fix(gateway-api): address review findings

- Add HTTP-to-HTTPS redirect HTTPRoute for all Gateways (central and
  per-tenant) to ensure plain HTTP requests are properly redirected
- Add oidc-enabled check to keycloak HTTPRoute condition to match
  the Gateway listener condition
- Use gateway-name from cluster config instead of hardcoded value
  in central Gateway template
- Remove redundant namespace from TLSRoute metadata where it matches
  the HelmRelease install namespace (kubevirt, kubevirt-cdi)

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Kirill Ilin <stitch14@yandex.ru>

packages/apps/harbor/templates/httproute.yaml

@@ -39,6 +39,23 @@ spec:
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}-harbor-redirect-to-https
+spec:
+  parentRefs:
+  - name: {{ .Release.Name }}-harbor
+    sectionName: http
+  hostnames:
+  - {{ $harborHost | quote }}
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
   name: {{ .Release.Name }}-harbor
 spec:

packages/extra/bootbox/templates/matchbox/httproute.yaml

@@ -39,6 +39,23 @@ spec:
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
+metadata:
+  name: bootbox-redirect-to-https
+spec:
+  parentRefs:
+  - name: bootbox
+    sectionName: http
+  hostnames:
+  - {{ $bootboxHost | quote }}
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
   name: bootbox
 spec:

packages/system/bucket/templates/httproute.yaml

@@ -39,6 +39,23 @@ spec:
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
+metadata:
+  name: {{ .Values.bucketName }}-ui-redirect-to-https
+spec:
+  parentRefs:
+  - name: {{ .Values.bucketName }}-ui
+    sectionName: http
+  hostnames:
+  - {{ $bucketHost | quote }}
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
   name: {{ .Values.bucketName }}-ui
 spec:

packages/system/cozystack-gateway/templates/gateway.yaml

@@ -3,11 +3,12 @@
 {{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
 {{- $oidcEnabled := (index .Values._cluster "oidc-enabled") | default "false" }}
 {{- $hostnames := .Values._cluster.hostnames | default dict }}
+{{- $gatewayName := (index .Values._cluster "gateway-name") | default "cozystack" }}
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
-  name: cozystack
+  name: {{ $gatewayName }}
   annotations:
     cert-manager.io/cluster-issuer: {{ $clusterIssuer }}
 spec:
@@ -81,3 +82,18 @@ spec:
       namespaces:
         from: All
   {{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ $gatewayName }}-redirect-to-https
+spec:
+  parentRefs:
+  - name: {{ $gatewayName }}
+    sectionName: http
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301

packages/system/keycloak/templates/httproute.yaml

@@ -5,7 +5,9 @@
 {{- $gatewayNamespace := (index .Values._cluster "gateway-namespace") | default "cozy-gateway" }}
 {{- $keycloakHost := .Values.ingress.host | default (index $hostnames "keycloak") | default (printf "keycloak.%s" $host) }}
 
-{{- if eq $gatewayAPI "true" }}
+{{- $oidcEnabled := (index .Values._cluster "oidc-enabled") | default "false" }}
+
+{{- if and (eq $gatewayAPI "true") (eq $oidcEnabled "true") }}
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:

packages/system/kubevirt-cdi/templates/cdi-uploadproxy-tlsroute.yaml

@@ -10,7 +10,6 @@ apiVersion: gateway.networking.k8s.io/v1alpha2
 kind: TLSRoute
 metadata:
   name: cdi-uploadproxy
-  namespace: cozy-kubevirt-cdi
 spec:
   parentRefs:
   - name: {{ $gatewayName }}

packages/system/kubevirt/templates/vm-exportproxy-tlsroute.yaml

@@ -10,7 +10,6 @@ apiVersion: gateway.networking.k8s.io/v1alpha2
 kind: TLSRoute
 metadata:
   name: vm-exportproxy
-  namespace: cozy-kubevirt
 spec:
   parentRefs:
   - name: {{ $gatewayName }}

packages/system/monitoring/templates/alerta/httproute.yaml

@@ -39,6 +39,23 @@ spec:
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
+metadata:
+  name: alerta-redirect-to-https
+spec:
+  parentRefs:
+  - name: alerta
+    sectionName: http
+  hostnames:
+  - {{ $alertaHost | quote }}
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
   name: alerta
 spec:

packages/system/monitoring/templates/grafana/httproute.yaml

@@ -39,6 +39,23 @@ spec:
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
+metadata:
+  name: grafana-redirect-to-https
+spec:
+  parentRefs:
+  - name: grafana
+    sectionName: http
+  hostnames:
+  - {{ $grafanaHost | quote }}
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
 metadata:
   name: grafana
 spec: