mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
Huabing (Robin) Zhao
abcd15d1f2
The chart's optional Gateway API ingress only rendered a plaintext HTTP listener, so the gateway could not be exposed over TLS. Add an HTTPS listener option that terminates TLS at the Envoy Gateway and forwards plaintext gRPC to the gateway pod. - gateway.yaml renders an HTTPS listener with `tls.mode: Terminate` and `certificateRefs` when `grpcRoute.gateway.listener.protocol=HTTPS`, keeping the default HTTP listener unchanged. Guards fail the render when `certificateRefs` is empty or `server.disableTls` is not true (the chart does not render a BackendTLSPolicy for re-encryption). - values.yaml adds `grpcRoute.gateway.listener.tls.certificateRefs`. - ci/values-gateway-tls.yaml exercises the HTTPS branch in lint/render. - docs/kubernetes/ingress.mdx documents HTTPS setup and clarifies that Envoy Gateway only terminates TLS (no OIDC SecurityPolicy); client identity uses OIDC bearer tokens, with the client-credentials grant for headless agents. - debug-openshell-cluster skill gains HTTPS-ingress troubleshooting rows. - Regenerated the chart README values table. Signed-off-by: Huabing (Robin) Zhao <zhaohuabing@gmail.com>
34 lines
1.7 KiB
YAML
34 lines
1.7 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
{{- if and .Values.grpcRoute.enabled .Values.grpcRoute.gateway.create }}
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: {{ default (include "openshell.fullname" .) .Values.grpcRoute.gateway.name }}
|
|
namespace: {{ .Release.Namespace }}
|
|
labels:
|
|
{{- include "openshell.labels" . | nindent 4 }}
|
|
spec:
|
|
gatewayClassName: {{ .Values.grpcRoute.gateway.className }}
|
|
listeners:
|
|
- name: {{ ternary "https" "http" (eq .Values.grpcRoute.gateway.listener.protocol "HTTPS") }}
|
|
port: {{ .Values.grpcRoute.gateway.listener.port }}
|
|
protocol: {{ .Values.grpcRoute.gateway.listener.protocol }}
|
|
{{- if eq .Values.grpcRoute.gateway.listener.protocol "HTTPS" }}
|
|
{{- if not .Values.grpcRoute.gateway.listener.tls.certificateRefs }}
|
|
{{- fail "grpcRoute.gateway.listener.tls.certificateRefs is required when grpcRoute.gateway.listener.protocol is HTTPS" }}
|
|
{{- end }}
|
|
{{- if not .Values.server.disableTls }}
|
|
{{- fail "grpcRoute.gateway.listener.protocol=HTTPS terminates TLS at Envoy Gateway, which forwards plaintext gRPC to the gateway pod; set server.disableTls=true so the pod listens plaintext (this chart does not render a BackendTLSPolicy for re-encryption to a TLS backend)" }}
|
|
{{- end }}
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
{{- toYaml .Values.grpcRoute.gateway.listener.tls.certificateRefs | nindent 10 }}
|
|
{{- end }}
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: {{ .Values.grpcRoute.gateway.listener.allowedRoutes }}
|
|
{{- end }}
|