diff --git a/charts/plane-enterprise/Chart.yaml b/charts/plane-enterprise/Chart.yaml index 3152b0b7..f986c42a 100644 --- a/charts/plane-enterprise/Chart.yaml +++ b/charts/plane-enterprise/Chart.yaml @@ -5,7 +5,7 @@ description: Meet Plane. An Enterprise software development tool to manage issue type: application -version: 3.5.4 +version: 3.5.5 appVersion: "3.1.4" home: https://plane.so/ diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index a16d30ab..4dc4a368 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -27,35 +27,197 @@ If you plan to use Traefik as your ingress controller, install it before deployi ## Migrating the Ingress Controller -The chart selects between three ingress templates based on `ingress.ingressClass`: - -| `ingressClass` value | Template rendered | Resource kind | -| ----------------------------- | ---------------------------------- | -------------------------------------------- | -| `traefik` (or starts with it) | `templates/ingress-traefik.yaml` | `traefik.io/v1alpha1 IngressRoute` | -| `openshift` | `templates/ingress-openshift.yaml` | `route.openshift.io/v1 Route` (one per path) | -| `nginx` | `templates/ingress.yaml` | `networking.k8s.io/v1 Ingress` | - -> **Any other value renders no ingress at all**, silently. `templates/ingress.yaml` is -> gated on `ingressClass` being exactly `nginx`, so `alb`, `haproxy`, `contour`, -> `openshift-default` or a custom IngressClass name produce a successful-looking -> install with nothing reachable. Use one of the three values above, or create the -> Ingress yourself. +The chart renders one of three ingress templates — nginx, Traefik or OpenShift. +**Which one** is chosen by the *controller type*, kept separate from the *class +name*, so a class name your controller happens to use (e.g. `nginx-new`) no longer +has to double as the template selector. + +`ingress.controller` selects the resource kind: + +| `ingress.controller` value | Template rendered | Resource kind | +| --------------------------------- | ---------------------------------- | -------------------------------------------- | +| `traefik` (or starts with it) | `templates/ingress-traefik.yaml` | `traefik.io/v1alpha1 IngressRoute` | +| `openshift` | `templates/ingress-openshift.yaml` | `route.openshift.io/v1 Route` (one per path) | +| `nginx` | `templates/ingress-nginx.yaml` | `networking.k8s.io/v1 Ingress` | + +> **nginx, Traefik and OpenShift are the supported configurations.** The value is +> only a selector and is never written into a manifest; the class name comes from +> `ingress.ingressClass` (`spec.ingressClassName`), which can be any string your +> controller exposes. Any `controller` value other than `traefik*`/`openshift` +> renders the same standard `Ingress` as `nginx` — that is how a class name like +> `nginx-new` is served — but only the three above are tested. > **No body-size limit on Routes.** `ingress.traefik.maxRequestBodyBytes` has no > OpenShift equivalent; HAProxy Routes cannot cap request bodies. Enforce upload > limits in the application or at a WAF/CDN in front of the router. -The default value is `"traefik"`. If you are switching to a standard ingress controller such as nginx, follow the migration steps below. +#### If you leave `ingress.controller` empty + +The selection falls back to `ingress.ingressClass`, and is **exactly** what it was +before this value existed: + +| `ingressClass` with no `controller` | Renders | +| --------------------------------------- | ---------------------------- | +| `traefik`, or anything starting with it | Traefik `IngressRoute` | +| `openshift` | OpenShift `Route`s | +| `nginx` | Standard `Ingress` | +| **anything else** | **nothing at all, silently** | + +> ⚠️ **Any class other than `nginx`, `openshift` or `traefik*` renders no ingress** +> while `ingress.controller` is empty — `nginx-new`, `openshift-default`, a custom +> `IngressClass` name or an empty string included. `helm install` succeeds and +> nothing is reachable. **Set `ingress.controller: nginx`** to get a standard +> `Ingress` carrying your class name, or `ingress.enabled: false` if you manage the +> ingress yourself. + +This no-op is kept on purpose rather than widened: an operator on such a class today +gets no ingress from the chart and will have their own in place, so making the +fallback render one would create a second, conflicting `-ingress` on +upgrade — or fail the upgrade outright if theirs shares that name. Opting in via +`ingress.controller` keeps upgrades inert until you ask for the change. + +The default is a Traefik `IngressRoute` (`ingressClass: traefik`, no `controller`). +If you are switching to a standard ingress controller, follow the migration steps +below. + +### Configuration snippets + +Every snippet below is the `ingress` block of your `values.yaml`. All of them also +need `license.licenseDomain` set — no ingress of any kind renders without it: + +```yaml +license: + licenseDomain: plane.example.com +``` + +#### Already supported — no `ingress.controller` needed + +These four worked before `ingress.controller` existed and are unchanged. Leave +`controller` out entirely. + +**1. Traefik `IngressRoute` — the chart default** + +```yaml +ingress: + enabled: true + ingressClass: 'traefik' + traefik: + maxRequestBodyBytes: 20971520 # 20 MiB upload cap + entryPoints: [] # empty = derive from your ssl.* settings +``` + +Renders `IngressRoute` + `Middleware`. Requires the Traefik CRDs. Any class +starting with `traefik` works here (`traefik-v2`, `traefikee`, ...). + +**2. Standard `Ingress` with ingress-nginx** + +```yaml +ingress: + enabled: true + ingressClass: 'nginx' + ingress_annotations: + nginx.ingress.kubernetes.io/proxy-body-size: '20m' + nginx.ingress.kubernetes.io/proxy-buffer-size: '16k' # avoids 502 "too big header" +``` + +Renders one `Ingress` with `ingressClassName: nginx`. The class must be exactly +`nginx` for this to work without `controller`. + +**3. OpenShift Route's** + +```yaml +ingress: + enabled: true + ingressClass: 'openshift' + openshift: + timeout: '300s' # router default is 30s and severs /live/ WebSockets + termination: 'edge' # edge | reencrypt (passthrough cannot do path routing) + insecureEdgeTerminationPolicy: 'Redirect' +``` + +Renders one `Route` per path. See [`examples/values-openshift.yaml`](examples/values-openshift.yaml) +for a complete OpenShift values file. + +**4. No chart-managed ingress — bring your own** + +```yaml +ingress: + enabled: false +``` + +Renders nothing at all. Use this when you expose Plane through your own `Ingress`, +`HTTPRoute`, `LoadBalancer` Service, Cloudflare Tunnel or service mesh. This is the +right setting if you are managing the ingress yourself — do not rely on an +unrecognised `ingressClass` to suppress it. + +#### Newly possible — set `ingress.controller` + +Each of these rendered **no ingress at all** before this change, because the class +name was not one of the three the chart recognised. `controller` picks the resource +kind; `ingressClass` is then used verbatim as `spec.ingressClassName`. + +**5. Standard `Ingress` with a class name that is not `nginx`** — e.g. a second +ingress-nginx install, or an nginx build that exposes its own `IngressClass` + +```yaml +ingress: + enabled: true + controller: 'nginx' # any value but traefik*/openshift selects the Ingress + ingressClass: 'nginx-new' # whatever your controller actually exposes + ingress_annotations: + nginx.ingress.kubernetes.io/proxy-body-size: '20m' +``` + +Renders one `Ingress` with `ingressClassName: nginx-new`. + +**6. Traefik `IngressRoute` with a class name that is not `traefik*`** + +```yaml +ingress: + enabled: true + controller: 'traefik' + ingressClass: 'internal-lb' # unused by the IngressRoute; kept for your own bookkeeping +``` + +Renders `IngressRoute` + `Middleware`. Useful when your platform's naming convention +does not allow a class called `traefik`. + +**7. OpenShift Route's with a class name that is not `openshift`** + +```yaml +ingress: + enabled: true + controller: 'openshift' + ingressClass: 'ocp-internal' # unused by Routes + openshift: + timeout: '300s' +``` + +Renders one `Route` per path. + +**8. OpenShift, letting the ingress-to-route controller convert a plain `Ingress`** + +```yaml +ingress: + enabled: true + controller: 'nginx' # emit a standard Ingress... + ingressClass: 'openshift-default' # ...for OpenShift's router to convert +``` + +Renders one `Ingress` with `ingressClassName: openshift-default`. Note this path gets +**no** per-route HAProxy timeout, so `/live/` WebSockets are subject to the router's +30s default — prefer snippet 3 or 9 unless you specifically need the conversion. ### Switching from Traefik to a standard Ingress controller (e.g. nginx) 1. **Install your target ingress controller** if it is not already running. -2. **Update `ingress.ingressClass`** in your `values.yaml`: +2. **Set `ingress.controller` and `ingress.ingressClass`** in your `values.yaml`: ```yaml ingress: - ingressClass: "nginx" # supported: nginx | traefik* | openshift + controller: "nginx" # selects templates/ingress-nginx.yaml + ingressClass: "nginx" # spec.ingressClassName — whichever class your controller exposes (e.g. "nginx-new") ``` 3. **Run `helm upgrade`**: @@ -80,11 +242,12 @@ The default value is `"traefik"`. If you are switching to a standard ingress con 1. **Install Traefik** with CRD support enabled (see [Installing Traefik Ingress Controller](#installing-traefik-ingress-controller-optional) above). -2. **Update `ingress.ingressClass`**: +2. **Set `ingress.controller`**: ```yaml ingress: - ingressClass: "traefik" + controller: "traefik" + ingressClass: "traefik" # unused by the IngressRoute, kept for clarity ``` 3. **Run `helm upgrade`**. The old `Ingress` resource is orphaned — delete it: @@ -97,11 +260,12 @@ The default value is `"traefik"`. If you are switching to a standard ingress con | Value | Default | Effect | | ------------------------------------- | ---------- | ----------------------------------------------------------------------------------------- | -| `ingress.enabled` | `true` | Master switch — set to `false` to render neither template. | -| `ingress.ingressClass` | `traefik` | Selects which template is active (see table above). | +| `ingress.enabled` | `true` | Master switch — set to `false` to render no ingress at all. | +| `ingress.controller` | `''` | Selects the resource kind: `traefik` → IngressRoute, `openshift` → Routes, `nginx` → standard `Ingress` with your class name. Empty = legacy selection from `ingressClass`, where only `nginx`/`openshift`/`traefik*` render anything. | +| `ingress.ingressClass` | `traefik` | Free-form `spec.ingressClassName` on the standard `Ingress`. Also drives the legacy selection while `controller` is empty. Unused by Traefik and OpenShift. | | `ingress.traefik.maxRequestBodyBytes` | `20971520` | Max request body size for Traefik's buffering middleware. Ignored when not using Traefik. | | `ingress.traefik.entryPoints` | `[]` | Traefik entrypoints for the `IngressRoute`. Empty means derive from your SSL settings — see below. Ignored when not using Traefik. | -| `ingress.ingress_annotations` | `{}` | Standard `Ingress` annotations. Only rendered when `ingressClass` is exactly `nginx`; the `openshift` Route path uses `ingress.openshift.route_annotations`. | +| `ingress.ingress_annotations` | `{}` | Standard `Ingress` annotations (e.g. cert-manager). Rendered only on the standard `Ingress`; the `openshift` path uses `ingress.openshift.route_annotations` and Traefik ignores them. | | `ingress.openshift.timeout` | `300s` | HAProxy per-route timeout. The router default of 30s severs `/live/` WebSockets and `/pi/` streaming. | | `ingress.openshift.termination` | `edge` | Route TLS termination (`edge` or `reencrypt`; `passthrough` cannot do path routing). | | `ingress.openshift.externalCertificate` | `''` | Name of a TLS Secret for the router to serve instead of its wildcard cert. OpenShift 4.16+. | @@ -264,7 +428,7 @@ If the redirection is present, every plain-HTTP request is answered with a permanent redirect *before* it reaches a route, so Option 1 cannot serve Plane on that cluster. Either drop the redirection, or use Option 2/3/4. -#### A note on nginx (`ingress.ingressClass: nginx`) +#### A note on the standard `Ingress` path (`ingress.controller: nginx`) The `ssl.*` settings above drive the standard `Ingress` path too — everything in the table applies except the **Entrypoint** column, which is Traefik-only: @@ -276,6 +440,7 @@ the table applies except the **Entrypoint** column, which is Traefik-only: ```yaml ingress: + controller: nginx ingressClass: nginx ingress_annotations: { "nginx.ingress.kubernetes.io/proxy-body-size": "5m" } ssl: @@ -375,6 +540,7 @@ ingress: - `planeVersion: v3.1.4 ` - `license.licenseDomain: ` - `ingress.enabled: ` + - `ingress.controller: ` - `ingress.ingressClass: ` - `env.storageClass: ` @@ -1145,10 +1311,11 @@ Note: When the email service is enabled, the cert-issuer will be automatically c | ingress.enabled | true | | Ingress setup in kubernetes is a common practice to expose application to the intended audience. Set it to `false` if you are using external ingress providers like `Cloudflare` | | ingress.minioHost | | | Based on above configuration, if you want to expose the `minio` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | | ingress.rabbitmqHost | | | Based on above configuration, if you want to expose the `rabbitmq` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | -| ingress.ingressClass | nginx | Yes | Kubernetes cluster setup comes with various options of `ingressClass`. Based on your setup, set this value to the right one (eg. nginx, traefik, etc). Leave it to default in case you are using external ingress provider. | +| ingress.controller | | | Selects the ingress resource kind. Supported: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; `nginx` renders a standard `Ingress` using `ingressClass` verbatim. **Required when your class is not exactly `nginx`, `openshift` or `traefik*`** — left empty, any other class renders no ingress at all. | +| ingress.ingressClass | traefik | Yes | Free-form class name written to the standard `Ingress` `spec.ingressClassName` (eg. nginx, traefik, nginx-new, etc). While `controller` is empty it also selects the template, and only `nginx`, `openshift` and `traefik*` are recognised. Unused by the Traefik `IngressRoute` and by OpenShift `Route`s. | | ingress.ingress_annotations | `{ "nginx.ingress.kubernetes.io/proxy-body-size": "5m" }` | | Ingress controllers comes with various configuration options which can be passed as annotations. Setting this value lets you change the default value to user required. | -| ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute` binds to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `['websecure','web']`. Ignored unless `ingressClass` starts with `traefik` | -| ingress.traefik.maxRequestBodyBytes | 20971520 | | Max request body size in bytes for Traefik's buffering middleware (upload size limit). Ignored unless `ingressClass` starts with `traefik` | +| ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute` binds to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `['websecure','web']`. Ignored unless the controller resolves to `traefik` | +| ingress.traefik.maxRequestBodyBytes | 20971520 | | Max request body size in bytes for Traefik's buffering middleware (upload size limit). Ignored unless the controller resolves to `traefik` | | ssl.createIssuer | false | | Kubernets cluster setup supports creating `issuer` type resource. After deployment, this is step towards creating secure access to the ingress url. Issuer is required for you generate SSL certifiate. Kubernetes can be configured to use any of the certificate authority to generate SSL (depending on CertManager configuration). Set it to `true` to create the issuer. Applicable only when `ingress.enabled=true` | | ssl.issuer | http | | CertManager configuration allows user to create issuers using `http` or any of the other DNS Providers like `cloudflare`, `digitalocean`, etc. As of now Plane supports `http`, `cloudflare`, `digitalocean` | | ssl.token | | | To create issuers using DNS challenge, set the issuer api token of dns provider like cloudflare`or`digitalocean`(not required for http) | diff --git a/charts/plane-enterprise/examples/values-openshift.yaml b/charts/plane-enterprise/examples/values-openshift.yaml index 9f8af39e..26a25f30 100644 --- a/charts/plane-enterprise/examples/values-openshift.yaml +++ b/charts/plane-enterprise/examples/values-openshift.yaml @@ -68,12 +68,15 @@ services: # ----------------------------------------------------------------------------- # Ingress # ----------------------------------------------------------------------------- -# 'openshift' renders one route.openshift.io/v1 Route per path, with the HAProxy -# timeout set explicitly. This is the only OpenShift ingress path the chart offers -# — 'openshift-default' (letting the ingress-to-route controller convert a plain -# Ingress) renders nothing, because templates/ingress.yaml is gated on 'nginx'. +# controller: 'openshift' renders one route.openshift.io/v1 Route per path, with +# the HAProxy timeout set explicitly. To let OpenShift's ingress-to-route +# controller convert a plain Ingress instead, set controller: 'nginx' with +# ingressClass: 'openshift-default' — the timeout below is then not applied. +# Note controller must be set for that: with it empty, 'openshift-default' +# renders no ingress at all. ingress: enabled: true + controller: 'openshift' ingressClass: 'openshift' openshift: # The router default is 30s, which severs /live/'s collaborative-editing diff --git a/charts/plane-enterprise/questions.yml b/charts/plane-enterprise/questions.yml index 26597591..74c1238f 100644 --- a/charts/plane-enterprise/questions.yml +++ b/charts/plane-enterprise/questions.yml @@ -1714,8 +1714,15 @@ questions: type: string default: "" show_if: "services.rabbitmq.local_setup=true" + - variable: ingress.controller + label: "Ingress Controller Type" + description: "Which kind of ingress resource to render. Supported: 'traefik' a Traefik IngressRoute, 'openshift' one OpenShift Route per path, 'nginx' a standard networking.k8s.io/v1 Ingress using the Ingress Classname below verbatim. REQUIRED when your class name is not exactly 'nginx', 'openshift' or 'traefik*' - left empty, any other class renders no ingress at all." + type: string + default: "" + show_if: "ingress.enabled=true" - variable: ingress.ingressClass label: "Ingress Classname" + description: "Class name written to the standard Ingress' spec.ingressClassName. Unused by the Traefik IngressRoute and by OpenShift Routes. While Ingress Controller Type above is empty this also selects which template renders, and only 'nginx', 'openshift' and 'traefik*' are recognised." type: string required: true default: "nginx" @@ -1773,7 +1780,7 @@ questions: - variable: ingress.traefik.entryPoints label: "Traefik Entrypoints Override" - description: "Traefik entrypoints the IngressRoute binds to, e.g. 'websecure'. Leave empty to derive from the SSL settings (websecure when this chart manages a certificate, otherwise web). Required as 'websecure' when TLS is terminated by Traefik's own entrypoint. Ignored unless the ingress class is traefik." + description: "Traefik entrypoints the IngressRoute binds to, e.g. 'websecure'. Leave empty to derive from the SSL settings (websecure when this chart manages a certificate, otherwise web). Required as 'websecure' when TLS is terminated by Traefik's own entrypoint. Ignored unless the controller resolves to traefik." type: string default: "" group: "Ingress" diff --git a/charts/plane-enterprise/templates/_helpers.tpl b/charts/plane-enterprise/templates/_helpers.tpl index 29eca847..29dad75b 100644 --- a/charts/plane-enterprise/templates/_helpers.tpl +++ b/charts/plane-enterprise/templates/_helpers.tpl @@ -98,6 +98,41 @@ of the local_setup flag's value. {{- end -}} {{- end -}} +{{/* +Selects which ingress template renders, decoupling the controller *type* (which +resource kind to emit) from the ingress *class name* (a free-form string). +Returns "traefik" (IngressRoute), "openshift" (Route per path), "ingress" +(networking.k8s.io/v1 Ingress, i.e. ingress-nginx) or "none" (render nothing). + +ingress.controller decides when set: "traefik*" -> traefik, "openshift" -> +openshift, anything else -> a standard Ingress, whatever the class name is. That +last case exists so a non-"nginx" class name can still be served, e.g. +controller "nginx" with ingressClass "nginx-new". + +When ingress.controller is EMPTY the selection is the pre-3.5.5 one, exactly: +only "traefik*", "openshift" and "nginx" are recognised and any other class +returns "none", rendering no ingress. That silent no-op is kept deliberately -- +widening it would make an upgrade create a -ingress for operators who +are on such a class today and already run an ingress of their own. Set +ingress.controller to opt into the standard Ingress for any class name. +*/}} +{{- define "plane.ingressController" -}} + {{- $c := .Values.ingress.controller | default "" | trim | lower -}} + {{- if $c -}} + {{- if hasPrefix "traefik" $c -}}traefik + {{- else if eq $c "openshift" -}}openshift + {{- else -}}ingress + {{- end -}} + {{- else -}} + {{- $k := .Values.ingress.ingressClass | default "" -}} + {{- if hasPrefix "traefik" $k -}}traefik + {{- else if eq $k "openshift" -}}openshift + {{- else if eq $k "nginx" -}}ingress + {{- else -}}none + {{- end -}} + {{- end -}} +{{- end -}} + {{/* Normalize the deprecated s3SecretName/s3SecretKey into the s3Secrets list format. Returns "true" when airgapped is enabled and at least one CA secret is configured. diff --git a/charts/plane-enterprise/templates/ingress.yaml b/charts/plane-enterprise/templates/ingress-nginx.yaml similarity index 87% rename from charts/plane-enterprise/templates/ingress.yaml rename to charts/plane-enterprise/templates/ingress-nginx.yaml index e439bf6c..e8d91b55 100644 --- a/charts/plane-enterprise/templates/ingress.yaml +++ b/charts/plane-enterprise/templates/ingress-nginx.yaml @@ -1,15 +1,14 @@ {{/* -Standard networking.k8s.io/v1 Ingress. Gated on ingressClass being exactly -"nginx"; the other templates are ingress-traefik.yaml ("traefik*") and -ingress-openshift.yaml ("openshift"). +Standard networking.k8s.io/v1 Ingress, for ingress-nginx. Which of the three +ingress templates renders is decided by the "plane.ingressController" helper, not +by ingressClass directly. -NOTE: any other class (alb, haproxy, contour, openshift-default, a custom -IngressClass name, ...) renders nothing at all, with no error -- despite the -README describing this template as the fallback for "any other value". That -mismatch is deliberately left as-is for now and tracked separately; do not widen -this condition without checking what else assumes the nginx-only behaviour. +The resource itself is controller-agnostic, so setting ingress.controller to +something other than traefik/openshift also renders from here -- that is how a +non-"nginx" class name such as "nginx-new" is served. Only nginx, Traefik and +OpenShift are supported configurations. */}} -{{- if and .Values.ingress.enabled (eq .Values.ingress.ingressClass "nginx") .Values.license.licenseDomain }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "ingress") .Values.license.licenseDomain }} apiVersion: networking.k8s.io/v1 kind: Ingress diff --git a/charts/plane-enterprise/templates/ingress-openshift.yaml b/charts/plane-enterprise/templates/ingress-openshift.yaml index 8304905d..4d50bf0b 100644 --- a/charts/plane-enterprise/templates/ingress-openshift.yaml +++ b/charts/plane-enterprise/templates/ingress-openshift.yaml @@ -2,18 +2,19 @@ ================================================================================ OpenShift ingress: one route.openshift.io/v1 Route per path. ================================================================================ -Rendered when ingress.ingressClass == "openshift". +Rendered when "plane.ingressController" resolves to "openshift", i.e. +ingress.controller (or, unset, ingress.ingressClass) is "openshift". Why explicit Routes rather than a plain Ingress: OpenShift's ingress-to-route controller can convert a networking.k8s.io/v1 -Ingress into Routes. This chart does not offer that path: templates/ingress.yaml -is gated on ingressClass == "nginx", so setting "openshift-default" renders -nothing. Declaring the Routes here is also the more predictable option — the -conversion only picks up an Ingress whose class maps to the +Ingress into Routes, but declaring the Routes here is the more predictable +option — the conversion only picks up an Ingress whose class maps to the openshift.io/ingress-to-route controller, and whether per-path HAProxy annotations survive it varies by OCP version. Plane needs the timeout below, so -there is no guesswork this way. +there is no guesswork this way. (If you do want that path, set +ingress.controller to "nginx" with ingressClass "openshift-default" and the +standard Ingress renders instead.) Differences from the Traefik IngressRoute this mirrors: @@ -26,7 +27,7 @@ Differences from the Traefik IngressRoute this mirrors: - Path-based Routes require edge or reencrypt TLS termination; they are not supported with passthrough. */}} -{{- if and .Values.ingress.enabled (eq .Values.ingress.ingressClass "openshift") .Values.license.licenseDomain }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "openshift") .Values.license.licenseDomain }} {{- $host := .Values.license.licenseDomain }} {{- $name := .Release.Name }} {{- $oc := .Values.ingress.openshift | default dict }} @@ -40,7 +41,7 @@ Differences from the Traefik IngressRoute this mirrors: {{- fail (printf "ingress.openshift.termination must be \"edge\" or \"reencrypt\", got %q. Path-based Routes cannot use passthrough termination; see charts/plane-enterprise/README.md." $termination) }} {{- end }} -{{/* Same path -> service mapping as templates/ingress.yaml, most specific first +{{/* Same path -> service mapping as templates/ingress-nginx.yaml, most specific first (ordering is cosmetic here, kept aligned so the two are easy to diff). */}} {{- $routes := list (dict "slug" "spaces" "path" "/spaces/" "svc" (printf "%s-space" $name) "port" 3000) @@ -64,7 +65,7 @@ Differences from the Traefik IngressRoute this mirrors: {{- $routes = append $routes (dict "slug" "web" "path" "/" "svc" (printf "%s-web" $name) "port" 3000) }} {{/* The bundled MinIO console and RabbitMQ management UI live on their own hosts, - matching templates/ingress.yaml. Both are gated on the corresponding + matching templates/ingress-nginx.yaml. Both are gated on the corresponding local_setup, so neither renders in the recommended OpenShift configuration (where the bundled datastores are off because they cannot run under an arbitrary UID) -- they are here for a cluster that grants those workloads a diff --git a/charts/plane-enterprise/templates/ingress-traefik.yaml b/charts/plane-enterprise/templates/ingress-traefik.yaml index 2c75f218..fa8bd304 100644 --- a/charts/plane-enterprise/templates/ingress-traefik.yaml +++ b/charts/plane-enterprise/templates/ingress-traefik.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.ingress.enabled (hasPrefix "traefik" .Values.ingress.ingressClass) .Values.license.licenseDomain }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "traefik") .Values.license.licenseDomain }} apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/charts/plane-enterprise/templates/traefik-middleware.yaml b/charts/plane-enterprise/templates/traefik-middleware.yaml index faaaae0d..b46ea55d 100644 --- a/charts/plane-enterprise/templates/traefik-middleware.yaml +++ b/charts/plane-enterprise/templates/traefik-middleware.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.ingress.enabled (hasPrefix "traefik" .Values.ingress.ingressClass) }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "traefik") .Values.license.licenseDomain }} apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 09482089..ec1f2d4b 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -38,16 +38,30 @@ ingress: enabled: true minioHost: '' rabbitmqHost: '' - # Selects which ingress template is rendered: - # 'traefik*' -> Traefik IngressRoute CRD (templates/ingress-traefik.yaml) - # 'openshift' -> OpenShift Route per path (templates/ingress-openshift.yaml) - # 'nginx' -> networking.k8s.io/v1 Ingress (templates/ingress.yaml) - # Any OTHER value renders no ingress at all -- see the note in templates/ingress.yaml. + # controller selects WHICH KIND of ingress resource is rendered, decoupled from + # the class name below. Supported: nginx, traefik and openshift. When set: + # 'traefik' -> Traefik IngressRoute CRD (templates/ingress-traefik.yaml) + # 'openshift' -> one OpenShift Route per path (templates/ingress-openshift.yaml) + # 'nginx' (or any other value) + # -> networking.k8s.io/v1 Ingress (templates/ingress-nginx.yaml), + # with ingressClass below used verbatim as spec.ingressClassName. + # Leave it empty and the legacy selection applies, unchanged: only a class of + # 'traefik*', 'openshift' or 'nginx' renders anything, and ANY OTHER class + # renders no ingress at all, silently. That is kept so upgrades never create an + # ingress where the chart previously created none. + # => Set controller when your class name is not exactly 'nginx', 'openshift' or + # 'traefik*' -- e.g. controller 'nginx' with ingressClass 'nginx-new'. + controller: '' + # ingressClass is the free-form class name written to the standard Ingress' + # spec.ingressClassName. Unused on the traefik and openshift paths, since + # neither an IngressRoute nor a Route carries a class name. It also drives the + # legacy selection above while controller is empty. ingressClass: 'traefik' - # Annotations for the standard Ingress — e.g. to set the proxy body size limit on - # the nginx controller. ONLY rendered when ingressClass is exactly 'nginx'; they - # have no effect with traefik, and the 'openshift' Route path takes its - # annotations from ingress.openshift.route_annotations instead. Example: + # Annotations for the standard Ingress — e.g. to set the proxy body size limit + # on the nginx controller. Rendered onto the standard Ingress only; they have no + # effect with traefik (use ingress.traefik.maxRequestBodyBytes) and the openshift + # path takes its annotations from ingress.openshift.route_annotations instead. + # Example for ingress-nginx: # - proxy-body-size: nginx equivalent of traefik's maxRequestBodyBytes (upload size limit). # - proxy-buffer-size: size of the buffer for the response headers from upstream; bump this to avoid # "502 upstream sent too big header" errors. @@ -64,7 +78,7 @@ ingress: # Set explicitly only if your Traefik install renamed the default entrypoints, # e.g. entryPoints: ['websecure', 'web'] or ['https']. entryPoints: [] - # Only read when ingressClass is 'openshift'. + # Only read on the openshift path (see controller above). openshift: # HAProxy's per-route timeout. The router default is 30s, which severs # /live/'s collaborative-editing WebSockets and /pi/'s streaming responses.