Wire the three HTTPS-passthrough services through Gateway API so
ingress-nginx is no longer required for them when gateway.enabled=true.
extra/gateway chart: new values.tlsPassthroughServices (defaults to
[api, vm-exportproxy, cdi-uploadproxy]). For each service in that list
AND in _cluster.expose-services, the Gateway emits an extra
port-443 listener with protocol: TLS, tls.mode: Passthrough, hostname
<svc>.<host>, and allowedRoutes.kinds restricted to TLSRoute. The
specific hostname wins over the wildcard HTTPS Terminate listener at
SNI-matching time per Gateway API spec.
Per-service packages:
- packages/system/cozystack-api: existing Ingress wrapped in
'!= gateway-enabled=true'. New api-tlsroute.yaml renders
apiVersion gateway.networking.k8s.io/v1alpha2 TLSRoute in the
'default' namespace (where the kubernetes Service lives) targeting
the tls-api listener, hostname api.<root-host>, backendRef kubernetes:443.
- packages/system/kubevirt: same treatment for
vm-exportproxy-ingress.yaml → vm-exportproxy-tlsroute.yaml,
hostname vm-exportproxy.<root-host>, backendRef vm-exportproxy:443
in cozy-kubevirt.
- packages/system/kubevirt-cdi: same for cdi-uploadproxy —
hostname cdi-uploadproxy.<root-host>, backendRef cdi-uploadproxy:443
in cozy-kubevirt-cdi.
TLSRoute apiVersion v1alpha2 is intentional: Cilium 1.19 vendors
Gateway API CRDs v1.4 (TLSRoute is v1alpha2 there) and v1.5.1 ships
both v1 and v1alpha2 in the experimental channel, so v1alpha2 is
compatible with both. A follow-up can bump to v1 once Cilium v1.20
(Gateway API v1.5) lands in the platform.
Backward compatibility: default gateway.enabled=false keeps the
existing Ingress path verbatim for all three services.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
2c5bf50f43