Tenants can now opt their own apps into Gateway API without touching
the publishing tenant. The mechanism mirrors the existing
_namespace.ingress contract exactly.
packages/apps/tenant/templates/namespace.yaml:
- Compute a new $gateway value: if the tenant sets .Values.gateway
it becomes the tenant's own namespace, otherwise it inherits from
the parent namespace (empty means no Gateway anywhere in the chain).
- Ship $gateway out through the cozystack-values Secret under
_namespace.gateway and through a namespace label
namespace.cozystack.io/gateway.
packages/apps/harbor and packages/system/bucket:
- Existing Ingress wrapped in '{{ if not $gateway }}' so it only
renders when no Gateway is attached anywhere up the tenant chain.
- New templates/httproute.yaml render when $gateway is non-empty:
apiVersion gateway.networking.k8s.io/v1 HTTPRoute, parentRef to
the 'cozystack' Gateway in whichever namespace $gateway points
at, hostname <release>.<host> (harbor) or <bucketName>.<host>
(bucket), backendRef to the existing Service on its current port.
Per-tenant resolution: a tenant with .Values.gateway=true gets its
own Gateway in its own namespace, and harbor/bucket deployed inside
that tenant attach to that namespace's Gateway — no cross-namespace
references, no coupling to the publishing tenant.
Default remains ingress-nginx: tenants that do not opt in keep
rendering Ingress verbatim.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
b719cf67e3