From 48c269c2277b84967b6d2551e96d47a9210d149b Mon Sep 17 00:00:00 2001 From: Arnob kumar saha Date: Wed, 8 Jul 2026 17:25:32 +0600 Subject: [PATCH 1/3] Add rules in acaas Signed-off-by: Arnob kumar saha --- apis/installer/v1alpha1/ace_acaas_types.go | 8 ++++++- .../v1alpha1/zz_generated.deepcopy.go | 21 +++++++++++++++++++ charts/acaas/README.md | 5 +++++ charts/acaas/values.yaml | 11 ++++++++++ 4 files changed, 44 insertions(+), 1 deletion(-) diff --git a/apis/installer/v1alpha1/ace_acaas_types.go b/apis/installer/v1alpha1/ace_acaas_types.go index 1d123f0b5..b0c0c9425 100644 --- a/apis/installer/v1alpha1/ace_acaas_types.go +++ b/apis/installer/v1alpha1/ace_acaas_types.go @@ -54,7 +54,7 @@ type AcaasSpec struct { Global AcaasGlobalValues `json:"global"` Ingress AcaasIngress `json:"ingress"` - Gateway AceGateway `json:"gateway"` + Gateway AcaasGateway `json:"gateway"` } type AceBilling struct { @@ -137,6 +137,12 @@ type AcaasIngressTLS struct { Secret LocalObjectReference `json:"secret"` } +type AcaasGateway struct { + Enabled bool `json:"enabled"` + *GatewaySpec `json:",inline,omitempty"` + Rules AcaasIngressRules `json:"rules"` +} + type AcaasIngressRules struct { Blog ExternalService `json:"blog"` Docs ExternalService `json:"docs"` diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go index 9508f4f54..b79982d6b 100644 --- a/apis/installer/v1alpha1/zz_generated.deepcopy.go +++ b/apis/installer/v1alpha1/zz_generated.deepcopy.go @@ -61,6 +61,27 @@ func (in *Acaas) DeepCopyObject() runtime.Object { return nil } +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AcaasGateway) DeepCopyInto(out *AcaasGateway) { + *out = *in + if in.GatewaySpec != nil { + in, out := &in.GatewaySpec, &out.GatewaySpec + *out = new(GatewaySpec) + (*in).DeepCopyInto(*out) + } + out.Rules = in.Rules +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AcaasGateway. +func (in *AcaasGateway) DeepCopy() *AcaasGateway { + if in == nil { + return nil + } + out := new(AcaasGateway) + in.DeepCopyInto(out) + return out +} + // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. func (in *AcaasGlobalValues) DeepCopyInto(out *AcaasGlobalValues) { *out = *in diff --git a/charts/acaas/README.md b/charts/acaas/README.md index 0e989b8d6..553bf42ef 100644 --- a/charts/acaas/README.md +++ b/charts/acaas/README.md @@ -79,6 +79,11 @@ The following table lists the configurable parameters of the `acaas` chart and t | gateway.enabled | | false | | gateway.tls.enabled | | true | | gateway.tls.secret.name | | "ace-cert" | +| gateway.rules.blog.upstream | | "" | +| gateway.rules.docs.upstream | | "" | +| gateway.rules.learn.upstream | | "" | +| gateway.rules.license.upstream | | "" | +| gateway.rules.selfhost.upstream | | "" | | ingress.enabled | | true | | ingress.className | | "nginx-ace" | | ingress.tls.enable | | true | diff --git a/charts/acaas/values.yaml b/charts/acaas/values.yaml index 9a94def11..c3929316c 100644 --- a/charts/acaas/values.yaml +++ b/charts/acaas/values.yaml @@ -67,6 +67,17 @@ gateway: enabled: true secret: name: "ace-cert" + rules: + blog: + upstream: "" + docs: + upstream: "" + learn: + upstream: "" + license: + upstream: "" + selfhost: + upstream: "" ingress: enabled: true From 423e48c641c2c921797c6ce25c92ef76b63aa2b6 Mon Sep 17 00:00:00 2001 From: Arnob kumar saha Date: Wed, 8 Jul 2026 17:30:25 +0600 Subject: [PATCH 2/3] Use gateway.rules upstream when gateway is enabled in acaas The blog/docs/learn/license/selfhost ExternalName services hardcoded ingress.rules.*.upstream, so the newly added gateway.rules.* values had no effect on the actual rendered chart. Signed-off-by: Arnob kumar saha --- charts/acaas/templates/blog/service.yaml | 2 +- charts/acaas/templates/docs/service.yaml | 2 +- charts/acaas/templates/learn/service.yaml | 2 +- charts/acaas/templates/license/service.yaml | 2 +- charts/acaas/templates/selfhost/service.yaml | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/charts/acaas/templates/blog/service.yaml b/charts/acaas/templates/blog/service.yaml index 7f0f08afe..14929812c 100644 --- a/charts/acaas/templates/blog/service.yaml +++ b/charts/acaas/templates/blog/service.yaml @@ -5,7 +5,7 @@ metadata: name: blog namespace: {{ .Release.Namespace }} spec: - externalName: {{ .Values.ingress.rules.blog.upstream }} + externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.blog.upstream }}{{ else }}{{ .Values.ingress.rules.blog.upstream }}{{ end }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/docs/service.yaml b/charts/acaas/templates/docs/service.yaml index 0b2d769a4..e35cbb775 100644 --- a/charts/acaas/templates/docs/service.yaml +++ b/charts/acaas/templates/docs/service.yaml @@ -5,7 +5,7 @@ metadata: name: docs namespace: {{ .Release.Namespace }} spec: - externalName: {{ .Values.ingress.rules.docs.upstream }} + externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.docs.upstream }}{{ else }}{{ .Values.ingress.rules.docs.upstream }}{{ end }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/learn/service.yaml b/charts/acaas/templates/learn/service.yaml index 7070a1f9e..aea781897 100644 --- a/charts/acaas/templates/learn/service.yaml +++ b/charts/acaas/templates/learn/service.yaml @@ -5,7 +5,7 @@ metadata: name: learn namespace: {{ .Release.Namespace }} spec: - externalName: {{ .Values.ingress.rules.learn.upstream }} + externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.learn.upstream }}{{ else }}{{ .Values.ingress.rules.learn.upstream }}{{ end }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/license/service.yaml b/charts/acaas/templates/license/service.yaml index 0ca5cfd92..84016251f 100644 --- a/charts/acaas/templates/license/service.yaml +++ b/charts/acaas/templates/license/service.yaml @@ -5,7 +5,7 @@ metadata: name: license namespace: {{ .Release.Namespace }} spec: - externalName: {{ .Values.ingress.rules.license.upstream }} + externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.license.upstream }}{{ else }}{{ .Values.ingress.rules.license.upstream }}{{ end }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/selfhost/service.yaml b/charts/acaas/templates/selfhost/service.yaml index 13fa52c9d..4cd20afad 100644 --- a/charts/acaas/templates/selfhost/service.yaml +++ b/charts/acaas/templates/selfhost/service.yaml @@ -5,7 +5,7 @@ metadata: name: selfhost namespace: {{ .Release.Namespace }} spec: - externalName: {{ .Values.ingress.rules.selfhost.upstream }} + externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.selfhost.upstream }}{{ else }}{{ .Values.ingress.rules.selfhost.upstream }}{{ end }} sessionAffinity: None type: ExternalName {{- end }} From 8da7a0919ae79d6f316f0714828ef2069a291249 Mon Sep 17 00:00:00 2001 From: Arnob Kumar Saha Date: Thu, 9 Jul 2026 00:11:11 +0600 Subject: [PATCH 3/3] Modify routes for acaas Signed-off-by: Arnob Kumar Saha --- charts/acaas/templates/blog/route.yaml | 9 ++-- charts/acaas/templates/blog/service.yaml | 4 +- charts/acaas/templates/docs/route.yaml | 9 +++- charts/acaas/templates/docs/service.yaml | 4 +- charts/acaas/templates/gateway-backends.yaml | 44 ++++++++++++++++++++ charts/acaas/templates/learn/route.yaml | 9 +++- charts/acaas/templates/learn/service.yaml | 4 +- charts/acaas/templates/license/route.yaml | 9 +++- charts/acaas/templates/license/service.yaml | 4 +- charts/acaas/templates/selfhost/route.yaml | 9 +++- charts/acaas/templates/selfhost/service.yaml | 4 +- charts/acaas/values.ninja.yaml | 13 ++++++ charts/acaas/values.prod.yaml | 13 ++++++ 13 files changed, 114 insertions(+), 21 deletions(-) create mode 100644 charts/acaas/templates/gateway-backends.yaml diff --git a/charts/acaas/templates/blog/route.yaml b/charts/acaas/templates/blog/route.yaml index 31a9fd975..aa6a87ee2 100644 --- a/charts/acaas/templates/blog/route.yaml +++ b/charts/acaas/templates/blog/route.yaml @@ -23,10 +23,13 @@ spec: type: PathPrefix value: /blog backendRefs: - - group: "" - kind: Service + - group: gateway.envoyproxy.io + kind: Backend name: blog - namespace: {{ .Release.Namespace }} port: 443 weight: 1 + filters: + - type: URLRewrite + urlRewrite: + hostname: {{ .Values.gateway.rules.blog.upstream }} {{- end }} diff --git a/charts/acaas/templates/blog/service.yaml b/charts/acaas/templates/blog/service.yaml index 14929812c..6a95fe7c3 100644 --- a/charts/acaas/templates/blog/service.yaml +++ b/charts/acaas/templates/blog/service.yaml @@ -1,11 +1,11 @@ -{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }} +{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }} apiVersion: v1 kind: Service metadata: name: blog namespace: {{ .Release.Namespace }} spec: - externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.blog.upstream }}{{ else }}{{ .Values.ingress.rules.blog.upstream }}{{ end }} + externalName: {{ .Values.ingress.rules.blog.upstream }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/docs/route.yaml b/charts/acaas/templates/docs/route.yaml index 72780bfe6..f3aba36f5 100644 --- a/charts/acaas/templates/docs/route.yaml +++ b/charts/acaas/templates/docs/route.yaml @@ -23,8 +23,13 @@ spec: type: PathPrefix value: /docs backendRefs: - - kind: Service + - group: gateway.envoyproxy.io + kind: Backend name: docs - namespace: {{ .Release.Namespace }} port: 443 + weight: 1 + filters: + - type: URLRewrite + urlRewrite: + hostname: {{ .Values.gateway.rules.docs.upstream }} {{- end }} diff --git a/charts/acaas/templates/docs/service.yaml b/charts/acaas/templates/docs/service.yaml index e35cbb775..772b5783d 100644 --- a/charts/acaas/templates/docs/service.yaml +++ b/charts/acaas/templates/docs/service.yaml @@ -1,11 +1,11 @@ -{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }} +{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }} apiVersion: v1 kind: Service metadata: name: docs namespace: {{ .Release.Namespace }} spec: - externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.docs.upstream }}{{ else }}{{ .Values.ingress.rules.docs.upstream }}{{ end }} + externalName: {{ .Values.ingress.rules.docs.upstream }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/gateway-backends.yaml b/charts/acaas/templates/gateway-backends.yaml new file mode 100644 index 000000000..03ceaa296 --- /dev/null +++ b/charts/acaas/templates/gateway-backends.yaml @@ -0,0 +1,44 @@ +{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "gateway" "enabled") }} +{{- range $name, $rule := .Values.gateway.rules }} +--- +# Backend: resolves the external upstream by FQDN so Envoy uses a STRICT_DNS +# cluster instead of Kubernetes EndpointSlices. An ExternalName Service has no +# EndpointSlices, so plain backendRefs -> Service report zero ready endpoints. +# Requires extensionApis.enableBackend: true in the EnvoyGateway config. +apiVersion: gateway.envoyproxy.io/v1alpha1 +kind: Backend +metadata: + {{- with $.Values.gateway.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ $name }} + namespace: {{ $.Release.Namespace }} +spec: + endpoints: + - fqdn: + hostname: {{ $rule.upstream }} + port: 443 +--- +# BackendTLSPolicy: makes Envoy originate TLS to the Backend above. Without it +# Envoy connects in plaintext on 443 and the upstream (which terminates TLS on +# that port) resets the connection with a protocol_error. +apiVersion: gateway.networking.k8s.io/v1alpha3 +kind: BackendTLSPolicy +metadata: + {{- with $.Values.gateway.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + name: {{ $name }} + namespace: {{ $.Release.Namespace }} +spec: + targetRefs: + - group: gateway.envoyproxy.io + kind: Backend + name: {{ $name }} + validation: + hostname: {{ $rule.upstream }} + wellKnownCACertificates: System +{{- end }} +{{- end }} diff --git a/charts/acaas/templates/learn/route.yaml b/charts/acaas/templates/learn/route.yaml index ba3da7626..886afbf88 100644 --- a/charts/acaas/templates/learn/route.yaml +++ b/charts/acaas/templates/learn/route.yaml @@ -23,8 +23,13 @@ spec: type: PathPrefix value: /learn backendRefs: - - kind: Service + - group: gateway.envoyproxy.io + kind: Backend name: learn - namespace: {{ .Release.Namespace }} port: 443 + weight: 1 + filters: + - type: URLRewrite + urlRewrite: + hostname: {{ .Values.gateway.rules.learn.upstream }} {{- end }} diff --git a/charts/acaas/templates/learn/service.yaml b/charts/acaas/templates/learn/service.yaml index aea781897..8f2e9e995 100644 --- a/charts/acaas/templates/learn/service.yaml +++ b/charts/acaas/templates/learn/service.yaml @@ -1,11 +1,11 @@ -{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }} +{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }} apiVersion: v1 kind: Service metadata: name: learn namespace: {{ .Release.Namespace }} spec: - externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.learn.upstream }}{{ else }}{{ .Values.ingress.rules.learn.upstream }}{{ end }} + externalName: {{ .Values.ingress.rules.learn.upstream }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/license/route.yaml b/charts/acaas/templates/license/route.yaml index 74724fd4d..292bfdacf 100644 --- a/charts/acaas/templates/license/route.yaml +++ b/charts/acaas/templates/license/route.yaml @@ -23,8 +23,13 @@ spec: type: PathPrefix value: /issue-license backendRefs: - - kind: Service + - group: gateway.envoyproxy.io + kind: Backend name: license - namespace: {{ .Release.Namespace }} port: 443 + weight: 1 + filters: + - type: URLRewrite + urlRewrite: + hostname: {{ .Values.gateway.rules.license.upstream }} {{- end }} diff --git a/charts/acaas/templates/license/service.yaml b/charts/acaas/templates/license/service.yaml index 84016251f..430f8d3cb 100644 --- a/charts/acaas/templates/license/service.yaml +++ b/charts/acaas/templates/license/service.yaml @@ -1,11 +1,11 @@ -{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }} +{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }} apiVersion: v1 kind: Service metadata: name: license namespace: {{ .Release.Namespace }} spec: - externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.license.upstream }}{{ else }}{{ .Values.ingress.rules.license.upstream }}{{ end }} + externalName: {{ .Values.ingress.rules.license.upstream }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/templates/selfhost/route.yaml b/charts/acaas/templates/selfhost/route.yaml index 82fb9d99d..8d038a204 100644 --- a/charts/acaas/templates/selfhost/route.yaml +++ b/charts/acaas/templates/selfhost/route.yaml @@ -23,8 +23,13 @@ spec: type: PathPrefix value: /selfhost backendRefs: - - kind: Service + - group: gateway.envoyproxy.io + kind: Backend name: selfhost - namespace: {{ .Release.Namespace }} port: 443 + weight: 1 + filters: + - type: URLRewrite + urlRewrite: + hostname: {{ .Values.gateway.rules.selfhost.upstream }} {{- end }} diff --git a/charts/acaas/templates/selfhost/service.yaml b/charts/acaas/templates/selfhost/service.yaml index 4cd20afad..d29891425 100644 --- a/charts/acaas/templates/selfhost/service.yaml +++ b/charts/acaas/templates/selfhost/service.yaml @@ -1,11 +1,11 @@ -{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }} +{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }} apiVersion: v1 kind: Service metadata: name: selfhost namespace: {{ .Release.Namespace }} spec: - externalName: {{ if .Values.gateway.enabled }}{{ .Values.gateway.rules.selfhost.upstream }}{{ else }}{{ .Values.ingress.rules.selfhost.upstream }}{{ end }} + externalName: {{ .Values.ingress.rules.selfhost.upstream }} sessionAffinity: None type: ExternalName {{- end }} diff --git a/charts/acaas/values.ninja.yaml b/charts/acaas/values.ninja.yaml index 21db9933a..d185da265 100644 --- a/charts/acaas/values.ninja.yaml +++ b/charts/acaas/values.ninja.yaml @@ -3,6 +3,19 @@ global: host: appscode.ninja deploymentType: Hosted +gateway: + rules: + blog: + upstream: blog-prod.web.app + docs: + upstream: bb-docs-qa.web.app + learn: + upstream: learn-qa.web.app + license: + upstream: x.appscode.com + selfhost: + upstream: selfhosting-qa.web.app + ingress: rules: blog: diff --git a/charts/acaas/values.prod.yaml b/charts/acaas/values.prod.yaml index 63c26970d..1688452f8 100644 --- a/charts/acaas/values.prod.yaml +++ b/charts/acaas/values.prod.yaml @@ -12,6 +12,19 @@ global: host: appscode.com deploymentType: Hosted +gateway: + rules: + blog: + upstream: blog-prod.web.app + docs: + upstream: byte-builders-docs.web.app + learn: + upstream: byte-builders-learn.web.app + license: + upstream: x.appscode.com + selfhost: + upstream: byte-builders-selfhosting.web.app + ingress: rules: blog: