From 9efd2c3f270e854a2488e26c2e9027957207f8c3 Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Tue, 23 Jun 2026 14:34:18 +0530 Subject: [PATCH 1/7] fix(plane-enterprise): decouple ingress controller type from class name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ingress templates used `ingress.ingressClass` to decide both the resource kind (standard Ingress vs Traefik IngressRoute) and the class name string. As a result `ingress.yaml` rendered only for the exact value `nginx` and `ingress-traefik.yaml` only for values prefixed `traefik` — any other class name (a Traefik alias, or `nginx-new`) matched neither template and the ingress was silently dropped. Introduce `ingress.controller` to select the resource kind, decoupled from the free-form class name. Only `traefik` selects the IngressRoute; any other value selects a standard Ingress. Empty falls back to the previous auto-detection from `ingressClass`, so existing installs are unaffected. Also fix a pre-existing latent bug in ingress.yaml where `len` of a nil `ingress_annotations` threw a hard render error; switched to `with`. Bumps chart 2.6.2 -> 2.6.3. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/plane-enterprise/Chart.yaml | 2 +- charts/plane-enterprise/README.md | 66 ++++++++++++------- .../examples/values-openshift.yaml | 9 +-- .../plane-enterprise/templates/_helpers.tpl | 22 +++++++ .../templates/ingress-openshift.yaml | 15 +++-- .../templates/ingress-traefik.yaml | 2 +- .../plane-enterprise/templates/ingress.yaml | 14 ++-- charts/plane-enterprise/values.yaml | 31 ++++++--- 8 files changed, 105 insertions(+), 56 deletions(-) diff --git a/charts/plane-enterprise/Chart.yaml b/charts/plane-enterprise/Chart.yaml index 3152b0b7..f986c42a 100644 --- a/charts/plane-enterprise/Chart.yaml +++ b/charts/plane-enterprise/Chart.yaml @@ -5,7 +5,7 @@ description: Meet Plane. An Enterprise software development tool to manage issue type: application -version: 3.5.4 +version: 3.5.5 appVersion: "3.1.4" home: https://plane.so/ diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index a16d30ab..0b34063d 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -27,35 +27,50 @@ If you plan to use Traefik as your ingress controller, install it before deployi ## Migrating the Ingress Controller -The chart selects between three ingress templates based on `ingress.ingressClass`: +The chart renders one of three ingress templates. **Which one** is chosen by the +*controller type* — kept separate from the *class name*, so atypical class names +(e.g. `nginx-new`, or a Traefik-named alias served by a standard controller) work +without changing template selection. -| `ingressClass` value | Template rendered | Resource kind | -| ----------------------------- | ---------------------------------- | -------------------------------------------- | -| `traefik` (or starts with it) | `templates/ingress-traefik.yaml` | `traefik.io/v1alpha1 IngressRoute` | -| `openshift` | `templates/ingress-openshift.yaml` | `route.openshift.io/v1 Route` (one per path) | -| `nginx` | `templates/ingress.yaml` | `networking.k8s.io/v1 Ingress` | +`ingress.controller` selects the resource kind: -> **Any other value renders no ingress at all**, silently. `templates/ingress.yaml` is -> gated on `ingressClass` being exactly `nginx`, so `alb`, `haproxy`, `contour`, -> `openshift-default` or a custom IngressClass name produce a successful-looking -> install with nothing reachable. Use one of the three values above, or create the -> Ingress yourself. +| `ingress.controller` value | Template rendered | Resource kind | +| -------------------------------------- | ---------------------------------- | -------------------------------------------- | +| `traefik` (or starts with it) | `templates/ingress-traefik.yaml` | `traefik.io/v1alpha1 IngressRoute` | +| `openshift` | `templates/ingress-openshift.yaml` | `route.openshift.io/v1 Route` (one per path) | +| Any other value (`nginx`, `f5`, ...) | `templates/ingress.yaml` | `networking.k8s.io/v1 Ingress` | + +> The standard `Ingress` path covers **any** standard Kubernetes ingress controller — +> ingress-nginx, F5 NGINX, HAProxy, ALB, Contour, etc. The value is just a selector; +> it is not written anywhere. The actual class name comes from `ingress.ingressClass` +> (`spec.ingressClassName`), which can be any string your controller exposes. > **No body-size limit on Routes.** `ingress.traefik.maxRequestBodyBytes` has no > OpenShift equivalent; HAProxy Routes cannot cap request bodies. Enforce upload > limits in the application or at a WAF/CDN in front of the router. -The default value is `"traefik"`. If you are switching to a standard ingress controller such as nginx, follow the migration steps below. +If `ingress.controller` is left empty, the controller is **inferred** from +`ingress.ingressClass` for backward compatibility: a value starting with `traefik` +selects Traefik, exactly `openshift` selects Routes, anything else selects the +standard `Ingress`. Set `ingress.controller` explicitly to override that — for +example to serve a standard `Ingress` whose `ingressClassName` happens to start +with `traefik`, or to use a non-`nginx` class name like `nginx-new` (which +previously rendered nothing at all, silently). + +The default is a Traefik `IngressRoute` (`ingressClass: traefik`, controller +auto-detected). If you are switching to a standard ingress controller, follow the +migration steps below. ### Switching from Traefik to a standard Ingress controller (e.g. nginx) 1. **Install your target ingress controller** if it is not already running. -2. **Update `ingress.ingressClass`** in your `values.yaml`: +2. **Set `ingress.controller` and `ingress.ingressClass`** in your `values.yaml`: ```yaml ingress: - ingressClass: "nginx" # supported: nginx | traefik* | openshift + controller: "nginx" # selects the standard Ingress template (anything but traefik/openshift) + ingressClass: "nginx" # spec.ingressClassName — whichever class your controller exposes (e.g. "nginx-new") ``` 3. **Run `helm upgrade`**: @@ -80,11 +95,12 @@ The default value is `"traefik"`. If you are switching to a standard ingress con 1. **Install Traefik** with CRD support enabled (see [Installing Traefik Ingress Controller](#installing-traefik-ingress-controller-optional) above). -2. **Update `ingress.ingressClass`**: +2. **Set `ingress.controller`**: ```yaml ingress: - ingressClass: "traefik" + controller: "traefik" + ingressClass: "traefik" # unused by the IngressRoute, kept for clarity ``` 3. **Run `helm upgrade`**. The old `Ingress` resource is orphaned — delete it: @@ -97,11 +113,12 @@ The default value is `"traefik"`. If you are switching to a standard ingress con | Value | Default | Effect | | ------------------------------------- | ---------- | ----------------------------------------------------------------------------------------- | -| `ingress.enabled` | `true` | Master switch — set to `false` to render neither template. | -| `ingress.ingressClass` | `traefik` | Selects which template is active (see table above). | +| `ingress.enabled` | `true` | Master switch — set to `false` to render no ingress at all. | +| `ingress.controller` | `''` | Selects the resource kind: `traefik` → IngressRoute, `openshift` → Routes, anything else → standard `Ingress`. Empty = infer from `ingressClass`. | +| `ingress.ingressClass` | `traefik` | Free-form `spec.ingressClassName` on the standard `Ingress`. Also drives the inference when `controller` is empty. Unused by Traefik and OpenShift. | | `ingress.traefik.maxRequestBodyBytes` | `20971520` | Max request body size for Traefik's buffering middleware. Ignored when not using Traefik. | | `ingress.traefik.entryPoints` | `[]` | Traefik entrypoints for the `IngressRoute`. Empty means derive from your SSL settings — see below. Ignored when not using Traefik. | -| `ingress.ingress_annotations` | `{}` | Standard `Ingress` annotations. Only rendered when `ingressClass` is exactly `nginx`; the `openshift` Route path uses `ingress.openshift.route_annotations`. | +| `ingress.ingress_annotations` | `{}` | Standard `Ingress` annotations (e.g. cert-manager). Rendered only on the standard `Ingress`; the `openshift` path uses `ingress.openshift.route_annotations` and Traefik ignores them. | | `ingress.openshift.timeout` | `300s` | HAProxy per-route timeout. The router default of 30s severs `/live/` WebSockets and `/pi/` streaming. | | `ingress.openshift.termination` | `edge` | Route TLS termination (`edge` or `reencrypt`; `passthrough` cannot do path routing). | | `ingress.openshift.externalCertificate` | `''` | Name of a TLS Secret for the router to serve instead of its wildcard cert. OpenShift 4.16+. | @@ -264,7 +281,7 @@ If the redirection is present, every plain-HTTP request is answered with a permanent redirect *before* it reaches a route, so Option 1 cannot serve Plane on that cluster. Either drop the redirection, or use Option 2/3/4. -#### A note on nginx (`ingress.ingressClass: nginx`) +#### A note on the standard `Ingress` path (`ingress.controller: nginx`) The `ssl.*` settings above drive the standard `Ingress` path too — everything in the table applies except the **Entrypoint** column, which is Traefik-only: @@ -276,6 +293,7 @@ the table applies except the **Entrypoint** column, which is Traefik-only: ```yaml ingress: + controller: nginx ingressClass: nginx ingress_annotations: { "nginx.ingress.kubernetes.io/proxy-body-size": "5m" } ssl: @@ -375,6 +393,7 @@ ingress: - `planeVersion: v3.1.4 ` - `license.licenseDomain: ` - `ingress.enabled: ` + - `ingress.controller: ` - `ingress.ingressClass: ` - `env.storageClass: ` @@ -1145,10 +1164,11 @@ Note: When the email service is enabled, the cert-issuer will be automatically c | ingress.enabled | true | | Ingress setup in kubernetes is a common practice to expose application to the intended audience. Set it to `false` if you are using external ingress providers like `Cloudflare` | | ingress.minioHost | | | Based on above configuration, if you want to expose the `minio` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | | ingress.rabbitmqHost | | | Based on above configuration, if you want to expose the `rabbitmq` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | -| ingress.ingressClass | nginx | Yes | Kubernetes cluster setup comes with various options of `ingressClass`. Based on your setup, set this value to the right one (eg. nginx, traefik, etc). Leave it to default in case you are using external ingress provider. | +| ingress.controller | | | Selects the ingress resource kind: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; any other value (`nginx`, `f5`, `haproxy`, ...) renders a standard `Ingress`. Leave empty to infer it from `ingressClass`. Set explicitly for atypical class names (e.g. `nginx-new`) or a Traefik-named alias served by a standard controller. | +| ingress.ingressClass | traefik | Yes | Free-form class name written to the standard `Ingress` `spec.ingressClassName` (eg. nginx, traefik, nginx-new, etc). When `controller` is empty it also drives the inference. Unused by the Traefik `IngressRoute` and by OpenShift `Route`s. | | ingress.ingress_annotations | `{ "nginx.ingress.kubernetes.io/proxy-body-size": "5m" }` | | Ingress controllers comes with various configuration options which can be passed as annotations. Setting this value lets you change the default value to user required. | -| ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute` binds to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `['websecure','web']`. Ignored unless `ingressClass` starts with `traefik` | -| ingress.traefik.maxRequestBodyBytes | 20971520 | | Max request body size in bytes for Traefik's buffering middleware (upload size limit). Ignored unless `ingressClass` starts with `traefik` | +| ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute` binds to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `['websecure','web']`. Ignored unless the controller resolves to `traefik` | +| ingress.traefik.maxRequestBodyBytes | 20971520 | | Max request body size in bytes for Traefik's buffering middleware (upload size limit). Ignored unless the controller resolves to `traefik` | | ssl.createIssuer | false | | Kubernets cluster setup supports creating `issuer` type resource. After deployment, this is step towards creating secure access to the ingress url. Issuer is required for you generate SSL certifiate. Kubernetes can be configured to use any of the certificate authority to generate SSL (depending on CertManager configuration). Set it to `true` to create the issuer. Applicable only when `ingress.enabled=true` | | ssl.issuer | http | | CertManager configuration allows user to create issuers using `http` or any of the other DNS Providers like `cloudflare`, `digitalocean`, etc. As of now Plane supports `http`, `cloudflare`, `digitalocean` | | ssl.token | | | To create issuers using DNS challenge, set the issuer api token of dns provider like cloudflare`or`digitalocean`(not required for http) | diff --git a/charts/plane-enterprise/examples/values-openshift.yaml b/charts/plane-enterprise/examples/values-openshift.yaml index 9f8af39e..85df844f 100644 --- a/charts/plane-enterprise/examples/values-openshift.yaml +++ b/charts/plane-enterprise/examples/values-openshift.yaml @@ -68,12 +68,13 @@ services: # ----------------------------------------------------------------------------- # Ingress # ----------------------------------------------------------------------------- -# 'openshift' renders one route.openshift.io/v1 Route per path, with the HAProxy -# timeout set explicitly. This is the only OpenShift ingress path the chart offers -# — 'openshift-default' (letting the ingress-to-route controller convert a plain -# Ingress) renders nothing, because templates/ingress.yaml is gated on 'nginx'. +# controller: 'openshift' renders one route.openshift.io/v1 Route per path, with +# the HAProxy timeout set explicitly. To let OpenShift's ingress-to-route +# controller convert a plain Ingress instead, set controller: 'nginx' with +# ingressClass: 'openshift-default' — the timeout below is then not applied. ingress: enabled: true + controller: 'openshift' ingressClass: 'openshift' openshift: # The router default is 30s, which severs /live/'s collaborative-editing diff --git a/charts/plane-enterprise/templates/_helpers.tpl b/charts/plane-enterprise/templates/_helpers.tpl index 29eca847..4fdde7a2 100644 --- a/charts/plane-enterprise/templates/_helpers.tpl +++ b/charts/plane-enterprise/templates/_helpers.tpl @@ -98,6 +98,28 @@ of the local_setup flag's value. {{- end -}} {{- end -}} +{{/* +Selects which ingress template renders, decoupling the controller *type* (which +resource kind to emit) from the ingress *class name* (a free-form string). +Returns "traefik" (IngressRoute), "openshift" (Route per path), or "ingress" +(networking.k8s.io/v1 Ingress -- nginx, F5 NGINX, HAProxy, ALB, anything else). + +ingress.controller decides when set; otherwise the value is inferred from +ingress.ingressClass, which is the pre-existing behaviour. Set controller to +override that inference -- an atypical class name such as "nginx-new", or a +Traefik-named class that should still be served by a standard Ingress. +*/}} +{{- define "plane.ingressController" -}} + {{- $c := .Values.ingress.controller | default "" | trim | lower -}} + {{- if not $c -}} + {{- $c = .Values.ingress.ingressClass | default "" | trim | lower -}} + {{- end -}} + {{- if hasPrefix "traefik" $c -}}traefik + {{- else if eq $c "openshift" -}}openshift + {{- else -}}ingress + {{- end -}} +{{- end -}} + {{/* Normalize the deprecated s3SecretName/s3SecretKey into the s3Secrets list format. Returns "true" when airgapped is enabled and at least one CA secret is configured. diff --git a/charts/plane-enterprise/templates/ingress-openshift.yaml b/charts/plane-enterprise/templates/ingress-openshift.yaml index 8304905d..2c11074f 100644 --- a/charts/plane-enterprise/templates/ingress-openshift.yaml +++ b/charts/plane-enterprise/templates/ingress-openshift.yaml @@ -2,18 +2,19 @@ ================================================================================ OpenShift ingress: one route.openshift.io/v1 Route per path. ================================================================================ -Rendered when ingress.ingressClass == "openshift". +Rendered when "plane.ingressController" resolves to "openshift", i.e. +ingress.controller (or, unset, ingress.ingressClass) is "openshift". Why explicit Routes rather than a plain Ingress: OpenShift's ingress-to-route controller can convert a networking.k8s.io/v1 -Ingress into Routes. This chart does not offer that path: templates/ingress.yaml -is gated on ingressClass == "nginx", so setting "openshift-default" renders -nothing. Declaring the Routes here is also the more predictable option — the -conversion only picks up an Ingress whose class maps to the +Ingress into Routes, but declaring the Routes here is the more predictable +option — the conversion only picks up an Ingress whose class maps to the openshift.io/ingress-to-route controller, and whether per-path HAProxy annotations survive it varies by OCP version. Plane needs the timeout below, so -there is no guesswork this way. +there is no guesswork this way. (If you do want that path, set +ingress.controller to "nginx" with ingressClass "openshift-default" and the +standard Ingress renders instead.) Differences from the Traefik IngressRoute this mirrors: @@ -26,7 +27,7 @@ Differences from the Traefik IngressRoute this mirrors: - Path-based Routes require edge or reencrypt TLS termination; they are not supported with passthrough. */}} -{{- if and .Values.ingress.enabled (eq .Values.ingress.ingressClass "openshift") .Values.license.licenseDomain }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "openshift") .Values.license.licenseDomain }} {{- $host := .Values.license.licenseDomain }} {{- $name := .Release.Name }} {{- $oc := .Values.ingress.openshift | default dict }} diff --git a/charts/plane-enterprise/templates/ingress-traefik.yaml b/charts/plane-enterprise/templates/ingress-traefik.yaml index 2c75f218..fa8bd304 100644 --- a/charts/plane-enterprise/templates/ingress-traefik.yaml +++ b/charts/plane-enterprise/templates/ingress-traefik.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.ingress.enabled (hasPrefix "traefik" .Values.ingress.ingressClass) .Values.license.licenseDomain }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "traefik") .Values.license.licenseDomain }} apiVersion: traefik.io/v1alpha1 kind: IngressRoute diff --git a/charts/plane-enterprise/templates/ingress.yaml b/charts/plane-enterprise/templates/ingress.yaml index e439bf6c..9423d5e2 100644 --- a/charts/plane-enterprise/templates/ingress.yaml +++ b/charts/plane-enterprise/templates/ingress.yaml @@ -1,15 +1,9 @@ {{/* -Standard networking.k8s.io/v1 Ingress. Gated on ingressClass being exactly -"nginx"; the other templates are ingress-traefik.yaml ("traefik*") and -ingress-openshift.yaml ("openshift"). - -NOTE: any other class (alb, haproxy, contour, openshift-default, a custom -IngressClass name, ...) renders nothing at all, with no error -- despite the -README describing this template as the fallback for "any other value". That -mismatch is deliberately left as-is for now and tracked separately; do not widen -this condition without checking what else assumes the nginx-only behaviour. +Standard networking.k8s.io/v1 Ingress -- the fallback for every controller that +is not Traefik or OpenShift. Which of the three ingress templates renders is +decided by the "plane.ingressController" helper, not by ingressClass directly. */}} -{{- if and .Values.ingress.enabled (eq .Values.ingress.ingressClass "nginx") .Values.license.licenseDomain }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "ingress") .Values.license.licenseDomain }} apiVersion: networking.k8s.io/v1 kind: Ingress diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 09482089..070c686c 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -38,16 +38,27 @@ ingress: enabled: true minioHost: '' rabbitmqHost: '' - # Selects which ingress template is rendered: - # 'traefik*' -> Traefik IngressRoute CRD (templates/ingress-traefik.yaml) - # 'openshift' -> OpenShift Route per path (templates/ingress-openshift.yaml) - # 'nginx' -> networking.k8s.io/v1 Ingress (templates/ingress.yaml) - # Any OTHER value renders no ingress at all -- see the note in templates/ingress.yaml. + # controller selects WHICH KIND of ingress resource is rendered, decoupled from + # the class name below. Recognised values: + # 'traefik' -> Traefik IngressRoute CRD (templates/ingress-traefik.yaml) + # 'openshift' -> one OpenShift Route per path (templates/ingress-openshift.yaml) + # anything else ('nginx', 'f5', 'haproxy', 'alb', ...) + # -> networking.k8s.io/v1 Ingress (templates/ingress.yaml) + # Leave empty to infer it from ingressClass: a value starting with 'traefik' + # means Traefik, exactly 'openshift' means Routes, everything else means a + # standard Ingress. Set it explicitly when your class name is atypical + # (e.g. 'nginx-new', or a Traefik-named alias served by a standard Ingress). + controller: '' + # ingressClass is the free-form class name written to the standard Ingress' + # spec.ingressClassName. It no longer constrains which template renders (use + # controller above for that). Unused on the traefik and openshift paths, since + # neither an IngressRoute nor a Route carries a class name. ingressClass: 'traefik' - # Annotations for the standard Ingress — e.g. to set the proxy body size limit on - # the nginx controller. ONLY rendered when ingressClass is exactly 'nginx'; they - # have no effect with traefik, and the 'openshift' Route path takes its - # annotations from ingress.openshift.route_annotations instead. Example: + # Annotations for the standard Ingress — e.g. to set the proxy body size limit + # on the nginx controller. Rendered onto the standard Ingress only; they have no + # effect with traefik (use ingress.traefik.maxRequestBodyBytes) and the openshift + # path takes its annotations from ingress.openshift.route_annotations instead. + # Example for ingress-nginx: # - proxy-body-size: nginx equivalent of traefik's maxRequestBodyBytes (upload size limit). # - proxy-buffer-size: size of the buffer for the response headers from upstream; bump this to avoid # "502 upstream sent too big header" errors. @@ -64,7 +75,7 @@ ingress: # Set explicitly only if your Traefik install renamed the default entrypoints, # e.g. entryPoints: ['websecure', 'web'] or ['https']. entryPoints: [] - # Only read when ingressClass is 'openshift'. + # Only read on the openshift path (see controller above). openshift: # HAProxy's per-route timeout. The router default is 30s, which severs # /live/'s collaborative-editing WebSockets and /pi/'s streaming responses. From 4c85f38ff2685026053e22cc7e669244ea390863 Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Tue, 23 Jun 2026 14:39:03 +0530 Subject: [PATCH 2/7] docs(plane-enterprise): drop Traefik-alias-on-standard-Ingress guidance The ingress.controller feature stays (it implements the F5/nginx-new request). Remove only the README/values examples about serving a Traefik-named class alias via a standard Ingress, which is no longer a needed use case. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/plane-enterprise/README.md | 11 ++++------- charts/plane-enterprise/values.yaml | 2 +- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 0b34063d..68a57d27 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -29,8 +29,7 @@ If you plan to use Traefik as your ingress controller, install it before deployi The chart renders one of three ingress templates. **Which one** is chosen by the *controller type* — kept separate from the *class name*, so atypical class names -(e.g. `nginx-new`, or a Traefik-named alias served by a standard controller) work -without changing template selection. +(e.g. `nginx-new`) work without changing template selection. `ingress.controller` selects the resource kind: @@ -52,10 +51,8 @@ without changing template selection. If `ingress.controller` is left empty, the controller is **inferred** from `ingress.ingressClass` for backward compatibility: a value starting with `traefik` selects Traefik, exactly `openshift` selects Routes, anything else selects the -standard `Ingress`. Set `ingress.controller` explicitly to override that — for -example to serve a standard `Ingress` whose `ingressClassName` happens to start -with `traefik`, or to use a non-`nginx` class name like `nginx-new` (which -previously rendered nothing at all, silently). +standard `Ingress`. Set `ingress.controller` explicitly to use a non-`nginx` class +name like `nginx-new` (which previously rendered nothing at all, silently). The default is a Traefik `IngressRoute` (`ingressClass: traefik`, controller auto-detected). If you are switching to a standard ingress controller, follow the @@ -1164,7 +1161,7 @@ Note: When the email service is enabled, the cert-issuer will be automatically c | ingress.enabled | true | | Ingress setup in kubernetes is a common practice to expose application to the intended audience. Set it to `false` if you are using external ingress providers like `Cloudflare` | | ingress.minioHost | | | Based on above configuration, if you want to expose the `minio` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | | ingress.rabbitmqHost | | | Based on above configuration, if you want to expose the `rabbitmq` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | -| ingress.controller | | | Selects the ingress resource kind: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; any other value (`nginx`, `f5`, `haproxy`, ...) renders a standard `Ingress`. Leave empty to infer it from `ingressClass`. Set explicitly for atypical class names (e.g. `nginx-new`) or a Traefik-named alias served by a standard controller. | +| ingress.controller | | | Selects the ingress resource kind: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; any other value (`nginx`, `f5`, `haproxy`, ...) renders a standard `Ingress`. Leave empty to infer it from `ingressClass`. Set explicitly for atypical class names (e.g. `nginx-new`). | | ingress.ingressClass | traefik | Yes | Free-form class name written to the standard `Ingress` `spec.ingressClassName` (eg. nginx, traefik, nginx-new, etc). When `controller` is empty it also drives the inference. Unused by the Traefik `IngressRoute` and by OpenShift `Route`s. | | ingress.ingress_annotations | `{ "nginx.ingress.kubernetes.io/proxy-body-size": "5m" }` | | Ingress controllers comes with various configuration options which can be passed as annotations. Setting this value lets you change the default value to user required. | | ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute` binds to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `['websecure','web']`. Ignored unless the controller resolves to `traefik` | diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 070c686c..7287bb05 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -47,7 +47,7 @@ ingress: # Leave empty to infer it from ingressClass: a value starting with 'traefik' # means Traefik, exactly 'openshift' means Routes, everything else means a # standard Ingress. Set it explicitly when your class name is atypical - # (e.g. 'nginx-new', or a Traefik-named alias served by a standard Ingress). + # (e.g. 'nginx-new'). controller: '' # ingressClass is the free-form class name written to the standard Ingress' # spec.ingressClassName. It no longer constrains which template renders (use From d85f24ce97244c90fd7dd1f5b7c7087c0a579277 Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Tue, 23 Jun 2026 14:45:27 +0530 Subject: [PATCH 3/7] fix(plane-enterprise): align Middleware gate + expose controller in questions.yml - traefik-middleware.yaml: gate on plane.ingressController (matching ingress-traefik.yaml, licenseDomain condition included) instead of hasPrefix on ingressClass. Prevents a missing Middleware (and route admission failure) when controller=traefik with a non-traefik ingressClass, and avoids an orphan Middleware in the reverse case or when licenseDomain is unset. - questions.yml: add ingress.controller so the Rancher form can reach the new value, describe what ingressClass now does, and default ingress.ingressClass to "traefik" to match values.yaml (the authoritative chart default). Co-Authored-By: Claude Opus 5 (1M context) --- charts/plane-enterprise/questions.yml | 11 +++++++++-- .../templates/traefik-middleware.yaml | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/charts/plane-enterprise/questions.yml b/charts/plane-enterprise/questions.yml index 26597591..0dae5199 100644 --- a/charts/plane-enterprise/questions.yml +++ b/charts/plane-enterprise/questions.yml @@ -1714,11 +1714,18 @@ questions: type: string default: "" show_if: "services.rabbitmq.local_setup=true" + - variable: ingress.controller + label: "Ingress Controller Type" + description: "Which kind of ingress resource to render: 'traefik' a Traefik IngressRoute, 'openshift' one OpenShift Route per path, anything else ('nginx', 'f5', 'haproxy', ...) a standard networking.k8s.io/v1 Ingress. Leave empty to infer it from the Ingress Classname below. Set it explicitly when your class name is atypical, e.g. 'nginx-new'." + type: string + default: "" + show_if: "ingress.enabled=true" - variable: ingress.ingressClass label: "Ingress Classname" + description: "Class name written to the standard Ingress' spec.ingressClassName. Unused by the Traefik IngressRoute and by OpenShift Routes. When the Ingress Controller Type above is empty this also selects which template renders." type: string required: true - default: "nginx" + default: "traefik" show_if: "ingress.enabled=true" - variable: ssl.createIssuer @@ -1773,7 +1780,7 @@ questions: - variable: ingress.traefik.entryPoints label: "Traefik Entrypoints Override" - description: "Traefik entrypoints the IngressRoute binds to, e.g. 'websecure'. Leave empty to derive from the SSL settings (websecure when this chart manages a certificate, otherwise web). Required as 'websecure' when TLS is terminated by Traefik's own entrypoint. Ignored unless the ingress class is traefik." + description: "Traefik entrypoints the IngressRoute binds to, e.g. 'websecure'. Leave empty to derive from the SSL settings (websecure when this chart manages a certificate, otherwise web). Required as 'websecure' when TLS is terminated by Traefik's own entrypoint. Ignored unless the controller resolves to traefik." type: string default: "" group: "Ingress" diff --git a/charts/plane-enterprise/templates/traefik-middleware.yaml b/charts/plane-enterprise/templates/traefik-middleware.yaml index faaaae0d..b46ea55d 100644 --- a/charts/plane-enterprise/templates/traefik-middleware.yaml +++ b/charts/plane-enterprise/templates/traefik-middleware.yaml @@ -1,4 +1,4 @@ -{{- if and .Values.ingress.enabled (hasPrefix "traefik" .Values.ingress.ingressClass) }} +{{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "traefik") .Values.license.licenseDomain }} apiVersion: traefik.io/v1alpha1 kind: Middleware metadata: From 943134f90032a8d80a5aa5ae94bcb1d7984591f4 Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Mon, 31 Aug 2026 12:46:35 +0530 Subject: [PATCH 4/7] fix(plane-enterprise): make the widened Ingress fallback opt-in An upgrade-safety review of 3.5.2 -> 3.5.5 found the one case where this branch was not inert. With ingress.controller empty, the widened fallback in ingress.yaml rendered a -ingress for any class outside {traefik*, nginx, openshift} -- alb, contour, istio, gce, nginx-new, openshift-default, a custom IngressClass name, an empty string. Those operators get no ingress from 3.5.2 and therefore run one of their own, so on upgrade they would get a second Ingress for the same host (a second ALB on the AWS LB controller), or a failed upgrade if theirs is already named -ingress and Helm refuses to adopt it. The fallback is now reached only when an operator sets ingress.controller. With it empty the helper reproduces the pre-3.5.5 selection exactly, including its case sensitivity, so every existing values file renders byte-for-byte what it did before. The F5/nginx-new case the ticket asked for still works via ingress.controller. Also reverts the questions.yml ingress.ingressClass default to "nginx". Defaulting the Rancher form to "traefik" would fail a new install on any cluster without the Traefik CRDs; upgrades keep their stored answer either way, so the change bought consistency with values.yaml at the cost of new form installs. Verified: rendered output is identical to 3.5.2 across 22 ingressClass values plus ingress.enabled=false, an empty licenseDomain, and examples/values-openshift.yaml. Co-Authored-By: Claude Opus 5 (1M context) --- charts/plane-enterprise/README.md | 49 +++++++++++++------ .../examples/values-openshift.yaml | 2 + charts/plane-enterprise/questions.yml | 6 +-- .../plane-enterprise/templates/_helpers.tpl | 37 +++++++++----- .../plane-enterprise/templates/ingress.yaml | 8 +-- charts/plane-enterprise/values.yaml | 21 ++++---- 6 files changed, 80 insertions(+), 43 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 68a57d27..babb809b 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -28,8 +28,9 @@ If you plan to use Traefik as your ingress controller, install it before deployi ## Migrating the Ingress Controller The chart renders one of three ingress templates. **Which one** is chosen by the -*controller type* — kept separate from the *class name*, so atypical class names -(e.g. `nginx-new`) work without changing template selection. +*controller type* — kept separate from the *class name*, so a class name your +controller happens to use (e.g. `nginx-new`, `alb`) no longer has to double as the +template selector. `ingress.controller` selects the resource kind: @@ -48,15 +49,33 @@ The chart renders one of three ingress templates. **Which one** is chosen by the > OpenShift equivalent; HAProxy Routes cannot cap request bodies. Enforce upload > limits in the application or at a WAF/CDN in front of the router. -If `ingress.controller` is left empty, the controller is **inferred** from -`ingress.ingressClass` for backward compatibility: a value starting with `traefik` -selects Traefik, exactly `openshift` selects Routes, anything else selects the -standard `Ingress`. Set `ingress.controller` explicitly to use a non-`nginx` class -name like `nginx-new` (which previously rendered nothing at all, silently). +#### If you leave `ingress.controller` empty -The default is a Traefik `IngressRoute` (`ingressClass: traefik`, controller -auto-detected). If you are switching to a standard ingress controller, follow the -migration steps below. +The selection falls back to `ingress.ingressClass`, and is **exactly** what it was +before this value existed: + +| `ingressClass` with no `controller` | Renders | +| --------------------------------------- | ---------------------------- | +| `traefik`, or anything starting with it | Traefik `IngressRoute` | +| `openshift` | OpenShift `Route`s | +| `nginx` | Standard `Ingress` | +| **anything else** | **nothing at all, silently** | + +> ⚠️ **`alb`, `contour`, `istio`, `gce`, `nginx-new`, `openshift-default`, a custom +> `IngressClass` name, an empty string — all render no ingress** while +> `ingress.controller` is empty. `helm install` succeeds and nothing is reachable. +> **Set `ingress.controller`** (to `nginx`, or any label you like) to get a standard +> `Ingress` carrying your class name. + +This no-op is kept on purpose rather than widened: an operator on such a class today +gets no ingress from the chart and will have their own in place, so making the +fallback render one would create a second, conflicting `-ingress` on +upgrade — or fail the upgrade outright if theirs shares that name. Opting in via +`ingress.controller` keeps upgrades inert until you ask for the change. + +The default is a Traefik `IngressRoute` (`ingressClass: traefik`, no `controller`). +If you are switching to a standard ingress controller, follow the migration steps +below. ### Switching from Traefik to a standard Ingress controller (e.g. nginx) @@ -111,8 +130,8 @@ migration steps below. | Value | Default | Effect | | ------------------------------------- | ---------- | ----------------------------------------------------------------------------------------- | | `ingress.enabled` | `true` | Master switch — set to `false` to render no ingress at all. | -| `ingress.controller` | `''` | Selects the resource kind: `traefik` → IngressRoute, `openshift` → Routes, anything else → standard `Ingress`. Empty = infer from `ingressClass`. | -| `ingress.ingressClass` | `traefik` | Free-form `spec.ingressClassName` on the standard `Ingress`. Also drives the inference when `controller` is empty. Unused by Traefik and OpenShift. | +| `ingress.controller` | `''` | Selects the resource kind: `traefik` → IngressRoute, `openshift` → Routes, anything else → standard `Ingress` with your class name. Empty = legacy selection from `ingressClass`, where only `nginx`/`openshift`/`traefik*` render anything. | +| `ingress.ingressClass` | `traefik` | Free-form `spec.ingressClassName` on the standard `Ingress`. Also drives the legacy selection while `controller` is empty. Unused by Traefik and OpenShift. | | `ingress.traefik.maxRequestBodyBytes` | `20971520` | Max request body size for Traefik's buffering middleware. Ignored when not using Traefik. | | `ingress.traefik.entryPoints` | `[]` | Traefik entrypoints for the `IngressRoute`. Empty means derive from your SSL settings — see below. Ignored when not using Traefik. | | `ingress.ingress_annotations` | `{}` | Standard `Ingress` annotations (e.g. cert-manager). Rendered only on the standard `Ingress`; the `openshift` path uses `ingress.openshift.route_annotations` and Traefik ignores them. | @@ -390,7 +409,7 @@ ingress: - `planeVersion: v3.1.4 ` - `license.licenseDomain: ` - `ingress.enabled: ` - - `ingress.controller: ` + - `ingress.controller: ` - `ingress.ingressClass: ` - `env.storageClass: ` @@ -1161,8 +1180,8 @@ Note: When the email service is enabled, the cert-issuer will be automatically c | ingress.enabled | true | | Ingress setup in kubernetes is a common practice to expose application to the intended audience. Set it to `false` if you are using external ingress providers like `Cloudflare` | | ingress.minioHost | | | Based on above configuration, if you want to expose the `minio` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | | ingress.rabbitmqHost | | | Based on above configuration, if you want to expose the `rabbitmq` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | -| ingress.controller | | | Selects the ingress resource kind: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; any other value (`nginx`, `f5`, `haproxy`, ...) renders a standard `Ingress`. Leave empty to infer it from `ingressClass`. Set explicitly for atypical class names (e.g. `nginx-new`). | -| ingress.ingressClass | traefik | Yes | Free-form class name written to the standard `Ingress` `spec.ingressClassName` (eg. nginx, traefik, nginx-new, etc). When `controller` is empty it also drives the inference. Unused by the Traefik `IngressRoute` and by OpenShift `Route`s. | +| ingress.controller | | | Selects the ingress resource kind: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; any other value (`nginx`, `f5`, `haproxy`, ...) renders a standard `Ingress` using `ingressClass` verbatim. **Required when your class is not exactly `nginx`, `openshift` or `traefik*`** — left empty, any other class renders no ingress at all. | +| ingress.ingressClass | traefik | Yes | Free-form class name written to the standard `Ingress` `spec.ingressClassName` (eg. nginx, traefik, nginx-new, etc). While `controller` is empty it also selects the template, and only `nginx`, `openshift` and `traefik*` are recognised. Unused by the Traefik `IngressRoute` and by OpenShift `Route`s. | | ingress.ingress_annotations | `{ "nginx.ingress.kubernetes.io/proxy-body-size": "5m" }` | | Ingress controllers comes with various configuration options which can be passed as annotations. Setting this value lets you change the default value to user required. | | ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute` binds to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `['websecure','web']`. Ignored unless the controller resolves to `traefik` | | ingress.traefik.maxRequestBodyBytes | 20971520 | | Max request body size in bytes for Traefik's buffering middleware (upload size limit). Ignored unless the controller resolves to `traefik` | diff --git a/charts/plane-enterprise/examples/values-openshift.yaml b/charts/plane-enterprise/examples/values-openshift.yaml index 85df844f..26a25f30 100644 --- a/charts/plane-enterprise/examples/values-openshift.yaml +++ b/charts/plane-enterprise/examples/values-openshift.yaml @@ -72,6 +72,8 @@ services: # the HAProxy timeout set explicitly. To let OpenShift's ingress-to-route # controller convert a plain Ingress instead, set controller: 'nginx' with # ingressClass: 'openshift-default' — the timeout below is then not applied. +# Note controller must be set for that: with it empty, 'openshift-default' +# renders no ingress at all. ingress: enabled: true controller: 'openshift' diff --git a/charts/plane-enterprise/questions.yml b/charts/plane-enterprise/questions.yml index 0dae5199..e4a2fefa 100644 --- a/charts/plane-enterprise/questions.yml +++ b/charts/plane-enterprise/questions.yml @@ -1716,16 +1716,16 @@ questions: show_if: "services.rabbitmq.local_setup=true" - variable: ingress.controller label: "Ingress Controller Type" - description: "Which kind of ingress resource to render: 'traefik' a Traefik IngressRoute, 'openshift' one OpenShift Route per path, anything else ('nginx', 'f5', 'haproxy', ...) a standard networking.k8s.io/v1 Ingress. Leave empty to infer it from the Ingress Classname below. Set it explicitly when your class name is atypical, e.g. 'nginx-new'." + description: "Which kind of ingress resource to render: 'traefik' a Traefik IngressRoute, 'openshift' one OpenShift Route per path, anything else ('nginx', 'f5', 'haproxy', 'alb', ...) a standard networking.k8s.io/v1 Ingress using the Ingress Classname below verbatim. REQUIRED when your class name is not exactly 'nginx', 'openshift' or 'traefik*' - left empty, any other class renders no ingress at all." type: string default: "" show_if: "ingress.enabled=true" - variable: ingress.ingressClass label: "Ingress Classname" - description: "Class name written to the standard Ingress' spec.ingressClassName. Unused by the Traefik IngressRoute and by OpenShift Routes. When the Ingress Controller Type above is empty this also selects which template renders." + description: "Class name written to the standard Ingress' spec.ingressClassName. Unused by the Traefik IngressRoute and by OpenShift Routes. While Ingress Controller Type above is empty this also selects which template renders, and only 'nginx', 'openshift' and 'traefik*' are recognised." type: string required: true - default: "traefik" + default: "nginx" show_if: "ingress.enabled=true" - variable: ssl.createIssuer diff --git a/charts/plane-enterprise/templates/_helpers.tpl b/charts/plane-enterprise/templates/_helpers.tpl index 4fdde7a2..d827c9eb 100644 --- a/charts/plane-enterprise/templates/_helpers.tpl +++ b/charts/plane-enterprise/templates/_helpers.tpl @@ -101,22 +101,33 @@ of the local_setup flag's value. {{/* Selects which ingress template renders, decoupling the controller *type* (which resource kind to emit) from the ingress *class name* (a free-form string). -Returns "traefik" (IngressRoute), "openshift" (Route per path), or "ingress" -(networking.k8s.io/v1 Ingress -- nginx, F5 NGINX, HAProxy, ALB, anything else). - -ingress.controller decides when set; otherwise the value is inferred from -ingress.ingressClass, which is the pre-existing behaviour. Set controller to -override that inference -- an atypical class name such as "nginx-new", or a -Traefik-named class that should still be served by a standard Ingress. +Returns "traefik" (IngressRoute), "openshift" (Route per path), "ingress" +(networking.k8s.io/v1 Ingress) or "none" (render nothing). + +ingress.controller decides when set: "traefik*" -> traefik, "openshift" -> +openshift, anything else -> a standard Ingress, whatever the class name is. + +When ingress.controller is EMPTY the selection is the pre-3.5.5 one, exactly: +only "traefik*", "openshift" and "nginx" are recognised and any other class +returns "none", rendering no ingress. That silent no-op is kept deliberately -- +widening it would make an upgrade create a -ingress for operators who +are on such a class today and already run an ingress of their own. Set +ingress.controller to opt into the standard Ingress for any class name. */}} {{- define "plane.ingressController" -}} {{- $c := .Values.ingress.controller | default "" | trim | lower -}} - {{- if not $c -}} - {{- $c = .Values.ingress.ingressClass | default "" | trim | lower -}} - {{- end -}} - {{- if hasPrefix "traefik" $c -}}traefik - {{- else if eq $c "openshift" -}}openshift - {{- else -}}ingress + {{- if $c -}} + {{- if hasPrefix "traefik" $c -}}traefik + {{- else if eq $c "openshift" -}}openshift + {{- else -}}ingress + {{- end -}} + {{- else -}} + {{- $k := .Values.ingress.ingressClass | default "" -}} + {{- if hasPrefix "traefik" $k -}}traefik + {{- else if eq $k "openshift" -}}openshift + {{- else if eq $k "nginx" -}}ingress + {{- else -}}none + {{- end -}} {{- end -}} {{- end -}} diff --git a/charts/plane-enterprise/templates/ingress.yaml b/charts/plane-enterprise/templates/ingress.yaml index 9423d5e2..4ade57e2 100644 --- a/charts/plane-enterprise/templates/ingress.yaml +++ b/charts/plane-enterprise/templates/ingress.yaml @@ -1,7 +1,9 @@ {{/* -Standard networking.k8s.io/v1 Ingress -- the fallback for every controller that -is not Traefik or OpenShift. Which of the three ingress templates renders is -decided by the "plane.ingressController" helper, not by ingressClass directly. +Standard networking.k8s.io/v1 Ingress. Which of the three ingress templates +renders is decided by the "plane.ingressController" helper, not by ingressClass +directly. This one covers every controller that is not Traefik or OpenShift, but +only once ingress.controller is set -- with it empty the helper still recognises +"nginx" alone, so an unrecognised class renders nothing (see the helper). */}} {{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "ingress") .Values.license.licenseDomain }} diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 7287bb05..1aa4b23f 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -39,20 +39,23 @@ ingress: minioHost: '' rabbitmqHost: '' # controller selects WHICH KIND of ingress resource is rendered, decoupled from - # the class name below. Recognised values: + # the class name below. When set: # 'traefik' -> Traefik IngressRoute CRD (templates/ingress-traefik.yaml) # 'openshift' -> one OpenShift Route per path (templates/ingress-openshift.yaml) # anything else ('nginx', 'f5', 'haproxy', 'alb', ...) - # -> networking.k8s.io/v1 Ingress (templates/ingress.yaml) - # Leave empty to infer it from ingressClass: a value starting with 'traefik' - # means Traefik, exactly 'openshift' means Routes, everything else means a - # standard Ingress. Set it explicitly when your class name is atypical - # (e.g. 'nginx-new'). + # -> networking.k8s.io/v1 Ingress (templates/ingress.yaml), with + # ingressClass below used verbatim as spec.ingressClassName. + # Leave it empty and the legacy selection applies, unchanged: only a class of + # 'traefik*', 'openshift' or 'nginx' renders anything, and ANY OTHER class + # renders no ingress at all, silently. That is kept so upgrades never create an + # ingress where the chart previously created none. + # => Set controller whenever your class is not exactly 'nginx'/'traefik*'/ + # 'openshift' -- e.g. 'nginx-new', 'alb', 'contour', 'istio', 'gce'. controller: '' # ingressClass is the free-form class name written to the standard Ingress' - # spec.ingressClassName. It no longer constrains which template renders (use - # controller above for that). Unused on the traefik and openshift paths, since - # neither an IngressRoute nor a Route carries a class name. + # spec.ingressClassName. Unused on the traefik and openshift paths, since + # neither an IngressRoute nor a Route carries a class name. It also drives the + # legacy selection above while controller is empty. ingressClass: 'traefik' # Annotations for the standard Ingress — e.g. to set the proxy body size limit # on the nginx controller. Rendered onto the standard Ingress only; they have no From 38830d6b20fb868ff71c25fae66e6f0ff7d518e9 Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Mon, 31 Aug 2026 13:00:38 +0530 Subject: [PATCH 5/7] docs(plane-enterprise): add a values snippet for every ingress configuration Ten copy-pasteable `ingress` blocks, split by whether they need the new ingress.controller value: - Already supported, controller omitted: Traefik IngressRoute (the default), standard Ingress on ingress-nginx, OpenShift Routes, and ingress.enabled false for bring-your-own. - Newly possible with controller set: a class name that is not "nginx" (F5 NGINX, a second ingress-nginx install), AWS ALB, Contour/HAProxy/ Kong/Istio/Cilium/GCE, Traefik behind a non-traefik class name, OpenShift Routes behind a non-openshift class name, and OpenShift's ingress-to-route conversion. Each snippet states what it renders and carries the annotations that controller actually needs. All ten were rendered with `helm template` and the output checked against the documented result, annotations included. Co-Authored-By: Claude Opus 5 (1M context) --- charts/plane-enterprise/README.md | 158 ++++++++++++++++++++++++++++++ 1 file changed, 158 insertions(+) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index babb809b..9359b58a 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -77,6 +77,164 @@ The default is a Traefik `IngressRoute` (`ingressClass: traefik`, no `controller If you are switching to a standard ingress controller, follow the migration steps below. +### Configuration snippets + +Every snippet below is the `ingress` block of your `values.yaml`. All of them also +need `license.licenseDomain` set — no ingress of any kind renders without it: + +```yaml +license: + licenseDomain: plane.example.com +``` + +#### Already supported — no `ingress.controller` needed + +These four worked before `ingress.controller` existed and are unchanged. Leave +`controller` out entirely. + +**1. Traefik `IngressRoute` — the chart default** + +```yaml +ingress: + enabled: true + ingressClass: 'traefik' + traefik: + maxRequestBodyBytes: 20971520 # 20 MiB upload cap + entryPoints: [] # empty = derive from your ssl.* settings +``` + +Renders `IngressRoute` + `Middleware`. Requires the Traefik CRDs. Any class +starting with `traefik` works here (`traefik-v2`, `traefikee`, ...). + +**2. Standard `Ingress` with ingress-nginx** + +```yaml +ingress: + enabled: true + ingressClass: 'nginx' + ingress_annotations: + nginx.ingress.kubernetes.io/proxy-body-size: '20m' + nginx.ingress.kubernetes.io/proxy-buffer-size: '16k' # avoids 502 "too big header" +``` + +Renders one `Ingress` with `ingressClassName: nginx`. The class must be exactly +`nginx` for this to work without `controller`. + +**3. OpenShift `Route`s** + +```yaml +ingress: + enabled: true + ingressClass: 'openshift' + openshift: + timeout: '300s' # router default is 30s and severs /live/ WebSockets + termination: 'edge' # edge | reencrypt (passthrough cannot do path routing) + insecureEdgeTerminationPolicy: 'Redirect' +``` + +Renders one `Route` per path. See [`examples/values-openshift.yaml`](examples/values-openshift.yaml) +for a complete OpenShift values file. + +**4. No chart-managed ingress — bring your own** + +```yaml +ingress: + enabled: false +``` + +Renders nothing at all. Use this when you expose Plane through your own `Ingress`, +`HTTPRoute`, `LoadBalancer` Service, Cloudflare Tunnel or service mesh. This is the +right setting if you are managing the ingress yourself — do not rely on an +unrecognised `ingressClass` to suppress it. + +#### Newly possible — set `ingress.controller` + +Each of these rendered **no ingress at all** before this change. `controller` picks +the resource kind; `ingressClass` is then used verbatim as `spec.ingressClassName`. + +**5. Standard `Ingress` with a class name that is not `nginx`** — e.g. F5 NGINX, or a +second ingress-nginx install using a custom `IngressClass` + +```yaml +ingress: + enabled: true + controller: 'nginx' # any value but traefik*/openshift selects the Ingress + ingressClass: 'nginx-new' # whatever your controller actually exposes + ingress_annotations: + nginx.ingress.kubernetes.io/proxy-body-size: '20m' +``` + +Renders one `Ingress` with `ingressClassName: nginx-new`. + +**6. AWS Load Balancer Controller (ALB)** + +```yaml +ingress: + enabled: true + controller: 'alb' + ingressClass: 'alb' + ingress_annotations: + alb.ingress.kubernetes.io/scheme: internet-facing + alb.ingress.kubernetes.io/target-type: ip + alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' + alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:111122223333:certificate/abc + alb.ingress.kubernetes.io/group.name: plane # keep one ALB across Ingresses +``` + +Renders one `Ingress` with `ingressClassName: alb`. Set `ssl.externalTermination: true` +so Plane's URLs are `https://` while the ALB holds the certificate. + +**7. Contour, HAProxy, Kong, Istio, Cilium, GCE, or any other controller** + +```yaml +ingress: + enabled: true + controller: 'contour' # label only — not written into any manifest + ingressClass: 'contour' # the class your controller watches +``` + +Renders one `Ingress` with `ingressClassName: contour`. Substitute your own class +(`haproxy`, `kong`, `istio`, `cilium`, `gce`, `webapprouting.kubernetes.azure.com`, ...) +and add that controller's annotations under `ingress_annotations`. + +**8. Traefik `IngressRoute` with a class name that is not `traefik*`** + +```yaml +ingress: + enabled: true + controller: 'traefik' + ingressClass: 'internal-lb' # unused by the IngressRoute; kept for your own bookkeeping +``` + +Renders `IngressRoute` + `Middleware`. Useful when your platform's naming convention +does not allow a class called `traefik`. + +**9. OpenShift `Route`s with a class name that is not `openshift`** + +```yaml +ingress: + enabled: true + controller: 'openshift' + ingressClass: 'ocp-internal' # unused by Routes + openshift: + timeout: '300s' +``` + +Renders one `Route` per path. + +**10. OpenShift, letting the ingress-to-route controller convert a plain `Ingress`** + +```yaml +ingress: + enabled: true + controller: 'nginx' # emit a standard Ingress... + ingressClass: 'openshift-default' # ...for OpenShift's router to convert +``` + +Renders one `Ingress` with `ingressClassName: openshift-default`. Note this path gets +**no** per-route HAProxy timeout, so `/live/` WebSockets are subject to the router's +30s default — prefer snippet 3 or 9 unless you specifically need the conversion. + ### Switching from Traefik to a standard Ingress controller (e.g. nginx) 1. **Install your target ingress controller** if it is not already running. From a49f0ca8ff018e6a648445eba8e982bb0e5c1a5e Mon Sep 17 00:00:00 2001 From: Pratapa Lakshmi Date: Mon, 31 Aug 2026 13:15:08 +0530 Subject: [PATCH 6/7] refactor(plane-enterprise): rename ingress.yaml to ingress-nginx.yaml Names the standard-Ingress template after the controller it is for, matching ingress-traefik.yaml and ingress-openshift.yaml, and scopes the docs to the three supported configurations: nginx, Traefik and OpenShift. - templates/ingress.yaml -> templates/ingress-nginx.yaml. Template filenames do not affect rendering; verified the output is unchanged. - README: drop the AWS ALB and Contour/HAProxy/Kong/Istio/Cilium/GCE snippets and renumber the rest, so only nginx/Traefik/OpenShift are documented. The remaining eight snippets were re-extracted from the committed README and re-rendered. - README/values.yaml/questions.yml: stop listing third-party controllers as ingress.controller options. The "any other value" behaviour is still documented, because that is what serves a non-"nginx" class name such as nginx-new, but it is no longer presented as a supported controller list. - The unrecognised-class warning is kept and reworded to "any class other than nginx, openshift or traefik*" rather than naming specific controllers, so the silent no-op stays documented. Verified: rendered output identical to 3.5.2 across 22 ingressClass values plus ingress.enabled=false, an empty licenseDomain and examples/values-openshift.yaml; resource ordering unchanged by the rename. Co-Authored-By: Claude Opus 5 (1M context) --- charts/plane-enterprise/README.md | 93 +++++++------------ charts/plane-enterprise/questions.yml | 2 +- .../plane-enterprise/templates/_helpers.tpl | 6 +- .../{ingress.yaml => ingress-nginx.yaml} | 13 ++- .../templates/ingress-openshift.yaml | 4 +- charts/plane-enterprise/values.yaml | 12 +-- 6 files changed, 54 insertions(+), 76 deletions(-) rename charts/plane-enterprise/templates/{ingress.yaml => ingress-nginx.yaml} (91%) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 9359b58a..7ff2782c 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -27,23 +27,25 @@ If you plan to use Traefik as your ingress controller, install it before deployi ## Migrating the Ingress Controller -The chart renders one of three ingress templates. **Which one** is chosen by the -*controller type* — kept separate from the *class name*, so a class name your -controller happens to use (e.g. `nginx-new`, `alb`) no longer has to double as the -template selector. +The chart renders one of three ingress templates — nginx, Traefik or OpenShift. +**Which one** is chosen by the *controller type*, kept separate from the *class +name*, so a class name your controller happens to use (e.g. `nginx-new`) no longer +has to double as the template selector. `ingress.controller` selects the resource kind: -| `ingress.controller` value | Template rendered | Resource kind | -| -------------------------------------- | ---------------------------------- | -------------------------------------------- | -| `traefik` (or starts with it) | `templates/ingress-traefik.yaml` | `traefik.io/v1alpha1 IngressRoute` | -| `openshift` | `templates/ingress-openshift.yaml` | `route.openshift.io/v1 Route` (one per path) | -| Any other value (`nginx`, `f5`, ...) | `templates/ingress.yaml` | `networking.k8s.io/v1 Ingress` | +| `ingress.controller` value | Template rendered | Resource kind | +| --------------------------------- | ---------------------------------- | -------------------------------------------- | +| `traefik` (or starts with it) | `templates/ingress-traefik.yaml` | `traefik.io/v1alpha1 IngressRoute` | +| `openshift` | `templates/ingress-openshift.yaml` | `route.openshift.io/v1 Route` (one per path) | +| `nginx` | `templates/ingress-nginx.yaml` | `networking.k8s.io/v1 Ingress` | -> The standard `Ingress` path covers **any** standard Kubernetes ingress controller — -> ingress-nginx, F5 NGINX, HAProxy, ALB, Contour, etc. The value is just a selector; -> it is not written anywhere. The actual class name comes from `ingress.ingressClass` -> (`spec.ingressClassName`), which can be any string your controller exposes. +> **nginx, Traefik and OpenShift are the supported configurations.** The value is +> only a selector and is never written into a manifest; the class name comes from +> `ingress.ingressClass` (`spec.ingressClassName`), which can be any string your +> controller exposes. Any `controller` value other than `traefik*`/`openshift` +> renders the same standard `Ingress` as `nginx` — that is how a class name like +> `nginx-new` is served — but only the three above are tested. > **No body-size limit on Routes.** `ingress.traefik.maxRequestBodyBytes` has no > OpenShift equivalent; HAProxy Routes cannot cap request bodies. Enforce upload @@ -61,11 +63,12 @@ before this value existed: | `nginx` | Standard `Ingress` | | **anything else** | **nothing at all, silently** | -> ⚠️ **`alb`, `contour`, `istio`, `gce`, `nginx-new`, `openshift-default`, a custom -> `IngressClass` name, an empty string — all render no ingress** while -> `ingress.controller` is empty. `helm install` succeeds and nothing is reachable. -> **Set `ingress.controller`** (to `nginx`, or any label you like) to get a standard -> `Ingress` carrying your class name. +> ⚠️ **Any class other than `nginx`, `openshift` or `traefik*` renders no ingress** +> while `ingress.controller` is empty — `nginx-new`, `openshift-default`, a custom +> `IngressClass` name or an empty string included. `helm install` succeeds and +> nothing is reachable. **Set `ingress.controller: nginx`** to get a standard +> `Ingress` carrying your class name, or `ingress.enabled: false` if you manage the +> ingress yourself. This no-op is kept on purpose rather than widened: an operator on such a class today gets no ingress from the chart and will have their own in place, so making the @@ -149,11 +152,12 @@ unrecognised `ingressClass` to suppress it. #### Newly possible — set `ingress.controller` -Each of these rendered **no ingress at all** before this change. `controller` picks -the resource kind; `ingressClass` is then used verbatim as `spec.ingressClassName`. +Each of these rendered **no ingress at all** before this change, because the class +name was not one of the three the chart recognised. `controller` picks the resource +kind; `ingressClass` is then used verbatim as `spec.ingressClassName`. -**5. Standard `Ingress` with a class name that is not `nginx`** — e.g. F5 NGINX, or a -second ingress-nginx install using a custom `IngressClass` +**5. Standard `Ingress` with a class name that is not `nginx`** — e.g. a second +ingress-nginx install, or an nginx build that exposes its own `IngressClass` ```yaml ingress: @@ -166,38 +170,7 @@ ingress: Renders one `Ingress` with `ingressClassName: nginx-new`. -**6. AWS Load Balancer Controller (ALB)** - -```yaml -ingress: - enabled: true - controller: 'alb' - ingressClass: 'alb' - ingress_annotations: - alb.ingress.kubernetes.io/scheme: internet-facing - alb.ingress.kubernetes.io/target-type: ip - alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' - alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:us-east-1:111122223333:certificate/abc - alb.ingress.kubernetes.io/group.name: plane # keep one ALB across Ingresses -``` - -Renders one `Ingress` with `ingressClassName: alb`. Set `ssl.externalTermination: true` -so Plane's URLs are `https://` while the ALB holds the certificate. - -**7. Contour, HAProxy, Kong, Istio, Cilium, GCE, or any other controller** - -```yaml -ingress: - enabled: true - controller: 'contour' # label only — not written into any manifest - ingressClass: 'contour' # the class your controller watches -``` - -Renders one `Ingress` with `ingressClassName: contour`. Substitute your own class -(`haproxy`, `kong`, `istio`, `cilium`, `gce`, `webapprouting.kubernetes.azure.com`, ...) -and add that controller's annotations under `ingress_annotations`. - -**8. Traefik `IngressRoute` with a class name that is not `traefik*`** +**6. Traefik `IngressRoute` with a class name that is not `traefik*`** ```yaml ingress: @@ -209,7 +182,7 @@ ingress: Renders `IngressRoute` + `Middleware`. Useful when your platform's naming convention does not allow a class called `traefik`. -**9. OpenShift `Route`s with a class name that is not `openshift`** +**7. OpenShift `Route`s with a class name that is not `openshift`** ```yaml ingress: @@ -222,7 +195,7 @@ ingress: Renders one `Route` per path. -**10. OpenShift, letting the ingress-to-route controller convert a plain `Ingress`** +**8. OpenShift, letting the ingress-to-route controller convert a plain `Ingress`** ```yaml ingress: @@ -243,7 +216,7 @@ Renders one `Ingress` with `ingressClassName: openshift-default`. Note this path ```yaml ingress: - controller: "nginx" # selects the standard Ingress template (anything but traefik/openshift) + controller: "nginx" # selects templates/ingress-nginx.yaml ingressClass: "nginx" # spec.ingressClassName — whichever class your controller exposes (e.g. "nginx-new") ``` @@ -288,7 +261,7 @@ Renders one `Ingress` with `ingressClassName: openshift-default`. Note this path | Value | Default | Effect | | ------------------------------------- | ---------- | ----------------------------------------------------------------------------------------- | | `ingress.enabled` | `true` | Master switch — set to `false` to render no ingress at all. | -| `ingress.controller` | `''` | Selects the resource kind: `traefik` → IngressRoute, `openshift` → Routes, anything else → standard `Ingress` with your class name. Empty = legacy selection from `ingressClass`, where only `nginx`/`openshift`/`traefik*` render anything. | +| `ingress.controller` | `''` | Selects the resource kind: `traefik` → IngressRoute, `openshift` → Routes, `nginx` → standard `Ingress` with your class name. Empty = legacy selection from `ingressClass`, where only `nginx`/`openshift`/`traefik*` render anything. | | `ingress.ingressClass` | `traefik` | Free-form `spec.ingressClassName` on the standard `Ingress`. Also drives the legacy selection while `controller` is empty. Unused by Traefik and OpenShift. | | `ingress.traefik.maxRequestBodyBytes` | `20971520` | Max request body size for Traefik's buffering middleware. Ignored when not using Traefik. | | `ingress.traefik.entryPoints` | `[]` | Traefik entrypoints for the `IngressRoute`. Empty means derive from your SSL settings — see below. Ignored when not using Traefik. | @@ -567,7 +540,7 @@ ingress: - `planeVersion: v3.1.4 ` - `license.licenseDomain: ` - `ingress.enabled: ` - - `ingress.controller: ` + - `ingress.controller: ` - `ingress.ingressClass: ` - `env.storageClass: ` @@ -1338,7 +1311,7 @@ Note: When the email service is enabled, the cert-issuer will be automatically c | ingress.enabled | true | | Ingress setup in kubernetes is a common practice to expose application to the intended audience. Set it to `false` if you are using external ingress providers like `Cloudflare` | | ingress.minioHost | | | Based on above configuration, if you want to expose the `minio` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | | ingress.rabbitmqHost | | | Based on above configuration, if you want to expose the `rabbitmq` web console to set of users, use this key to set the `host` mapping or leave it as `EMPTY` to not expose interface. | -| ingress.controller | | | Selects the ingress resource kind: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; any other value (`nginx`, `f5`, `haproxy`, ...) renders a standard `Ingress` using `ingressClass` verbatim. **Required when your class is not exactly `nginx`, `openshift` or `traefik*`** — left empty, any other class renders no ingress at all. | +| ingress.controller | | | Selects the ingress resource kind. Supported: `traefik` renders a Traefik `IngressRoute`; `openshift` renders one `route.openshift.io/v1 Route` per path; `nginx` renders a standard `Ingress` using `ingressClass` verbatim. **Required when your class is not exactly `nginx`, `openshift` or `traefik*`** — left empty, any other class renders no ingress at all. | | ingress.ingressClass | traefik | Yes | Free-form class name written to the standard `Ingress` `spec.ingressClassName` (eg. nginx, traefik, nginx-new, etc). While `controller` is empty it also selects the template, and only `nginx`, `openshift` and `traefik*` are recognised. Unused by the Traefik `IngressRoute` and by OpenShift `Route`s. | | ingress.ingress_annotations | `{ "nginx.ingress.kubernetes.io/proxy-body-size": "5m" }` | | Ingress controllers comes with various configuration options which can be passed as annotations. Setting this value lets you change the default value to user required. | | ingress.traefik.entryPoints | `[]` | | Traefik entrypoints the `IngressRoute` binds to. Leave empty to derive them from your `ssl.*` settings (`websecure` when TLS is configured, otherwise `web`). Set explicitly only if your Traefik renamed the default entrypoints, e.g. `['websecure','web']`. Ignored unless the controller resolves to `traefik` | diff --git a/charts/plane-enterprise/questions.yml b/charts/plane-enterprise/questions.yml index e4a2fefa..74c1238f 100644 --- a/charts/plane-enterprise/questions.yml +++ b/charts/plane-enterprise/questions.yml @@ -1716,7 +1716,7 @@ questions: show_if: "services.rabbitmq.local_setup=true" - variable: ingress.controller label: "Ingress Controller Type" - description: "Which kind of ingress resource to render: 'traefik' a Traefik IngressRoute, 'openshift' one OpenShift Route per path, anything else ('nginx', 'f5', 'haproxy', 'alb', ...) a standard networking.k8s.io/v1 Ingress using the Ingress Classname below verbatim. REQUIRED when your class name is not exactly 'nginx', 'openshift' or 'traefik*' - left empty, any other class renders no ingress at all." + description: "Which kind of ingress resource to render. Supported: 'traefik' a Traefik IngressRoute, 'openshift' one OpenShift Route per path, 'nginx' a standard networking.k8s.io/v1 Ingress using the Ingress Classname below verbatim. REQUIRED when your class name is not exactly 'nginx', 'openshift' or 'traefik*' - left empty, any other class renders no ingress at all." type: string default: "" show_if: "ingress.enabled=true" diff --git a/charts/plane-enterprise/templates/_helpers.tpl b/charts/plane-enterprise/templates/_helpers.tpl index d827c9eb..29dad75b 100644 --- a/charts/plane-enterprise/templates/_helpers.tpl +++ b/charts/plane-enterprise/templates/_helpers.tpl @@ -102,10 +102,12 @@ of the local_setup flag's value. Selects which ingress template renders, decoupling the controller *type* (which resource kind to emit) from the ingress *class name* (a free-form string). Returns "traefik" (IngressRoute), "openshift" (Route per path), "ingress" -(networking.k8s.io/v1 Ingress) or "none" (render nothing). +(networking.k8s.io/v1 Ingress, i.e. ingress-nginx) or "none" (render nothing). ingress.controller decides when set: "traefik*" -> traefik, "openshift" -> -openshift, anything else -> a standard Ingress, whatever the class name is. +openshift, anything else -> a standard Ingress, whatever the class name is. That +last case exists so a non-"nginx" class name can still be served, e.g. +controller "nginx" with ingressClass "nginx-new". When ingress.controller is EMPTY the selection is the pre-3.5.5 one, exactly: only "traefik*", "openshift" and "nginx" are recognised and any other class diff --git a/charts/plane-enterprise/templates/ingress.yaml b/charts/plane-enterprise/templates/ingress-nginx.yaml similarity index 91% rename from charts/plane-enterprise/templates/ingress.yaml rename to charts/plane-enterprise/templates/ingress-nginx.yaml index 4ade57e2..e8d91b55 100644 --- a/charts/plane-enterprise/templates/ingress.yaml +++ b/charts/plane-enterprise/templates/ingress-nginx.yaml @@ -1,9 +1,12 @@ {{/* -Standard networking.k8s.io/v1 Ingress. Which of the three ingress templates -renders is decided by the "plane.ingressController" helper, not by ingressClass -directly. This one covers every controller that is not Traefik or OpenShift, but -only once ingress.controller is set -- with it empty the helper still recognises -"nginx" alone, so an unrecognised class renders nothing (see the helper). +Standard networking.k8s.io/v1 Ingress, for ingress-nginx. Which of the three +ingress templates renders is decided by the "plane.ingressController" helper, not +by ingressClass directly. + +The resource itself is controller-agnostic, so setting ingress.controller to +something other than traefik/openshift also renders from here -- that is how a +non-"nginx" class name such as "nginx-new" is served. Only nginx, Traefik and +OpenShift are supported configurations. */}} {{- if and .Values.ingress.enabled (eq (include "plane.ingressController" .) "ingress") .Values.license.licenseDomain }} diff --git a/charts/plane-enterprise/templates/ingress-openshift.yaml b/charts/plane-enterprise/templates/ingress-openshift.yaml index 2c11074f..4d50bf0b 100644 --- a/charts/plane-enterprise/templates/ingress-openshift.yaml +++ b/charts/plane-enterprise/templates/ingress-openshift.yaml @@ -41,7 +41,7 @@ Differences from the Traefik IngressRoute this mirrors: {{- fail (printf "ingress.openshift.termination must be \"edge\" or \"reencrypt\", got %q. Path-based Routes cannot use passthrough termination; see charts/plane-enterprise/README.md." $termination) }} {{- end }} -{{/* Same path -> service mapping as templates/ingress.yaml, most specific first +{{/* Same path -> service mapping as templates/ingress-nginx.yaml, most specific first (ordering is cosmetic here, kept aligned so the two are easy to diff). */}} {{- $routes := list (dict "slug" "spaces" "path" "/spaces/" "svc" (printf "%s-space" $name) "port" 3000) @@ -65,7 +65,7 @@ Differences from the Traefik IngressRoute this mirrors: {{- $routes = append $routes (dict "slug" "web" "path" "/" "svc" (printf "%s-web" $name) "port" 3000) }} {{/* The bundled MinIO console and RabbitMQ management UI live on their own hosts, - matching templates/ingress.yaml. Both are gated on the corresponding + matching templates/ingress-nginx.yaml. Both are gated on the corresponding local_setup, so neither renders in the recommended OpenShift configuration (where the bundled datastores are off because they cannot run under an arbitrary UID) -- they are here for a cluster that grants those workloads a diff --git a/charts/plane-enterprise/values.yaml b/charts/plane-enterprise/values.yaml index 1aa4b23f..ec1f2d4b 100644 --- a/charts/plane-enterprise/values.yaml +++ b/charts/plane-enterprise/values.yaml @@ -39,18 +39,18 @@ ingress: minioHost: '' rabbitmqHost: '' # controller selects WHICH KIND of ingress resource is rendered, decoupled from - # the class name below. When set: + # the class name below. Supported: nginx, traefik and openshift. When set: # 'traefik' -> Traefik IngressRoute CRD (templates/ingress-traefik.yaml) # 'openshift' -> one OpenShift Route per path (templates/ingress-openshift.yaml) - # anything else ('nginx', 'f5', 'haproxy', 'alb', ...) - # -> networking.k8s.io/v1 Ingress (templates/ingress.yaml), with - # ingressClass below used verbatim as spec.ingressClassName. + # 'nginx' (or any other value) + # -> networking.k8s.io/v1 Ingress (templates/ingress-nginx.yaml), + # with ingressClass below used verbatim as spec.ingressClassName. # Leave it empty and the legacy selection applies, unchanged: only a class of # 'traefik*', 'openshift' or 'nginx' renders anything, and ANY OTHER class # renders no ingress at all, silently. That is kept so upgrades never create an # ingress where the chart previously created none. - # => Set controller whenever your class is not exactly 'nginx'/'traefik*'/ - # 'openshift' -- e.g. 'nginx-new', 'alb', 'contour', 'istio', 'gce'. + # => Set controller when your class name is not exactly 'nginx', 'openshift' or + # 'traefik*' -- e.g. controller 'nginx' with ingressClass 'nginx-new'. controller: '' # ingressClass is the free-form class name written to the standard Ingress' # spec.ingressClassName. Unused on the traefik and openshift paths, since From bf2a55bde6a2869cabdfacc543fa0baf4daeb8ed Mon Sep 17 00:00:00 2001 From: pratapalakshmi Date: Mon, 31 Aug 2026 13:23:54 +0530 Subject: [PATCH 7/7] fix formatting --- charts/plane-enterprise/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/plane-enterprise/README.md b/charts/plane-enterprise/README.md index 7ff2782c..4dc4a368 100644 --- a/charts/plane-enterprise/README.md +++ b/charts/plane-enterprise/README.md @@ -123,7 +123,7 @@ ingress: Renders one `Ingress` with `ingressClassName: nginx`. The class must be exactly `nginx` for this to work without `controller`. -**3. OpenShift `Route`s** +**3. OpenShift Route's** ```yaml ingress: @@ -182,7 +182,7 @@ ingress: Renders `IngressRoute` + `Middleware`. Useful when your platform's naming convention does not allow a class called `traefik`. -**7. OpenShift `Route`s with a class name that is not `openshift`** +**7. OpenShift Route's with a class name that is not `openshift`** ```yaml ingress: