Add gateway.rules in acaas

apis/installer/v1alpha1/ace_acaas_types.go

@@ -54,7 +54,7 @@ type AcaasSpec struct {
 
 	Global  AcaasGlobalValues `json:"global"`
 	Ingress AcaasIngress      `json:"ingress"`
-	Gateway AceGateway        `json:"gateway"`
+	Gateway AcaasGateway      `json:"gateway"`
 }
 
 type AceBilling struct {
@@ -137,6 +137,12 @@ type AcaasIngressTLS struct {
 	Secret LocalObjectReference `json:"secret"`
 }
 
+type AcaasGateway struct {
+	Enabled      bool `json:"enabled"`
+	*GatewaySpec `json:",inline,omitempty"`
+	Rules        AcaasIngressRules `json:"rules"`
+}
+
 type AcaasIngressRules struct {
 	Blog     ExternalService `json:"blog"`
 	Docs     ExternalService `json:"docs"`

charts/acaas/README.md

@@ -79,6 +79,11 @@ The following table lists the configurable parameters of the `acaas` chart and t
 | gateway.enabled                                 |                                                                                                                                      | <code>false</code>                           |
 | gateway.tls.enabled                             |                                                                                                                                      | <code>true</code>                            |
 | gateway.tls.secret.name                         |                                                                                                                                      | <code>"ace-cert"</code>                      |
+| gateway.rules.blog.upstream                     |                                                                                                                                      | <code>""</code>                              |
+| gateway.rules.docs.upstream                     |                                                                                                                                      | <code>""</code>                              |
+| gateway.rules.learn.upstream                    |                                                                                                                                      | <code>""</code>                              |
+| gateway.rules.license.upstream                  |                                                                                                                                      | <code>""</code>                              |
+| gateway.rules.selfhost.upstream                 |                                                                                                                                      | <code>""</code>                              |
 | ingress.enabled                                 |                                                                                                                                      | <code>true</code>                            |
 | ingress.className                               |                                                                                                                                      | <code>"nginx-ace"</code>                     |
 | ingress.tls.enable                              |                                                                                                                                      | <code>true</code>                            |

charts/acaas/templates/blog/route.yaml

@@ -23,10 +23,13 @@ spec:
             type: PathPrefix
             value: /blog
       backendRefs:
-        - group: ""
-          kind: Service
+        - group: gateway.envoyproxy.io
+          kind: Backend
           name: blog
-          namespace: {{ .Release.Namespace }}
           port: 443
           weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            hostname: {{ .Values.gateway.rules.blog.upstream }}
 {{- end }}

charts/acaas/templates/blog/service.yaml

@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
 apiVersion: v1
 kind: Service
 metadata:

charts/acaas/templates/docs/route.yaml

@@ -23,8 +23,13 @@ spec:
             type: PathPrefix
             value: /docs
       backendRefs:
-        - kind: Service
+        - group: gateway.envoyproxy.io
+          kind: Backend
           name: docs
-          namespace: {{ .Release.Namespace }}
           port: 443
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            hostname: {{ .Values.gateway.rules.docs.upstream }}
 {{- end }}

charts/acaas/templates/docs/service.yaml

@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
 apiVersion: v1
 kind: Service
 metadata:

charts/acaas/templates/gateway-backends.yaml

@@ -0,0 +1,44 @@
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "gateway" "enabled") }}
+{{- range $name, $rule := .Values.gateway.rules }}
+---
+# Backend: resolves the external upstream by FQDN so Envoy uses a STRICT_DNS
+# cluster instead of Kubernetes EndpointSlices. An ExternalName Service has no
+# EndpointSlices, so plain backendRefs -> Service report zero ready endpoints.
+# Requires extensionApis.enableBackend: true in the EnvoyGateway config.
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
+metadata:
+  {{- with $.Values.gateway.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+spec:
+  endpoints:
+    - fqdn:
+        hostname: {{ $rule.upstream }}
+        port: 443
+---
+# BackendTLSPolicy: makes Envoy originate TLS to the Backend above. Without it
+# Envoy connects in plaintext on 443 and the upstream (which terminates TLS on
+# that port) resets the connection with a protocol_error.
+apiVersion: gateway.networking.k8s.io/v1alpha3
+kind: BackendTLSPolicy
+metadata:
+  {{- with $.Values.gateway.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+spec:
+  targetRefs:
+    - group: gateway.envoyproxy.io
+      kind: Backend
+      name: {{ $name }}
+  validation:
+    hostname: {{ $rule.upstream }}
+    wellKnownCACertificates: System
+{{- end }}
+{{- end }}

charts/acaas/templates/learn/route.yaml

@@ -23,8 +23,13 @@ spec:
             type: PathPrefix
             value: /learn
       backendRefs:
-        - kind: Service
+        - group: gateway.envoyproxy.io
+          kind: Backend
           name: learn
-          namespace: {{ .Release.Namespace }}
           port: 443
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            hostname: {{ .Values.gateway.rules.learn.upstream }}
 {{- end }}

charts/acaas/templates/learn/service.yaml

@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
 apiVersion: v1
 kind: Service
 metadata:

charts/acaas/templates/license/route.yaml

@@ -23,8 +23,13 @@ spec:
             type: PathPrefix
             value: /issue-license
       backendRefs:
-        - kind: Service
+        - group: gateway.envoyproxy.io
+          kind: Backend
           name: license
-          namespace: {{ .Release.Namespace }}
           port: 443
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            hostname: {{ .Values.gateway.rules.license.upstream }}
 {{- end }}

charts/acaas/templates/license/service.yaml

@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
 apiVersion: v1
 kind: Service
 metadata:

charts/acaas/templates/selfhost/route.yaml

@@ -23,8 +23,13 @@ spec:
             type: PathPrefix
             value: /selfhost
       backendRefs:
-        - kind: Service
+        - group: gateway.envoyproxy.io
+          kind: Backend
           name: selfhost
-          namespace: {{ .Release.Namespace }}
           port: 443
+          weight: 1
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            hostname: {{ .Values.gateway.rules.selfhost.upstream }}
 {{- end }}

charts/acaas/templates/selfhost/service.yaml

@@ -1,4 +1,4 @@
-{{- if eq (toString .Values.global.platform.deploymentType) "Hosted" }}
+{{- if and (eq (toString .Values.global.platform.deploymentType) "Hosted") (index .Values "ingress" "enabled") }}
 apiVersion: v1
 kind: Service
 metadata:

charts/acaas/values.ninja.yaml

@@ -3,6 +3,19 @@ global:
     host: appscode.ninja
     deploymentType: Hosted
 
+gateway:
+  rules:
+    blog:
+      upstream: blog-prod.web.app
+    docs:
+      upstream: bb-docs-qa.web.app
+    learn:
+      upstream: learn-qa.web.app
+    license:
+      upstream: x.appscode.com
+    selfhost:
+      upstream: selfhosting-qa.web.app
+
 ingress:
   rules:
     blog:

charts/acaas/values.prod.yaml

@@ -12,6 +12,19 @@ global:
     host: appscode.com
     deploymentType: Hosted
 
+gateway:
+  rules:
+    blog:
+      upstream: blog-prod.web.app
+    docs:
+      upstream: byte-builders-docs.web.app
+    learn:
+      upstream: byte-builders-learn.web.app
+    license:
+      upstream: x.appscode.com
+    selfhost:
+      upstream: byte-builders-selfhosting.web.app
+
 ingress:
   rules:
     blog:

charts/acaas/values.yaml

@@ -67,6 +67,17 @@ gateway:
     enabled: true
     secret:
       name: "ace-cert"
+  rules:
+    blog:
+      upstream: ""
+    docs:
+      upstream: ""
+    learn:
+      upstream: ""
+    license:
+      upstream: ""
+    selfhost:
+      upstream: ""
 
 ingress:
   enabled: true