ci: retry CI

Empty commit to retrigger E2E that hit two known flakes:
- kubernetes-previous (CSINode registration race per
  flake-kubernetes-previous-csi memory): nfs-test-pvc timed out waiting
  for condition.
- vminstance: VMI did not get IP in 20s timeout (KubeVirt flake).

Neither is related to the admission-chain or VAP changes in this PR.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>

api/apps/v1alpha1/tenant/types.go

@@ -29,6 +29,9 @@ type ConfigSpec struct {
 	// Deploy own Ingress Controller.
 	// +kubebuilder:default:=false
 	Ingress bool `json:"ingress"`
+	// Deploy own Gateway API Gateway (backed by Cilium Gateway API controller).
+	// +kubebuilder:default:=false
+	Gateway bool `json:"gateway"`
 	// Deploy own SeaweedFS.
 	// +kubebuilder:default:=false
 	Seaweedfs bool `json:"seaweedfs"`

hack/e2e-apps/gateway.bats

@@ -0,0 +1,356 @@
+#!/usr/bin/env bats
+
+@test "Gateway API CRDs are installed and the cilium GatewayClass is Accepted" {
+  # Gateway API CRDs must exist — installed by packages/system/gateway-api-crds
+  kubectl wait crd/gatewayclasses.gateway.networking.k8s.io --for=condition=Established --timeout=60s
+  kubectl wait crd/gateways.gateway.networking.k8s.io --for=condition=Established --timeout=60s
+  kubectl wait crd/httproutes.gateway.networking.k8s.io --for=condition=Established --timeout=60s
+
+  # Cilium must have registered its built-in GatewayClass once gatewayAPI.enabled
+  # is true in the cilium values. This verifies the flip in
+  # packages/system/cilium/values.yaml propagated end-to-end.
+  timeout 120 sh -ec 'until kubectl get gatewayclass cilium >/dev/null 2>&1; do sleep 2; done'
+  kubectl wait gatewayclass/cilium --for=condition=Accepted --timeout=3m
+}
+
+@test "Cilium Gateway API controller reconciles a minimal Gateway to Programmed" {
+  # Use the pre-existing tenant-test namespace created by e2e-install-cozystack.bats.
+  kubectl apply -f - <<'EOF'
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-e2e-probe
+  namespace: tenant-test
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    protocol: HTTP
+    port: 80
+    allowedRoutes:
+      namespaces:
+        from: Same
+EOF
+
+  # The controller must accept and program the Gateway.
+  kubectl -n tenant-test wait gateway/gateway-e2e-probe --for=condition=Accepted --timeout=2m
+  kubectl -n tenant-test wait gateway/gateway-e2e-probe --for=condition=Programmed --timeout=3m
+
+  # Cilium materialises a LoadBalancer Service named cilium-gateway-<gateway-name>
+  # for each programmed Gateway. Its existence is the observable proof that the
+  # full data-plane wiring kicked in.
+  kubectl -n tenant-test get svc cilium-gateway-gateway-e2e-probe
+
+  # Cleanup
+  kubectl -n tenant-test delete gateway/gateway-e2e-probe --ignore-not-found --timeout=1m
+}
+
+@test "cozystack-gateway-hostname-policy VAP and binding are installed" {
+  # Diagnose the hostname-policy enforcement path from the ground up.
+  # If these resources are missing, admission cannot reject anything.
+  kubectl get validatingadmissionpolicy cozystack-gateway-hostname-policy -o yaml
+  kubectl get validatingadmissionpolicybinding cozystack-gateway-hostname-policy -o yaml
+  # Binding MUST have validationActions: [Deny] — [Audit] / [] would let requests through silently.
+  actions=$(kubectl get validatingadmissionpolicybinding cozystack-gateway-hostname-policy -o jsonpath='{.spec.validationActions}')
+  echo "binding.validationActions=$actions"
+  case "$actions" in
+    *Deny*) ;;
+    *) echo "SETUP FAILURE: binding.validationActions lacks Deny (got '$actions')" >&2; return 1 ;;
+  esac
+}
+
+@test "tenant-test namespace carries namespace.cozystack.io/host label from tenant chart" {
+  # Diagnostic: the whole hostname-policy VAP keys off this label. If it is
+  # missing or empty, the VAP's matchCondition returns false, VAP skips, and
+  # EVERY Gateway in the namespace is admitted regardless of listener hostname.
+  # Make that bug loud instead of letting it fall through as a silent pass.
+  host_label=$(kubectl get namespace tenant-test -o jsonpath='{.metadata.labels.namespace\.cozystack\.io/host}')
+  if [ -z "$host_label" ]; then
+    echo "SETUP FAILURE: tenant-test namespace lacks namespace.cozystack.io/host label" >&2
+    kubectl get namespace tenant-test -o yaml >&2
+    return 1
+  fi
+  if [ "$host_label" != "test.example.org" ]; then
+    echo "SETUP FAILURE: tenant-test host label is '$host_label', expected 'test.example.org'" >&2
+    kubectl get namespace tenant-test -o yaml >&2
+    return 1
+  fi
+}
+
+@test "ValidatingAdmissionPolicy rejects Gateway with foreign hostname" {
+  # tenant-test namespace should only be allowed to publish its own
+  # domain suffix ('.test.example.org'); a listener hostname from the
+  # root tenant's apex must be denied by cozystack-gateway-hostname-policy.
+  # hack/cozytest.sh is /bin/sh (dash) with set -e — a failing command
+  # substitution propagates its exit status through variable assignment and
+  # kills the test. We specifically EXPECT admission to reject the apply, so
+  # use `if !` — set -e is disabled inside the if-condition, the exit status
+  # is captured, and $output is filled either way for the follow-up greps.
+  if ! output=$(kubectl apply -f - 2>&1 <<'EOF'
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: hostname-hijack-probe
+  namespace: tenant-test
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443
+    hostname: "dashboard.example.org"
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - name: noop
+    allowedRoutes:
+      namespaces:
+        from: Same
+EOF
+); then
+    # Happy path: admission rejected the Gateway. Verify the rejection came
+    # from our VAP and names the expected tenant host.
+    echo "$output" | grep -qi "ValidatingAdmissionPolicy"
+    echo "$output" | grep -q "must equal test.example.org"
+  else
+    echo "BUG: admission accepted cross-tenant hostname — Gateway 'hostname-hijack-probe' was created in tenant-test" >&2
+    echo "$output" >&2
+    return 1
+  fi
+}
+
+@test "cozystack-gateway-attached-namespaces-policy rejects Packages with tenant-* entries" {
+  # The platform Package default name is cozystack.cozystack-platform, managed by
+  # cozystack-api. Creating a dummy Package with tenant-alice in gateway.attachedNamespaces
+  # must fail at admission time.
+  if ! output=$(kubectl apply -f - 2>&1 <<'EOF'
+apiVersion: cozystack.io/v1alpha1
+kind: Package
+metadata:
+  name: vap-reject-probe
+spec:
+  variant: isp-full
+  components:
+    platform:
+      values:
+        gateway:
+          attachedNamespaces:
+          - tenant-alice
+EOF
+); then
+    echo "$output" | grep -qi "ValidatingAdmissionPolicy"
+    echo "$output" | grep -q "must not contain any tenant-"
+  else
+    echo "BUG: admission accepted tenant-* in attachedNamespaces — Package 'vap-reject-probe' was created" >&2
+    echo "$output" >&2
+    kubectl delete package vap-reject-probe --ignore-not-found
+    return 1
+  fi
+}
+
+@test "cozystack-tenant-host-policy blocks non-trusted callers from setting tenant.spec.host" {
+  # Impersonate a tenant-scoped ServiceAccount that is NOT in the trustedCaller
+  # group list. First grant RBAC to create Tenants — authorization runs BEFORE
+  # admission, so without this grant the apiserver returns a plain RBAC
+  # Forbidden and the test would fail grep-ing for 'ValidatingAdmissionPolicy'
+  # even though the VAP itself is fine.
+  kubectl apply -f - <<'EOF'
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: vap-probe-tenant-create
+  namespace: tenant-test
+rules:
+- apiGroups: ["apps.cozystack.io"]
+  resources: ["tenants"]
+  verbs: ["create","get","list","watch","update","patch","delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: vap-probe-tenant-create
+  namespace: tenant-test
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: vap-probe-tenant-create
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: tenant-test
+EOF
+  if ! output=$(kubectl --as=system:serviceaccount:tenant-test:default \
+                        --as-group=system:serviceaccounts \
+                        --as-group=system:serviceaccounts:tenant-test \
+    apply -f - 2>&1 <<'EOF'
+apiVersion: apps.cozystack.io/v1alpha1
+kind: Tenant
+metadata:
+  name: vaphostprobe
+  namespace: tenant-test
+spec:
+  host: foreign.example.org
+EOF
+); then
+    kubectl -n tenant-test delete rolebinding vap-probe-tenant-create --ignore-not-found
+    kubectl -n tenant-test delete role vap-probe-tenant-create --ignore-not-found
+    echo "$output" | grep -qi "ValidatingAdmissionPolicy"
+    echo "$output" | grep -q "spec.host can only be set"
+  else
+    kubectl -n tenant-test delete tenants.apps.cozystack.io vaphostprobe --ignore-not-found
+    kubectl -n tenant-test delete rolebinding vap-probe-tenant-create --ignore-not-found
+    kubectl -n tenant-test delete role vap-probe-tenant-create --ignore-not-found
+    echo "BUG: admission accepted tenant.spec.host from untrusted SA — Tenant 'vaphostprobe' was created" >&2
+    echo "$output" >&2
+    return 1
+  fi
+}
+
+@test "cozystack-namespace-host-label-policy blocks non-trusted callers from changing the host label" {
+  # tenant-test namespace already has namespace.cozystack.io/host set by the
+  # cozystack tenant chart. Grant patch on namespaces cluster-wide to the
+  # impersonated SA — namespaces is a cluster-scoped resource so this needs a
+  # ClusterRole. Authorization runs before admission, so without this grant
+  # the test would fail with plain RBAC Forbidden rather than a VAP rejection.
+  kubectl apply -f - <<'EOF'
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vap-probe-namespace-patch
+rules:
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get","list","watch","update","patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vap-probe-namespace-patch
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vap-probe-namespace-patch
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: tenant-test
+EOF
+  if ! output=$(kubectl --as=system:serviceaccount:tenant-test:default \
+                        --as-group=system:serviceaccounts \
+                        --as-group=system:serviceaccounts:tenant-test \
+    label namespace tenant-test \
+      namespace.cozystack.io/host=foreign.example.org --overwrite 2>&1); then
+    kubectl delete clusterrolebinding vap-probe-namespace-patch --ignore-not-found
+    kubectl delete clusterrole vap-probe-namespace-patch --ignore-not-found
+    echo "$output" | grep -qi "ValidatingAdmissionPolicy"
+    echo "$output" | grep -q "immutable"
+  else
+    # Revert label if apiserver somehow accepted the overwrite.
+    kubectl label namespace tenant-test namespace.cozystack.io/host=test.example.org --overwrite
+    kubectl delete clusterrolebinding vap-probe-namespace-patch --ignore-not-found
+    kubectl delete clusterrole vap-probe-namespace-patch --ignore-not-found
+    echo "BUG: admission accepted host label change from untrusted SA" >&2
+    echo "$output" >&2
+    return 1
+  fi
+}
+
+@test "cozystack-namespace-host-label-policy blocks non-trusted callers from setting the host label at CREATE" {
+  # Defense-in-depth: a non-trusted caller must not be able to stamp
+  # namespace.cozystack.io/host=X on a brand-new namespace either — only
+  # cozystack/Flux SAs may write the label. Authorization runs before
+  # admission, so grant cluster-wide namespace create to the impersonated SA
+  # first, otherwise the test would fail with plain RBAC Forbidden.
+  kubectl apply -f - <<'EOF'
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: vap-probe-namespace-create
+rules:
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["create","get","list","delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: vap-probe-namespace-create
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: vap-probe-namespace-create
+subjects:
+- kind: ServiceAccount
+  name: default
+  namespace: tenant-test
+EOF
+  if ! output=$(kubectl --as=system:serviceaccount:tenant-test:default \
+                        --as-group=system:serviceaccounts \
+                        --as-group=system:serviceaccounts:tenant-test \
+    apply -f - 2>&1 <<'EOF'
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vap-host-label-probe
+  labels:
+    namespace.cozystack.io/host: foreign.example.org
+EOF
+); then
+    kubectl delete clusterrolebinding vap-probe-namespace-create --ignore-not-found
+    kubectl delete clusterrole vap-probe-namespace-create --ignore-not-found
+    echo "$output" | grep -qi "ValidatingAdmissionPolicy"
+    echo "$output" | grep -q "immutable"
+  else
+    kubectl delete namespace vap-host-label-probe --ignore-not-found --wait=false
+    kubectl delete clusterrolebinding vap-probe-namespace-create --ignore-not-found
+    kubectl delete clusterrole vap-probe-namespace-create --ignore-not-found
+    echo "BUG: admission accepted first-time host label write from untrusted SA at CREATE — Namespace 'vap-host-label-probe' was created" >&2
+    echo "$output" >&2
+    return 1
+  fi
+}
+
+@test "HTTPRoute with a matching parentRef reaches Accepted status" {
+  # Put a Gateway and a route in the same namespace so allowedRoutes: Same accepts them.
+  kubectl apply -f - <<'EOF'
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-route-probe
+  namespace: tenant-test
+spec:
+  gatewayClassName: cilium
+  listeners:
+  - name: http
+    protocol: HTTP
+    port: 80
+    allowedRoutes:
+      namespaces:
+        from: Same
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httproute-probe
+  namespace: tenant-test
+spec:
+  parentRefs:
+  - name: gateway-route-probe
+    sectionName: http
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - name: kubernetes
+      namespace: default
+      port: 443
+EOF
+
+  kubectl -n tenant-test wait gateway/gateway-route-probe --for=condition=Programmed --timeout=3m
+  timeout 120 sh -ec 'until kubectl -n tenant-test get httproute httproute-probe -o jsonpath="{.status.parents[0].conditions[?(@.type==\"Accepted\")].status}" 2>/dev/null | grep -q True; do sleep 2; done'
+
+  kubectl -n tenant-test delete httproute/httproute-probe --ignore-not-found
+  kubectl -n tenant-test delete gateway/gateway-route-probe --ignore-not-found
+}

packages/apps/harbor/templates/httproute.yaml

@@ -0,0 +1,22 @@
+{{- $gateway := .Values._namespace.gateway | default "" }}
+{{- $host := .Values._namespace.host }}
+{{- $harborHost := .Values.host | default (printf "%s.%s" .Release.Name $host) }}
+{{- if $gateway }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Release.Name }}
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: cozystack
+    namespace: {{ $gateway }}
+    sectionName: https
+  hostnames:
+  - {{ $harborHost | quote }}
+  rules:
+  - backendRefs:
+    - name: {{ .Release.Name }}
+      port: 80
+{{- end }}

packages/apps/harbor/templates/ingress.yaml

@@ -1,8 +1,10 @@
 {{- $ingress := .Values._namespace.ingress }}
+{{- $gateway := .Values._namespace.gateway | default "" }}
 {{- $host := .Values._namespace.host }}
 {{- $harborHost := .Values.host | default (printf "%s.%s" .Release.Name $host) }}
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
 {{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
+{{- if not $gateway }}
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -35,3 +37,4 @@ spec:
                 name: {{ .Release.Name }}
                 port:
                   number: 80
+{{- end }}

packages/apps/tenant/README.md

@@ -80,6 +80,7 @@ tenant-u1
 | `etcd`            | Deploy own Etcd cluster.                                                                                                   | `bool`                | `false` |
 | `monitoring`      | Deploy own Monitoring Stack.                                                                                               | `bool`                | `false` |
 | `ingress`         | Deploy own Ingress Controller.                                                                                             | `bool`                | `false` |
+| `gateway`         | Deploy own Gateway API Gateway (backed by Cilium Gateway API controller).                                                  | `bool`                | `false` |
 | `seaweedfs`       | Deploy own SeaweedFS.                                                                                                      | `bool`                | `false` |
 | `schedulingClass` | The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.                              | `string`              | `""`    |
 | `resourceQuotas`  | Define resource quotas for the tenant.                                                                                     | `map[string]quantity` | `{}`    |

packages/apps/tenant/templates/cilium-lb-pool.yaml

@@ -12,7 +12,11 @@
       (eq $exposeMode "loadBalancer")
       (eq $exposeIngress .Release.Namespace)
       .Values.ingress }}
-{{- if and $isPublishingIngressLB $ipsList }}
+{{- $hasOwnGateway := .Values.gateway | default false }}
+{{- if and $hasOwnGateway (not $ipsList) }}
+{{- fail "publishing.externalIPs is empty — a tenant Gateway has no CiliumLoadBalancerIPPool to draw from. The Gateway Service would stay in <pending> with no address. Set publishing.externalIPs on the platform (or publishing.exposure=loadBalancer with a BGP / L2-announce pool you manage separately) before enabling tenant.spec.gateway=true." }}
+{{- end }}
+{{- if and (or $isPublishingIngressLB $hasOwnGateway) $ipsList }}
 apiVersion: cilium.io/v2
 kind: CiliumLoadBalancerIPPool
 metadata:

packages/apps/tenant/templates/gateway.yaml

@@ -0,0 +1,32 @@
+{{- if .Values.gateway }}
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gateway
+  namespace: {{ include "tenant.name" . }}
+  labels:
+    sharding.fluxcd.io/key: tenants
+    internal.cozystack.io/tenantmodule: "true"
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/managed-by: {{ .Release.Service }}
+    apps.cozystack.io/application.kind: Gateway
+    apps.cozystack.io/application.group: apps.cozystack.io
+    apps.cozystack.io/application.name: gateway
+spec:
+  chartRef:
+    kind: ExternalArtifact
+    name: cozystack-gateway-application-default-gateway
+    namespace: cozy-system
+  interval: 5m
+  timeout: 10m
+  install:
+    remediation:
+      retries: -1
+  upgrade:
+    force: true
+    remediation:
+      retries: -1
+  valuesFrom:
+  - kind: Secret
+    name: cozystack-values
+{{- end }}

packages/apps/tenant/templates/namespace.yaml

@@ -29,6 +29,23 @@
 {{- $ingress = $tenantName }}
 {{- end }}
 
+{{/*
+  Gateway reference is NOT inherited from parent. Unlike ingress (where nginx
+  serves from the publishing namespace and any tenant can attach via the shared
+  apex), a Gateway's allowedRoutes.namespaces selector is restrictive: a child
+  tenant namespace is not on the parent Gateway's whitelist, so an HTTPRoute
+  from the child would be NotAllowedByListeners. The parent Gateway's cert also
+  only covers <apex> and *.<apex> (one level), and a child apex is
+  <name>.<parent-apex> — two levels deep — so even if admission let the route
+  through, TLS would break. Require explicit tenant.spec.gateway=true on each
+  tenant that wants Gateway-attached apps; otherwise apps fall back to the
+  inherited Ingress.
+*/}}
+{{- $gateway := "" }}
+{{- if .Values.gateway }}
+{{- $gateway = $tenantName }}
+{{- end }}
+
 {{- $monitoring := $parentNamespace.monitoring | default "" }}
 {{- if .Values.monitoring }}
 {{- $monitoring = $tenantName }}
@@ -61,6 +78,7 @@ metadata:
     {{/* Labels for network policies */}}
     namespace.cozystack.io/etcd: {{ $etcd | quote }}
     namespace.cozystack.io/ingress: {{ $ingress | quote }}
+    namespace.cozystack.io/gateway: {{ $gateway | quote }}
     namespace.cozystack.io/monitoring: {{ $monitoring | quote }}
     namespace.cozystack.io/seaweedfs: {{ $seaweedfs | quote }}
     namespace.cozystack.io/host: {{ $computedHost | quote }}
@@ -92,6 +110,7 @@ stringData:
     _namespace:
       etcd: {{ $etcd | quote }}
       ingress: {{ $ingress | quote }}
+      gateway: {{ $gateway | quote }}
       monitoring: {{ $monitoring | quote }}
       seaweedfs: {{ $seaweedfs | quote }}
       host: {{ $computedHost | quote }}

packages/apps/tenant/tests/exposure_test.yaml

@@ -139,3 +139,78 @@ tests:
     asserts:
       - hasDocuments:
           count: 0
+
+  - it: gateway=true in any tenant renders pool with namespace-only selector
+    set:
+      gateway: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.name
+          value: root-exposure
+      - equal:
+          path: spec.blocks
+          value:
+            - cidr: 192.0.2.10/32
+      - equal:
+          path: spec.serviceSelector.matchLabels["io.kubernetes.service.namespace"]
+          value: tenant-root
+
+  - it: gateway=true in a non-publishing tenant renders its own pool (not tied to publishing tenant)
+    set:
+      gateway: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+    release:
+      name: tenant-u1
+      namespace: tenant-u1
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.name
+          value: u1-exposure
+      - equal:
+          path: spec.serviceSelector.matchLabels["io.kubernetes.service.namespace"]
+          value: tenant-u1
+
+  - it: gateway=true + ingress=true + loadBalancer mode renders a single shared pool (no overlapping CIDR conflict)
+    set:
+      gateway: true
+      ingress: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        expose-mode: loadBalancer
+    asserts:
+      - hasDocuments:
+          count: 1
+      - equal:
+          path: metadata.name
+          value: root-exposure
+
+  - it: gateway=true with ingress=false still renders pool (gateway alone is enough)
+    set:
+      gateway: true
+      ingress: false
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+    asserts:
+      - hasDocuments:
+          count: 1
+
+  - it: gateway=true with empty externalIPs fails chart render with explicit message
+    set:
+      gateway: true
+      _cluster:
+        expose-ingress: tenant-root
+        expose-external-ips: ""
+    asserts:
+      - failedTemplate:
+          errorMessage: "publishing.externalIPs is empty — a tenant Gateway has no CiliumLoadBalancerIPPool to draw from. The Gateway Service would stay in <pending> with no address. Set publishing.externalIPs on the platform (or publishing.exposure=loadBalancer with a BGP / L2-announce pool you manage separately) before enabling tenant.spec.gateway=true."

packages/apps/tenant/values.schema.json

@@ -22,6 +22,11 @@
       "type": "boolean",
       "default": false
     },
+    "gateway": {
+      "description": "Deploy own Gateway API Gateway (backed by Cilium Gateway API controller).",
+      "type": "boolean",
+      "default": false
+    },
     "seaweedfs": {
       "description": "Deploy own SeaweedFS.",
       "type": "boolean",

packages/apps/tenant/values.yaml

@@ -14,6 +14,9 @@ monitoring: false
 ## @param {bool} ingress - Deploy own Ingress Controller.
 ingress: false
 
+## @param {bool} gateway - Deploy own Gateway API Gateway (backed by Cilium Gateway API controller).
+gateway: false
+
 ## @param {bool} seaweedfs - Deploy own SeaweedFS.
 seaweedfs: false
 

packages/core/platform/sources/cert-manager.yaml

@@ -13,6 +13,7 @@ spec:
   - name: default
     dependsOn:
     - cozystack.networking
+    - cozystack.gateway-api-crds
     components:
     - name: cert-manager-crds
       path: system/cert-manager-crds

packages/core/platform/sources/gateway-api-crds.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.gateway-api-crds
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+  - name: default
+    dependsOn: []
+    components:
+    - name: gateway-api-crds
+      path: system/gateway-api-crds
+      install:
+        namespace: cozy-gateway-api
+        releaseName: gateway-api-crds

packages/core/platform/sources/gateway-application.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: cozystack.io/v1alpha1
+kind: PackageSource
+metadata:
+  name: cozystack.gateway-application
+spec:
+  sourceRef:
+    kind: OCIRepository
+    name: cozystack-packages
+    namespace: cozy-system
+    path: /
+  variants:
+    - name: default
+      dependsOn:
+        - cozystack.gateway-api-crds
+        - cozystack.cert-manager
+      libraries:
+        - name: cozy-lib
+          path: library/cozy-lib
+      components:
+        - name: gateway
+          path: extra/gateway
+          libraries: ["cozy-lib"]

packages/core/platform/sources/networking.yaml

@@ -13,7 +13,8 @@ spec:
   - name: noop
     components: []
   - name: cilium
-    dependsOn: []
+    dependsOn:
+    - cozystack.gateway-api-crds
     components:
     - name: cilium
       path: system/cilium
@@ -34,7 +35,8 @@ spec:
         dependsOn:
         - cilium
   - name: cilium-kilo
-    dependsOn: []
+    dependsOn:
+    - cozystack.gateway-api-crds
     components:
     - name: cilium
       path: system/cilium
@@ -60,7 +62,8 @@ spec:
         - cilium
   # Generic Cilium variant for non-Talos clusters (kubeadm, k3s, RKE2, etc.)
   - name: cilium-generic
-    dependsOn: []
+    dependsOn:
+    - cozystack.gateway-api-crds
     components:
     - name: cilium
       path: system/cilium
@@ -81,7 +84,8 @@ spec:
         dependsOn:
         - cilium
   - name: kubeovn-cilium
-    dependsOn: []
+    dependsOn:
+    - cozystack.gateway-api-crds
     components:
     - name: cilium
       path: system/cilium
@@ -112,7 +116,8 @@ spec:
         - cilium
   # Generic KubeOVN+Cilium variant for non-Talos clusters (kubeadm, k3s, RKE2, etc.)
   - name: kubeovn-cilium-generic
-    dependsOn: []
+    dependsOn:
+    - cozystack.gateway-api-crds
     components:
     - name: cilium
       path: system/cilium

packages/core/platform/templates/apps.yaml

@@ -31,6 +31,8 @@ stringData:
       expose-ingress: {{ .Values.publishing.ingressName | quote }}
       expose-external-ips: {{ .Values.publishing.externalIPs | join "," | quote }}
       expose-mode: {{ .Values.publishing.exposure | default "externalIPs" | quote }}
+      gateway-enabled: {{ .Values.gateway.enabled | default false | quote }}
+      gateway-attached-namespaces: {{ .Values.gateway.attachedNamespaces | default (list) | join "," | quote }}
       cluster-domain: {{ .Values.networking.clusterDomain | quote }}
       api-server-endpoint: {{ .Values.publishing.apiServerEndpoint | quote }}
       {{- with .Values.branding }}

packages/core/platform/templates/bundles/system.yaml

@@ -118,6 +118,7 @@
 {{- end }}
 
 # Common Packages
+{{include "cozystack.platform.package.default" (list "cozystack.gateway-api-crds" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.cert-manager" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.flux-plunger" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.victoria-metrics-operator" $) }}
@@ -126,6 +127,7 @@
 {{- $_ := set $tenantComponents "tenant" (dict "values" $tenantClusterValues) }}
 {{include "cozystack.platform.package" (list "cozystack.tenant-application" "default" $ $tenantComponents) }}
 {{include "cozystack.platform.package.default" (list "cozystack.ingress-application" $) }}
+{{include "cozystack.platform.package.default" (list "cozystack.gateway-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.seaweedfs-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.info-application" $) }}
 {{include "cozystack.platform.package.default" (list "cozystack.monitoring-application" $) }}

packages/core/platform/values.yaml

@@ -83,6 +83,15 @@ publishing:
   certificates:
     solver: http01 # "http01" or "dns01"
     issuerName: letsencrypt-prod
+    # Rate-limit note: every tenant with gateway=true issues one
+    # Certificate for its wildcard + apex hostnames. If many tenants share
+    # the same apex domain with issuerName=letsencrypt-prod, the cluster
+    # can hit the Let's Encrypt limits (50 certs / registered domain /
+    # week, 5 duplicate certs / week, 300 new orders / account / 3h).
+    # Use letsencrypt-stage for non-production clusters or gate the
+    # number of certificates per tenant via tenant.spec.resourceQuotas
+    # with count/certificates.cert-manager.io. See
+    # https://letsencrypt.org/docs/rate-limits/.
 # Authentication configuration
 authentication:
   oidc:
@@ -94,6 +103,42 @@ authentication:
     # userinfo, logout) through this URL while keeping browser redirects on the external URL.
     # Example: http://keycloak-http.cozy-keycloak.svc:8080/realms/cozy
     keycloakInternalUrl: ""
+# Gateway API configuration
+gateway:
+  # Enable Gateway API support across the platform. When true:
+  #   - cert-manager ClusterIssuers use an http01.gatewayHTTPRoute solver
+  #     that attaches to the root tenant's Gateway, so Certificate issuance
+  #     works for tenants whose ingress is via Gateway API rather than
+  #     ingress-nginx.
+  #   - Exposed services (dashboard, keycloak, harbor, bucket, grafana,
+  #     cozystack-api, vm-exportproxy, cdi-uploadproxy) render an
+  #     HTTPRoute attached to the tenant's Gateway.
+  # Per-tenant opt-in is still governed by tenant.spec.gateway=true, which
+  # materialises the Gateway itself. This flag only controls platform-wide
+  # Gateway API integration (cert-manager solver + per-service HTTPRoutes).
+  enabled: false
+  # Namespaces that are allowed to attach HTTPRoute or TLSRoute to a tenant
+  # Gateway. The publishing tenant namespace is always included implicitly.
+  # Additional entries must be the exact namespace name (matched on the
+  # built-in kubernetes.io/metadata.name label). Tenants not on this list
+  # cannot attach a route to somebody else's Gateway, which prevents
+  # hostname hijacking across tenants.
+  #
+  # The `default` namespace is included because the Kubernetes API's
+  # TLSRoute (shipped by the cozystack-api package) has to live next to
+  # the `kubernetes` Service it points at, which is always in `default`.
+  attachedNamespaces:
+    - cozy-cert-manager
+    - cozy-dashboard
+    - cozy-keycloak
+    - cozy-system
+    - cozy-harbor
+    - cozy-bucket
+    - cozy-kubevirt
+    - cozy-kubevirt-cdi
+    - cozy-monitoring
+    - cozy-linstor-gui
+    - default
 # Pod scheduling configuration
 scheduling:
   globalAppTopologySpreadConstraints: ""

packages/extra/gateway/.helmignore

@@ -0,0 +1,2 @@
+.helmignore
+/Makefile

packages/extra/gateway/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: gateway
+description: Cozystack per-tenant Gateway API resource backed by Cilium
+type: application
+version: 0.0.0 # Placeholder, the actual version will be automatically set during the build process

packages/extra/gateway/Makefile

@@ -0,0 +1,9 @@
+NAME=gateway
+
+include ../../../hack/package.mk
+
+generate:
+	cozyvalues-gen -v values.yaml -s values.schema.json -r README.md
+
+test:
+	helm unittest .

packages/extra/gateway/README.md

@@ -0,0 +1,59 @@
+# Cozystack Tenant Gateway
+
+Per-tenant Gateway API Gateway backed by Cilium. Installed automatically when `tenant.spec.gateway=true` on the publishing tenant.
+
+## Parameters
+
+### Common parameters
+
+| Name                     | Description                                                                                                                                                                                                                                                                          | Type       | Value                                    |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- | ---------------------------------------- |
+| `gatewayClassName`       | GatewayClass to attach the tenant Gateway to. Must exist cluster-wide. Default matches the Cilium-managed class.                                                                                                                                                                     | `string`   | `cilium`                                 |
+| `tlsPassthroughServices` | Names (from publishing.exposedServices) whose traffic is TLS-passthrough rather than TLS-terminate. For each such service a dedicated HTTPS listener with tls.mode=Passthrough is rendered on the Gateway, and the service is expected to attach a TLSRoute instead of an HTTPRoute. | `[]string` | `[api, vm-exportproxy, cdi-uploadproxy]` |
+
+
+## Security model
+
+Six independent layers protect cross-tenant isolation. Compromising one of them does not bypass the others; admission-time checks (layers 2–5) fail closed (`failurePolicy: Fail`, `validationActions: [Deny]`).
+
+1. **Namespace whitelist on listeners.** The Gateway's `allowedRoutes.namespaces.from: Selector` matches the built-in `kubernetes.io/metadata.name` label (written by kube-apiserver, unspoofable). It accepts routes from the publishing tenant's namespace plus `publishing.gateway.attachedNamespaces` in the platform chart (default includes the `cozy-*` namespaces for platform services and `default` for the Kubernetes API TLSRoute). A namespace outside the list literally cannot attach any `HTTPRoute` or `TLSRoute` to this Gateway.
+2. **`cozystack-gateway-hostname-policy`** — `ValidatingAdmissionPolicy` on `gateway.networking.k8s.io/v1 Gateway` CREATE/UPDATE. Reads `namespaceObject.metadata.labels["namespace.cozystack.io/host"]` and rejects any listener hostname that is not equal to that value or a subdomain of it. `matchConditions` gate the VAP to cozystack-managed namespaces only — Gateways in unrelated namespaces (e.g. `kube-system`) are not touched.
+3. **`cozystack-gateway-attached-namespaces-policy`** — VAP on `cozystack.io/v1alpha1 Package` CREATE/UPDATE. Rejects any `tenant-*` entry in `spec.components.platform.values.gateway.attachedNamespaces`. Catches direct `kubectl edit packages.cozystack.io` that would bypass the helm render-time guard in layer 6.
+4. **`cozystack-tenant-host-policy`** — VAP on `apps.cozystack.io/v1alpha1 Tenant` CREATE/UPDATE. Rejects setting or changing `spec.host` unless the caller's groups contain `system:masters`, `system:serviceaccounts:cozy-system`, `system:serviceaccounts:cozy-cert-manager`, `system:serviceaccounts:cozy-fluxcd` or `system:serviceaccounts:kube-system`. Closes the path where a tenant user sets `spec.host=dashboard.example.org` on their own tenant to have the tenant chart write a hijacked label into the namespace.
+5. **`cozystack-namespace-host-label-policy`** — VAP on core `v1 Namespace` CREATE/UPDATE. Rejects any set or change of the `namespace.cozystack.io/host` label, except by the same trusted-caller whitelist as layer 4. This closes both first-time label writes on CREATE and first-time adds on UPDATE — only cozystack/Flux service accounts (which apply the tenant chart) can stamp the label.
+6. **Render-time `fail` in cozystack-basics.** The cozystack-basics chart fails the helm render if `_cluster.gateway-attached-namespaces` contains any `tenant-*` entry. Triggers on the helm-install path before the cluster ever sees the values — complements layer 3 which triggers at `kubectl apply` time.
+
+For `tenant-root` the allowed host suffix is `publishing.host`; for any `tenant-<name>` that inherits from its parent the suffix is `<name>.<parent apex>`. A child tenant with an independent apex (`customer1.io` instead of a subdomain) is handled correctly because the VAP reads the per-namespace label rather than assuming a subdomain hierarchy.
+
+## Rate limits
+
+cert-manager issues one `Certificate` per Gateway release. With `issuerName: letsencrypt-prod` (the default), the `Certificate` for a tenant Gateway counts against the [Let's Encrypt rate limits](https://letsencrypt.org/docs/rate-limits/):
+
+- 50 new certificates per registered domain per week.
+- 5 duplicate certificates per week for the same set of hostnames.
+- 300 new orders per account per 3 hours.
+
+A cluster where many tenants share the same apex domain can exhaust these quickly. Mitigations:
+
+- Use `publishing.certificates.issuerName: letsencrypt-stage` for non-production clusters (staging does not count against prod quotas).
+- Limit the number of simultaneous tenant Gateways per cluster via the platform's package quota, or cap it via `tenant.spec.resourceQuotas` with `count/certificates.cert-manager.io` to limit how many `Certificate` objects a tenant may create.
+- For bare-metal or air-gapped deployments consider an internal ACME server or the self-signed `ClusterIssuer` (`selfsigned-cluster-issuer`) that ships alongside the Let's Encrypt issuers.
+
+Recommended tenant-level quota to contain a misbehaving tenant:
+
+```yaml
+apiVersion: apps.cozystack.io/v1alpha1
+kind: Tenant
+spec:
+  gateway: true
+  resourceQuotas:
+    count/certificates.cert-manager.io: "10"
+```
+
+The default for a fresh tenant is unlimited; operators running shared-apex multi-tenant clusters should set this explicitly (or stage it via the tenant-application default values) before opening `gateway: true` to non-trusted tenants.
+
+## Known limitations
+
+- **Upstream application gaps** — some chart-level features (harbor ACL integrations, bucket upstream limitations) remain on ingress-nginx workflows in upstream docs; cozystack tracks those separately as upstream PRs.
+- **Supported ACME issuers** — `publishing.certificates.issuerName` for Gateway-based tenants must be `letsencrypt-prod` or `letsencrypt-stage` (the chart maps those names to concrete ACME server URLs). To support another ACME provider, extend `templates/issuer.yaml` with an additional branch.
+

packages/extra/gateway/charts/cozy-lib

@@ -0,0 +1 @@
+../../../library/cozy-lib

packages/extra/gateway/config.json

@@ -0,0 +1,23 @@
+{
+  "comments": {
+    "format": "##"
+  },
+  "tags": {
+    "param": "@param",
+    "section": "@section",
+    "descriptionStart": "@descriptionStart",
+    "descriptionEnd": "@descriptionEnd",
+    "skip": "@skip",
+    "extra": "@extra"
+  },
+  "modifiers": {
+    "array": "array",
+    "object": "object",
+    "string": "string",
+    "nullable": "nullable",
+    "default": "default"
+  },
+  "regexp": {
+    "paramsSectionTitle": "Parameters"
+  }
+}

packages/extra/gateway/templates/gateway.yaml

@@ -0,0 +1,108 @@
+{{- $host := (index .Values._namespace "host") | default "" }}
+{{- if not $host }}
+{{- fail "_namespace.host is empty — the tenant has no apex domain. Either set tenant.spec.host on this tenant or inherit it from a parent that has host set." }}
+{{- end }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: {{ trimPrefix "tenant-" .Release.Namespace }}-gateway-tls
+spec:
+  secretName: {{ trimPrefix "tenant-" .Release.Namespace }}-gateway-tls
+  issuerRef:
+    name: gateway
+    kind: Issuer
+  dnsNames:
+  - {{ $host | quote }}
+  - {{ printf "*.%s" $host | quote }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: cozystack
+  labels:
+    cozystack.io/gateway: {{ .Release.Namespace }}
+spec:
+  gatewayClassName: {{ .Values.gatewayClassName | quote }}
+  listeners:
+  {{- $extraNs := list }}
+  {{- range splitList "," ((index .Values._cluster "gateway-attached-namespaces") | default "") }}
+    {{- $ns := . | trim }}
+    {{- if $ns }}
+      {{- $extraNs = append $extraNs $ns }}
+    {{- end }}
+  {{- end }}
+  {{- $allowedNamespaces := concat (list .Release.Namespace) $extraNs | uniq }}
+  {{- $allowedNamespacesSelector := dict "matchExpressions" (list (dict
+        "key" "kubernetes.io/metadata.name"
+        "operator" "In"
+        "values" $allowedNamespaces)) }}
+  - name: http
+    protocol: HTTP
+    port: 80
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          {{- toYaml $allowedNamespacesSelector | nindent 10 }}
+  - name: https
+    protocol: HTTPS
+    port: 443
+    hostname: {{ printf "*.%s" $host | quote }}
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - name: {{ trimPrefix "tenant-" .Release.Namespace }}-gateway-tls
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          {{- toYaml $allowedNamespacesSelector | nindent 10 }}
+  - name: https-apex
+    protocol: HTTPS
+    port: 443
+    hostname: {{ $host | quote }}
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - name: {{ trimPrefix "tenant-" .Release.Namespace }}-gateway-tls
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          {{- toYaml $allowedNamespacesSelector | nindent 10 }}
+  {{- $exposedServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
+  {{- range .Values.tlsPassthroughServices }}
+    {{- $svc := . }}
+    {{- if has $svc $exposedServices }}
+  - name: {{ printf "tls-%s" $svc | quote }}
+    protocol: TLS
+    port: 443
+    hostname: {{ printf "%s.%s" $svc $host | quote }}
+    tls:
+      mode: Passthrough
+    allowedRoutes:
+      kinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+      namespaces:
+        from: Selector
+        selector:
+          {{- toYaml $allowedNamespacesSelector | nindent 10 }}
+    {{- end }}
+  {{- end }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-to-https-redirect
+spec:
+  parentRefs:
+  - name: cozystack
+    sectionName: http
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301

packages/extra/gateway/templates/issuer.yaml

@@ -0,0 +1,42 @@
+{{- $issuerName := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
+{{- $solver := (index .Values._cluster "solver") | default "http01" }}
+{{- $acmeServer := "" }}
+{{- if eq $issuerName "letsencrypt-prod" }}
+  {{- $acmeServer = "https://acme-v02.api.letsencrypt.org/directory" }}
+{{- else if eq $issuerName "letsencrypt-stage" }}
+  {{- $acmeServer = "https://acme-staging-v02.api.letsencrypt.org/directory" }}
+{{- else }}
+  {{- fail (printf "packages/extra/gateway currently supports publishing.certificates.issuerName=letsencrypt-prod or letsencrypt-stage (got %q). For other issuers, extend templates/issuer.yaml to map the name to the corresponding ACME server URL." $issuerName) }}
+{{- end }}
+{{- /*
+  Let's Encrypt refuses to issue wildcard certificates via HTTP-01 (see
+  cert-manager/cert-manager-crds/.../crd-cert-manager.io_clusterissuers.yaml
+  at the http01 field description, and LE policy
+  https://letsencrypt.org/docs/challenge-types/#http-01-challenge). The
+  tenant Gateway's Certificate requests apex + *.apex, so HTTP-01 would
+  loop the Order forever and the HTTPS listeners would never get a cert.
+  Require dns01 (or selfsigned) for Gateway API tenants — fail fast so
+  the operator sees the mismatch at install time instead of during a
+  stuck cert-manager challenge.
+*/}}
+{{- if eq $solver "http01" }}
+  {{- fail "publishing.certificates.solver=http01 cannot issue the wildcard certificate the tenant Gateway needs (Let's Encrypt refuses HTTP-01 for wildcard identifiers). Set publishing.certificates.solver=dns01 (with a Cloudflare API token Secret in cozy-cert-manager) before enabling tenant.spec.gateway=true, or use the self-signed ClusterIssuer for air-gapped clusters." }}
+{{- else if ne $solver "dns01" }}
+  {{- fail (printf "packages/extra/gateway currently supports publishing.certificates.solver=dns01 only (got %q). Extend templates/issuer.yaml to add additional solver types." $solver) }}
+{{- end }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: gateway
+spec:
+  acme:
+    server: {{ $acmeServer }}
+    privateKeySecretRef:
+      name: gateway-acme-account
+    solvers:
+    - dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token-secret
+            key: api-token

packages/extra/gateway/tests/gateway_test.yaml

@@ -0,0 +1,284 @@
+suite: tenant gateway
+templates:
+  - templates/gateway.yaml
+  - templates/issuer.yaml
+
+release:
+  name: gateway
+  namespace: tenant-root
+
+tests:
+  - it: renders Certificate, Gateway and redirect HTTPRoute when IPs and host are set
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10,192.0.2.11"
+        issuer-name: letsencrypt-prod
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/gateway.yaml
+        hasDocuments:
+          count: 3
+      - template: templates/gateway.yaml
+        documentIndex: 0
+        equal:
+          path: kind
+          value: Certificate
+      - template: templates/gateway.yaml
+        documentIndex: 0
+        equal:
+          path: spec.dnsNames
+          value:
+            - example.org
+            - "*.example.org"
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: kind
+          value: Gateway
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.gatewayClassName
+          value: cilium
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[0].name
+          value: http
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[1].hostname
+          value: "*.example.org"
+      - template: templates/gateway.yaml
+        documentIndex: 2
+        equal:
+          path: kind
+          value: HTTPRoute
+      - template: templates/gateway.yaml
+        documentIndex: 2
+        equal:
+          path: spec.rules[0].filters[0].requestRedirect.scheme
+          value: https
+
+  - it: child tenant renders its own Gateway with the child's per-tenant apex
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.11"
+      _namespace:
+        host: alice.example.org
+    release:
+      namespace: tenant-alice
+    asserts:
+      - template: templates/gateway.yaml
+        hasDocuments:
+          count: 3
+      - template: templates/gateway.yaml
+        documentIndex: 0
+        equal:
+          path: spec.dnsNames
+          value:
+            - alice.example.org
+            - "*.alice.example.org"
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[1].hostname
+          value: "*.alice.example.org"
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[2].hostname
+          value: "alice.example.org"
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[0].allowedRoutes.namespaces.selector.matchExpressions[0].values
+          value:
+            - tenant-alice
+
+  - it: empty _namespace.host fails with explicit error
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+      _namespace:
+        host: ""
+    asserts:
+      - template: templates/gateway.yaml
+        failedTemplate:
+          errorMessage: "_namespace.host is empty — the tenant has no apex domain. Either set tenant.spec.host on this tenant or inherit it from a parent that has host set."
+
+  - it: allowedRoutes whitelist defaults to publishing namespace only when no extra namespaces are set
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[0].allowedRoutes.namespaces.from
+          value: Selector
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[0].allowedRoutes.namespaces.selector.matchExpressions[0].key
+          value: kubernetes.io/metadata.name
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[0].allowedRoutes.namespaces.selector.matchExpressions[0].operator
+          value: In
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[0].allowedRoutes.namespaces.selector.matchExpressions[0].values
+          value:
+            - tenant-root
+
+  - it: allowedRoutes whitelist prepends publishing namespace to the gateway-attached-namespaces list and filters empty entries
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        gateway-attached-namespaces: "cozy-cert-manager,,cozy-dashboard, cozy-keycloak,"
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[0].allowedRoutes.namespaces.selector.matchExpressions[0].values
+          value:
+            - tenant-root
+            - cozy-cert-manager
+            - cozy-dashboard
+            - cozy-keycloak
+
+  - it: Certificate references the per-tenant Issuer (not a shared ClusterIssuer) so each tenant gets isolated ACME state
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        issuer-name: letsencrypt-prod
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/gateway.yaml
+        documentIndex: 0
+        equal:
+          path: kind
+          value: Certificate
+      - template: templates/gateway.yaml
+        documentIndex: 0
+        equal:
+          path: spec.issuerRef.kind
+          value: Issuer
+      - template: templates/gateway.yaml
+        documentIndex: 0
+        equal:
+          path: spec.issuerRef.name
+          value: gateway
+      - template: templates/issuer.yaml
+        hasDocuments:
+          count: 1
+      - template: templates/issuer.yaml
+        equal:
+          path: kind
+          value: Issuer
+      - template: templates/issuer.yaml
+        equal:
+          path: metadata.name
+          value: gateway
+      - template: templates/issuer.yaml
+        equal:
+          path: spec.acme.server
+          value: https://acme-v02.api.letsencrypt.org/directory
+      - template: templates/issuer.yaml
+        equal:
+          path: spec.acme.solvers[0].dns01.cloudflare.apiTokenSecretRef.name
+          value: cloudflare-api-token-secret
+      - template: templates/issuer.yaml
+        equal:
+          path: spec.acme.solvers[0].dns01.cloudflare.apiTokenSecretRef.key
+          value: api-token
+
+  - it: chart render fails when publishing.certificates.solver=http01 because Let's Encrypt refuses HTTP-01 for wildcard certs
+    set:
+      _cluster:
+        solver: http01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        issuer-name: letsencrypt-prod
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/issuer.yaml
+        failedTemplate:
+          errorMessage: "publishing.certificates.solver=http01 cannot issue the wildcard certificate the tenant Gateway needs (Let's Encrypt refuses HTTP-01 for wildcard identifiers). Set publishing.certificates.solver=dns01 (with a Cloudflare API token Secret in cozy-cert-manager) before enabling tenant.spec.gateway=true, or use the self-signed ClusterIssuer for air-gapped clusters."
+
+  - it: Issuer picks the staging ACME server when publishing.certificates.issuerName=letsencrypt-stage
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        issuer-name: letsencrypt-stage
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/issuer.yaml
+        equal:
+          path: spec.acme.server
+          value: https://acme-staging-v02.api.letsencrypt.org/directory
+
+  - it: unknown issuer-name fails chart render with an explicit error
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        issuer-name: my-custom-ca
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/issuer.yaml
+        failedTemplate:
+          errorMessage: 'packages/extra/gateway currently supports publishing.certificates.issuerName=letsencrypt-prod or letsencrypt-stage (got "my-custom-ca"). For other issuers, extend templates/issuer.yaml to map the name to the corresponding ACME server URL.'
+
+  - it: HTTPS and HTTPS-apex listeners share the same allowedRoutes whitelist
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        expose-external-ips: "192.0.2.10"
+        gateway-attached-namespaces: "cozy-dashboard"
+      _namespace:
+        host: example.org
+    asserts:
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[1].allowedRoutes.namespaces.selector.matchExpressions[0].values
+          value:
+            - tenant-root
+            - cozy-dashboard
+      - template: templates/gateway.yaml
+        documentIndex: 1
+        equal:
+          path: spec.listeners[2].allowedRoutes.namespaces.selector.matchExpressions[0].values
+          value:
+            - tenant-root
+            - cozy-dashboard

packages/extra/gateway/values.schema.json

@@ -0,0 +1,23 @@
+{
+  "title": "Chart Values",
+  "type": "object",
+  "properties": {
+    "gatewayClassName": {
+      "description": "GatewayClass to attach the tenant Gateway to. Must exist cluster-wide. Default matches the Cilium-managed class.",
+      "type": "string",
+      "default": "cilium"
+    },
+    "tlsPassthroughServices": {
+      "description": "Names (from publishing.exposedServices) whose traffic is TLS-passthrough rather than TLS-terminate. For each such service a dedicated HTTPS listener with tls.mode=Passthrough is rendered on the Gateway, and the service is expected to attach a TLSRoute instead of an HTTPRoute.",
+      "type": "array",
+      "default": [
+        "api",
+        "vm-exportproxy",
+        "cdi-uploadproxy"
+      ],
+      "items": {
+        "type": "string"
+      }
+    }
+  }
+}

packages/extra/gateway/values.yaml

@@ -0,0 +1,12 @@
+##
+## @section Common parameters
+##
+
+## @param {string} gatewayClassName - GatewayClass to attach the tenant Gateway to. Must exist cluster-wide. Default matches the Cilium-managed class.
+gatewayClassName: cilium
+
+## @param {[]string} tlsPassthroughServices - Names (from publishing.exposedServices) whose traffic is TLS-passthrough rather than TLS-terminate. For each such service a dedicated HTTPS listener with tls.mode=Passthrough is rendered on the Gateway, and the service is expected to attach a TLSRoute instead of an HTTPRoute.
+tlsPassthroughServices:
+  - api
+  - vm-exportproxy
+  - cdi-uploadproxy

packages/system/bucket/templates/httproute.yaml

@@ -0,0 +1,21 @@
+{{- $host := .Values._namespace.host }}
+{{- $gateway := .Values._namespace.gateway | default "" }}
+{{- if $gateway }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Values.bucketName }}-ui
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: cozystack
+    namespace: {{ $gateway }}
+    sectionName: https
+  hostnames:
+  - {{ printf "%s.%s" .Values.bucketName $host | quote }}
+  rules:
+  - backendRefs:
+    - name: {{ .Values.bucketName }}-ui
+      port: 8080
+{{- end }}

packages/system/bucket/templates/ingress.yaml

@@ -1,7 +1,9 @@
 {{- $host := .Values._namespace.host }}
 {{- $ingress := .Values._namespace.ingress }}
+{{- $gateway := .Values._namespace.gateway | default "" }}
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
 {{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
+{{- if not $gateway }}
 
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -32,3 +34,4 @@ spec:
             name: {{ .Values.bucketName }}-ui
             port:
               number: 8080
+{{- end }}

packages/system/cert-manager-issuers/Makefile

@@ -2,3 +2,6 @@ export NAME=cert-manager-issuers
 export NAMESPACE=cozy-cert-manager
 
 include ../../../hack/package.mk
+
+test:
+	helm unittest .

packages/system/cert-manager-issuers/templates/cluster-issuers.yaml

@@ -1,57 +1,73 @@
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
+
+{{- define "cert-manager-issuers.httpSolver" -}}
+{{- $gatewayEnabled := index . "gatewayEnabled" -}}
+{{- $exposeIngress := index . "exposeIngress" -}}
+{{- if eq $gatewayEnabled "true" }}
+http01:
+  gatewayHTTPRoute:
+    parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: cozystack
+      namespace: {{ $exposeIngress }}
+      sectionName: http
+{{- else }}
+http01:
+  ingress:
+    ingressClassName: {{ $exposeIngress }}
+{{- end }}
+{{- end }}
 
 apiVersion: cert-manager.io/v1
-kind: ClusterIssuer  
-metadata:  
-  name: letsencrypt-prod  
-spec:  
-  acme:  
-    privateKeySecretRef:  
-      name: letsencrypt-prod  
-    server: https://acme-v02.api.letsencrypt.org/directory  
-    solvers:  
-    - {{- if eq $solver "dns01" }}  
-        dns01:  
-          cloudflare:  
-            apiTokenSecretRef:  
-              name: cloudflare-api-token-secret  
-              key: api-token  
-      {{- else }}  
-        http01:
-          ingress:
-            ingressClassName: {{ $exposeIngress }}
-      {{- end }}  
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    server: https://acme-v02.api.letsencrypt.org/directory
+    solvers:
+    - {{- if eq $solver "dns01" }}
+        dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token-secret
+              key: api-token
+      {{- else }}
+        {{- include "cert-manager-issuers.httpSolver" (dict "gatewayEnabled" $gatewayEnabled "exposeIngress" $exposeIngress) | nindent 8 }}
+      {{- end }}
 
----  
+---
 
-apiVersion: cert-manager.io/v1  
-kind: ClusterIssuer  
-metadata:  
-  name: letsencrypt-stage  
-spec:  
-  acme:  
-    privateKeySecretRef:  
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-stage
+spec:
+  acme:
+    privateKeySecretRef:
       name: letsencrypt-stage
-    server: https://acme-staging-v02.api.letsencrypt.org/directory  
-    solvers:  
-    - {{- if eq $solver "dns01" }}  
-        dns01:  
-          cloudflare:  
-            apiTokenSecretRef:  
-              name: cloudflare-api-token-secret  
-              key: api-token  
-      {{- else }}  
-        http01:
-          ingress:
-            ingressClassName: {{ $exposeIngress }}
-      {{- end }}  
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    solvers:
+    - {{- if eq $solver "dns01" }}
+        dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cloudflare-api-token-secret
+              key: api-token
+      {{- else }}
+        {{- include "cert-manager-issuers.httpSolver" (dict "gatewayEnabled" $gatewayEnabled "exposeIngress" $exposeIngress) | nindent 8 }}
+      {{- end }}
 
----  
+---
 
-apiVersion: cert-manager.io/v1  
-kind: ClusterIssuer  
-metadata:  
-  name: selfsigned-cluster-issuer  
-spec:  
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-cluster-issuer
+spec:
   selfSigned: {}

packages/system/cert-manager-issuers/tests/solver_test.yaml

@@ -0,0 +1,103 @@
+suite: cluster-issuer solver selection
+templates:
+  - templates/cluster-issuers.yaml
+
+release:
+  name: cert-manager-issuers
+  namespace: cozy-cert-manager
+
+tests:
+  - it: default renders ingress-nginx HTTP-01 solver on both ACME issuers
+    set:
+      _cluster:
+        solver: http01
+        expose-ingress: tenant-root
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: metadata.name
+          value: letsencrypt-prod
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].http01.ingress.ingressClassName
+          value: tenant-root
+      - documentIndex: 0
+        notExists:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute
+      - documentIndex: 1
+        equal:
+          path: metadata.name
+          value: letsencrypt-stage
+      - documentIndex: 1
+        equal:
+          path: spec.acme.solvers[0].http01.ingress.ingressClassName
+          value: tenant-root
+
+  - it: gateway-enabled=true renders gatewayHTTPRoute solver on both ACME issuers
+    set:
+      _cluster:
+        solver: http01
+        expose-ingress: tenant-root
+        gateway-enabled: "true"
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute.parentRefs[0].group
+          value: gateway.networking.k8s.io
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute.parentRefs[0].kind
+          value: Gateway
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute.parentRefs[0].name
+          value: cozystack
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute.parentRefs[0].namespace
+          value: tenant-root
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute.parentRefs[0].sectionName
+          value: http
+      - documentIndex: 0
+        notExists:
+          path: spec.acme.solvers[0].http01.ingress
+      - documentIndex: 1
+        equal:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute.parentRefs[0].name
+          value: cozystack
+
+  - it: solver=dns01 is unaffected by gateway-enabled flag
+    set:
+      _cluster:
+        solver: dns01
+        expose-ingress: tenant-root
+        gateway-enabled: "true"
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].dns01.cloudflare.apiTokenSecretRef.name
+          value: cloudflare-api-token-secret
+      - documentIndex: 0
+        notExists:
+          path: spec.acme.solvers[0].http01
+      - documentIndex: 1
+        equal:
+          path: spec.acme.solvers[0].dns01.cloudflare.apiTokenSecretRef.name
+          value: cloudflare-api-token-secret
+
+  - it: gateway-enabled defaults to ingress solver when unset
+    set:
+      _cluster:
+        solver: http01
+        expose-ingress: tenant-root
+        gateway-enabled: ""
+    asserts:
+      - documentIndex: 0
+        equal:
+          path: spec.acme.solvers[0].http01.ingress.ingressClassName
+          value: tenant-root
+      - documentIndex: 0
+        notExists:
+          path: spec.acme.solvers[0].http01.gatewayHTTPRoute

packages/system/cilium/values.yaml

@@ -18,7 +18,20 @@ cilium:
     tag: 1.19.3
     digest: "sha256:700f06f4803a838a8e830be5ace4650e3ad82bdefabfb2f4d110368d307a5efb"
   envoy:
-    enabled: false
+    enabled: true
+    # Upstream default is {} — no requests/limits. The embedded envoy DaemonSet
+    # idles at ~100 MB RAM/node and grows under L7 traffic; without requests
+    # the DaemonSet schedules onto any node with no reserved headroom, and
+    # without a memory limit a runaway listener could OOM the node.
+    # The baseline matches the commented-out example in the upstream Helm values.
+    resources:
+      requests:
+        cpu: 100m
+        memory: 512Mi
+      limits:
+        memory: 1Gi
+  gatewayAPI:
+    enabled: true
   rollOutCiliumPods: true
   operator:
     rollOutPods: true

packages/system/cozystack-api/templates/api-ingress.yaml

@@ -1,8 +1,9 @@
 {{- $host := index .Values._cluster "root-host" }}
 {{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
 
-{{- if and (has "api" $exposeServices) }}
+{{- if and (has "api" $exposeServices) (ne $gatewayEnabled "true") }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

packages/system/cozystack-api/templates/api-tlsroute.yaml

@@ -0,0 +1,24 @@
+{{- $host := index .Values._cluster "root-host" }}
+{{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
+{{- if and (has "api" $exposeServices) (eq $gatewayEnabled "true") }}
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TLSRoute
+metadata:
+  name: kubernetes-api
+  namespace: default
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: cozystack
+    namespace: {{ $exposeIngress }}
+    sectionName: tls-api
+  hostnames:
+  - {{ printf "api.%s" $host | quote }}
+  rules:
+  - backendRefs:
+    - name: kubernetes
+      port: 443
+{{- end }}

packages/system/cozystack-basics/templates/gateway-hostname-policy.yaml

@@ -0,0 +1,203 @@
+{{- $attachedNamespaces := (index .Values._cluster "gateway-attached-namespaces") | default "" }}
+{{- range splitList "," $attachedNamespaces }}
+  {{- $ns := . | trim }}
+  {{- if and $ns (hasPrefix "tenant-" $ns) }}
+    {{- fail (printf "publishing.gateway.attachedNamespaces must not contain tenant-* namespaces (got %q). Adding a tenant namespace here lets that tenant attach HTTPRoutes to the publishing tenant's Gateway and hijack hostnames. Child tenants that need their own Gateway must opt in via tenant.spec.gateway=true instead." $ns) }}
+  {{- end }}
+{{- end }}
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: cozystack-gateway-hostname-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups: ["gateway.networking.k8s.io"]
+      apiVersions: ["v1", "v1beta1"]
+      operations: ["CREATE", "UPDATE"]
+      resources: ["gateways"]
+  matchConditions:
+  - name: tenant-namespace
+    expression: object.metadata.namespace.startsWith("tenant-")
+  variables:
+  - name: tenantHost
+    expression: >-
+      (namespaceObject != null &&
+       has(namespaceObject.metadata.labels) &&
+       "namespace.cozystack.io/host" in namespaceObject.metadata.labels)
+         ? namespaceObject.metadata.labels["namespace.cozystack.io/host"]
+         : ""
+  validations:
+  - expression: >-
+      variables.tenantHost == "" ||
+      !has(object.spec.listeners) ||
+      object.spec.listeners.all(l,
+        !has(l.hostname) ||
+        l.hostname == variables.tenantHost ||
+        l.hostname.endsWith("." + variables.tenantHost)
+      )
+    messageExpression: >-
+      "Gateway listener hostname must equal " + variables.tenantHost +
+      " or end with ." + variables.tenantHost +
+      " (namespace " + object.metadata.namespace + " carries label namespace.cozystack.io/host=" + variables.tenantHost + ")"
+    reason: Forbidden
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: cozystack-gateway-hostname-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  policyName: cozystack-gateway-hostname-policy
+  validationActions: [Deny]
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: cozystack-gateway-attached-namespaces-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups: ["cozystack.io"]
+      apiVersions: ["v1alpha1"]
+      operations: ["CREATE", "UPDATE"]
+      resources: ["packages"]
+  matchConditions:
+  - name: has-gateway-attached-namespaces
+    expression: >-
+      has(object.spec) &&
+      has(object.spec.components) &&
+      "platform" in object.spec.components &&
+      has(object.spec.components.platform.values) &&
+      "gateway" in object.spec.components.platform.values &&
+      "attachedNamespaces" in object.spec.components.platform.values.gateway
+  validations:
+  - expression: >-
+      object.spec.components.platform.values.gateway.attachedNamespaces.all(ns, !ns.startsWith("tenant-"))
+    messageExpression: >-
+      "spec.components.platform.values.gateway.attachedNamespaces must not contain any tenant-* namespace; use tenant.spec.gateway=true instead of adding a tenant namespace to the publishing Gateway's whitelist"
+    reason: Forbidden
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: cozystack-gateway-attached-namespaces-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  policyName: cozystack-gateway-attached-namespaces-policy
+  validationActions: [Deny]
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: cozystack-tenant-host-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups: ["apps.cozystack.io"]
+      apiVersions: ["v1alpha1"]
+      operations: ["CREATE", "UPDATE"]
+      resources: ["tenants"]
+  matchConditions:
+  - name: has-host-field
+    expression: >-
+      (has(object.spec) && "host" in object.spec && object.spec.host != "") ||
+      (oldObject != null && has(oldObject.spec) && "host" in oldObject.spec && oldObject.spec.host != "")
+  variables:
+  - name: oldHost
+    expression: >-
+      (oldObject != null && has(oldObject.spec) && "host" in oldObject.spec) ? oldObject.spec.host : ""
+  - name: newHost
+    expression: >-
+      (has(object.spec) && "host" in object.spec) ? object.spec.host : ""
+  - name: hostChanged
+    expression: variables.oldHost != variables.newHost
+  - name: trustedCaller
+    expression: >-
+      has(request.userInfo.groups) && request.userInfo.groups.exists(g,
+        g == "system:masters" ||
+        g == "system:serviceaccounts:cozy-system" ||
+        g == "system:serviceaccounts:cozy-cert-manager" ||
+        g == "system:serviceaccounts:cozy-fluxcd" ||
+        g == "system:serviceaccounts:kube-system")
+  validations:
+  - expression: "!variables.hostChanged || variables.trustedCaller"
+    messageExpression: >-
+      "tenant.spec.host can only be set or changed by cluster-admins (system:masters) or by cozystack/Flux service accounts; request user is " + request.userInfo.username + ". A tenant with empty spec.host inherits the apex from its parent tenant."
+    reason: Forbidden
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: cozystack-tenant-host-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  policyName: cozystack-tenant-host-policy
+  validationActions: [Deny]
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicy
+metadata:
+  name: cozystack-namespace-host-label-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  failurePolicy: Fail
+  matchConstraints:
+    resourceRules:
+    - apiGroups: [""]
+      apiVersions: ["v1"]
+      operations: ["CREATE", "UPDATE"]
+      resources: ["namespaces"]
+  matchConditions:
+  - name: touches-host-label
+    expression: >-
+      (has(object.metadata.labels) && "namespace.cozystack.io/host" in object.metadata.labels) ||
+      (oldObject != null && has(oldObject.metadata.labels) && "namespace.cozystack.io/host" in oldObject.metadata.labels)
+  variables:
+  - name: oldHost
+    expression: >-
+      (oldObject != null && has(oldObject.metadata.labels) && "namespace.cozystack.io/host" in oldObject.metadata.labels)
+        ? oldObject.metadata.labels["namespace.cozystack.io/host"]
+        : ""
+  - name: newHost
+    expression: >-
+      has(object.metadata.labels) && "namespace.cozystack.io/host" in object.metadata.labels
+        ? object.metadata.labels["namespace.cozystack.io/host"]
+        : ""
+  - name: trustedCaller
+    expression: >-
+      has(request.userInfo.groups) && request.userInfo.groups.exists(g,
+        g == "system:masters" ||
+        g == "system:serviceaccounts:cozy-system" ||
+        g == "system:serviceaccounts:cozy-cert-manager" ||
+        g == "system:serviceaccounts:cozy-fluxcd" ||
+        g == "system:serviceaccounts:kube-system")
+  validations:
+  - expression: "variables.newHost == variables.oldHost || variables.trustedCaller"
+    messageExpression: >-
+      "namespace label namespace.cozystack.io/host is immutable once set (was " + variables.oldHost + ", requested " + variables.newHost + "); only cluster-admins and cozystack/Flux service accounts may change it. Request user: " + request.userInfo.username
+    reason: Forbidden
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingAdmissionPolicyBinding
+metadata:
+  name: cozystack-namespace-host-label-policy
+  labels:
+    internal.cozystack.io/managed-by-cozystack: ""
+spec:
+  policyName: cozystack-namespace-host-label-policy
+  validationActions: [Deny]

packages/system/cozystack-basics/templates/tenant-root.yaml

@@ -3,6 +3,8 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: tenant-root
+  labels:
+    namespace.cozystack.io/host: {{ index .Values._cluster "root-host" | quote }}
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease

packages/system/dashboard/templates/httproute.yaml

@@ -0,0 +1,23 @@
+{{- $host := index .Values._cluster "root-host" }}
+{{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
+{{- if and (has "dashboard" $exposeServices) (eq $gatewayEnabled "true") }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: dashboard
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: cozystack
+    namespace: {{ $exposeIngress }}
+    sectionName: https
+  hostnames:
+  - {{ printf "dashboard.%s" $host | quote }}
+  rules:
+  - backendRefs:
+    - name: incloud-web-gatekeeper
+      port: 8000
+{{- end }}

packages/system/dashboard/templates/ingress.yaml

@@ -3,8 +3,9 @@
 {{- $host := index .Values._cluster "root-host" }}
 {{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
 
-{{- if and (has "dashboard" $exposeServices) }}
+{{- if and (has "dashboard" $exposeServices) (ne $gatewayEnabled "true") }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

packages/system/gateway-api-crds/Makefile

@@ -6,4 +6,4 @@ include ../../../hack/package.mk
 update:
 	rm -rf templates
 	mkdir templates
-	kubectl kustomize "github.com/kubernetes-sigs/gateway-api/config/crd/experimental?ref=v1.2.0" > templates/crds-experimental.yaml
+	kubectl kustomize "github.com/kubernetes-sigs/gateway-api/config/crd/experimental?ref=v1.5.1" > templates/crds-experimental.yaml

packages/system/keycloak/templates/httproute.yaml

@@ -0,0 +1,23 @@
+{{- $host := index .Values._cluster "root-host" }}
+{{- $ingressHost := .Values.ingress.host | default (printf "keycloak.%s" $host) }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
+{{- if eq $gatewayEnabled "true" }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: keycloak
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: cozystack
+    namespace: {{ $exposeIngress }}
+    sectionName: https
+  hostnames:
+  - {{ $ingressHost | quote }}
+  rules:
+  - backendRefs:
+    - name: keycloak-http
+      port: 80
+{{- end }}

packages/system/keycloak/templates/ingress.yaml

@@ -3,6 +3,8 @@
 {{- $solver := (index .Values._cluster "solver") | default "http01" }}
 {{- $clusterIssuer := (index .Values._cluster "issuer-name") | default "letsencrypt-prod" }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
+{{- if ne $gatewayEnabled "true" }}
 
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -33,3 +35,4 @@ spec:
             name: keycloak-http
             port:
               name: http
+{{- end }}

packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml

@@ -1,9 +1,10 @@
 {{- $host := index .Values._cluster "root-host" }}
 {{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
 
 
-{{- if and (has "cdi-uploadproxy" $exposeServices) }}
+{{- if and (has "cdi-uploadproxy" $exposeServices) (ne $gatewayEnabled "true") }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

packages/system/kubevirt-cdi/templates/cdi-uploadproxy-tlsroute.yaml

@@ -0,0 +1,23 @@
+{{- $host := index .Values._cluster "root-host" }}
+{{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
+{{- if and (has "cdi-uploadproxy" $exposeServices) (eq $gatewayEnabled "true") }}
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TLSRoute
+metadata:
+  name: cdi-uploadproxy
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: cozystack
+    namespace: {{ $exposeIngress }}
+    sectionName: tls-cdi-uploadproxy
+  hostnames:
+  - {{ printf "cdi-uploadproxy.%s" $host | quote }}
+  rules:
+  - backendRefs:
+    - name: cdi-uploadproxy
+      port: 443
+{{- end }}

packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml

@@ -1,8 +1,9 @@
 {{- $host := index .Values._cluster "root-host" }}
 {{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
 {{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
 
-{{- if and (has "vm-exportproxy" $exposeServices) }}
+{{- if and (has "vm-exportproxy" $exposeServices) (ne $gatewayEnabled "true") }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:

packages/system/kubevirt/templates/vm-exportproxy-tlsroute.yaml

@@ -0,0 +1,23 @@
+{{- $host := index .Values._cluster "root-host" }}
+{{- $exposeServices := splitList "," ((index .Values._cluster "expose-services") | default "") }}
+{{- $exposeIngress := (index .Values._cluster "expose-ingress") | default "tenant-root" }}
+{{- $gatewayEnabled := (index .Values._cluster "gateway-enabled") | default "false" }}
+{{- if and (has "vm-exportproxy" $exposeServices) (eq $gatewayEnabled "true") }}
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TLSRoute
+metadata:
+  name: vm-exportproxy
+spec:
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: cozystack
+    namespace: {{ $exposeIngress }}
+    sectionName: tls-vm-exportproxy
+  hostnames:
+  - {{ printf "vm-exportproxy.%s" $host | quote }}
+  rules:
+  - backendRefs:
+    - name: vm-exportproxy
+      port: 443
+{{- end }}

packages/system/tenant-rd/cozyrds/tenant.yaml

@@ -8,7 +8,7 @@ spec:
     singular: tenant
     plural: tenants
     openAPISchema: |-
-      {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false},"schedulingClass":{"description":"The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.","type":"string","default":""},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}
+      {"title":"Chart Values","type":"object","properties":{"host":{"description":"The hostname used to access tenant services (defaults to using the tenant name as a subdomain for its parent tenant host).","type":"string","default":""},"etcd":{"description":"Deploy own Etcd cluster.","type":"boolean","default":false},"monitoring":{"description":"Deploy own Monitoring Stack.","type":"boolean","default":false},"ingress":{"description":"Deploy own Ingress Controller.","type":"boolean","default":false},"gateway":{"description":"Deploy own Gateway API Gateway (backed by Cilium Gateway API controller).","type":"boolean","default":false},"seaweedfs":{"description":"Deploy own SeaweedFS.","type":"boolean","default":false},"schedulingClass":{"description":"The name of a SchedulingClass CR to apply scheduling constraints for this tenant's workloads.","type":"string","default":""},"resourceQuotas":{"description":"Define resource quotas for the tenant.","type":"object","default":{},"additionalProperties":{"pattern":"^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$","anyOf":[{"type":"integer"},{"type":"string"}],"x-kubernetes-int-or-string":true}}}}
   release:
     prefix: tenant-
     labels:
@@ -23,7 +23,7 @@ spec:
     plural: Tenants
     description: Separated tenant namespace
     icon: PHN2ZyB3aWR0aD0iMTQ0IiBoZWlnaHQ9IjE0NCIgdmlld0JveD0iMCAwIDE0NCAxNDQiIGZpbGw9Im5vbmUiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+CjxyZWN0IHdpZHRoPSIxNDQiIGhlaWdodD0iMTQ0IiByeD0iMjQiIGZpbGw9InVybCgjcGFpbnQwX2xpbmVhcl82ODdfMzQwMykiLz4KPGcgY2xpcC1wYXRoPSJ1cmwoI2NsaXAwXzY4N18zNDAzKSI+CjxwYXRoIGQ9Ik03MiAyOUM2Ni4zOTI2IDI5IDYxLjAxNDggMzEuMjM4OCA1Ny4wNDk3IDM1LjIyNEM1My4wODQ3IDM5LjIwOTEgNTAuODU3MSA0NC42MTQxIDUwLjg1NzEgNTAuMjVDNTAuODU3MSA1NS44ODU5IDUzLjA4NDcgNjEuMjkwOSA1Ny4wNDk3IDY1LjI3NkM2MS4wMTQ4IDY5LjI2MTIgNjYuMzkyNiA3MS41IDcyIDcxLjVDNzcuNjA3NCA3MS41IDgyLjk4NTIgNjkuMjYxMiA4Ni45NTAzIDY1LjI3NkM5MC45MTUzIDYxLjI5MDkgOTMuMTQyOSA1NS44ODU5IDkzLjE0MjkgNTAuMjVDOTMuMTQyOSA0NC42MTQxIDkwLjkxNTMgMzkuMjA5MSA4Ni45NTAzIDM1LjIyNEM4Mi45ODUyIDMxLjIzODggNzcuNjA3NCAyOSA3MiAyOVpNNjAuOTgyNiA4My4zMDM3QzYwLjQ1NCA4Mi41ODk4IDU5LjU5NTEgODIuMTkxNCA1OC43MTk2IDgyLjI3NDRDNDUuMzg5NyA4My43MzU0IDM1IDk1LjEwNzQgMzUgMTA4LjkwM0MzNSAxMTEuNzI2IDM3LjI3OTUgMTE0IDQwLjA3MSAxMTRIMTAzLjkyOUMxMDYuNzM3IDExNCAxMDkgMTExLjcwOSAxMDkgMTA4LjkwM0MxMDkgOTUuMTA3NCA5OC42MTAzIDgzLjc1MiA4NS4yNjM4IDgyLjI5MUM4NC4zODg0IDgyLjE5MTQgODMuNTI5NSA4Mi42MDY0IDgzLjAwMDkgODMuMzIwM0w3NC4wOTc4IDk1LjI0MDJDNzMuMDQwNiA5Ni42NTE0IDcwLjkyNjMgOTYuNjUxNCA2OS44NjkyIDk1LjI0MDJMNjAuOTY2MSA4My4zMjAzTDYwLjk4MjYgODMuMzAzN1oiIGZpbGw9ImJsYWNrIi8+CjwvZz4KPGRlZnM+CjxsaW5lYXJHcmFkaWVudCBpZD0icGFpbnQwX2xpbmVhcl82ODdfMzQwMyIgeDE9IjcyIiB5MT0iMTQ0IiB4Mj0iLTEuMjgxN2UtMDUiIHkyPSI0IiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSI+CjxzdG9wIHN0b3AtY29sb3I9IiNDMEQ2RkYiLz4KPHN0b3Agb2Zmc2V0PSIwLjMiIHN0b3AtY29sb3I9IiNDNERBRkYiLz4KPHN0b3Agb2Zmc2V0PSIwLjY1IiBzdG9wLWNvbG9yPSIjRDNFOUZGIi8+CjxzdG9wIG9mZnNldD0iMSIgc3RvcC1jb2xvcj0iI0U5RkZGRiIvPgo8L2xpbmVhckdyYWRpZW50Pgo8Y2xpcFBhdGggaWQ9ImNsaXAwXzY4N18zNDAzIj4KPHJlY3Qgd2lkdGg9Ijc0IiBoZWlnaHQ9Ijg1IiBmaWxsPSJ3aGl0ZSIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMzUgMjkpIi8+CjwvY2xpcFBhdGg+CjwvZGVmcz4KPC9zdmc+Cg==
-    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "etcd"], ["spec", "monitoring"], ["spec", "ingress"], ["spec", "seaweedfs"], ["spec", "schedulingClass"], ["spec", "resourceQuotas"]]
+    keysOrder: [["apiVersion"], ["appVersion"], ["kind"], ["metadata"], ["metadata", "name"], ["spec", "host"], ["spec", "etcd"], ["spec", "monitoring"], ["spec", "ingress"], ["spec", "gateway"], ["spec", "seaweedfs"], ["spec", "schedulingClass"], ["spec", "resourceQuotas"]]
   secrets:
     exclude: []
     include: []

pkg/registry/apps/application/rest.go

@@ -181,6 +181,16 @@ func (r *REST) Create(ctx context.Context, obj runtime.Object, createValidation
 		return nil, apierrors.NewBadRequest(err.Error())
 	}
 
+	// Run the genericapiserver-supplied admission chain (mutating + validating
+	// webhooks and ValidatingAdmissionPolicies) before persisting anything.
+	// Custom REST handlers must invoke this hook explicitly — unlike
+	// genericregistry.Store, which wires it automatically.
+	if createValidation != nil {
+		if err := createValidation(ctx, obj); err != nil {
+			return nil, err
+		}
+	}
+
 	// Convert Application to HelmRelease
 	helmRelease, err := r.ConvertApplicationToHelmRelease(app)
 	if err != nil {
@@ -590,6 +600,22 @@ func (r *REST) Delete(ctx context.Context, name string, deleteValidation rest.Va
 		return nil, false, apierrors.NewNotFound(r.gvr.GroupResource(), name)
 	}
 
+	// Run the genericapiserver-supplied admission chain (validating webhooks
+	// and ValidatingAdmissionPolicies) on the resolved Application before
+	// removing the underlying HelmRelease. Custom REST handlers must invoke
+	// this hook explicitly — unlike genericregistry.Store, which wires it
+	// automatically.
+	if deleteValidation != nil {
+		converted, convErr := r.ConvertHelmReleaseToApplication(ctx, helmRelease)
+		if convErr != nil {
+			klog.Errorf("Failed to convert HelmRelease %s to Application for delete admission: %v", helmReleaseName, convErr)
+			return nil, false, convErr
+		}
+		if err := deleteValidation(ctx, &converted); err != nil {
+			return nil, false, err
+		}
+	}
+
 	klog.V(6).Infof("Deleting HelmRelease %s in namespace %s", helmReleaseName, namespace)
 
 	// Delete the HelmRelease corresponding to the Application