Aleksei Sviridkin 52f09d1aed fix(gateway)!: render passthrough services only where platform routes attach ...

The chart wrote the tlsPassthroughServices default onto every non-edge
tenant's TenantGateway, so every tenant Gateway carried tls-api,
tls-vm-exportproxy and tls-cdi-uploadproxy. The TLSRoutes that serve
those names are platform routes: the packages owning the services render
one per name in publishing.exposedServices while gateway.enabled is on,
parented to the publishing tenant's Gateway alone. Everywhere else no
shipped route attached to the listeners, and a passthrough listener
holds its name whether or not anything is routed through it.

The chart now writes the field only on the publishing tenant, with the
same gateway.enabled switch and the same exposedServices filter those
routes use, so a listener exists exactly where a platform route can
attach. A TLSRoute attached by hand to one of those listeners on another
tenant loses its parent.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-09 18:46:47 +03:00

..

cleanup_acme_test.yaml

fix(gateway): clean up orphaned ACME account secret on tenant module delete (#3089)

2026-06-26 17:29:44 +03:00

tenantgateway_test.yaml

fix(gateway)!: render passthrough services only where platform routes attach

2026-10-09 18:46:47 +03:00