diff --git a/apis/installer/v1alpha1/ace_acaas_types.go b/apis/installer/v1alpha1/ace_acaas_types.go
index 1d123f0b5..b0c0c9425 100644
--- a/apis/installer/v1alpha1/ace_acaas_types.go
+++ b/apis/installer/v1alpha1/ace_acaas_types.go
@@ -54,7 +54,7 @@ type AcaasSpec struct {
Global AcaasGlobalValues `json:"global"`
Ingress AcaasIngress `json:"ingress"`
- Gateway AceGateway `json:"gateway"`
+ Gateway AcaasGateway `json:"gateway"`
}
type AceBilling struct {
@@ -137,6 +137,12 @@ type AcaasIngressTLS struct {
Secret LocalObjectReference `json:"secret"`
}
+type AcaasGateway struct {
+ Enabled bool `json:"enabled"`
+ *GatewaySpec `json:",inline,omitempty"`
+ Rules AcaasIngressRules `json:"rules"`
+}
+
type AcaasIngressRules struct {
Blog ExternalService `json:"blog"`
Docs ExternalService `json:"docs"`
diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go
index 9508f4f54..b79982d6b 100644
--- a/apis/installer/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/installer/v1alpha1/zz_generated.deepcopy.go
@@ -61,6 +61,27 @@ func (in *Acaas) DeepCopyObject() runtime.Object {
return nil
}
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AcaasGateway) DeepCopyInto(out *AcaasGateway) {
+ *out = *in
+ if in.GatewaySpec != nil {
+ in, out := &in.GatewaySpec, &out.GatewaySpec
+ *out = new(GatewaySpec)
+ (*in).DeepCopyInto(*out)
+ }
+ out.Rules = in.Rules
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AcaasGateway.
+func (in *AcaasGateway) DeepCopy() *AcaasGateway {
+ if in == nil {
+ return nil
+ }
+ out := new(AcaasGateway)
+ in.DeepCopyInto(out)
+ return out
+}
+
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *AcaasGlobalValues) DeepCopyInto(out *AcaasGlobalValues) {
*out = *in
diff --git a/charts/acaas/README.md b/charts/acaas/README.md
index 0e989b8d6..553bf42ef 100644
--- a/charts/acaas/README.md
+++ b/charts/acaas/README.md
@@ -79,6 +79,11 @@ The following table lists the configurable parameters of the `acaas` chart and t
| gateway.enabled | | false |
| gateway.tls.enabled | | true |
| gateway.tls.secret.name | | "ace-cert" |
+| gateway.rules.blog.upstream | | "" |
+| gateway.rules.docs.upstream | | "" |
+| gateway.rules.learn.upstream | | "" |
+| gateway.rules.license.upstream | | "" |
+| gateway.rules.selfhost.upstream | | "" |
| ingress.enabled | | true |
| ingress.className | | "nginx-ace" |
| ingress.tls.enable | | true |
diff --git a/charts/acaas/templates/blog/route.yaml b/charts/acaas/templates/blog/route.yaml
index 31a9fd975..aa6a87ee2 100644
--- a/charts/acaas/templates/blog/route.yaml
+++ b/charts/acaas/templates/blog/route.yaml
@@ -23,10 +23,13 @@ spec:
type: PathPrefix
value: /blog
backendRefs:
- - group: ""
- kind: Service
+ - group: gateway.envoyproxy.io
+ kind: Backend
name: blog
- namespace: {{ .Release.Namespace }}
port: 443
weight: 1
+ filters:
+ - type: URLRewrite
+ urlRewrite:
+ hostname: {{ .Values.gateway.rules.blog.upstream }}
{{- end }}
diff --git a/charts/acaas/templates/blog/service.yaml b/charts/acaas/templates/blog/service.yaml
index 7f0f08afe..6a95fe7c3 100644
--- a/charts/acaas/templates/blog/service.yaml
+++ b/charts/acaas/templates/blog/service.yaml
@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
apiVersion: v1
kind: Service
metadata:
diff --git a/charts/acaas/templates/docs/route.yaml b/charts/acaas/templates/docs/route.yaml
index 72780bfe6..f3aba36f5 100644
--- a/charts/acaas/templates/docs/route.yaml
+++ b/charts/acaas/templates/docs/route.yaml
@@ -23,8 +23,13 @@ spec:
type: PathPrefix
value: /docs
backendRefs:
- - kind: Service
+ - group: gateway.envoyproxy.io
+ kind: Backend
name: docs
- namespace: {{ .Release.Namespace }}
port: 443
+ weight: 1
+ filters:
+ - type: URLRewrite
+ urlRewrite:
+ hostname: {{ .Values.gateway.rules.docs.upstream }}
{{- end }}
diff --git a/charts/acaas/templates/docs/service.yaml b/charts/acaas/templates/docs/service.yaml
index 0b2d769a4..772b5783d 100644
--- a/charts/acaas/templates/docs/service.yaml
+++ b/charts/acaas/templates/docs/service.yaml
@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
apiVersion: v1
kind: Service
metadata:
diff --git a/charts/acaas/templates/gateway-backends.yaml b/charts/acaas/templates/gateway-backends.yaml
new file mode 100644
index 000000000..03ceaa296
--- /dev/null
+++ b/charts/acaas/templates/gateway-backends.yaml
@@ -0,0 +1,44 @@
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "gateway" "enabled") }}
+{{- range $name, $rule := .Values.gateway.rules }}
+---
+# Backend: resolves the external upstream by FQDN so Envoy uses a STRICT_DNS
+# cluster instead of Kubernetes EndpointSlices. An ExternalName Service has no
+# EndpointSlices, so plain backendRefs -> Service report zero ready endpoints.
+# Requires extensionApis.enableBackend: true in the EnvoyGateway config.
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+ {{- with $.Values.gateway.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ name: {{ $name }}
+ namespace: {{ $.Release.Namespace }}
+spec:
+ endpoints:
+ - fqdn:
+ hostname: {{ $rule.upstream }}
+ port: 443
+---
+# BackendTLSPolicy: makes Envoy originate TLS to the Backend above. Without it
+# Envoy connects in plaintext on 443 and the upstream (which terminates TLS on
+# that port) resets the connection with a protocol_error.
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+ {{- with $.Values.gateway.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ name: {{ $name }}
+ namespace: {{ $.Release.Namespace }}
+spec:
+ targetRefs:
+ - group: gateway.envoyproxy.io
+ kind: Backend
+ name: {{ $name }}
+ validation:
+ hostname: {{ $rule.upstream }}
+ wellKnownCACertificates: System
+{{- end }}
+{{- end }}
diff --git a/charts/acaas/templates/learn/route.yaml b/charts/acaas/templates/learn/route.yaml
index ba3da7626..886afbf88 100644
--- a/charts/acaas/templates/learn/route.yaml
+++ b/charts/acaas/templates/learn/route.yaml
@@ -23,8 +23,13 @@ spec:
type: PathPrefix
value: /learn
backendRefs:
- - kind: Service
+ - group: gateway.envoyproxy.io
+ kind: Backend
name: learn
- namespace: {{ .Release.Namespace }}
port: 443
+ weight: 1
+ filters:
+ - type: URLRewrite
+ urlRewrite:
+ hostname: {{ .Values.gateway.rules.learn.upstream }}
{{- end }}
diff --git a/charts/acaas/templates/learn/service.yaml b/charts/acaas/templates/learn/service.yaml
index 7070a1f9e..8f2e9e995 100644
--- a/charts/acaas/templates/learn/service.yaml
+++ b/charts/acaas/templates/learn/service.yaml
@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
apiVersion: v1
kind: Service
metadata:
diff --git a/charts/acaas/templates/license/route.yaml b/charts/acaas/templates/license/route.yaml
index 74724fd4d..292bfdacf 100644
--- a/charts/acaas/templates/license/route.yaml
+++ b/charts/acaas/templates/license/route.yaml
@@ -23,8 +23,13 @@ spec:
type: PathPrefix
value: /issue-license
backendRefs:
- - kind: Service
+ - group: gateway.envoyproxy.io
+ kind: Backend
name: license
- namespace: {{ .Release.Namespace }}
port: 443
+ weight: 1
+ filters:
+ - type: URLRewrite
+ urlRewrite:
+ hostname: {{ .Values.gateway.rules.license.upstream }}
{{- end }}
diff --git a/charts/acaas/templates/license/service.yaml b/charts/acaas/templates/license/service.yaml
index 0ca5cfd92..430f8d3cb 100644
--- a/charts/acaas/templates/license/service.yaml
+++ b/charts/acaas/templates/license/service.yaml
@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
apiVersion: v1
kind: Service
metadata:
diff --git a/charts/acaas/templates/selfhost/route.yaml b/charts/acaas/templates/selfhost/route.yaml
index 82fb9d99d..8d038a204 100644
--- a/charts/acaas/templates/selfhost/route.yaml
+++ b/charts/acaas/templates/selfhost/route.yaml
@@ -23,8 +23,13 @@ spec:
type: PathPrefix
value: /selfhost
backendRefs:
- - kind: Service
+ - group: gateway.envoyproxy.io
+ kind: Backend
name: selfhost
- namespace: {{ .Release.Namespace }}
port: 443
+ weight: 1
+ filters:
+ - type: URLRewrite
+ urlRewrite:
+ hostname: {{ .Values.gateway.rules.selfhost.upstream }}
{{- end }}
diff --git a/charts/acaas/templates/selfhost/service.yaml b/charts/acaas/templates/selfhost/service.yaml
index 13fa52c9d..d29891425 100644
--- a/charts/acaas/templates/selfhost/service.yaml
+++ b/charts/acaas/templates/selfhost/service.yaml
@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
apiVersion: v1
kind: Service
metadata:
diff --git a/charts/acaas/values.ninja.yaml b/charts/acaas/values.ninja.yaml
index 21db9933a..d185da265 100644
--- a/charts/acaas/values.ninja.yaml
+++ b/charts/acaas/values.ninja.yaml
@@ -3,6 +3,19 @@ global:
host: appscode.ninja
deploymentType: Hosted
+gateway:
+ rules:
+ blog:
+ upstream: blog-prod.web.app
+ docs:
+ upstream: bb-docs-qa.web.app
+ learn:
+ upstream: learn-qa.web.app
+ license:
+ upstream: x.appscode.com
+ selfhost:
+ upstream: selfhosting-qa.web.app
+
ingress:
rules:
blog:
diff --git a/charts/acaas/values.prod.yaml b/charts/acaas/values.prod.yaml
index 63c26970d..1688452f8 100644
--- a/charts/acaas/values.prod.yaml
+++ b/charts/acaas/values.prod.yaml
@@ -12,6 +12,19 @@ global:
host: appscode.com
deploymentType: Hosted
+gateway:
+ rules:
+ blog:
+ upstream: blog-prod.web.app
+ docs:
+ upstream: byte-builders-docs.web.app
+ learn:
+ upstream: byte-builders-learn.web.app
+ license:
+ upstream: x.appscode.com
+ selfhost:
+ upstream: byte-builders-selfhosting.web.app
+
ingress:
rules:
blog:
diff --git a/charts/acaas/values.yaml b/charts/acaas/values.yaml
index 9a94def11..c3929316c 100644
--- a/charts/acaas/values.yaml
+++ b/charts/acaas/values.yaml
@@ -67,6 +67,17 @@ gateway:
enabled: true
secret:
name: "ace-cert"
+ rules:
+ blog:
+ upstream: ""
+ docs:
+ upstream: ""
+ learn:
+ upstream: ""
+ license:
+ upstream: ""
+ selfhost:
+ upstream: ""
ingress:
enabled: true