Skip to content

Commit 9a37d74

Browse files
cavus700cavus700
committed
Add GatewayAPI Support
1 parent ad37280 commit 9a37d74

File tree

10 files changed

+223
-2
lines changed

10 files changed

+223
-2
lines changed

‎README.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -217,7 +217,22 @@ In addition, Sentry will always behave as follows:
217217
| global.secret.imagePullSecret | Image pull secret | "e30K" |
218218
| cloud.hashLookup.enabled | Enable/Disable the cloud hash lookup | true |
219219
| cloud.allowlistLookup.enabled | Enable/Disable the cloud allowlist lookup | true |
220-
| gateway.ingress.enabled | Enable/Disable the Ingress resource | false |
220+
| gatewayApi.enabled | Enable/Disable Gateway API resources | false |
221+
| gatewayApi.nameOverride | Overrides the Gateway API application name | "" |
222+
| gatewayApi.fullnameOverride | Overrides the Gateway API full name | "gateway-api" |
223+
| gatewayApi.gatewayClassName | Gateway class name for Gateway API | "eg" |
224+
| gatewayApi.annotations | Additional annotations for Gateway API | {} |
225+
| gatewayApi.infrastructure.annotations | Infrastructure-specific annotations for Gateway API | {} |
226+
| gatewayApi.listeners.https.hostname | Hostname for HTTPS listener | "" |
227+
| gatewayApi.listeners.https.protocol | Protocol for HTTPS listener | HTTPS |
228+
| gatewayApi.listeners.https.port | Port for HTTPS listener | 443 |
229+
| gatewayApi.listeners.https.tlsSecretName | TLS secret name for HTTPS listener | "gateway-api-tls" |
230+
| gatewayApi.listeners.http.hostname | Hostname for HTTP listener | "" |
231+
| gatewayApi.listeners.http.protocol | Protocol for HTTP listener | HTTP |
232+
| gatewayApi.listeners.http.port | Port for HTTP listener | 80 |
233+
| gateway.httpRoute.enabled | Enable/Disable HTTPRoute resource for Gateway API | false |
234+
| gateway.httpRoute.hostname | Hostname for HTTPRoute | "" |
235+
| gateway.ingress.enabled | Enable/Disable the Ingress resource (deprecated: use gatewayApi and httpRoute instead) | true |
221236
| gateway.ingress.annotations | Additional annotations for Ingress | {} |
222237
| gateway.ingress.hosts | Hostnames and paths for Ingress | [] |
223238
| gateway.ingress.tls` | TLS configuration for Ingress | [] |

‎charts/vaas/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
name: vaas
3-
version: 3.2.6
3+
version: 3.3.0-alpha.1
44
description: Deployment of a Verdict-as-a-Service on-premise instance
55
maintainers:
66
- name: G DATA CyberDefense AG

‎charts/vaas/templates/gateway-api/_helpers.tpl‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
{{/*
2+
Expand the name of the chart.
3+
*/}}
4+
{{- define "gateway-api.name" -}}
5+
{{- default "gateway-api" .Values.gatewayApi.nameOverride | trunc 63 | trimSuffix "-" }}
6+
{{- end }}
7+
8+
{{/*
9+
Create a default fully qualified app name.
10+
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
11+
If release name contains chart name it will be used as a full name.
12+
*/}}
13+
{{- define "gateway-api.fullname" -}}
14+
{{- if .Values.gatewayApi.fullnameOverride }}
15+
{{- .Values.gatewayApi.fullnameOverride | trunc 63 | trimSuffix "-" }}
16+
{{- else }}
17+
{{- $name := default .Chart.Name .Values.gatewayApi.nameOverride }}
18+
{{- if contains $name .Release.Name }}
19+
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
20+
{{- else }}
21+
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}
25+
26+
27+
{{/*
28+
Create chart name and version as used by the chart label.
29+
*/}}
30+
{{- define "gateway-api.chart" -}}
31+
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
32+
{{- end }}
33+
34+
{{/*
35+
Common labels
36+
*/}}
37+
{{- define "gateway-api.labels" -}}
38+
helm.sh/chart: {{ include "gateway-api.chart" . }}
39+
{{ include "gateway-api.selectorLabels" . }}
40+
{{- if .Chart.AppVersion }}
41+
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
42+
{{- end }}
43+
app.kubernetes.io/managed-by: {{ .Release.Service }}
44+
{{- end }}
45+
46+
{{/*
47+
Selector labels
48+
*/}}
49+
{{- define "gateway-api.selectorLabels" -}}
50+
app.kubernetes.io/name: {{ include "gateway-api.name" . }}
51+
app.kubernetes.io/instance: {{ .Release.Name }}
52+
app.kubernetes.io/namespace: {{ .Release.Namespace }}
53+
{{- end }}

‎charts/vaas/templates/gateway-api/gateway.yaml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
{{- if .Values.gatewayApi.enabled }}
2+
---
3+
apiVersion: gateway.networking.k8s.io/v1
4+
kind: Gateway
5+
metadata:
6+
name: {{ default (include "gateway-api.fullname" .) .Values.gatewayApi.nameOverride }}
7+
namespace: {{ .Release.Namespace }}
8+
labels:
9+
{{ include "gateway-api.labels" . | nindent 4 }}
10+
annotations:
11+
{{- with .Values.gatewayApi.annotations }}
12+
{{ toYaml . | nindent 4 }}
13+
{{- end }}
14+
spec:
15+
{{- if .Values.gatewayApi.infrastructure.annotations }}
16+
infrastructure:
17+
annotations:
18+
{{ toYaml .Values.gatewayApi.infrastructure.annotations | nindent 6 }}
19+
{{- end }}
20+
gatewayClassName: {{ .Values.gatewayApi.gatewayClassName | quote }}
21+
listeners:
22+
{{- range $name, $values := .Values.gatewayApi.listeners }}
23+
- name: {{ $name }}
24+
port: {{ $values.port }}
25+
protocol: {{ $values.protocol }}
26+
{{- if $values.hostname }}
27+
hostname: {{ $values.hostname }}
28+
{{- end }}
29+
{{- if $values.tlsSecretName }}
30+
tls:
31+
mode: Terminate
32+
certificateRefs:
33+
- kind: Secret
34+
name: {{ $values.tlsSecretName }}
35+
{{- end }}
36+
{{- if $values.allowedRoutes }}
37+
allowedRoutes:
38+
{{ toYaml $values.allowedRoutes | nindent 8 }}
39+
{{- end }}
40+
{{- end}}
41+
{{- end }}

‎charts/vaas/templates/gateway-api/http-redirect-route.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{- if .Values.gatewayApi.enabled }}
2+
---
3+
apiVersion: gateway.networking.k8s.io/v1beta1
4+
kind: HTTPRoute
5+
metadata:
6+
name: {{ default (include "gateway-api.fullname" .) .Values.gatewayApi.nameOverride }}
7+
namespace: {{ .Release.Namespace }}
8+
spec:
9+
parentRefs:
10+
- name: {{ default (include "gateway-api.fullname" .) .Values.gatewayApi.nameOverride }}
11+
sectionName: http
12+
rules:
13+
- filters:
14+
- type: RequestRedirect
15+
requestRedirect:
16+
scheme: https
17+
statusCode: 301
18+
{{- end }}

‎charts/vaas/templates/gateway/http-route.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
{{- if .Values.gateway.httpRoute.enabled }}
2+
---
3+
apiVersion: gateway.networking.k8s.io/v1beta1
4+
kind: HTTPRoute
5+
metadata:
6+
name: {{ include "gateway.fullname" . }}
7+
namespace: {{ .Release.Namespace }}
8+
spec:
9+
parentRefs:
10+
- name: {{ default (include "gateway-api.fullname" .) .Values.gatewayApi.nameOverride }}
11+
sectionName: https
12+
{{- if .Values.gateway.httpRoute.hostname }}
13+
hostnames:
14+
- {{ .Values.gateway.httpRoute.hostname | quote }}
15+
{{- end }}
16+
rules:
17+
# DEPRECATED: WebSocket connection will be removed in the future
18+
- backendRefs:
19+
- name: {{ include "gateway.fullname" . }}
20+
port: {{ .Values.gateway.service.ws.port }}
21+
weight: 1
22+
header:
23+
- name: Upgrade
24+
value: websocket
25+
matches:
26+
- path:
27+
type: PathPrefix
28+
value: /
29+
- backendRefs:
30+
- name: {{ include "gateway.fullname" . }}
31+
port: {{ .Values.gateway.service.http.port }}
32+
weight: 1
33+
matches:
34+
- path:
35+
type: PathPrefix
36+
value: /files
37+
- path:
38+
type: PathPrefix
39+
value: /urls
40+
- path:
41+
type: PathPrefix
42+
value: /swagger
43+
# DEPRECATED: Functionality is moved to other routes and will be removed in the future
44+
- path:
45+
type: PathPrefix
46+
value: /upload
47+
{{- end }}

‎charts/vaas/templates/gateway/ingress.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
#######################################################################
2+
### DEPRECATED: Will be replaced by Gateway API ###
3+
### https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/ ###
4+
#######################################################################
5+
16
{{- if .Values.gateway.ingress.enabled -}}
27
{{- $fullName := include "gateway.fullname" . -}}
38
{{- $defaultAnnotations := dict "nginx.ingress.kubernetes.io/proxy-body-size" "2G" "nginx.ingress.kubernetes.io/proxy-request-buffering" "off" }}

‎charts/vaas/templates/gateway/statefulset.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@ spec:
2020
{{- toYaml . | nindent 8 }}
2121
{{- end }}
2222
labels:
23+
{{- if .Values.gateway.podLabels }}
24+
{{ toYaml .Values.gateway.podLabels | nindent 8 }}
25+
{{- end }}
2326
{{- include "gateway.selectorLabels" . | nindent 8 }}
2427
spec:
2528
{{- include "gateway.imagePullSecrets" . | nindent 6 }}

‎charts/vaas/templates/gdscan/ingress.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
#######################################################################
2+
### DEPRECATED: Will be replaced by Gateway API ###
3+
### https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/ ###
4+
#######################################################################
5+
16
{{- if .Values.gdscan.ingress.enabled -}}
27
{{- $fullName := include "gdscan.fullname" . -}}
38
{{- $svcPort := .Values.gdscan.service.port -}}

‎charts/vaas/values.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,10 +80,43 @@ cloud:
8080
# enableTracing: ""
8181
# tracesSampleRate: ""
8282

83+
gatewayApi:
84+
enabled: false
85+
nameOverride: ""
86+
fullnameOverride: "gateway-api"
87+
gatewayClassName: "eg"
88+
annotations: {}
89+
infrastructure:
90+
annotations: {}
91+
listeners:
92+
https:
93+
hostname: ""
94+
protocol: HTTPS
95+
port: 443
96+
tlsSecretName: "gateway-api-tls"
97+
allowedRoutes:
98+
kinds:
99+
- kind: HTTPRoute
100+
namespaces:
101+
from: Same
102+
http:
103+
hostname: ""
104+
protocol: HTTP
105+
port: 80
106+
allowedRoutes:
107+
kinds:
108+
- kind: HTTPRoute
109+
namespaces:
110+
from: Same
111+
83112
gateway:
84113
uploadToken:
85114
existingSecret: ""
86115
key: ""
116+
httpRoute:
117+
enabled: false
118+
hostname: ""
119+
# Deprecated: Use gatewayApi and httpRoute instead
87120
ingress:
88121
enabled: true
89122
className: ""
@@ -174,6 +207,7 @@ gateway:
174207
terminationGracePeriodSeconds: 30
175208

176209
podAnnotations: {}
210+
podLabels: {}
177211
nodeSelector: {}
178212
tolerations: []
179213
affinity: {}

0 commit comments

Comments
 (0)