helm-charts/searxng/templates/searxng.httproute.yaml

{{/*
The Gateway-API alternative to searxng.ingress.yaml (Gitea #114). Form and
reasoning: template-chart/templates/xxx.httproute.yaml and README, "Ingress and
Gateway API".

Only an HTTPRoute with parentRefs. No Gateway, no gatewayClassName, no
Certificate, and no implementation-specific policy object - that subset looks
identical on nginx-gateway-fabric, Cilium, Envoy Gateway and Istio, which is
the whole reason the cluster's implementation can be swapped without touching
this chart. Class and certificate therefore belong to the PLATFORM, on the
Gateway and its listeners.

WHAT THIS CHART IN PARTICULAR LOSES IN THIS MODE, AND IT IS THE LOUD ONE

values.yaml documents ingress.annotations as THE place authentication in front
of SearXNG belongs - the forward-auth annotations for Authentik and friends,
which need no chart change because they are entirely an ingress-nginx matter.
The Gateway API has no annotation channel for controller behaviour, so in this
mode that escape hatch does not exist in this chart at all. It is not rebuilt
here: a policy object would bind the chart to one implementation and to a CRD
whose presence it cannot check. Protection has to come from the Gateway - a
listener that is not publicly reachable, or that implementation's own auth
filter. NOTES.txt says so in this mode rather than leaving an operator to find
out from their access log.

Note that the rate limiter is a separate question and unaffected: it runs
inside SearXNG against a Valkey (settings.limiter), not at the proxy.

ingress.clusterIssuer is meaningless here - this chart renders no Certificate
in this mode - and it is not demanded either: its only required() sits inside
searxng.ingress.yaml, behind ingress.enabled.

ingress.domain IS STILL REQUIRED, AND NOT BECAUSE OF THIS FILE

Checked for this chart rather than copied: searxng.deployment.yaml reads
ingress.domain with its own required() to build SEARXNG_BASE_URL, which is what
SearXNG puts into its OpenSearch description, into the image-proxy URLs it
signs and into every absolute link it generates. So domain is mandatory in
every mode of this chart and the fallback below is never the only reader -
which also means httpRoute.hostnames set for a migration does NOT move
server.base_url with it.
*/}}
{{- /*
Null-safe like every other block this chart dereferences (#99): an override
written without children - "httpRoute:" with the keys below it deleted - is
YAML null, and `.Values.httpRoute.enabled` would abort the render with a nil
pointer. An empty block means "chart defaults apply", and all three defaults
are empty or false, so the whole block collapses to "no HTTPRoute".
*/ -}}
{{- $httpRoute := .Values.httpRoute | default dict -}}
{{- if and $httpRoute.enabled .Values.ingress.enabled -}}
{{- fail "ingress.enabled and httpRoute.enabled are both true - set exactly one of them. The Ingress and the HTTPRoute would publish the same Service under the same hostname over two different data paths, which is already a conflict at DNS level: one name, two addresses, and which one a client reaches is luck. A migration runs over a SECOND hostname (set httpRoute.hostnames explicitly while the Ingress keeps ingress.domain), never over parallel operation of both." -}}
{{- end -}}
{{- if $httpRoute.enabled -}}
{{- $parentRefs := $httpRoute.parentRefs | default list -}}
{{- if not $parentRefs -}}
{{- fail "httpRoute.enabled is true but httpRoute.parentRefs is empty - an HTTPRoute without a parent attaches to no Gateway. It is created, it is schema-valid, and it routes NOTHING, with no event and no condition that says so; the only symptom is a hostname that does not answer. Name the cluster's Gateway, e.g. httpRoute.parentRefs: [{name: public, namespace: gateway}]." -}}
{{- end -}}
{{- /*
One source of truth for the hostname: an empty httpRoute.hostnames means
[ingress.domain], so the two cannot drift apart. See the header for what
setting it explicitly does not move.
*/ -}}
{{- $hostnames := $httpRoute.hostnames | default list -}}
{{- if not $hostnames -}}
{{- $hostnames = list (required "A Domain/Host must be provided: set ingress.domain (used as the HTTPRoute's single hostname when httpRoute.hostnames is empty) or set httpRoute.hostnames explicitly" .Values.ingress.domain) -}}
{{- end -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ .Release.Name }}-{{ .Chart.Name }}-httproute
spec:
  parentRefs:
    {{- toYaml $parentRefs | nindent 4 }}
  hostnames:
    {{- toYaml $hostnames | nindent 4 }}
  rules:
    # The Ingress counterpart is `path: / , pathType: Prefix` on the one
    # backend Service - SearXNG serves its UI, /search and /healthz from one
    # worker and has no second path. The port is the Service's port NUMBER and
    # not its name ("http"): backendRefs takes a PortNumber, so unlike the
    # Ingress this reference cannot be made by name and the 80 below has to
    # track searxng.service.yaml by hand.
    # ci/run-httproute-match-test.sh is what holds that pair - it fails when a
    # backendRef names a Service, or a port, the same render does not create.
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: {{ .Release.Name }}-{{ .Chart.Name }}-service
          port: 80
{{- end }}