Repository navigation
feat(chart): optional Ingress for the console UI (P2-7) - #765
Merged
Merged
Conversation
Adds templates/console-ingress.yaml, gated on BOTH console.enabled AND console.ingress.enabled.
It deliberately fronts ONLY the console UI. RESP is an L4/TCP protocol, so an HTTP Ingress
cannot proxy the cache -- the cache's external paths (client Service / NodePort / LoadBalancer /
Traefik IngressRouteTCP) stay documented in deploy/K3S.md, along with the reminder that a single
endpoint in front of a raft cluster is not cluster-aware (nodes answer MOVED for un-owned slots).
- values: console.ingress.{enabled,className,annotations,hosts,tls}. `className` defaults empty
(the cluster's default IngressClass); "traefik" is the stock-k3s value. hosts entries are
{host, paths:[{path,pathType}]} with sensible per-field defaults, and `tls` passes through
verbatim. Documented that the console serves an operator UI + API, so real authn belongs in
front of it.
- values.schema.json typed to match.
- deploy-lint: an `ing_set` value-set + a guard asserting the Ingress renders AND targets the
CONSOLE Service. NOTE: the arm is placed BEFORE the generic `*console.enabled=true*` arm --
`case` takes the FIRST match and ing_set contains both, so the more specific arm must come
first or the guard would silently never run (verified by simulating the dispatch).
Plan updated: P2-7 -> DONE, and the `helm test` + `ct` row -> DONE (the kind e2e now covers
install AND upgrade after #763; `ct` itself is not used because the kind job covers what P2-3
asked for). Only two checklist rows remain non-DONE, both PARTIAL BY DESIGN (failover-before-
drain and online scale-out -- documented, and automating them is operator charter).
Verified with helm 3.15.4 + kubeconform 0.6.7: lint clean; renders only when BOTH flags are set
(defaults and console-only both render zero Ingresses); the backend resolves to the console
Service:9180; the full 9-way matrix validates.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_01FfFZ8gkkNhDBASuntB72HR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
templates/console-ingress.yaml, gated on bothconsole.enabledandconsole.ingress.enabled.It fronts only the console UI. RESP is L4/TCP, so an HTTP Ingress cannot proxy the cache -- the cache's external paths (client Service / NodePort / LoadBalancer / Traefik
IngressRouteTCP) stay documented indeploy/K3S.md, with the reminder that a single endpoint in front of a raft cluster isn't cluster-aware (nodes answerMOVEDfor un-owned slots).console.ingress.{enabled,className,annotations,hosts,tls}.classNameempty = the cluster default (traefikon stock k3s);hostsentries are{host, paths:[{path,pathType}]}with per-field defaults;tlspasses through verbatim. Documented that the console serves an operator UI+API, so real authn belongs in front.ing_setvalue-set + a guard asserting the Ingress renders and targets the console Service.*console.enabled=true*arm.casetakes the first match anding_setcontains both strings, so the more specific arm must come first -- otherwise the guard silently never runs. Verified by simulating the dispatch.Plan
P2-7 -> DONE; the
helm test+ctrow -> DONE (the kind e2e covers install AND upgrade after #763;ctisn't used because the kind job covers what P2-3 asked for). Only two checklist rows remain non-DONE, both PARTIAL by design (failover-before-drain, online scale-out -- documented; automating them is operator charter).Verified
lint clean; renders only when both flags are set (defaults and console-only both render zero Ingresses); backend resolves to
ic-ironcache-console:9180; full 9-way matrix validates.