ArnobKumarSaha · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/apis/installer/v1alpha1/ace_ace_types.go b/apis/installer/v1alpha1/ace_ace_types.go
@@ -149,6 +149,8 @@ type AceIngressNginx struct {
 type AceGateway struct {
 	Enabled      bool `json:"enabled"`
 	*GatewaySpec `json:",inline,omitempty"`
+	// +optional
+	LoadBalancer *GatewayLoadBalancer `json:"loadBalancer,omitempty"`
 }
 
 type AceIngressDns struct {

diff --git a/apis/installer/v1alpha1/s3proxy.go b/apis/installer/v1alpha1/s3proxy.go
@@ -75,7 +75,7 @@ type S3proxySpec struct {
 	Persistence  PersistenceSpec      `json:"persistence"`
 	StorageClass LocalObjectReference `json:"storageClass"`
 	Ingress      S3proxyIngress       `json:"ingress"`
-	Gateway      AppGateway           `json:"gateway"`
+	Gateway      S3proxyGateway       `json:"gateway"`
 	S3proxy      S3proxyConfig        `json:"s3proxy"`
 	// +optional
 	Distro shared.DistroSpec `json:"distro"`
@@ -88,6 +88,12 @@ type S3proxyIngress struct {
 	Domain      string            `json:"domain"`
 }
 
+type S3proxyGateway struct {
+	AppGateway `json:",inline"`
+	// +optional
+	LoadBalancer *GatewayLoadBalancer `json:"loadBalancer,omitempty"`
+}
+
 type S3proxyConfig struct {
 	Auth S3proxyAuth `json:"auth"`
 	TLS  S3proxyTLS  `json:"tls"`

diff --git a/apis/installer/v1alpha1/shared_types.go b/apis/installer/v1alpha1/shared_types.go
@@ -29,6 +29,10 @@ type GatewaySpec struct {
 	TLS         *GatewayTLS       `json:"tls"`
 }
 
+type GatewayLoadBalancer struct {
+	Annotations map[string]string `json:"annotations"`
+}
+
 type GatewayTLS struct {
 	Enabled bool                  `json:"enabled"`
 	Secret  *LocalObjectReference `json:"secret"`

diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go
diff --git a/charts/acaas/templates/gateway-backends.yaml b/charts/acaas/templates/gateway-backends.yaml
@@ -19,6 +19,12 @@ spec:
     - fqdn:
         hostname: {{ $rule.upstream }}
         port: 443
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy), so TLS is set on the Backend there. */}}
+{{- if eq (include "distro.openshift" $) "true" }}
+  tls:
+    sni: {{ $rule.upstream }}
+    wellKnownCACertificates: System
+{{- else }}
 ---
 # BackendTLSPolicy: makes Envoy originate TLS to the Backend above. Without it
 # Envoy connects in plaintext on 443 and the upstream (which terminates TLS on
@@ -42,3 +48,4 @@ spec:
     wellKnownCACertificates: System
 {{- end }}
 {{- end }}
+{{- end }}
diff --git a/charts/ace/README.md b/charts/ace/README.md
@@ -57,6 +57,7 @@ The following table lists the configurable parameters of the `ace` chart and the
 | gateway.enabled                                           |                                                                                                                                                                                                                                                | <code>false</code>                                                                                                                                                                             |
 | gateway.tls.enabled                                       |                                                                                                                                                                                                                                                | <code>true</code>                                                                                                                                                                              |
 | gateway.tls.secret.name                                   |                                                                                                                                                                                                                                                | <code>"ace-cert"</code>                                                                                                                                                                        |
+| gateway.loadBalancer.annotations                          |                                                                                                                                                                                                                                                | <code>{}</code>                                                                                                                                                                                |
 | ingress-nginx.enabled                                     |                                                                                                                                                                                                                                                | <code>false</code>                                                                                                                                                                             |
 | ingress-dns.enabled                                       |                                                                                                                                                                                                                                                | <code>false</code>                                                                                                                                                                             |
 | nats.enabled                                              |                                                                                                                                                                                                                                                | <code>false</code>                                                                                                                                                                             |

diff --git a/charts/ace/templates/db/pgpool.yaml b/charts/ace/templates/db/pgpool.yaml
@@ -30,7 +30,7 @@ spec:
           {{- toYaml .Values.settings.pgpool.resources | nindent 10 }}
     {{- if eq (include "distro.openshift" $) "true" }}
         securityContext:
-          runAsGroup: {{ .Values.securityContext.runAsUser }}
+          runAsGroup: 0
           runAsUser: {{ .Values.securityContext.runAsUser }}
           capabilities:
             drop:
@@ -41,12 +41,31 @@ spec:
       securityContext:
         fsGroup: {{ .Values.securityContext.runAsUser }}
         runAsUser: {{ .Values.securityContext.runAsUser }}
-        runAsGroup: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: 0
     {{- end }}
 {{- if .Values.global.monitoring }}
   monitor:
     agent: {{ .Values.global.monitoring.agent }}
     prometheus:
+      {{- if or .Values.global.monitoring.exporter.resources (eq (include "distro.openshift" $) "true") }}
+      exporter:
+      {{- with .Values.global.monitoring.exporter.resources }}
+        resources:
+          {{- toYaml . | nindent 10 }}
+      {{- end }}
+      {{- if eq (include "distro.openshift" $) "true" }}
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          runAsGroup: {{ .Values.securityContext.runAsUser }}
+          runAsNonRoot: true
+          runAsUser: {{ .Values.securityContext.runAsUser }}
+          seccompProfile:
+            type: RuntimeDefault
+      {{- end }}
+      {{- end }}
       serviceMonitor:
         interval: 30s
         labels:

diff --git a/charts/ace/templates/gateway/gateway.yaml b/charts/ace/templates/gateway/gateway.yaml
@@ -31,6 +31,8 @@ spec:
     allowedRoutes:
       namespaces:
         from: Same
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (TCPRoute), so NATS and s3proxy use their own LoadBalancer Services there. */}}
+{{- if ne (include "distro.openshift" .) "true" }}
   - allowedRoutes:
       namespaces:
         from: Same
@@ -50,3 +52,4 @@ spec:
     port: 4224
     protocol: TCP
 {{- end }}
+{{- end }}
diff --git a/charts/ace/templates/gateway/route-nats.yaml b/charts/ace/templates/gateway/route-nats.yaml
@@ -35,6 +35,43 @@ spec:
           type: ReplacePrefixMatch
           replacePrefixMatch: /
     backendRefs:
+{{- if eq (include "distro.openshift" .) "true" }}
+    - group: gateway.envoyproxy.io
+      kind: Backend
+      name: {{ include "ace.fullname" . }}-nats
+      namespace: {{ .Release.Namespace }}
+      weight: 1
+---
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy, TCPRoute). */}}
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  name: {{ include "ace.fullname" . }}-nats
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpoints:
+  - fqdn:
+      hostname: {{ include "ace.fullname" . }}-nats.{{ .Release.Namespace }}.svc
+      port: 443
+  tls:
+    caCertificateRefs:
+    {{- if and
+      (or (eq .Values.global.infra.tls.issuer "letsencrypt") (eq .Values.global.infra.tls.issuer "letsencrypt-staging"))
+      (index .Values "gateway" "enabled") }}
+    - group: ""
+      kind: Secret
+      name: {{ include "ace.fullname" . }}-acme-ca-cert
+    {{- else }}
+    - group: ""
+      kind: Secret
+      name: {{ include "ace.fullname" . }}-gw-cert
+    {{- end }}
+  {{- if eq (index .Values "global" "platform" "hostType") "ip" }}
+    sni: {{ include "ace.fullname" . }}-nats
+  {{- else }}
+    sni: {{ printf "%s" .Values.global.platform.host }}
+  {{- end }}
+{{- else }}
     - group: ""
       kind: Service
       name: {{ include "ace.fullname" . }}-nats
@@ -93,3 +130,4 @@ spec:
       port: 4222
       weight: 1
 {{- end }}
+{{- end }}
diff --git a/charts/ace/templates/gateway/service-nats-lb.yaml b/charts/ace/templates/gateway/service-nats-lb.yaml
@@ -0,0 +1,23 @@
+{{- if and (index .Values "gateway" "enabled") .Values.nats.enabled (not .Values.nats.nats.externalAccess) (eq (include "distro.openshift" .) "true") }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "ace.fullname" . }}-nats-lb
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "ace.labels" . | nindent 4 }}
+  {{- with .Values.gateway.loadBalancer.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  type: LoadBalancer
+  ports:
+  - name: client
+    port: 4222
+    targetPort: 4222
+    protocol: TCP
+  selector:
+    app.kubernetes.io/name: {{ default "nats" .Values.nats.nameOverride }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
diff --git a/charts/ace/values.openapiv3_schema.yaml b/charts/ace/values.openapiv3_schema.yaml
@@ -1329,6 +1329,15 @@ properties:
         type: object
       enabled:
         type: boolean
+      loadBalancer:
+        properties:
+          annotations:
+            additionalProperties:
+              type: string
+            type: object
+        required:
+        - annotations
+        type: object
       tls:
         properties:
           enabled:
@@ -23993,6 +24002,15 @@ properties:
               - paths
               type: object
             type: array
+          loadBalancer:
+            properties:
+              annotations:
+                additionalProperties:
+                  type: string
+                type: object
+            required:
+            - annotations
+            type: object
           tls:
             properties:
               enabled:

diff --git a/charts/ace/values.yaml b/charts/ace/values.yaml
@@ -27,6 +27,10 @@ gateway:
     enabled: true
     secret:
       name: "ace-cert"
+  # OpenShift only: NATS (4222) is exposed by its own LoadBalancer Service.
+  # Use the same IP-sharing annotations as the Envoy Service to share its IP.
+  loadBalancer:
+    annotations: {}
 
 ingress-nginx:
   enabled: false

diff --git a/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml b/charts/opscenter-features/templates/featuresets/opscenter-networking/voyager-gateway.yaml
@@ -8,6 +8,10 @@ deployment:
       repository: %s
 gateway-converter:
   registryFQDN: %s
+config:
+  envoyGateway:
+    extensionApis:
+      enableBackend: true
 `
   (include "image.ghcr" (merge (dict "_repo" "voyagermesh/gateway") $))
   (include "image.ghcr" (merge (dict "_repo" "appscode/kube-rbac-proxy") $))

diff --git a/charts/s3proxy/README.md b/charts/s3proxy/README.md
@@ -68,6 +68,7 @@ The following table lists the configurable parameters of the `s3proxy` chart and
 | gateway.tls.enabled                   |                                                                                                                                      | <code>true</code>                                                                                                                                                |
 | gateway.tls.secret.name               |                                                                                                                                      | <code>"ace-cert"</code>                                                                                                                                          |
 | gateway.hosts                         |                                                                                                                                      | <code>[]</code>                                                                                                                                                  |
+| gateway.loadBalancer.annotations      |                                                                                                                                      | <code>{}</code>                                                                                                                                                  |
 | resources                             |                                                                                                                                      | <code>{}</code>                                                                                                                                                  |
 | service.type                          |                                                                                                                                      | <code>ClusterIP</code>                                                                                                                                           |
 | service.port                          |                                                                                                                                      | <code>4224</code>                                                                                                                                                |

diff --git a/charts/s3proxy/templates/httproute.yaml b/charts/s3proxy/templates/httproute.yaml
@@ -42,16 +42,55 @@ spec:
         type: PathPrefix
         value: {{ .path }}
     backendRefs:
+    {{- if eq (include "distro.openshift" $) "true" }}
+    - group: gateway.envoyproxy.io
+      kind: Backend
+      name: {{ include "s3proxy.fullname" $ }}
+      namespace: {{ $.Release.Namespace }}
+      weight: 1
+    {{- else }}
     - group: ""
       kind: Service
       name: {{ include "s3proxy.fullname" $ }}
       namespace: {{ $.Release.Namespace }}
       port: {{ $.Values.service.port }}
       weight: 1
     {{- end }}
+    {{- end }}
   {{- end }}
 
 ---
+{{- if eq (include "distro.openshift" .) "true" }}
+{{- /* OpenShift Degrades the ingress operator on unmanaged Gateway API CRDs (BackendTLSPolicy, TCPRoute). */}}
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  name: {{ include "s3proxy.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpoints:
+  - fqdn:
+      hostname: {{ include "s3proxy.fullname" . }}.{{ .Release.Namespace }}.svc
+      port: {{ .Values.service.port }}
+  tls:
+    caCertificateRefs:
+    {{- if and
+      (or (eq .Values.global.infra.tls.issuer "letsencrypt") (eq .Values.global.infra.tls.issuer "letsencrypt-staging"))
+      (index .Values "gateway" "enabled") }}
+    - group: ""
+      kind: Secret
+      name: {{ include "ace.fullname" . }}-acme-ca-cert
+    {{- else }}
+    - group: ""
+      kind: Secret
+      name: {{ include "ace.fullname" . }}-gw-cert
+    {{- end }}
+  {{- if eq (index .Values "global" "platform" "hostType") "ip" }}
+    sni: {{ include "ace.fullname" . }}-s3proxy
+  {{- else }}
+    sni: {{ .Values.global.platform.host }}
+  {{- end }}
+{{- else }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: BackendTLSPolicy
 metadata:
@@ -81,6 +120,9 @@ spec:
     hostname: {{ .Values.global.platform.host }}
   {{- end }}
 {{- end }}
+{{- end }}
+
+{{- if ne (include "distro.openshift" .) "true" }}
 
 ---
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -104,3 +146,4 @@ spec:
       port: 4224
       weight: 1
 {{- end }}
+{{- end }}