vrr/cozystack
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
cozystack/packages/extra/ingress
History
Exact
Aleksei Sviridkin 500816b71b
refactor(ingress): move CiliumLoadBalancerIPPool to tenant chart 
The pool is now rendered from packages/apps/tenant/templates/cilium-lb-pool.yaml instead of packages/extra/ingress/templates/cilium-lb-pool.yaml. Cilium LB IPAM forbids overlapping CIDRs across pools regardless of serviceSelector, so both the ingress-loadBalancer path and the upcoming per-tenant Gateway in #2470 cannot each own their own pool on the same publishing.externalIPs range. The tenant chart is the natural per-tenant owner — it already creates the Namespace, the cozystack-values Secret, and the HelmReleases for both ingress and gateway.

The new pool uses a namespace-only serviceSelector (io.kubernetes.service.namespace: <ns>), which matches any LoadBalancer Service in the tenant namespace. The metadata.name changed from <trim>-ingress to <trim>-exposure to reflect that the pool is not ingress-specific.

Only the ingress-loadBalancer signal is wired in this commit (_cluster.expose-mode=loadBalancer plus .Values.ingress=true on the publishing tenant). The gateway branch is added in #2470 on top of this commit — it rebases, drops its own packages/extra/gateway/templates/cilium-lb-pool.yaml, and adds an OR branch for .Values.gateway in the tenant template.

Pool-rendering unit tests moved from packages/extra/ingress/tests/ to packages/apps/tenant/tests/. The ingress chart tests keep the Service-level asserts. packages/apps/tenant/Makefile gains a test target so hack/helm-unit-tests.sh picks up the new suite.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
2026-04-24 16:44:46 +03:00
..
charts Configure all apps to use new function to generate subjects 2025-06-16 20:32:11 +02:00
logos Update dashboard icons (#274) 2024-08-12 14:47:11 +02:00
templates refactor(ingress): move CiliumLoadBalancerIPPool to tenant chart 2026-04-24 16:44:46 +03:00
tests refactor(ingress): move CiliumLoadBalancerIPPool to tenant chart 2026-04-24 16:44:46 +03:00
.helmignore Ship all logos with Cozystack 2024-07-16 17:31:52 +02:00
Chart.yaml Remove versions_map logic 2025-09-24 12:32:37 +02:00
config.json Allow specify externalIPs for nginx-ingress (#164) 2024-06-14 15:28:10 +02:00
Makefile feat(ingress): add loadBalancer exposure mode via CiliumLoadBalancerIPPool 2026-04-23 17:35:36 +03:00
README.md feat(ingress): add loadBalancer exposure mode via CiliumLoadBalancerIPPool 2026-04-23 17:35:36 +03:00
values.schema.json [docs] Updated app go types 2026-03-25 15:57:25 +05:00
values.yaml [dx] JSDoc compatible syntax for values.yaml 2025-10-29 08:57:26 +05:00

README.md

Ingress-NGINX Controller

Parameters

Common parameters

Name Description Type Value
replicas Number of ingress-nginx replicas. int 2
whitelist List of client networks. []string []
cloudflareProxy Restoring original visitor IPs when Cloudflare proxied is enabled. bool false
resources Explicit CPU and memory configuration for each ingress-nginx replica. When omitted, the preset defined in resourcesPreset is applied. object {}
resources.cpu CPU available to each replica. quantity ""
resources.memory Memory (RAM) available to each replica. quantity ""
resourcesPreset Default sizing preset used when resources is omitted. string micro

Exposure mode

The ingress Service type is driven by the cluster-wide publishing.exposure value in the platform chart, not by any key in this package. Two modes exist:

  • externalIPs (default) has three rendered shapes:
    • Release namespace matches publishing.ingressName AND publishing.externalIPs is non-empty → Service is ClusterIP with Service.spec.externalIPs set from that list and externalTrafficPolicy: Cluster.
    • Release namespace matches publishing.ingressName but publishing.externalIPs is empty → Service falls back to type: LoadBalancer with externalTrafficPolicy: Local.
    • Release namespace does not match publishing.ingressName (non-root tenants) → Service is type: LoadBalancer with externalTrafficPolicy: Local. Service.spec.externalIPs is deprecated upstream in Kubernetes v1.36 (KEP-5707); plan migration before v1.40.
  • loadBalancer — Service is type: LoadBalancer with externalTrafficPolicy: Local, and a CiliumLoadBalancerIPPool makes the addresses in publishing.externalIPs allocatable via Cilium LB IPAM. Requires publishing.externalIPs to contain at least one non-empty address (render fails otherwise) and assumes the addresses are already routed to a cluster node (floating IP / upstream router). See the inline comment on publishing.exposure in the platform chart for full caveats, including the note that switching the value on a running cluster causes the ingress Service to be recreated.

This setting only migrates ingress-nginx away from Service.spec.externalIPs. Other cozystack components that use the same deprecated field (e.g. the vpn app) must be migrated separately before Kubernetes v1.40 flips the AllowServiceExternalIPs feature gate off.