Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion charts/pmm-ha/Chart.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: pmm-ha
description: A Helm chart for Percona Monitoring and Management (PMM)
type: application
version: 1.5.1
version: 1.5.2
appVersion: "3.8.1"
home: https://github.com/percona/pmm
maintainers:
Expand Down
17 changes: 17 additions & 0 deletions charts/pmm-ha/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -280,6 +280,23 @@ To create additional service tokens manually, see the [PMM documentation on serv
| `ingress.pathType` | -- How ingress paths should be treated. | `Prefix` |
| `ingress.tls` | -- Ingress TLS configuration | `[]` |

### PMM Gateway API configuration

| Name | Description | Value |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
| `gateway.enabled` | -- Enable Gateway API HTTPRoute resource | `false` |
| `gateway.annotations` | -- Annotations on the HTTPRoute resource | `{}` |
| `gateway.parentRefs` | -- References to Gateways this HTTPRoute should attach to | `[{'name':'','namespace':'','sectionName':''}]` |
| `gateway.parentRefs[0].name` | -- Name of the Gateway. Required when `gateway.enabled=true` | `""` |
| `gateway.parentRefs[0].namespace` | -- Namespace of the Gateway (omit to use same namespace) | `""` |
| `gateway.parentRefs[0].sectionName` | -- Listener section name on the Gateway (omit to match all listeners) | `""` |
| `gateway.hosts` | -- Hostnames with path lists. Paths are aggregated and applied route-wide across all listed hostnames | `[{'host':'chart-example.local','paths':[]}]` |
| `gateway.hosts[0].host` | -- Hostname to match | `chart-example.local` |
| `gateway.hosts[0].paths` | -- Path prefixes to route. Must contain at least one path when `gateway.enabled=true` | `[]` |
| `gateway.pathType` | -- Path match type applied to all generated rules: `PathPrefix`, `Exact`, or `RegularExpression` | `PathPrefix` |

> **Gateway behavior**: when `gateway.enabled=true`, Helm fails fast unless `gateway.parentRefs[*].name` and at least one entry in `gateway.hosts[*].paths` are provided. Paths from `gateway.hosts[*].paths` are aggregated and applied route-wide to all listed hostnames. HTTPRoute backends use the regular `service.name-grpc` service for compatibility with Gateway API implementations; gRPC-prefixed paths (`/agent.`, `/inventory.`, `/management.`, `/server.`) also route to `service.name-grpc`. PMM-HA defaults this backend to HTTPS port 8443. HTTPRoute does not configure gateway-to-backend TLS by itself; depending on your Gateway implementation, you may need `BackendTLSPolicy` (or equivalent implementation-specific settings) to enable upstream TLS, otherwise some gateways may attempt plain HTTP to 8443 and routing can fail.


### HAProxy external access configuration

Expand Down
89 changes: 89 additions & 0 deletions charts/pmm-ha/templates/gateway-httproute.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,89 @@
{{- if .Values.gateway.enabled -}}
{{- $serviceName := .Values.service.name -}}
{{- $grpcPort := (index $.Values.service.ports 0).port -}}
{{- $servicePort := (index $.Values.service.ports 0).port -}}
{{- if gt (len $.Values.service.ports) 1 -}}
{{- $servicePort = (index $.Values.service.ports 1).port -}}
{{- end -}}
Comment thread
rkferreira marked this conversation as resolved.
{{- $pathType := .Values.gateway.pathType -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: {{ include "pmm.fullname" . }}
labels:
{{- include "pmm.labels" . | nindent 4 }}
{{- with .Values.gateway.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if empty .Values.gateway.parentRefs }}
{{- fail "gateway.parentRefs must be set when gateway.enabled=true" }}
{{- end }}
parentRefs:
{{- range .Values.gateway.parentRefs }}
{{- if empty .name }}
{{- fail "gateway.parentRefs[*].name must be set when gateway.enabled=true" }}
{{- end }}
- name: {{ .name | quote }}
{{- if .namespace }}
namespace: {{ .namespace | quote }}
{{- end }}
{{- if .sectionName }}
sectionName: {{ .sectionName | quote }}
{{- end }}
{{- end }}
{{- if .Values.gateway.hosts }}
hostnames:
{{- range .Values.gateway.hosts }}
- {{ .host | quote }}
{{- end }}
{{- end }}
{{/* HTTPRoute hostnames are route-level, so host paths are aggregated once and applied across listed hostnames. */}}
{{- $allPaths := list -}}
{{- range .Values.gateway.hosts }}
{{- $allPaths = concat $allPaths (default (list) .paths) -}}
{{- end }}
Comment thread
rkferreira marked this conversation as resolved.
{{- if empty $allPaths }}
{{- fail "gateway.hosts[*].paths must contain at least one path when gateway.enabled=true" }}
{{- end }}
rules:
{{- range $allPaths }}
- matches:
- path:
type: {{ $pathType }}
value: {{ . | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $servicePort }}
# gRPC paths — configure protocol-level gRPC handling via gateway.annotations
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/agent." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/inventory." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/management." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/server." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
{{- end }}
{{- end }}
6 changes: 3 additions & 3 deletions charts/pmm-ha/templates/service.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,10 @@ spec:
{{- end }}
selector:
{{- include "pmm.selectorLabels" . | nindent 4 }}
{{- if .Values.ingress.enabled }}
{{- if or .Values.ingress.enabled .Values.gateway.enabled }}
---
# Regular ClusterIP service for ingress routing
# Note: Both HTTP and gRPC traffic use this service when ingress is enabled
# Regular ClusterIP service for ingress / gateway routing
# Note: Both HTTP and gRPC traffic use this service when ingress or gateway is enabled
Comment thread
rkferreira marked this conversation as resolved.
apiVersion: v1
kind: Service
metadata:
Expand Down
28 changes: 28 additions & 0 deletions charts/pmm-ha/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -270,6 +270,34 @@ ingress:
## hosts:
## - chart-example.local

## Gateway API configuration
## Requires Gateway API CRDs to be installed in the cluster.
## ref: https://gateway-api.sigs.k8s.io/
##
Comment thread
rkferreira marked this conversation as resolved.
gateway:
## @param gateway.enabled -- Enable Gateway API HTTPRoute resource
enabled: false
## @param gateway.annotations -- Annotations on the HTTPRoute resource
annotations: {}
## @param gateway.parentRefs -- References to Gateways this HTTPRoute should attach to
parentRefs:
## @param gateway.parentRefs[0].name -- Name of the Gateway
- name: ""
## @param gateway.parentRefs[0].namespace -- Namespace of the Gateway (omit to use same namespace)
namespace: ""
## @param gateway.parentRefs[0].sectionName -- Listener section name on the Gateway (omit to match all listeners)
sectionName: ""

## Hostnames and path lists (paths are aggregated and applied route-wide)
hosts:
## @param gateway.hosts[0].host -- Hostname to match
- host: chart-example.local
## @param gateway.hosts[0].paths -- Path prefixes to route (aggregated across hosts and applied route-wide)
paths: []

## @param gateway.pathType -- Path match type: PathPrefix, Exact, or RegularExpression
pathType: PathPrefix

## @section PMM storage configuration
## Claiming storage for PMM using Persistent Volume Claims (PVC)
## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/
Expand Down
2 changes: 1 addition & 1 deletion charts/pmm/Chart.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: v2
name: pmm
description: A Helm chart for Percona Monitoring and Management (PMM)
type: application
version: 1.8.1
version: 1.8.2
appVersion: "3.8.1"
home: https://github.com/percona/pmm
maintainers:
Expand Down
17 changes: 17 additions & 0 deletions charts/pmm/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,23 @@ It removes all of the resources associated with the last release of the chart as
| `ingress.pathType` | -- How ingress paths should be treated. | `Prefix` |
| `ingress.tls` | -- Ingress TLS configuration | `[]` |

### PMM Gateway API configuration

| Name | Description | Value |
| ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- |
| `gateway.enabled` | -- Enable Gateway API HTTPRoute resource | `false` |
| `gateway.annotations` | -- Annotations on the HTTPRoute resource | `{}` |
| `gateway.parentRefs` | -- References to Gateways this HTTPRoute should attach to | `[{'name':'','namespace':'','sectionName':''}]` |
| `gateway.parentRefs[0].name` | -- Name of the Gateway. Required when `gateway.enabled=true` | `""` |
| `gateway.parentRefs[0].namespace` | -- Namespace of the Gateway (omit to use same namespace) | `""` |
| `gateway.parentRefs[0].sectionName` | -- Listener section name on the Gateway (omit to match all listeners) | `""` |
| `gateway.hosts` | -- Hostnames with path lists. Paths are aggregated and applied route-wide across all listed hostnames | `[{'host':'chart-example.local','paths':[]}]` |
| `gateway.hosts[0].host` | -- Hostname to match | `chart-example.local` |
| `gateway.hosts[0].paths` | -- Path prefixes to route. Must contain at least one path when `gateway.enabled=true` | `[]` |
| `gateway.pathType` | -- Path match type applied to all generated rules: `PathPrefix`, `Exact`, or `RegularExpression` | `PathPrefix` |

> **Gateway behavior**: when `gateway.enabled=true`, Helm fails fast unless `gateway.parentRefs[*].name` and at least one entry in `gateway.hosts[*].paths` are provided. Paths from `gateway.hosts[*].paths` are aggregated and applied route-wide to all listed hostnames. HTTP paths route to `service.name`, while gRPC-prefixed paths (`/agent.`, `/inventory.`, `/management.`, `/server.`) route to `service.name-grpc`. HTTPRoute does not configure gateway-to-backend TLS by itself; depending on your Gateway implementation, you may need `BackendTLSPolicy` (or equivalent implementation-specific settings) to enable TLS to PMM HTTPS/GRPCS backend ports.


### PMM storage configuration

Expand Down
90 changes: 90 additions & 0 deletions charts/pmm/templates/gateway-httproute.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,90 @@
{{- if .Values.gateway.enabled -}}
{{- $serviceName := .Values.service.name -}}
{{- $grpcPort := (index $.Values.service.ports 0).port -}}
{{- $servicePort := (index $.Values.service.ports 0).port -}}
{{- if gt (len $.Values.service.ports) 1 -}}
{{- $servicePort = (index $.Values.service.ports 1).port -}}
{{- end -}}
Comment thread
rkferreira marked this conversation as resolved.
{{- $pathType := .Values.gateway.pathType -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: {{ include "pmm.fullname" . }}
{{- include "pmm.includeNamespace" . | nindent 2 }}
labels:
{{- include "pmm.labels" . | nindent 4 }}
{{- with .Values.gateway.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if empty .Values.gateway.parentRefs }}
{{- fail "gateway.parentRefs must be set when gateway.enabled=true" }}
{{- end }}
parentRefs:
{{- range .Values.gateway.parentRefs }}
{{- if empty .name }}
{{- fail "gateway.parentRefs[*].name must be set when gateway.enabled=true" }}
{{- end }}
- name: {{ .name | quote }}
{{- if .namespace }}
namespace: {{ .namespace | quote }}
{{- end }}
{{- if .sectionName }}
sectionName: {{ .sectionName | quote }}
{{- end }}
{{- end }}
{{- if .Values.gateway.hosts }}
hostnames:
{{- range .Values.gateway.hosts }}
- {{ .host | quote }}
{{- end }}
{{- end }}
{{/* HTTPRoute hostnames are route-level, so host paths are aggregated once and applied across listed hostnames. */}}
{{- $allPaths := list -}}
{{- range .Values.gateway.hosts }}
{{- $allPaths = concat $allPaths (default (list) .paths) -}}
{{- end }}
Comment thread
rkferreira marked this conversation as resolved.
{{- if empty $allPaths }}
{{- fail "gateway.hosts[*].paths must contain at least one path when gateway.enabled=true" }}
{{- end }}
rules:
{{- range $allPaths }}
- matches:
- path:
type: {{ $pathType }}
value: {{ . | quote }}
backendRefs:
- name: {{ $serviceName }}
port: {{ $servicePort }}
# gRPC paths — configure protocol-level gRPC handling via gateway.annotations
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/agent." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/inventory." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/management." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
- matches:
- path:
type: {{ $pathType }}
value: {{ printf "%s/server." . | replace "//" "/" | quote }}
backendRefs:
- name: {{ $serviceName }}-grpc
port: {{ $grpcPort }}
{{- end }}
{{- end }}
2 changes: 1 addition & 1 deletion charts/pmm/templates/service.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ spec:
{{- end }}
selector:
{{- include "pmm.selectorLabels" . | nindent 4 }}
{{- if .Values.ingress.enabled }}
{{- if or .Values.ingress.enabled .Values.gateway.enabled }}
---
apiVersion: v1
Comment thread
rkferreira marked this conversation as resolved.
kind: Service
Expand Down
28 changes: 28 additions & 0 deletions charts/pmm/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -199,6 +199,34 @@ ingress:
## hosts:
## - chart-example.local

## Gateway API configuration
## Requires Gateway API CRDs to be installed in the cluster.
## ref: https://gateway-api.sigs.k8s.io/
##
Comment thread
rkferreira marked this conversation as resolved.
gateway:
## @param gateway.enabled -- Enable Gateway API HTTPRoute resource
enabled: false
## @param gateway.annotations -- Annotations on the HTTPRoute resource
annotations: {}
## @param gateway.parentRefs -- References to Gateways this HTTPRoute should attach to
parentRefs:
## @param gateway.parentRefs[0].name -- Name of the Gateway
- name: ""
## @param gateway.parentRefs[0].namespace -- Namespace of the Gateway (omit to use same namespace)
namespace: ""
## @param gateway.parentRefs[0].sectionName -- Listener section name on the Gateway (omit to match all listeners)
sectionName: ""

## Hostnames and path lists (paths are aggregated and applied route-wide)
hosts:
## @param gateway.hosts[0].host -- Hostname to match
- host: chart-example.local
## @param gateway.hosts[0].paths -- Path prefixes to route (aggregated across hosts and applied route-wide)
paths: []

## @param gateway.pathType -- Path match type: PathPrefix, Exact, or RegularExpression
pathType: PathPrefix

## @section PMM storage configuration
## Claiming storage for PMM using Persistent Volume Claims (PVC)
## ref: https://kubernetes.io/docs/user-guide/persistent-volumes/
Expand Down
Loading