helm-charts/zipline/templates/zipline.httproute.yaml

{{/*
The Gateway-API alternative to zipline.ingress.yaml (Gitea #114). Form and
reasoning: template-chart/templates/xxx.httproute.yaml and README, "Ingress and
Gateway API".

Only an HTTPRoute with parentRefs. No Gateway, no gatewayClassName, no
Certificate, and no implementation-specific policy object - that subset looks
identical on nginx-gateway-fabric, Cilium, Envoy Gateway and Istio, which is
the whole reason the cluster's implementation can be swapped without touching
this chart. Class and certificate therefore belong to the PLATFORM, on the
Gateway and its listeners.

ingress.clusterIssuer is meaningless here - this chart renders no Certificate
in this mode - and it is not demanded either: its only required() sits inside
zipline.ingress.yaml, behind ingress.enabled.

ingress.domain IS STILL REQUIRED, AND NOT BECAUSE OF THIS FILE

Checked for this chart rather than copied: ingress.domain is read once more
outside both routing templates, in zipline.sfs.yaml, where it becomes
CORE_DEFAULT_DOMAIN and carries its own required(). That is the host Zipline
puts into every share link it hands out - the whole point of the application -
so domain is mandatory in EVERY mode of this chart and the fallback below is
never its only reader. Setting httpRoute.hostnames to a name ingress.domain
does not carry publishes the route under one host while every link the app
generates names another, and the links simply do not resolve. Set both
together.

THE UPLOAD LIMIT IS WHAT THIS MODE LOSES, AND IT IS NOT REBUILT

config.maxUploadFileSize is rendered into proxy-body-size and
nginx.org/client-max-body-size by the Ingress template, and in Ingress mode it
is the ceiling that actually bites: it is far below the app's own
UPLOADER_ADMIN_LIMIT of 500mb, which this chart pins and does not expose. The
Gateway API has NO counterpart - a request-body limit is implementation-
specific policy and lives in an implementation's own object
(ClientSettingsPolicy, ClientTrafficPolicy and their equivalents), which this
chart deliberately does not render. So the value is DOCUMENTED as unenforced in
NOTES.txt rather than rebuilt.

This chart is a file-upload service, so that is not a footnote: in Gateway mode
the ceiling is whatever the Gateway enforces, and the failure arrives as the
proxy's error rather than as a message from Zipline. There is a second,
quieter consequence that does NOT change with the mode and is worth re-reading
before raising anything: /tmp is an emptyDir and counts against the container's
ephemeral-storage limit, so an upload that fits through the Gateway can still
get the whole pod evicted. NOTES.txt covers both.
*/}}
{{- /*
Null-safe like every other block this chart dereferences (#99): an override
written without children - "httpRoute:" with the keys below it deleted - is
YAML null, and `.Values.httpRoute.enabled` would abort the render with a nil
pointer. An empty block means "chart defaults apply", and all three defaults
are empty or false, so the whole block collapses to "no HTTPRoute".
*/ -}}
{{- $httpRoute := .Values.httpRoute | default dict -}}
{{- if and $httpRoute.enabled .Values.ingress.enabled -}}
{{- fail "ingress.enabled and httpRoute.enabled are both true - set exactly one of them. The Ingress and the HTTPRoute would publish the same Service under the same hostname over two different data paths, which is already a conflict at DNS level: one name, two addresses, and which one a client reaches is luck. A migration runs over a SECOND hostname (set httpRoute.hostnames explicitly while the Ingress keeps ingress.domain), never over parallel operation of both." -}}
{{- end -}}
{{- if $httpRoute.enabled -}}
{{- $parentRefs := $httpRoute.parentRefs | default list -}}
{{- if not $parentRefs -}}
{{- fail "httpRoute.enabled is true but httpRoute.parentRefs is empty - an HTTPRoute without a parent attaches to no Gateway. It is created, it is schema-valid, and it routes NOTHING, with no event and no condition that says so; the only symptom is a hostname that does not answer. Name the cluster's Gateway, e.g. httpRoute.parentRefs: [{name: public, namespace: gateway}]." -}}
{{- end -}}
{{- /*
One source of truth for the hostname: an empty httpRoute.hostnames means
[ingress.domain], so the two cannot drift apart. ingress.domain is read here
even though no Ingress is rendered in this mode - the value names the public
hostname of this release, which both modes need; it is not an Ingress switch.
A hostname set explicitly here does NOT move CORE_DEFAULT_DOMAIN with it: the
share links keep naming ingress.domain, so the two have to be set together.
*/ -}}
{{- $hostnames := $httpRoute.hostnames | default list -}}
{{- if not $hostnames -}}
{{- $hostnames = list (required "A Domain/Host must be provided: set ingress.domain (used as the HTTPRoute's single hostname when httpRoute.hostnames is empty) or set httpRoute.hostnames explicitly" .Values.ingress.domain) -}}
{{- end -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-httproute
spec:
  parentRefs:
    {{- toYaml $parentRefs | nindent 4 }}
  hostnames:
    {{- toYaml $hostnames | nindent 4 }}
  rules:
    # The Ingress counterpart is `path: / , pathType: Prefix` on the one
    # backend Service - Zipline serves its UI, its API and the short URLs of
    # every upload from one process on one port, so a single path covers all of
    # them. The port is the Service's port NUMBER and not its name ("http"):
    # backendRefs takes a PortNumber, so unlike the Ingress this reference
    # cannot be made by name and the 80 below has to track
    # zipline.service.yaml by hand (whose targetPort is the container's
    # "zipline-server", which is a third name again).
    # ci/run-httproute-match-test.sh is what holds that pair - it fails when a
    # backendRef names a Service, or a port, the same render does not create.
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-service
          port: 80
{{- end }}