From 8f82a4114da474d409fea5452b1312009a0d70cd Mon Sep 17 00:00:00 2001 From: wtripp180901 Date: Tue, 14 Jul 2026 13:38:25 +0100 Subject: [PATCH 1/3] Make Rancher HelmChartConfig config optional --- sources/envoy-gateway-config/templates/coredns-config.yaml | 4 +++- sources/envoy-gateway-config/values.yaml | 5 +++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/sources/envoy-gateway-config/templates/coredns-config.yaml b/sources/envoy-gateway-config/templates/coredns-config.yaml index 2cc2102b..8693e438 100644 --- a/sources/envoy-gateway-config/templates/coredns-config.yaml +++ b/sources/envoy-gateway-config/templates/coredns-config.yaml @@ -1,3 +1,4 @@ +{{- if .Values.rkeCoreDNS.enabled }} # CoreDNS Configuration for Wildcard Domain Routing # Copied from kgateway-config with service reference update # Makes *.domain resolve to envoy-gateway service @@ -34,4 +35,5 @@ spec: parameters: "30" - name: loop - name: reload - - name: loadbalance \ No newline at end of file + - name: loadbalance +{{- end }} \ No newline at end of file diff --git a/sources/envoy-gateway-config/values.yaml b/sources/envoy-gateway-config/values.yaml index b513a69f..04cd2ccc 100644 --- a/sources/envoy-gateway-config/values.yaml +++ b/sources/envoy-gateway-config/values.yaml @@ -27,3 +27,8 @@ aiGateway: # Stable ClusterIP `ai-gateway` (CoreDNS target / passthrough backend). dnsService: enabled: true + +# Configure RKE2 CoreDNS for Wilcdcard Domain Routing by making *.domain resolve to +# envoy-gateway service +rkeCoreDNS: + enabled: true From f0a73ae7673b68b6f04137350260062e7779385c Mon Sep 17 00:00:00 2001 From: wtripp180901 Date: Wed, 15 Jul 2026 11:15:32 +0100 Subject: [PATCH 2/3] Allow overriding cluster-bloom specific nodeSelector --- .../templates/ai-gateway-proxy-config.yaml | 4 +++- .../templates/envoy-proxy-access-logs.yaml | 4 +++- sources/envoy-gateway-config/values.yaml | 4 ++++ 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml b/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml index ec99311a..ad9d85a8 100644 --- a/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml +++ b/sources/envoy-gateway-config/templates/ai-gateway-proxy-config.yaml @@ -19,8 +19,10 @@ spec: type: ClusterIP envoyDeployment: pod: + {{- if .Values.aiGateway.nodeSelector }} nodeSelector: - cluster-bloom/first-node: "true" + {{- toYaml .Values.aiGateway.nodeSelector | nindent 12 }} + {{- end }} priorityClassName: "system-cluster-critical" telemetry: accessLog: diff --git a/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml b/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml index 8cc5166a..b18debe6 100644 --- a/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml +++ b/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml @@ -18,8 +18,10 @@ spec: type: {{ .Values.appsGateway.serviceType }} envoyDeployment: pod: + {{- if .Values.appsGateway.nodeSelector }} nodeSelector: - cluster-bloom/first-node: "true" + {{- toYaml .Values.appsGateway.nodeSelector | nindent 12 }} + {{- end }} priorityClassName: "system-cluster-critical" telemetry: accessLog: diff --git a/sources/envoy-gateway-config/values.yaml b/sources/envoy-gateway-config/values.yaml index 04cd2ccc..4368911c 100644 --- a/sources/envoy-gateway-config/values.yaml +++ b/sources/envoy-gateway-config/values.yaml @@ -8,6 +8,8 @@ ports: # on the same :443 VIP by SNI. No separate tls-passthrough gateway. appsGateway: serviceType: LoadBalancer + nodeSelector: + cluster-bloom/first-node: "true" # Stable ClusterIP `https` selecting the apps-gateway data plane, used by CoreDNS for the # *.domain rewrite (in-cluster resolution). @@ -27,6 +29,8 @@ aiGateway: # Stable ClusterIP `ai-gateway` (CoreDNS target / passthrough backend). dnsService: enabled: true + nodeSelector: + cluster-bloom/first-node: "true" # Configure RKE2 CoreDNS for Wilcdcard Domain Routing by making *.domain resolve to # envoy-gateway service From 74e409b61cb6dd39873d3ad910e31fc521d406a4 Mon Sep 17 00:00:00 2001 From: wtripp180901 Date: Wed, 15 Jul 2026 12:47:29 +0100 Subject: [PATCH 3/3] Expose option to patch EnvoyProxy --- .../templates/envoy-proxy-access-logs.yaml | 8 ++++++++ sources/envoy-gateway-config/values.yaml | 2 ++ 2 files changed, 10 insertions(+) diff --git a/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml b/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml index b18debe6..5b181ad1 100644 --- a/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml +++ b/sources/envoy-gateway-config/templates/envoy-proxy-access-logs.yaml @@ -13,6 +13,14 @@ spec: type: Kubernetes kubernetes: envoyService: + {{- if .Values.appsGateway.envoyServiceAnnotations }} + annotations: + {{- toYaml .Values.appsGateway.envoyServiceAnnotations | nindent 10 }} + {{- end }} + {{- if .Values.appsGateway.envoyServicePatch }} + patch: + {{- toYaml .Values.appsGateway.envoyServicePatch | nindent 10 }} + {{- end }} # LoadBalancer: the apps gateway is the external front door and owns the VIP on :443 # (HTTPS terminate + k8s TLS-passthrough listeners). type: {{ .Values.appsGateway.serviceType }} diff --git a/sources/envoy-gateway-config/values.yaml b/sources/envoy-gateway-config/values.yaml index 4368911c..75808ec5 100644 --- a/sources/envoy-gateway-config/values.yaml +++ b/sources/envoy-gateway-config/values.yaml @@ -10,6 +10,8 @@ appsGateway: serviceType: LoadBalancer nodeSelector: cluster-bloom/first-node: "true" + envoyServiceAnnotations: + envoyServicePatch: # Stable ClusterIP `https` selecting the apps-gateway data plane, used by CoreDNS for the # *.domain rewrite (in-cluster resolution).