The Gateway-API pilot of Gitea #114: one chart, the convention, the CI that
holds it. The remaining 20 charts follow in their own PRs.
The form, additive and off by default:
httpRoute:
enabled: false # counterpart to ingress.enabled
parentRefs: [] # the Gateway - a platform object
hostnames: [] # empty = [ingress.domain]
Only HTTPRoute with parentRefs is rendered: no Gateway, no gatewayClassName,
no Certificate, and no implementation-specific policy object. That subset is
identical on nginx-gateway-fabric, Cilium, Envoy Gateway and Istio, which is
what lets the implementation be chosen later without touching the charts
again. Class and certificate move to the platform.
Four guards, all against silent failures:
- mutually exclusive with ingress.enabled, with a render abort naming BOTH
value paths. A migration runs over a second hostname, not in parallel.
- parentRefs mandatory in Gateway mode, render abort on the empty list: a
route without a parent is created, is schema-valid, and routes nothing.
- hostnames empty means [ingress.domain], so the hostname has one source.
- the mode is a VALUE, not auto-detection: .Capabilities.APIVersions is
unreliable at template time and a missing CRD fails at install time.
ingress.clusterIssuer was already only read inside the Ingress template, so
the "conditionally required" half of #114 needed no change in this chart -
checked rather than assumed, and it has to be re-checked per chart in the
sweep.
CI, both halves, because neither covers the other:
- the install-test installs cyberchef in GATEWAY mode against the REAL
Gateway-API CRDs (standard channel v1.6.3, pinned and Renovate-tracked,
applied --server-side). A schema-less stub would accept a malformed route
and prove only that something was created. The Ingress path of this one
chart is no longer installed; it is a built-in type that never routed in
k3d anyway, and helm lint renders this chart's defaults - Ingress mode -
on every PR.
- ci/run-httproute-match-test.sh, over every chart on every PR: every
backendRefs entry must name a Service, on a port, that the SAME render
creates, and parentRefs must not be empty. The CRDs accept both of those
mistakes, so the schema cannot catch them, and the only report would be a
route status no controller writes in CI.
What stays unprovable, and is written down instead of implied: that traffic
flows. No Gateway controller runs in k3d.
Minor: additive with unchanged defaults, proven by an empty helm template
diff against origin/main for the default values.
Part of #114
Per the maintainer decision (option a: ingress.clusterIssuer strictly
required in ALL charts) the two remaining defaults are removed as well:
- cyberchef: drop the letsencrypt default; bump raised from minor to
major (6.0.0+up11.4.0) as this is a breaking values change.
- urlaubsverwaltung: drop the letsencrypt-issuer default; major bump
to 6.0.0+up6.7.0.
- CI test-values for both charts now set clusterIssuer explicitly.
A repo-wide grep confirms no chart carries a clusterIssuer default
anymore.
New install-test job in validate-charts.yml: for exactly the charts a PR
changes, install them into an ephemeral k3d cluster (pinned k3d v5.9.0,
k3s v1.35.5-k3s1) and require every Deployment/StatefulSet to become
Ready. Runs non-blocking (continue-on-error) during the stabilization
phase.
Fixtures live at the repo root under ci/ (not inside chart directories,
so they neither trigger publishes on merge nor get packaged): a stub
OnePasswordItem CRD, per-chart test values and fixtures (dummy secrets
with in-cluster DSNs, throwaway postgres/redis/dex, synapse-generate
seed job, static hostPath PVs where charts pin storage classes or need
RWX), plus a shared ci/run-install-test.sh harness that also runs
locally.
Excluded with documented reasons (ci/excluded-charts.txt): satisfactory
(multi-GB image), teamspeak-server (TS6 beta license expired, image
crashes on start), template-chart (placeholder image).
All 14 non-excluded charts verified locally in k3d using only the
committed fixtures.
jklein