diff --git a/charts/connect/README.md b/charts/connect/README.md index f76908c..1fe2813 100644 --- a/charts/connect/README.md +++ b/charts/connect/README.md @@ -113,6 +113,12 @@ To disable this, you can run `helm install` with the [`--skip-crds` flag](https: | connect.hpa.enabled | bool | `false` | Enable Horizontal Pod Autoscaling for the Connect pod | | connect.hpa.maxReplicas | int | `3` | Maximum number of replicas for the Connect pod | | connect.hpa.minReplicas | int | `1` | Minimum number of replicas for the Connect pod | +| connect.httpRoute.annotations | object | `{}` | Additional annotations to be added to the HTTPRoute resource | +| connect.httpRoute.enabled | bool | `false` | Enable the creation of a Gateway API HTTPRoute resource for the Connect API | +| connect.httpRoute.hostnames | list | `[]` | Hostnames that the HTTPRoute should match | +| connect.httpRoute.labels | object | `{}` | Additional labels to be added to the HTTPRoute resource | +| connect.httpRoute.parentRefs | list | `[]` | Parent references to Gateway resources. At least one is required when enabled. ref: https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#parentreference | +| connect.httpRoute.rules | list | `[]` (See [values.yaml]) | HTTPRoute rules configuration. The default backendRefs service name and port are automatically set from connect.applicationName and the API port. ref: https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#httprouterule | | connect.imagePullPolicy | string | `"IfNotPresent"` | The 1Password Connect API image pull policy | | connect.imagePullSecrets | list | `[]` | List of secret names to use as image pull secrets. Secrets must exist in the same namespace. | | connect.ingress.annotations | object | `{}` | The 1Password Connect Ingress Annotations | diff --git a/charts/connect/ci/with-httproute-values.yaml b/charts/connect/ci/with-httproute-values.yaml new file mode 100644 index 0000000..cbac8a1 --- /dev/null +++ b/charts/connect/ci/with-httproute-values.yaml @@ -0,0 +1,13 @@ +# Deploys Connect with an HTTPRoute instead of Ingress +connect: + httpRoute: + enabled: true + parentRefs: + - name: test-gateway + namespace: default + hostnames: + - connect.example.com + labels: + traffic: external + annotations: + example.com/test: "true" diff --git a/charts/connect/templates/httproute.yaml b/charts/connect/templates/httproute.yaml new file mode 100644 index 0000000..02fa297 --- /dev/null +++ b/charts/connect/templates/httproute.yaml @@ -0,0 +1,51 @@ +{{- if and (.Values.connect.httpRoute.enabled) (.Values.connect.create) -}} +{{- if .Values.connect.ingress.enabled -}} +{{- fail "connect.ingress.enabled and connect.httpRoute.enabled are mutually exclusive" -}} +{{- end -}} +{{- if not .Values.connect.httpRoute.parentRefs -}} +{{- fail "connect.httpRoute.parentRefs must specify at least one Gateway reference when connect.httpRoute.enabled is true" -}} +{{- end -}} +{{- $serviceName := .Values.connect.applicationName -}} +{{- $tlsEnabled := .Values.connect.tls.enabled -}} +{{- $apiHttpPort := .Values.connect.api.httpPort -}} +{{- $apiHttpsPort := .Values.connect.api.httpsPort -}} +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: {{ template "onepassword-connect.name" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "onepassword-connect.labels" . | nindent 4 }} + {{- with .Values.connect.httpRoute.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.connect.httpRoute.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + parentRefs: + {{- toYaml .Values.connect.httpRoute.parentRefs | nindent 4 }} + {{- with .Values.connect.httpRoute.hostnames }} + hostnames: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + {{- range .Values.connect.httpRoute.rules }} + - {{- if .matches }} + matches: + {{- toYaml .matches | nindent 8 }} + {{- end }} + {{- if .filters }} + filters: + {{- toYaml .filters | nindent 8 }} + {{- end }} + backendRefs: + {{- if .backendRefs }} + {{- toYaml .backendRefs | nindent 8 }} + {{- else }} + - name: {{ $serviceName }} + port: {{ if $tlsEnabled }}{{ $apiHttpsPort }}{{ else }}{{ $apiHttpPort }}{{ end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/connect/values.yaml b/charts/connect/values.yaml index 11dd41d..c35157b 100644 --- a/charts/connect/values.yaml +++ b/charts/connect/values.yaml @@ -250,6 +250,35 @@ connect: # hosts: # - chart-example.local + # HTTPRoute allows creating a Gateway API HTTPRoute resource as an alternative to Ingress. + # Cannot be enabled at the same time as ingress. + # ref: https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#httproute + httpRoute: + # -- Enable the creation of a Gateway API HTTPRoute resource for the Connect API + enabled: false + # -- Additional labels to be added to the HTTPRoute resource + labels: {} + # -- Additional annotations to be added to the HTTPRoute resource + annotations: {} + # -- Parent references to Gateway resources. At least one is required when enabled. + # ref: https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#parentreference + parentRefs: [] + # - name: my-gateway + # namespace: gateway-ns + # sectionName: https + # -- Hostnames that the HTTPRoute should match + hostnames: [] + # - chart-example.local + # -- HTTPRoute rules configuration. + # The default backendRefs service name and port are automatically set from connect.applicationName and the API port. + # ref: https://gateway-api.sigs.k8s.io/reference/api-spec/main/spec/#httprouterule + # @default -- `[]` (See [values.yaml]) + rules: + - matches: + - path: + type: PathPrefix + value: / + # Optionally the internal profiler can be enabled to debug memory or performance issues. profiler: # -- Enable the internal profiler to debug memory or performance issues. For normal operation this does not have to be enabled.