mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
52f09d1aed
The chart wrote the tlsPassthroughServices default onto every non-edge tenant's TenantGateway, so every tenant Gateway carried tls-api, tls-vm-exportproxy and tls-cdi-uploadproxy. The TLSRoutes that serve those names are platform routes: the packages owning the services render one per name in publishing.exposedServices while gateway.enabled is on, parented to the publishing tenant's Gateway alone. Everywhere else no shipped route attached to the listeners, and a passthrough listener holds its name whether or not anything is routed through it. The chart now writes the field only on the publishing tenant, with the same gateway.enabled switch and the same exposedServices filter those routes use, so a listener exists exactly where a platform route can attach. A TLSRoute attached by hand to one of those listeners on another tenant loses its parent. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
24 lines
1.6 KiB
JSON
24 lines
1.6 KiB
JSON
{
|
|
"title": "Chart Values",
|
|
"type": "object",
|
|
"properties": {
|
|
"gatewayClassName": {
|
|
"description": "GatewayClass for this tenant's Gateway, set from `tenant.spec.gatewayClass`. Empty means the platform default (`_cluster.gateway-class-name`, itself defaulting to the bundled `cilium` class). Whether the class terminates TLS itself or at its provider's edge comes from the platform's `gateway.edgeTerminatedClasses`, so the two cannot get out of step.",
|
|
"type": "string",
|
|
"default": ""
|
|
},
|
|
"tlsPassthroughServices": {
|
|
"description": "Names (from publishing.exposedServices) whose traffic is TLS-passthrough rather than TLS-terminate. For each such service a dedicated HTTPS listener with tls.mode=Passthrough is rendered on the Gateway, and the service is expected to attach a TLSRoute instead of an HTTPRoute. Rendered only on the publishing tenant, the namespace `publishing.ingressName` names, while `gateway.enabled` is on, and only for names `publishing.exposedServices` lists: the platform TLSRoutes for these services attach to that tenant's Gateway alone, and a passthrough listener anywhere else would reserve its name with nothing behind it. Ignored when this tenant's Gateway is on a class the platform lists in `gateway.edgeTerminatedClasses`: an HTTP-only edge cannot carry a TLS listener, so those services are not published through the tenant Gateway at all.",
|
|
"type": "array",
|
|
"default": [
|
|
"api",
|
|
"vm-exportproxy",
|
|
"cdi-uploadproxy"
|
|
],
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|