fix: update gateway defaults

Author: davidebianchi

charts/rhai-on-openshift-chart/api-docs.md

@@ -18,7 +18,7 @@ A Helm chart for installing ODH/RHOAI dependencies and component configurations
 | components.feastoperator.dependencies | object | `{}` | Dependencies required by Feast Operator |
 | components.feastoperator.dsc | object | `{"managementState":null}` | DSC configuration for Feast Operator |
 | components.feastoperator.dsc.managementState | string | `nil` | Management state for Feast Operator. Null uses profile default. |
-| components.kserve | object | `{"dependencies":{"certManager":true,"customMetricsAutoscaler":false,"jobSet":null,"leaderWorkerSet":true,"rhcl":true},"dsc":{"managementState":null,"modelsAsService":{"managementState":null},"nim":{"managementState":null},"rawDeploymentServiceConfig":"Headless","wva":{"managementState":null}},"gateway":{"create":"auto","labels":{"istio.io/rev":"openshift-gateway"},"name":"openshift-ai-inference","namespace":"openshift-ingress","spec":{"gatewayClassName":"openshift-ai-inference","listeners":[{"allowedRoutes":{"namespaces":{"from":"All"}},"name":"https","port":443,"protocol":"HTTPS"}]}},"gatewayClass":{"create":"auto","name":"openshift-ai-inference","spec":{"controllerName":"openshift.io/gateway-controller/v1"}},"modelsAsService":{"gateway":{"annotations":{"opendatahub.io/managed":"false","security.opendatahub.io/authorino-tls-bootstrap":"true"},"create":false,"name":"maas-default-gateway","namespace":"openshift-ingress","spec":{"gatewayClassName":"maas-gateway-class","listeners":[{"allowedRoutes":{"namespaces":{"from":"All"}},"name":"https","port":443,"protocol":"HTTPS"}]}},"gatewayClass":{"create":false,"name":"maas-gateway-class","spec":{"controllerName":"openshift.io/gateway-controller/v1"}}}}` | KServe model serving component |
+| components.kserve | object | `{"dependencies":{"certManager":true,"customMetricsAutoscaler":false,"jobSet":null,"leaderWorkerSet":true,"rhcl":true},"dsc":{"managementState":null,"modelsAsService":{"managementState":null},"nim":{"managementState":null},"rawDeploymentServiceConfig":"Headless","wva":{"managementState":null}},"gateway":{"create":"auto","labels":{"istio.io/rev":"openshift-gateway"},"name":"openshift-ai-inference","namespace":"openshift-ingress","spec":{"gatewayClassName":"openshift-ai-inference","listeners":[{"allowedRoutes":{"namespaces":{"from":"Same"}},"name":"https","port":443,"protocol":"HTTPS"}]}},"gatewayClass":{"create":"auto","name":"openshift-ai-inference","spec":{"controllerName":"openshift.io/gateway-controller/v1"}},"modelsAsService":{"gateway":{"annotations":{"opendatahub.io/managed":"false","security.opendatahub.io/authorino-tls-bootstrap":"true"},"create":false,"name":"maas-default-gateway","namespace":"openshift-ingress","spec":{"gatewayClassName":"maas-gateway-class","listeners":[{"allowedRoutes":{"namespaces":{"from":"Same"}},"name":"https","port":443,"protocol":"HTTPS"}]}},"gatewayClass":{"create":false,"name":"maas-gateway-class","spec":{"controllerName":"openshift.io/gateway-controller/v1"}}}}` | KServe model serving component |
 | components.kserve.dependencies | object | `{"certManager":true,"customMetricsAutoscaler":false,"jobSet":null,"leaderWorkerSet":true,"rhcl":true}` | Dependencies required by KServe (set to false to disable) |
 | components.kserve.dependencies.jobSet | string | `nil` | JobSet dependency. Null uses profile default (true for default, false for rhaii). |
 | components.kserve.dsc | object | `{"managementState":null,"modelsAsService":{"managementState":null},"nim":{"managementState":null},"rawDeploymentServiceConfig":"Headless","wva":{"managementState":null}}` | DSC configuration for KServe |
@@ -30,13 +30,13 @@ A Helm chart for installing ODH/RHOAI dependencies and component configurations
 | components.kserve.dsc.rawDeploymentServiceConfig | string | `"Headless"` | Raw deployment service config for KServe (Headless or Headed) |
 | components.kserve.dsc.wva | object | `{"managementState":null}` | Note: When run on Openshift, and set to Managed ensure Custom Metrics Autoscaler (CMA) or Prometheus Adapter is installed |
 | components.kserve.dsc.wva.managementState | string | `nil` | Management state for workload-variant-autoscaler. Null uses profile default. |
-| components.kserve.gateway | object | `{"create":"auto","labels":{"istio.io/rev":"openshift-gateway"},"name":"openshift-ai-inference","namespace":"openshift-ingress","spec":{"gatewayClassName":"openshift-ai-inference","listeners":[{"allowedRoutes":{"namespaces":{"from":"All"}},"name":"https","port":443,"protocol":"HTTPS"}]}}` | Gateway configuration for KServe inference. |
+| components.kserve.gateway | object | `{"create":"auto","labels":{"istio.io/rev":"openshift-gateway"},"name":"openshift-ai-inference","namespace":"openshift-ingress","spec":{"gatewayClassName":"openshift-ai-inference","listeners":[{"allowedRoutes":{"namespaces":{"from":"Same"}},"name":"https","port":443,"protocol":"HTTPS"}]}}` | Gateway configuration for KServe inference. |
 | components.kserve.gateway.create | string | `"auto"` | Flag to create the Gateway (auto, true, false). If auto, it will be created if KServe is Managed. |
 | components.kserve.gatewayClass | object | `{"create":"auto","name":"openshift-ai-inference","spec":{"controllerName":"openshift.io/gateway-controller/v1"}}` | GatewayClass configuration for KServe inference |
 | components.kserve.gatewayClass.create | string | `"auto"` | Create the GatewayClass: auto (if KServe is Managed), true (always), false (never) |
 | components.kserve.gatewayClass.name | string | `"openshift-ai-inference"` | GatewayClass name |
 | components.kserve.gatewayClass.spec | object | `{"controllerName":"openshift.io/gateway-controller/v1"}` | GatewayClass spec |
-| components.kserve.modelsAsService.gateway | object | `{"annotations":{"opendatahub.io/managed":"false","security.opendatahub.io/authorino-tls-bootstrap":"true"},"create":false,"name":"maas-default-gateway","namespace":"openshift-ingress","spec":{"gatewayClassName":"maas-gateway-class","listeners":[{"allowedRoutes":{"namespaces":{"from":"All"}},"name":"https","port":443,"protocol":"HTTPS"}]}}` | Gateway configuration for the LLMInferenceService. |
+| components.kserve.modelsAsService.gateway | object | `{"annotations":{"opendatahub.io/managed":"false","security.opendatahub.io/authorino-tls-bootstrap":"true"},"create":false,"name":"maas-default-gateway","namespace":"openshift-ingress","spec":{"gatewayClassName":"maas-gateway-class","listeners":[{"allowedRoutes":{"namespaces":{"from":"Same"}},"name":"https","port":443,"protocol":"HTTPS"}]}}` | Gateway configuration for the LLMInferenceService. |
 | components.kserve.modelsAsService.gateway.create | bool | `false` | Flag to create the Gateway (auto, true, false). If auto, it will be created if Models as Service is Managed. |
 | components.kserve.modelsAsService.gatewayClass | object | `{"create":false,"name":"maas-gateway-class","spec":{"controllerName":"openshift.io/gateway-controller/v1"}}` | Gateway Class configuration for the LLMInferenceService. |
 | components.kserve.modelsAsService.gatewayClass.create | bool | `false` | Flag to create the Gateway Class (auto, true, false). If auto, it will be created if Models as Service is Managed. |

charts/rhai-on-openshift-chart/test/snapshots/all-components-managed.snap.yaml

@@ -184,7 +184,7 @@ spec:
   listeners:
   - allowedRoutes:
       namespaces:
-        from: All
+        from: Same
     name: https
     port: 443
     protocol: HTTPS
@@ -206,7 +206,7 @@ spec:
   listeners:
   - allowedRoutes:
       namespaces:
-        from: All
+        from: Same
     name: https
     port: 443
     protocol: HTTPS

charts/rhai-on-openshift-chart/test/snapshots/enable-llm-d-wva.snap.yaml

@@ -139,7 +139,7 @@ spec:
   listeners:
   - allowedRoutes:
       namespaces:
-        from: All
+        from: Same
     name: https
     port: 443
     protocol: HTTPS

charts/rhai-on-openshift-chart/test/snapshots/inference-only.snap.yaml

@@ -121,7 +121,7 @@ spec:
   listeners:
   - allowedRoutes:
       namespaces:
-        from: All
+        from: Same
     name: https
     port: 443
     protocol: HTTPS

charts/rhai-on-openshift-chart/test/snapshots/profile-with-customization.snap.yaml

@@ -130,7 +130,7 @@ spec:
   listeners:
   - allowedRoutes:
       namespaces:
-        from: All
+        from: Same
     name: https
     port: 443
     protocol: HTTPS

charts/rhai-on-openshift-chart/test/snapshots/with-rhcl-config.snap.yaml

@@ -130,7 +130,7 @@ spec:
   listeners:
   - allowedRoutes:
       namespaces:
-        from: All
+        from: Same
     name: https
     port: 443
     protocol: HTTPS

charts/rhai-on-openshift-chart/values.yaml

@@ -176,8 +176,11 @@ components:
             protocol: HTTPS
             allowedRoutes:
               namespaces:
-                from: All
-                # The following is an example of how to restrict the namespaces to the interested ones.
+                from: Same
+                # Example for All (any namespace can attach routes):
+                # from: All
+                #
+                # Example for Selector (only namespaces matching labels):
                 # from: Selector
                 # selector:
                 #   matchExpressions:
@@ -186,7 +189,6 @@ components:
                 #     values:
                 #     - llm-namespace1
                 #     - llm-namespace2
-                #      - ...
             # Uncomment this to enable TLS termination for the Gateway.
             # tls:
             #   certificateRefs:
@@ -220,16 +222,18 @@ components:
               protocol: HTTPS
               allowedRoutes:
                 namespaces:
-                  from: All
-                  # The following is an example of how to restrict the namespaces to the interested ones.
+                  from: Same
+                  # Example for All (any namespace can attach routes):
+                  # from: All
+                  #
+                  # Example for Selector (only namespaces matching labels):
                   # from: Selector
                   # selector:
                   #   matchExpressions:
                   #   - key: kubernetes.io/metadata.name
                   #     operator: In
                   #     values:
                   #     - openshift-ingress
-                  #     - ...
               # tls: # Uncomment this to enable TLS termination for the Gateway.
               #   certificateRefs:
               #   - group: ''