yaml b/charts/ace/templates/gateway/service-nats-lb.yaml index ab810593d1..e6df314686 100644 --- a/charts/ace/templates/gateway/service-nats-lb.yaml +++ b/charts/ace/templates/gateway/service-nats-lb.yaml @@ -12,9 +12,6 @@ metadata: {{- end }} spec: type: LoadBalancer - {{- with .Values.gateway.loadBalancer.loadBalancerIP }} - loadBalancerIP: {{ . }} - {{- end }} ports: - name: client port: 4222 diff --git a/charts/ace/values.openapiv3_schema.yaml b/charts/ace/values.openapiv3_schema.yaml index ac1032fff2..67d3deae92 100644 --- a/charts/ace/values.openapiv3_schema.yaml +++ b/charts/ace/values.openapiv3_schema.yaml @@ -1335,11 +1335,8 @@ properties: additionalProperties: type: string type: object - loadBalancerIP: - type: string required: - annotations - - loadBalancerIP type: object tls: properties: @@ -24011,11 +24008,8 @@ properties: additionalProperties: type: string type: object - loadBalancerIP: - type: string required: - annotations - - loadBalancerIP type: object tls: properties: diff --git a/charts/ace/values.yaml b/charts/ace/values.yaml index 8f565c7a43..e3f42a0eab 100644 --- a/charts/ace/values.yaml +++ b/charts/ace/values.yaml @@ -28,10 +28,9 @@ gateway: secret: name: "ace-cert" # OpenShift only: NATS (4222) is exposed by its own LoadBalancer Service. - # Set loadBalancerIP / annotations to share the Envoy LoadBalancer IP. + # Use the same IP-sharing annotations as the Envoy Service to share its IP. loadBalancer: annotations: {} - loadBalancerIP: "" ingress-nginx: enabled: false diff --git a/charts/s3proxy/README.md b/charts/s3proxy/README.md index 79ad2b1150..9b01be7871 100644 --- a/charts/s3proxy/README.md +++ b/charts/s3proxy/README.md @@ -68,6 +68,7 @@ The following table lists the configurable parameters of the `s3proxy` chart and | gateway.tls.enabled | | true | | gateway.tls.secret.name | | "ace-cert" | | gateway.hosts | | [] | +| gateway.loadBalancer.annotations | | {} | | resources | | {} | | service.type | | ClusterIP | | service.port | | 4224 | diff --git a/charts/s3proxy/templates/service-lb.yaml b/charts/s3proxy/templates/service-lb.yaml index ed41a52ff7..049857a8ff 100644 --- a/charts/s3proxy/templates/service-lb.yaml +++ b/charts/s3proxy/templates/service-lb.yaml @@ -12,9 +12,6 @@ metadata: {{- end }} spec: type: LoadBalancer - {{- with .Values.gateway.loadBalancer.loadBalancerIP }} - loadBalancerIP: {{ . }} - {{- end }} ports: - name: api port: 4224 diff --git a/charts/s3proxy/values.openapiv3_schema.yaml b/charts/s3proxy/values.openapiv3_schema.yaml index a08a008c2e..99f9e8a9f0 100644 --- a/charts/s3proxy/values.openapiv3_schema.yaml +++ b/charts/s3proxy/values.openapiv3_schema.yaml @@ -491,11 +491,8 @@ properties: additionalProperties: type: string type: object - loadBalancerIP: - type: string required: - annotations - - loadBalancerIP type: object tls: properties: diff --git a/charts/s3proxy/values.yaml b/charts/s3proxy/values.yaml index 5dbc2bcfe9..f21ceaf408 100644 --- a/charts/s3proxy/values.yaml +++ b/charts/s3proxy/values.yaml @@ -59,10 +59,9 @@ gateway: # - path: / # pathType: ImplementationSpecific # OpenShift only: s3proxy (4224) is exposed by its own LoadBalancer Service. - # Set loadBalancerIP / annotations to share the Envoy LoadBalancer IP. + # Use the same IP-sharing annotations as the Envoy Service to share its IP. loadBalancer: annotations: {} - loadBalancerIP: "" resources: {} # We usually recommend not to specify default resources and to leave this as a conscious From f3e0864935c870c68298ca46cce3f697bfec13e7 Mon Sep 17 00:00:00 2001 From: Arnob Kumar Saha Date: Thu, 29 Oct 2026 18:37:55 +0600 Subject: [PATCH 3/5] Run pgpool exporter in the namespace UID range on OpenShift Signed-off-by: Arnob Kumar Saha --- charts/ace/templates/db/pgpool.yaml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/charts/ace/templates/db/pgpool.yaml b/charts/ace/templates/db/pgpool.yaml index 2965a153fa..c91bd91468 100644 --- a/charts/ace/templates/db/pgpool.yaml +++ b/charts/ace/templates/db/pgpool.yaml @@ -47,6 +47,25 @@ spec: monitor: agent: {{ .Values.global.monitoring.agent }} prometheus: + {{- if or .Values.global.monitoring.exporter.resources (eq (include "distro.openshift" $) "true") }} + exporter: + {{- with .Values.global.monitoring.exporter.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- if eq (include "distro.openshift" $) "true" }} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + runAsGroup: {{ .Values.securityContext.runAsUser }} + runAsNonRoot: true + runAsUser: {{ .Values.securityContext.runAsUser }} + seccompProfile: + type: RuntimeDefault + {{- end }} + {{- end }} serviceMonitor: interval: 30s labels: From ddf2fd2dcd25e7e94cfa6dd6b1346d2ebad0c4ad Mon Sep 17 00:00:00 2001 From: Arnob Kumar Saha Date: Thu, 29 Oct 2026 18:55:45 +0600 Subject: [PATCH 4/5] Run pgpool with root group on OpenShift The pgpool image grants write access to /opt/pgpool-II/etc via group 0. With runAsGroup set to the namespace UID, the entrypoint cannot write its config files and the container crash-loops. Signed-off-by: Arnob Kumar Saha --- charts/ace/templates/db/pgpool.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/ace/templates/db/pgpool.yaml b/charts/ace/templates/db/pgpool.yaml index c91bd91468..b19edb4dd9 100644 --- a/charts/ace/templates/db/pgpool.yaml +++ b/charts/ace/templates/db/pgpool.yaml @@ -30,7 +30,7 @@ spec: {{- toYaml .Values.settings.pgpool.resources | nindent 10 }} {{- if eq (include "distro.openshift" $) "true" }} securityContext: - runAsGroup: {{ .Values.securityContext.runAsUser }} + runAsGroup: 0 runAsUser: {{ .Values.securityContext.runAsUser }} capabilities: drop: @@ -41,7 +41,7 @@ spec: securityContext: fsGroup: {{ .Values.securityContext.runAsUser }} runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsUser }} + runAsGroup: 0 {{- end }} {{- if .Values.global.monitoring }} monitor: From 8a5389eb3b8b7ed06606055f374014c36feecbd0 Mon Sep 17 00:00:00 2001 From: Arnob Kumar Saha Date: Thu, 29 Oct 2026 20:46:23 +0600 Subject: [PATCH 5/5] Enable Envoy Backend API in the per-namespace gateway The ace /nats and s3proxy HTTPRoutes on OpenShift reference an Envoy Backend, but they are served by the service-gateway (gateway.voyagermesh.com/ace), whose EnvoyGateway config lacked extensionApis.enableBackend, so the route failed with ResolvedRefs=False. Signed-off-by: Arnob Kumar Saha --- charts/service-gateway-presets/README.md | 1 + charts/service-gateway-presets/values.yaml | 1 + charts/service-gateway/README.md | 1 + charts/service-gateway/values.yaml | 1 + 4 files changed, 4 insertions(+) diff --git a/charts/service-gateway-presets/README.md b/charts/service-gateway-presets/README.md index 09f6473b9f..03e1993001 100644 --- a/charts/service-gateway-presets/README.md +++ b/charts/service-gateway-presets/README.md @@ -72,6 +72,7 @@ The following table lists the configurable parameters of the `service-gateway-pr | gateway.gateway-converter.enabled | | false | | gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace | | gateway.config.envoyGateway.extensionApis.enableEnvoyPatchPolicy | | true | +| gateway.config.envoyGateway.extensionApis.enableBackend | | true | | gateway.deployment.priorityClassName | | "" | | gateway.hpa.enabled | | false | | gateway.hpa.behavior | | {} | diff --git a/charts/service-gateway-presets/values.yaml b/charts/service-gateway-presets/values.yaml index 3d97d2bf08..9e2f79cf92 100644 --- a/charts/service-gateway-presets/values.yaml +++ b/charts/service-gateway-presets/values.yaml @@ -70,6 +70,7 @@ gateway: controllerName: gateway.voyagermesh.com/ace extensionApis: enableEnvoyPatchPolicy: true + enableBackend: true deployment: priorityClassName: "" hpa: diff --git a/charts/service-gateway/README.md b/charts/service-gateway/README.md index d2957e6c33..8bbf6bd166 100644 --- a/charts/service-gateway/README.md +++ b/charts/service-gateway/README.md @@ -72,6 +72,7 @@ The following table lists the configurable parameters of the `service-gateway` c | gateway.gateway-converter.enabled | | false | | gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace | | gateway.config.envoyGateway.extensionApis.enableEnvoyPatchPolicy | | true | +| gateway.config.envoyGateway.extensionApis.enableBackend | | true | | gateway.deployment.priorityClassName | | "" | | gateway.hpa.enabled | | false | | gateway.hpa.behavior | | {} | diff --git a/charts/service-gateway/values.yaml b/charts/service-gateway/values.yaml index 2cde7d1677..f3b11d8a0a 100644 --- a/charts/service-gateway/values.yaml +++ b/charts/service-gateway/values.yaml @@ -71,6 +71,7 @@ gateway: controllerName: gateway.voyagermesh.com/ace extensionApis: enableEnvoyPatchPolicy: true + enableBackend: true deployment: priorityClassName: "" hpa: