feat(keycloakx): add ListenerSet support to httpRoute

Signed-off-by: apkatsikas <apkatsikas@gmail.com>

Author: apkatsikas

charts/keycloakx/templates/httproute.yaml

@@ -16,13 +16,32 @@ metadata:
   {{- end }}
 spec:
   parentRefs:
+    {{- if $httpRoute.listenerSet.enabled }}
+    - kind: ListenerSet
+      name: {{ include "keycloak.fullname" $ }}
+      namespace: {{ $.Release.Namespace }}
+    {{- else }}
     {{- with $httpRoute.parentRefs }}
       {{- toYaml . | nindent 4 }}
     {{- end }}
+    {{- end }}
+  {{- if $httpRoute.listenerSet.enabled }}
+  {{- $hostnames := list }}
+  {{- range $httpRoute.listenerSet.listeners }}
+  {{- if .hostname }}
+  {{- $hostnames = append $hostnames .hostname }}
+  {{- end }}
+  {{- end }}
+  {{- with $hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- else }}
   {{- with $httpRoute.hostnames }}
   hostnames:
     {{- toYaml . | nindent 4 }}
   {{- end }}
+  {{- end }}
   rules:
     {{- range $httpRoute.rules }}
     {{- with .matches }}

charts/keycloakx/templates/listenerset.yaml

@@ -0,0 +1,29 @@
+{{- $httpRoute := .Values.httpRoute -}}
+{{- $listenerSet := $httpRoute.listenerSet -}}
+{{- if and $httpRoute.enabled $listenerSet.enabled -}}
+apiVersion: gateway.networking.k8s.io/v1
+kind: ListenerSet
+metadata:
+  name: {{ include "keycloak.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "keycloak.labels" . | nindent 4 }}
+    {{- range $key, $value := $httpRoute.labels }}
+    {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }}
+    {{- end }}
+    {{- range $key, $value := $listenerSet.labels }}
+    {{- printf "%s: %s" $key (tpl $value $ | quote) | nindent 4 }}
+    {{- end }}
+  {{- with $listenerSet.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRef:
+    name: {{ $listenerSet.parentRef.name }}
+    {{- with $listenerSet.parentRef.namespace }}
+    namespace: {{ . }}
+    {{- end }}
+  listeners:
+    {{- toYaml $listenerSet.listeners | nindent 4 }}
+{{- end }}

charts/keycloakx/values.schema.json

@@ -158,6 +158,37 @@
             },
             "console": {
               "$ref": "#/definitions/httpRoute"
+            },
+            "listenerSet": {
+              "type": "object",
+              "properties": {
+                "enabled": {
+                  "type": "boolean"
+                },
+                "annotations": {
+                  "type": "object"
+                },
+                "labels": {
+                  "type": "object"
+                },
+                "parentRef": {
+                  "type": "object",
+                  "properties": {
+                    "name": {
+                      "type": "string"
+                    },
+                    "namespace": {
+                      "type": "string"
+                    }
+                  }
+                },
+                "listeners": {
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  }
+                }
+              }
             }
           }
         }

charts/keycloakx/values.yaml

@@ -319,6 +319,34 @@ httpRoute:
           type: PathPrefix
           value: '{{ tpl .Values.http.relativePath $ | trimSuffix "/" }}/'
 
+  # -- Create a ListenerSet resource to attach listeners to an existing Gateway
+  # without requiring write access to the Gateway resource itself. Useful for
+  # namespace-level configuration where app owners do not have Gateway write access.
+  # When enabled, the HTTPRoute parentRefs are auto-derived from the ListenerSet name,
+  # and hostnames are derived from listener hostnames; httpRoute.parentRefs and
+  # httpRoute.hostnames are unused.
+  listenerSet:
+    # If `true`, a ListenerSet resource is created alongside the HTTPRoute
+    enabled: false
+    # Additional ListenerSet labels
+    labels: {}
+    # ListenerSet annotations
+    annotations: {}
+    # The Gateway this ListenerSet attaches to
+    parentRef:
+      name: gateway
+      # namespace: envoy-gateway-system
+    # Listeners to attach to the Gateway. Passed through as-is.
+    # Listener hostnames are used to populate the HTTPRoute hostnames field.
+    listeners: []
+    # - name: http
+    #   hostname: keycloak.example.com
+    #   port: 80
+    #   protocol: HTTP
+    #   allowedRoutes:
+    #     namespaces:
+    #       from: Same
+
   # HTTPRoute for console only (/auth/admin)
   console:
     # If `true`, an HTTPRoute is created for console path only