From 3a855029e21d25f86bffe285a665afa6a14aa87d Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Wed, 3 Jun 2026 11:54:48 +0300 Subject: [PATCH] fix(networking): point host ouroboros proxy at the root-tenant ingress With publishing.proxyProtocol enabled the host emits a cozystack.ouroboros Package via the no-override Package macro, so the proxy inherits the wrapper chart default backend ingress-nginx-controller.cozy-ingress-nginx. That layout describes a managed Kubernetes tenant cluster; on the host, extra/ingress deploys ingress-nginx into the root tenant namespace as root-ingress-controller in tenant-root. The composed backend FQDN never resolves, so ouroboros-proxy never reaches Ready. Emit the host ouroboros Package with a proxy.target override derived from publishing.ingressName (namespace plus -ingress-controller service name), mirroring the trimPrefix transform extra/ingress applies. Add bundle helm-unittest coverage for the default and a non-default ingress name, and correct the misleading wrapper values.yaml comment. Assisted-By: Claude Signed-off-by: Aleksei Sviridkin (cherry picked from commit f90411da7aa37c99c7f75773e57cbad1ee93b88c) --- .../platform/templates/bundles/system.yaml | 17 ++++++- .../tests/bundles_proxy_protocol_test.yaml | 44 +++++++++++++++++++ packages/system/ouroboros/values.yaml | 30 +++++++++---- 3 files changed, 81 insertions(+), 10 deletions(-) diff --git a/packages/core/platform/templates/bundles/system.yaml b/packages/core/platform/templates/bundles/system.yaml index ea2495902..c35f9328b 100644 --- a/packages/core/platform/templates/bundles/system.yaml +++ b/packages/core/platform/templates/bundles/system.yaml @@ -156,7 +156,22 @@ CrashLoop the controller on WaitForCacheSync against missing GVRs. Operators on hosts that do install Gateway-API CRDs out of band can enable it via the standard Package values override. */ -}} -{{include "cozystack.platform.package.default" (list "cozystack.ouroboros" $) }} +{{- /* Point the ouroboros proxy at the HOST ingress-nginx Service. The + wrapper chart default (cozy-ingress-nginx / ingress-nginx-controller) + describes a managed Kubernetes tenant cluster, NOT the host: on the + host, extra/ingress deploys ingress-nginx into the root tenant + namespace (publishing.ingressName, default tenant-root) with + fullnameOverride -ingress, yielding the controller Service + -ingress-controller (e.g. root-ingress-controller). Derive + namespace + serviceName from publishing.ingressName so a non-default + ingress name still resolves; mirror the trimPrefix "tenant-" + transform extra/ingress applies to .Release.Namespace. */ -}} +{{- $ingressNs := .Values.publishing.ingressName | default "tenant-root" -}} +{{- $ingressSvc := printf "%s-ingress-controller" (trimPrefix "tenant-" $ingressNs) -}} +{{- $ouroborosTarget := dict "namespace" $ingressNs "serviceName" $ingressSvc -}} +{{- $ouroborosValues := dict "ouroboros" (dict "proxy" (dict "target" $ouroborosTarget)) -}} +{{- $ouroborosComponents := dict "ouroboros" (dict "values" $ouroborosValues) -}} +{{include "cozystack.platform.package" (list "cozystack.ouroboros" "default" $ $ouroborosComponents) }} {{- end }} {{include "cozystack.platform.package.default" (list "cozystack.flux-plunger" $) }} {{include "cozystack.platform.package.default" (list "cozystack.victoria-metrics-operator" $) }} diff --git a/packages/core/platform/tests/bundles_proxy_protocol_test.yaml b/packages/core/platform/tests/bundles_proxy_protocol_test.yaml index dccb8c3ed..dc62d28a4 100644 --- a/packages/core/platform/tests/bundles_proxy_protocol_test.yaml +++ b/packages/core/platform/tests/bundles_proxy_protocol_test.yaml @@ -64,6 +64,50 @@ tests: path: spec.variant value: default + - it: points the host ouroboros proxy at the root-tenant ingress Service (default ingressName) + set: + bundles: + system: + enabled: true + variant: isp-full + publishing: + proxyProtocol: true + documentSelector: + path: metadata.name + value: cozystack.ouroboros + asserts: + # The host ingress-nginx is deployed by extra/ingress into the root + # tenant namespace as -ingress-controller, NOT the chart + # default ingress-nginx-controller.cozy-ingress-nginx (which is the + # managed-Kubernetes-tenant layout). Both are derived from + # publishing.ingressName (default tenant-root). + - equal: + path: spec.components.ouroboros.values.ouroboros.proxy.target.namespace + value: tenant-root + - equal: + path: spec.components.ouroboros.values.ouroboros.proxy.target.serviceName + value: root-ingress-controller + + - it: derives the ouroboros proxy target from a non-default publishing.ingressName + set: + bundles: + system: + enabled: true + variant: isp-full + publishing: + proxyProtocol: true + ingressName: tenant-foo + documentSelector: + path: metadata.name + value: cozystack.ouroboros + asserts: + - equal: + path: spec.components.ouroboros.values.ouroboros.proxy.target.namespace + value: tenant-foo + - equal: + path: spec.components.ouroboros.values.ouroboros.proxy.target.serviceName + value: foo-ingress-controller + - it: injects three PROXY-protocol nginx config keys into ingress-application when proxyProtocol is true (use-proxy-protocol, real-ip-header, enable-real-ip) set: bundles: diff --git a/packages/system/ouroboros/values.yaml b/packages/system/ouroboros/values.yaml index 662f6d6ff..b27f5bcc9 100644 --- a/packages/system/ouroboros/values.yaml +++ b/packages/system/ouroboros/values.yaml @@ -30,14 +30,26 @@ ouroboros: # this field for tenants that DO install Gateway-API. proxy: target: - # cozystack deploys ingress-nginx into cozy-ingress-nginx in both - # the host control plane and every tenant control plane (the tenant - # HelmRelease sets fullnameOverride: ingress-nginx + targetNamespace: - # cozy-ingress-nginx). Override the chart-default `ingress-nginx` - # namespace; the chart-default serviceName matches as-is. Leaving - # `host:` empty (chart-default) tells the proxy to compose the - # backend host at runtime as + # Tenant-cluster fallback default. A managed Kubernetes tenant + # cluster deploys ingress-nginx into cozy-ingress-nginx (its + # HelmRelease sets fullnameOverride: ingress-nginx + + # targetNamespace: cozy-ingress-nginx), so overriding the + # chart-default `ingress-nginx` namespace to cozy-ingress-nginx + # matches there; the chart-default serviceName lines up as-is. + # + # The HOST is different: extra/ingress deploys ingress-nginx into + # the root tenant namespace (publishing.ingressName, default + # tenant-root) as -ingress-controller (e.g. + # root-ingress-controller), NOT cozy-ingress-nginx. The host + # platform bundle (core/platform templates/bundles/system.yaml) + # therefore overrides proxy.target.{namespace,serviceName} when it + # emits cozystack.ouroboros, derived from publishing.ingressName. + # This default is never effective on the host once that override + # lands. + # + # Leaving `host:` empty (chart-default) tells the proxy to compose + # the backend host at runtime as # `..svc.`, - # which works on cozy.local (cozystack tenants), cluster.local - # (kubeadm), or any other domain without operator override. + # which works on cozy.local (cozystack), cluster.local (kubeadm), + # or any other domain without operator override. namespace: cozy-ingress-nginx