Skip to content

Commit 71d9dd2

Browse files
sourcegraph-release-botmichaellzc
sourcegraph-release-bot
and
michaellzc
authored
[Backport 7.0.x] feat: add tls and hosts values override for more flexibility (#829)
Backport 73050a9 from #828 closes PLAT-443 most community charts expose the option of `.ingress.hosts` and `.ingress.tls` for ingress configuration with more flexibility. not sure why we didn't do it in the first place. this PR added these two values override that supersede `.ingress.host` and `ingress.tlsSecret` and mutually exclusive. this way it's backward compatible, and offer power user more control over ingress without reaching to `kustomize`. ### Checklist - [x] Follow the [manual testing process](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/TEST.md) - [ ] Update [changelog](https://github.com/sourcegraph/deploy-sourcegraph-helm/blob/main/charts/sourcegraph/CHANGELOG.md) - [x] Update [Kubernetes update doc](https://docs.sourcegraph.com/admin/updates/kubernetes) ### Test plan added unit test Co-authored-by: Michael Lin <mlzc@hey.com>
1 parent 4f93de2 commit 71d9dd2

7 files changed

Lines changed: 155 additions & 3 deletions

File tree

‎charts/sourcegraph/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,8 +102,10 @@ In addition to the documented values, all services also support the following va
102102
| frontend.ingress.annotations."kubernetes.io/ingress.class" | string | `"nginx"` | [Deprecated annotation](https://kubernetes.io/docs/concepts/services-networking/ingress/#deprecated-annotation) for specifing the IngressClass in Kubernetes 1.17 and earlier. If you are using Kubernetes 1.18+, use `ingressClassName` instead and set an override value of `null` for this annotation. |
103103
| frontend.ingress.enabled | bool | `true` | Enable ingress for the Sourcegraph server |
104104
| frontend.ingress.host | string | `""` | External hostname for the Sourcegraph server ingress (SSL) |
105+
| frontend.ingress.hosts | list | `[]` | List of hosts for the ingress rules. Supersedes `host` if set. Cannot be set together with `host`. Example: hosts: - host: sourcegraph.example.com |
105106
| frontend.ingress.ingressClassName | string | `nil` | IngressClassName for the Ingress (Available in Kubernetes 1.18+) If you set this field, set the annotation `frontend.ingress.annotations."kubernetes.io/ingress.class"` to `null` |
106-
| frontend.ingress.tlsSecret | string | `""` | Secret containing SSL cert |
107+
| frontend.ingress.tls | list | `[]` | Full TLS configuration for the ingress. Supersedes `tlsSecret` if set. Cannot be set together with `tlsSecret`. Omit `secretName` for controllers that manage certificates themselves (e.g. Tailscale). Example: tls: - hosts: - sourcegraph.example.com secretName: sourcegraph-tls # optional |
108+
| frontend.ingress.tlsSecret | string | `""` | Secret containing TLS cert. Cannot be set together with `tls`. |
107109
| frontend.name | string | `"sourcegraph-frontend"` | Name used by resources. Does not affect service names or PVCs. |
108110
| frontend.podSecurityContext | object | `{}` | Security context for the `frontend` pod, learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) |
109111
| frontend.privileged | bool | `true` | Enable creation of Role and RoleBinding (RBAC). Uses [view](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles) ClusterRole if set to false |

‎charts/sourcegraph/templates/frontend/sourcegraph-frontend.Ingress.yaml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,10 @@
11
{{- if .Values.frontend.ingress.enabled -}}
2+
{{- if and .Values.frontend.ingress.hosts .Values.frontend.ingress.host -}}
3+
{{- fail "frontend.ingress.hosts and frontend.ingress.host cannot both be set" -}}
4+
{{- end -}}
5+
{{- if and .Values.frontend.ingress.tls .Values.frontend.ingress.tlsSecret -}}
6+
{{- fail "frontend.ingress.tls and frontend.ingress.tlsSecret cannot both be set" -}}
7+
{{- end -}}
28
apiVersion: networking.k8s.io/v1
39
kind: Ingress
410
metadata:
@@ -15,13 +21,30 @@ metadata:
1521
{{- end }}
1622
name: {{ .Values.frontend.name }}
1723
spec:
18-
{{- if and .Values.frontend.ingress.host .Values.frontend.ingress.tlsSecret }}
24+
{{- if .Values.frontend.ingress.tls }}
25+
tls:
26+
{{- toYaml .Values.frontend.ingress.tls | nindent 4 }}
27+
{{- else if and .Values.frontend.ingress.host .Values.frontend.ingress.tlsSecret }}
1928
tls:
2029
- hosts:
2130
- {{ .Values.frontend.ingress.host }}
2231
secretName: {{ .Values.frontend.ingress.tlsSecret }}
2332
{{- end }}
2433
rules:
34+
{{- if .Values.frontend.ingress.hosts }}
35+
{{- range .Values.frontend.ingress.hosts }}
36+
- http:
37+
paths:
38+
- path: /
39+
pathType: Prefix
40+
backend:
41+
service:
42+
name: sourcegraph-frontend
43+
port:
44+
number: 30080
45+
host: {{ .host }}
46+
{{- end }}
47+
{{- else }}
2548
- http:
2649
paths:
2750
- path: /
@@ -34,6 +57,7 @@ spec:
3457
{{- if .Values.frontend.ingress.host}}
3558
host: {{ .Values.frontend.ingress.host }}
3659
{{- end }}
60+
{{- end }}
3761
{{- if .Values.frontend.ingress.ingressClassName}}
3862
ingressClassName: {{ .Values.frontend.ingress.ingressClassName }}
3963
{{- end }}

‎charts/sourcegraph/tests/frontendIngress_hosts.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
frontend:
2+
ingress:
3+
enabled: true
4+
hosts:
5+
- host: sourcegraph.example.com
6+
- host: other.example.com

‎charts/sourcegraph/tests/frontendIngress_test.yaml‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
suite: frontendIngress
2+
templates:
3+
- frontend/sourcegraph-frontend.Ingress.yaml
4+
tests:
5+
# Backward-compatible: host + tlsSecret
6+
- it: should render tls block with secretName when both host and tlsSecret are set
7+
set:
8+
frontend.ingress.enabled: true
9+
frontend.ingress.host: sourcegraph.example.com
10+
frontend.ingress.tlsSecret: sourcegraph-tls
11+
asserts:
12+
- equal:
13+
path: spec.tls[0].hosts[0]
14+
value: sourcegraph.example.com
15+
- equal:
16+
path: spec.tls[0].secretName
17+
value: sourcegraph-tls
18+
- equal:
19+
path: spec.rules[0].host
20+
value: sourcegraph.example.com
21+
22+
# Backward-compatible: host only → no tls block (use tls list for TLS without a secret)
23+
- it: should not render tls block when host is set but tlsSecret is not
24+
set:
25+
frontend.ingress.enabled: true
26+
frontend.ingress.host: sourcegraph.example.com
27+
asserts:
28+
- notExists:
29+
path: spec.tls
30+
31+
# Backward-compatible: no tls when host is not set
32+
- it: should not render tls block when host is not set
33+
set:
34+
frontend.ingress.enabled: true
35+
asserts:
36+
- notExists:
37+
path: spec.tls
38+
39+
# New: hosts list creates one rule per host
40+
- it: should render rules per host when hosts list is set
41+
values:
42+
- frontendIngress_hosts.yaml
43+
asserts:
44+
- equal:
45+
path: spec.rules[0].host
46+
value: sourcegraph.example.com
47+
- equal:
48+
path: spec.rules[1].host
49+
value: other.example.com
50+
51+
# New: tls list with secretName
52+
- it: should render tls from tls list
53+
values:
54+
- frontendIngress_tls.yaml
55+
asserts:
56+
- equal:
57+
path: spec.tls[0].hosts[0]
58+
value: sourcegraph.example.com
59+
- equal:
60+
path: spec.tls[0].secretName
61+
value: sourcegraph-tls
62+
63+
# New: tls list without secretName (e.g. Tailscale)
64+
- it: should render tls block without secretName when tls list omits secretName
65+
values:
66+
- frontendIngress_tlsNoSecret.yaml
67+
asserts:
68+
- equal:
69+
path: spec.tls[0].hosts[0]
70+
value: sourcegraph.example.com
71+
- notExists:
72+
path: spec.tls[0].secretName
73+
74+
# Error: hosts and host both set
75+
- it: should fail when both hosts and host are set
76+
values:
77+
- frontendIngress_hosts.yaml
78+
set:
79+
frontend.ingress.host: sourcegraph.example.com
80+
asserts:
81+
- failedTemplate:
82+
errorMessage: frontend.ingress.hosts and frontend.ingress.host cannot both be set
83+
84+
# Error: tls and tlsSecret both set
85+
- it: should fail when both tls and tlsSecret are set
86+
values:
87+
- frontendIngress_tls.yaml
88+
set:
89+
frontend.ingress.tlsSecret: sourcegraph-tls
90+
asserts:
91+
- failedTemplate:
92+
errorMessage: frontend.ingress.tls and frontend.ingress.tlsSecret cannot both be set

‎charts/sourcegraph/tests/frontendIngress_tls.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
frontend:
2+
ingress:
3+
enabled: true
4+
tls:
5+
- hosts:
6+
- sourcegraph.example.com
7+
secretName: sourcegraph-tls

‎charts/sourcegraph/tests/frontendIngress_tlsNoSecret.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
frontend:
2+
ingress:
3+
enabled: true
4+
tls:
5+
- hosts:
6+
- sourcegraph.example.com

‎charts/sourcegraph/values.yaml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,8 +322,23 @@ frontend:
322322
# -- IngressClassName for the Ingress (Available in Kubernetes 1.18+)
323323
# If you set this field, set the annotation `frontend.ingress.annotations."kubernetes.io/ingress.class"` to `null`
324324
ingressClassName: null
325-
# -- Secret containing SSL cert
325+
# -- Secret containing TLS cert. Cannot be set together with `tls`.
326326
tlsSecret: ""
327+
# -- List of hosts for the ingress rules. Supersedes `host` if set.
328+
# Cannot be set together with `host`.
329+
# Example:
330+
# hosts:
331+
# - host: sourcegraph.example.com
332+
hosts: []
333+
# -- Full TLS configuration for the ingress. Supersedes `tlsSecret` if set.
334+
# Cannot be set together with `tlsSecret`.
335+
# Omit `secretName` for controllers that manage certificates themselves (e.g. Tailscale).
336+
# Example:
337+
# tls:
338+
# - hosts:
339+
# - sourcegraph.example.com
340+
# secretName: sourcegraph-tls # optional
341+
tls: []
327342
# -- Security context for the `frontend` container,
328343
# learn more from the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container)
329344
containerSecurityContext:

0 commit comments

Comments
 (0)