diff --git a/charts/catalog-manager/templates/cluster-role.yaml b/charts/catalog-manager/templates/cluster-role.yaml index 677b9a0ee..e6274055a 100644 --- a/charts/catalog-manager/templates/cluster-role.yaml +++ b/charts/catalog-manager/templates/cluster-role.yaml @@ -141,6 +141,7 @@ rules: - gateway.envoyproxy.io resources: - envoyproxies + - envoypatchpolicies - backendtrafficpolicies - clienttrafficpolicies verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] diff --git a/charts/service-gateway-presets/README.md b/charts/service-gateway-presets/README.md index 2c717d00e..02b0dfd64 100644 --- a/charts/service-gateway-presets/README.md +++ b/charts/service-gateway-presets/README.md @@ -45,71 +45,71 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the `service-gateway-presets` chart and their default values. -| Parameter | Description | Default | -|----------------------------------------------------|----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| nameOverride | Overrides name template | "" | -| fullnameOverride | Overrides fullname template | "" | -| global.distro.openshift | Set true, if installed in OpenShift | false | -| global.distro.ubi | Set operator or all to use ubi images | "" | -| clusterMetadata.uid | | "" | -| clusterMetadata.name | | "" | -| skipGatewayPreset | | false | -| infra.host | | chart-example.local | -| infra.hostType | | domain | -| infra.tenantSpreadPolicy | | "multi" | -| infra.tls.issuer | | "ca" # ca,letsencrypt,letsencrypt-staging | -| infra.tls.ca.cert | | "" | -| infra.tls.ca.key | | "" | -| infra.tls.acme.email | | ops@appscode.com | -| infra.tls.acme.solver | | Gateway | -| infra.tls.acme.gatewayName | | backend | -| infra.tls.certificate.cert | | "" | -| infra.tls.certificate.key | | "" | -| infra.tls.jks.keystore | | | -| infra.tls.jks.truststore | | | -| infra.tls.jks.password | | "" | -| infra.dns.provider | | "external" # external,cloudflare,route53,cloudDNS | -| infra.dns.auth | | {} | -| gateway.crd-manager.enabled | | true | -| gateway.gateway-converter.enabled | | false | -| gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace | -| gateway.config.envoyGateway.extensionApis | | {} | -| gateway.deployment.priorityClassName | | "" | -| gateway.hpa.enabled | | false | -| gateway.hpa.behavior | | {} | -| gateway.hpa.maxReplicas | | 0 | -| gateway.hpa.metrics | | [] | -| gateway.hpa.minReplicas | | 0 | -| gateway.service.annotations | | {} | -| gateway.service.trafficDistribution | | "" | -| gateway.service.type | | "ClusterIP" | -| gateway.topologyInjector.enabled | | false | -| gateway.topologyInjector.annotations | | {} | -| gateway-dns.enabled | | false | -| cluster.tls.issuer | | "ca" # ca,none | -| cluster.tls.ca.cert | | "" | -| cluster.tls.ca.key | | "" | -| envoy.provisionerType | | Deployment # DaemonSet | -| envoy.image | | ghcr.io/voyagermesh/envoy | -| envoy.tag | | "v1.37.2-ac" | -| envoy.service.portRange | Default listener portmanager range to use for gateway exposure | "10000-12767" | -| envoy.service.nodeportRange | Default node portmanager range to use for gateway exposure | "30000-32767" | -| envoy.service.type | | LoadBalancer # ClusterIP, LoadBalancer, NodePort | -| envoy.service.externalTrafficPolicy | | Cluster # Local | -| envoy.nodeSelector | | {} | -| envoy.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | -| echoserver.image | | ghcr.io/voyagermesh/echoserver | -| echoserver.tag | | "v20221109" | -| echoserver.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | -| vaultServer.name | Vault server name that exist on cluster | "vault" | -| vaultServer.namespace | Vault server namespace that exist on cluster | "ace" | -| chart.name | | service-gateway | -| chart.namespace | | ace | -| chart.createNamespace | | true | -| chart.version | | "v2026.6.19" | -| chart.sourceRef.kind | | HelmRepository | -| chart.sourceRef.name | | appscode-charts-oci | -| chart.sourceRef.namespace | | kubeops | +| Parameter | Description | Default | +|------------------------------------------------------------------|----------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| nameOverride | Overrides name template | "" | +| fullnameOverride | Overrides fullname template | "" | +| global.distro.openshift | Set true, if installed in OpenShift | false | +| global.distro.ubi | Set operator or all to use ubi images | "" | +| clusterMetadata.uid | | "" | +| clusterMetadata.name | | "" | +| skipGatewayPreset | | false | +| infra.host | | chart-example.local | +| infra.hostType | | domain | +| infra.tenantSpreadPolicy | | "multi" | +| infra.tls.issuer | | "ca" # ca,letsencrypt,letsencrypt-staging | +| infra.tls.ca.cert | | "" | +| infra.tls.ca.key | | "" | +| infra.tls.acme.email | | ops@appscode.com | +| infra.tls.acme.solver | | Gateway | +| infra.tls.acme.gatewayName | | backend | +| infra.tls.certificate.cert | | "" | +| infra.tls.certificate.key | | "" | +| infra.tls.jks.keystore | | | +| infra.tls.jks.truststore | | | +| infra.tls.jks.password | | "" | +| infra.dns.provider | | "external" # external,cloudflare,route53,cloudDNS | +| infra.dns.auth | | {} | +| gateway.crd-manager.enabled | | true | +| gateway.gateway-converter.enabled | | false | +| gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace | +| gateway.config.envoyGateway.extensionApis.enableEnvoyPatchPolicy | | true | +| gateway.deployment.priorityClassName | | "" | +| gateway.hpa.enabled | | false | +| gateway.hpa.behavior | | {} | +| gateway.hpa.maxReplicas | | 0 | +| gateway.hpa.metrics | | [] | +| gateway.hpa.minReplicas | | 0 | +| gateway.service.annotations | | {} | +| gateway.service.trafficDistribution | | "" | +| gateway.service.type | | "ClusterIP" | +| gateway.topologyInjector.enabled | | false | +| gateway.topologyInjector.annotations | | {} | +| gateway-dns.enabled | | false | +| cluster.tls.issuer | | "ca" # ca,none | +| cluster.tls.ca.cert | | "" | +| cluster.tls.ca.key | | "" | +| envoy.provisionerType | | Deployment # DaemonSet | +| envoy.image | | ghcr.io/voyagermesh/envoy | +| envoy.tag | | "v1.37.2-ac" | +| envoy.service.portRange | Default listener portmanager range to use for gateway exposure | "10000-12767" | +| envoy.service.nodeportRange | Default node portmanager range to use for gateway exposure | "30000-32767" | +| envoy.service.type | | LoadBalancer # ClusterIP, LoadBalancer, NodePort | +| envoy.service.externalTrafficPolicy | | Cluster # Local | +| envoy.nodeSelector | | {} | +| envoy.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | +| echoserver.image | | ghcr.io/voyagermesh/echoserver | +| echoserver.tag | | "v20221109" | +| echoserver.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | +| vaultServer.name | Vault server name that exist on cluster | "vault" | +| vaultServer.namespace | Vault server namespace that exist on cluster | "ace" | +| chart.name | | service-gateway | +| chart.namespace | | ace | +| chart.createNamespace | | true | +| chart.version | | "v2026.6.19" | +| chart.sourceRef.kind | | HelmRepository | +| chart.sourceRef.name | | appscode-charts-oci | +| chart.sourceRef.namespace | | kubeops | Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example: diff --git a/charts/service-gateway-presets/values.yaml b/charts/service-gateway-presets/values.yaml index e211cd182..d1684cef3 100644 --- a/charts/service-gateway-presets/values.yaml +++ b/charts/service-gateway-presets/values.yaml @@ -70,7 +70,8 @@ gateway: envoyGateway: gateway: controllerName: gateway.voyagermesh.com/ace - extensionApis: {} + extensionApis: + enableEnvoyPatchPolicy: true deployment: priorityClassName: "" hpa: diff --git a/charts/service-gateway/README.md b/charts/service-gateway/README.md index 85979e994..fc6e1c1a7 100644 --- a/charts/service-gateway/README.md +++ b/charts/service-gateway/README.md @@ -45,65 +45,65 @@ The command removes all the Kubernetes components associated with the chart and The following table lists the configurable parameters of the `service-gateway` chart and their default values. -| Parameter | Description | Default | -|----------------------------------------------------|--------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| nameOverride | Overrides name template | "" | -| fullnameOverride | Overrides fullname template | "" | -| global.distro.openshift | Set true, if installed in OpenShift | false | -| global.distro.ubi | Set operator or all to use ubi images | "" | -| clusterMetadata.uid | | tbd | -| clusterMetadata.name | | tbd | -| gatewayClass.annotations | | {} | -| gatewayClass.description | catalog.appscode.com/is-default-gatewayclass: "true" | "" | -| infra.host | | chart-example.local | -| infra.hostType | | domain | -| infra.tenantSpreadPolicy | | "multi" | -| infra.tls.issuer | | "ca" # ca,letsencrypt,letsencrypt-staging,external | -| infra.tls.ca.cert | | "" | -| infra.tls.ca.key | | "" | -| infra.tls.acme.email | | ops@appscode.com | -| infra.tls.acme.solver | | Gateway | -| infra.tls.acme.gatewayName | | backend | -| infra.tls.certificate.cert | | "" | -| infra.tls.certificate.key | | "" | -| infra.tls.jks.keystore | | | -| infra.tls.jks.truststore | | | -| infra.tls.jks.password | | "" | -| infra.dns.provider | | "external" # external,cloudflare,route53,cloudDNS | -| infra.dns.auth | | {} | -| gateway.gateway-converter.enabled | | false | -| gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace | -| gateway.config.envoyGateway.extensionApis | | {} | -| gateway.deployment.priorityClassName | | "" | -| gateway.hpa.enabled | | false | -| gateway.hpa.behavior | | {} | -| gateway.hpa.maxReplicas | | 0 | -| gateway.hpa.metrics | | [] | -| gateway.hpa.minReplicas | | 0 | -| gateway.service.annotations | | {} | -| gateway.service.trafficDistribution | | "" | -| gateway.service.type | | "ClusterIP" | -| gateway.topologyInjector.enabled | | false | -| gateway.topologyInjector.annotations | | {} | -| gateway-dns.enabled | | false | -| cluster.tls.issuer | possible values: ca,none,vault. none for client orgs, ca othereise | "ca" | -| cluster.tls.ca.cert | | "" | -| cluster.tls.ca.key | | "" | -| envoy.provisionerType | | Deployment # DaemonSet | -| envoy.image | | ghcr.io/voyagermesh/envoy | -| envoy.tag | | "v1.37.2-ac" | -| envoy.service.portRange | Default listener portmanager range to use for gateway exposure | "10000-12767" | -| envoy.service.nodeportRange | Default node portmanager range to use for gateway exposure | "30000-32767" | -| envoy.service.seedBackendPort | | 8080 | -| envoy.service.type | | LoadBalancer # ClusterIP, LoadBalancer, NodePort | -| envoy.service.externalTrafficPolicy | | Cluster # Local | -| envoy.nodeSelector | | {} | -| envoy.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | -| echoserver.image | | ghcr.io/voyagermesh/echoserver | -| echoserver.tag | | "v20221109" | -| echoserver.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | -| vaultServer.name | Vault server name that exist on cluster | "vault" | -| vaultServer.namespace | Vault server namespace that exist on cluster | "ace" | +| Parameter | Description | Default | +|------------------------------------------------------------------|--------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| nameOverride | Overrides name template | "" | +| fullnameOverride | Overrides fullname template | "" | +| global.distro.openshift | Set true, if installed in OpenShift | false | +| global.distro.ubi | Set operator or all to use ubi images | "" | +| clusterMetadata.uid | | tbd | +| clusterMetadata.name | | tbd | +| gatewayClass.annotations | | {} | +| gatewayClass.description | catalog.appscode.com/is-default-gatewayclass: "true" | "" | +| infra.host | | chart-example.local | +| infra.hostType | | domain | +| infra.tenantSpreadPolicy | | "multi" | +| infra.tls.issuer | | "ca" # ca,letsencrypt,letsencrypt-staging,external | +| infra.tls.ca.cert | | "" | +| infra.tls.ca.key | | "" | +| infra.tls.acme.email | | ops@appscode.com | +| infra.tls.acme.solver | | Gateway | +| infra.tls.acme.gatewayName | | backend | +| infra.tls.certificate.cert | | "" | +| infra.tls.certificate.key | | "" | +| infra.tls.jks.keystore | | | +| infra.tls.jks.truststore | | | +| infra.tls.jks.password | | "" | +| infra.dns.provider | | "external" # external,cloudflare,route53,cloudDNS | +| infra.dns.auth | | {} | +| gateway.gateway-converter.enabled | | false | +| gateway.config.envoyGateway.gateway.controllerName | | gateway.voyagermesh.com/ace | +| gateway.config.envoyGateway.extensionApis.enableEnvoyPatchPolicy | | true | +| gateway.deployment.priorityClassName | | "" | +| gateway.hpa.enabled | | false | +| gateway.hpa.behavior | | {} | +| gateway.hpa.maxReplicas | | 0 | +| gateway.hpa.metrics | | [] | +| gateway.hpa.minReplicas | | 0 | +| gateway.service.annotations | | {} | +| gateway.service.trafficDistribution | | "" | +| gateway.service.type | | "ClusterIP" | +| gateway.topologyInjector.enabled | | false | +| gateway.topologyInjector.annotations | | {} | +| gateway-dns.enabled | | false | +| cluster.tls.issuer | possible values: ca,none,vault. none for client orgs, ca othereise | "ca" | +| cluster.tls.ca.cert | | "" | +| cluster.tls.ca.key | | "" | +| envoy.provisionerType | | Deployment # DaemonSet | +| envoy.image | | ghcr.io/voyagermesh/envoy | +| envoy.tag | | "v1.37.2-ac" | +| envoy.service.portRange | Default listener portmanager range to use for gateway exposure | "10000-12767" | +| envoy.service.nodeportRange | Default node portmanager range to use for gateway exposure | "30000-32767" | +| envoy.service.seedBackendPort | | 8080 | +| envoy.service.type | | LoadBalancer # ClusterIP, LoadBalancer, NodePort | +| envoy.service.externalTrafficPolicy | | Cluster # Local | +| envoy.nodeSelector | | {} | +| envoy.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | +| echoserver.image | | ghcr.io/voyagermesh/echoserver | +| echoserver.tag | | "v20221109" | +| echoserver.securityContext | | {"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}} | +| vaultServer.name | Vault server name that exist on cluster | "vault" | +| vaultServer.namespace | Vault server namespace that exist on cluster | "ace" | Specify each parameter using the `--set key=value[,key=value]` argument to `helm upgrade -i`. For example: diff --git a/charts/service-gateway/values.yaml b/charts/service-gateway/values.yaml index c5ee38167..b7d71cbbc 100644 --- a/charts/service-gateway/values.yaml +++ b/charts/service-gateway/values.yaml @@ -71,7 +71,8 @@ gateway: envoyGateway: gateway: controllerName: gateway.voyagermesh.com/ace - extensionApis: {} + extensionApis: + enableEnvoyPatchPolicy: true deployment: priorityClassName: "" hpa: