Skip to content

Commit dd70fcc

Browse files
lexfreiclaude
lexfrei
and
claude
committed
feat(argo-cd): Expand Gateway API support with GRPCRoute and BackendTLSPolicy
- Add GRPCRoute template for gRPC traffic routing (Gateway API v1) - Add BackendTLSPolicy template for HTTPS backend support (v1alpha3, experimental) - Add experimental disclaimers for Gateway API support in values.yaml - Update documentation with Gateway API examples (HTTPRoute, GRPCRoute, BackendTLSPolicy) - All templates follow Helm scaffolding pattern (rules as arrays, consistent style) - Update Chart.yaml changelog Co-Authored-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 7281e3d commit dd70fcc

File tree

7 files changed

+316
-39
lines changed

7 files changed

+316
-39
lines changed

‎charts/argo-cd/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,4 @@ annotations:
2727
url: https://argoproj.github.io/argo-helm/pgp_keys.asc
2828
artifacthub.io/changes: |
2929
- kind: added
30-
description: Add HTTPRoute support for Gateway API
30+
description: Add Gateway API support (HTTPRoute, GRPCRoute, BackendTLSPolicy) - EXPERIMENTAL

‎charts/argo-cd/README.md‎

Lines changed: 79 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -237,6 +237,72 @@ server:
237237
enabled: true
238238
```
239239

240+
### Gateway API HTTPRoute
241+
242+
The Gateway API provides a modern, extensible way to configure ingress traffic routing. This chart supports HTTPRoute resources as an alternative to traditional Ingress.
243+
244+
> **Note:**
245+
> Gateway API support is **EXPERIMENTAL**. Support depends on your Gateway controller implementation. Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends). Refer to [Gateway API implementations](https://gateway-api.sigs.k8s.io/implementations/) for controller-specific details.
246+
247+
```yaml
248+
global:
249+
domain: argocd.example.com
250+
251+
server:
252+
httproute:
253+
enabled: true
254+
parentRefs:
255+
- name: example-gateway
256+
namespace: gateway-system
257+
sectionName: https
258+
```
259+
260+
#### Gateway API with gRPC support
261+
262+
For deployments requiring gRPC routing, use GRPCRoute alongside HTTPRoute:
263+
264+
```yaml
265+
server:
266+
httproute:
267+
enabled: true
268+
parentRefs:
269+
- name: example-gateway
270+
namespace: gateway-system
271+
sectionName: https
272+
273+
grpcroute:
274+
enabled: true
275+
parentRefs:
276+
- name: example-gateway
277+
namespace: gateway-system
278+
sectionName: grpc
279+
```
280+
281+
#### Gateway API with TLS backend
282+
283+
For HTTPS backends with Gateway API, you may need to configure BackendTLSPolicy (experimental, v1alpha3):
284+
285+
> **Warning:**
286+
> BackendTLSPolicy is in **EXPERIMENTAL** status. Not all Gateway controllers support this resource (e.g., Cilium does not yet support it).
287+
288+
```yaml
289+
configs:
290+
params:
291+
server.insecure: false # HTTPS backend
292+
293+
server:
294+
httproute:
295+
enabled: true
296+
parentRefs:
297+
- name: example-gateway
298+
namespace: gateway-system
299+
300+
backendTLSPolicy:
301+
enabled: true
302+
hostname: argocd-server.argocd.svc.cluster.local
303+
wellKnownCACertificates: System
304+
```
305+
240306
## Setting the initial admin password via Argo CD Application CR
241307

242308
> **Note:** When deploying the `argo-cd` chart via an Argo CD `Application` CR, define your bcrypt-hashed admin password under `helm.values`—not `helm.parameters`—because Argo CD performs variable substitution on `parameters`, which will mangle any `$…` in your hash.
@@ -1077,6 +1143,11 @@ NAME: my-release
10771143
| server.autoscaling.minReplicas | int | `1` | Minimum number of replicas for the Argo CD server [HPA] |
10781144
| server.autoscaling.targetCPUUtilizationPercentage | int | `50` | Average CPU utilization percentage for the Argo CD server [HPA] |
10791145
| server.autoscaling.targetMemoryUtilizationPercentage | int | `50` | Average memory utilization percentage for the Argo CD server [HPA] |
1146+
| server.backendTLSPolicy.annotations | object | `{}` | Additional BackendTLSPolicy annotations |
1147+
| server.backendTLSPolicy.enabled | bool | `false` | Enable BackendTLSPolicy resource for Argo CD server (Gateway API) |
1148+
| server.backendTLSPolicy.labels | object | `{}` | Additional BackendTLSPolicy labels |
1149+
| server.backendTLSPolicy.targetRefs | list | `[]` (See [values.yaml]) | Target references for the BackendTLSPolicy |
1150+
| server.backendTLSPolicy.validation | object | `{}` (See [values.yaml]) | TLS validation configuration |
10801151
| server.certificate.additionalHosts | list | `[]` | Certificate Subject Alternate Names (SANs) |
10811152
| server.certificate.annotations | object | `{}` | Annotations to be applied to the Server Certificate |
10821153
| server.certificate.domain | string | `""` (defaults to global.domain) | Certificate primary domain (commonName) |
@@ -1119,16 +1190,19 @@ NAME: my-release
11191190
| server.extensions.resources | object | `{}` | Resource limits and requests for the argocd-extensions container |
11201191
| server.extraArgs | list | `[]` | Additional command line arguments to pass to Argo CD server |
11211192
| server.extraContainers | list | `[]` | Additional containers to be added to the server pod |
1193+
| server.grpcroute.annotations | object | `{}` | Additional GRPCRoute annotations |
1194+
| server.grpcroute.enabled | bool | `false` | Enable GRPCRoute resource for Argo CD server (Gateway API) |
1195+
| server.grpcroute.hostnames | list | `[]` (See [values.yaml]) | List of hostnames for the GRPCRoute |
1196+
| server.grpcroute.labels | object | `{}` | Additional GRPCRoute labels |
1197+
| server.grpcroute.parentRefs | list | `[]` (See [values.yaml]) | Gateway API parentRefs for the GRPCRoute |
1198+
| server.grpcroute.rules | list | `[]` (See [values.yaml]) | GRPCRoute rules configuration |
11221199
| server.hostNetwork | bool | `false` | Host Network for Server pods |
11231200
| server.httproute.annotations | object | `{}` | Additional HTTPRoute annotations |
11241201
| server.httproute.enabled | bool | `false` | Enable HTTPRoute resource for Argo CD server (Gateway API) |
1125-
| server.httproute.extraHosts | list | `[]` (See [values.yaml]) | The list of additional hostnames to be covered by HTTPRoute |
1126-
| server.httproute.extraRules | list | `[]` (See [values.yaml]) | Additional HTTPRoute rules |
1127-
| server.httproute.hostname | string | `""` (defaults to global.domain) | Argo CD server hostname |
1202+
| server.httproute.hostnames | list | `[]` (See [values.yaml]) | List of hostnames for the HTTPRoute |
11281203
| server.httproute.labels | object | `{}` | Additional HTTPRoute labels |
11291204
| server.httproute.parentRefs | list | `[]` (See [values.yaml]) | Gateway API parentRefs for the HTTPRoute |
1130-
| server.httproute.path | string | `"/"` | The path to Argo CD server |
1131-
| server.httproute.pathType | string | `"PathPrefix"` | HTTPRoute path type. One of `Exact`, `PathPrefix` or `RegularExpression` |
1205+
| server.httproute.rules | list | `[]` (See [values.yaml]) | HTTPRoute rules configuration |
11321206
| server.image.imagePullPolicy | string | `""` (defaults to global.image.imagePullPolicy) | Image pull policy for the Argo CD server |
11331207
| server.image.repository | string | `""` (defaults to global.image.repository) | Repository to use for the Argo CD server |
11341208
| server.image.tag | string | `""` (defaults to global.image.tag) | Tag to use for the Argo CD server |

‎charts/argo-cd/README.md.gotmpl‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -236,6 +236,72 @@ server:
236236
enabled: true
237237
```
238238

239+
### Gateway API HTTPRoute
240+
241+
The Gateway API provides a modern, extensible way to configure ingress traffic routing. This chart supports HTTPRoute resources as an alternative to traditional Ingress.
242+
243+
> **Note:**
244+
> Gateway API support is **EXPERIMENTAL**. Support depends on your Gateway controller implementation. Some controllers may require additional configuration (e.g., BackendTLSPolicy for HTTPS backends). Refer to [Gateway API implementations](https://gateway-api.sigs.k8s.io/implementations/) for controller-specific details.
245+
246+
```yaml
247+
global:
248+
domain: argocd.example.com
249+
250+
server:
251+
httproute:
252+
enabled: true
253+
parentRefs:
254+
- name: example-gateway
255+
namespace: gateway-system
256+
sectionName: https
257+
```
258+
259+
#### Gateway API with gRPC support
260+
261+
For deployments requiring gRPC routing, use GRPCRoute alongside HTTPRoute:
262+
263+
```yaml
264+
server:
265+
httproute:
266+
enabled: true
267+
parentRefs:
268+
- name: example-gateway
269+
namespace: gateway-system
270+
sectionName: https
271+
272+
grpcroute:
273+
enabled: true
274+
parentRefs:
275+
- name: example-gateway
276+
namespace: gateway-system
277+
sectionName: grpc
278+
```
279+
280+
#### Gateway API with TLS backend
281+
282+
For HTTPS backends with Gateway API, you may need to configure BackendTLSPolicy (experimental, v1alpha3):
283+
284+
> **Warning:**
285+
> BackendTLSPolicy is in **EXPERIMENTAL** status. Not all Gateway controllers support this resource (e.g., Cilium does not yet support it).
286+
287+
```yaml
288+
configs:
289+
params:
290+
server.insecure: false # HTTPS backend
291+
292+
server:
293+
httproute:
294+
enabled: true
295+
parentRefs:
296+
- name: example-gateway
297+
namespace: gateway-system
298+
299+
backendTLSPolicy:
300+
enabled: true
301+
hostname: argocd-server.argocd.svc.cluster.local
302+
wellKnownCACertificates: System
303+
```
304+
239305
## Setting the initial admin password via Argo CD Application CR
240306

241307
> **Note:** When deploying the `argo-cd` chart via an Argo CD `Application` CR, define your bcrypt-hashed admin password under `helm.values`—not `helm.parameters`—because Argo CD performs variable substitution on `parameters`, which will mangle any `$…` in your hash.

‎charts/argo-cd/templates/argocd-server/backendtlspolicy.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{{- if .Values.server.backendTLSPolicy.enabled -}}
2+
{{- $fullName := include "argo-cd.server.fullname" . -}}
3+
apiVersion: gateway.networking.k8s.io/v1alpha3
4+
kind: BackendTLSPolicy
5+
metadata:
6+
name: {{ $fullName }}
7+
namespace: {{ include "argo-cd.namespace" . }}
8+
labels:
9+
{{- include "argo-cd.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
10+
{{- with .Values.server.backendTLSPolicy.labels }}
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
{{- with .Values.server.backendTLSPolicy.annotations }}
14+
annotations:
15+
{{- toYaml . | nindent 4 }}
16+
{{- end }}
17+
spec:
18+
targetRefs:
19+
{{- with .Values.server.backendTLSPolicy.targetRefs }}
20+
{{- toYaml . | nindent 4 }}
21+
{{- end }}
22+
{{- with .Values.server.backendTLSPolicy.validation }}
23+
validation:
24+
{{- toYaml . | nindent 4 }}
25+
{{- end }}
26+
{{- end }}

‎charts/argo-cd/templates/argocd-server/grpcroute.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{{- if .Values.server.grpcroute.enabled -}}
2+
{{- $fullName := include "argo-cd.server.fullname" . -}}
3+
{{- $insecure := index .Values.configs.params "server.insecure" | toString -}}
4+
{{- $servicePort := eq $insecure "true" | ternary .Values.server.service.servicePortHttp .Values.server.service.servicePortHttps -}}
5+
apiVersion: gateway.networking.k8s.io/v1
6+
kind: GRPCRoute
7+
metadata:
8+
name: {{ $fullName }}-grpc
9+
namespace: {{ include "argo-cd.namespace" . }}
10+
labels:
11+
{{- include "argo-cd.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
12+
{{- with .Values.server.grpcroute.labels }}
13+
{{- toYaml . | nindent 4 }}
14+
{{- end }}
15+
{{- with .Values.server.grpcroute.annotations }}
16+
annotations:
17+
{{- toYaml . | nindent 4 }}
18+
{{- end }}
19+
spec:
20+
parentRefs:
21+
{{- with .Values.server.grpcroute.parentRefs }}
22+
{{- toYaml . | nindent 4 }}
23+
{{- end }}
24+
{{- with .Values.server.grpcroute.hostnames }}
25+
hostnames:
26+
{{- toYaml . | nindent 4 }}
27+
{{- end }}
28+
rules:
29+
{{- range .Values.server.grpcroute.rules }}
30+
{{- with .matches }}
31+
- matches:
32+
{{- toYaml . | nindent 8 }}
33+
{{- end }}
34+
{{- with .filters }}
35+
filters:
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
38+
backendRefs:
39+
- name: {{ $fullName }}
40+
port: {{ $servicePort }}
41+
weight: 1
42+
{{- end }}
43+
{{- end }}

‎charts/argo-cd/templates/argocd-server/httproute.yaml‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,43 @@
11
{{- if .Values.server.httproute.enabled -}}
2+
{{- $fullName := include "argo-cd.server.fullname" . -}}
23
{{- $insecure := index .Values.configs.params "server.insecure" | toString -}}
34
{{- $servicePort := eq $insecure "true" | ternary .Values.server.service.servicePortHttp .Values.server.service.servicePortHttps -}}
45
apiVersion: gateway.networking.k8s.io/v1
56
kind: HTTPRoute
67
metadata:
7-
name: {{ include "argo-cd.server.fullname" . }}
8+
name: {{ $fullName }}
89
namespace: {{ include "argo-cd.namespace" . }}
910
labels:
1011
{{- include "argo-cd.labels" (dict "context" . "component" .Values.server.name "name" .Values.server.name) | nindent 4 }}
1112
{{- with .Values.server.httproute.labels }}
12-
{{- tpl (toYaml .) $ | nindent 4 }}
13+
{{- toYaml . | nindent 4 }}
1314
{{- end }}
1415
{{- with .Values.server.httproute.annotations }}
1516
annotations:
16-
{{- range $key, $value := . }}
17-
{{ $key }}: {{ tpl (toString $value) $ | quote }}
18-
{{- end }}
17+
{{- toYaml . | nindent 4 }}
1918
{{- end }}
2019
spec:
21-
{{- with .Values.server.httproute.parentRefs }}
2220
parentRefs:
23-
{{- tpl (toYaml .) $ | nindent 4 }}
24-
{{- end }}
25-
{{- if or .Values.server.httproute.hostname .Values.global.domain }}
26-
hostnames:
27-
- {{ tpl (.Values.server.httproute.hostname) $ | default .Values.global.domain }}
28-
{{- range .Values.server.httproute.extraHosts }}
29-
- {{ tpl .name $ }}
21+
{{- with .Values.server.httproute.parentRefs }}
22+
{{- toYaml . | nindent 4 }}
3023
{{- end }}
24+
{{- with .Values.server.httproute.hostnames }}
25+
hostnames:
26+
{{- toYaml . | nindent 4 }}
3127
{{- end }}
3228
rules:
29+
{{- range .Values.server.httproute.rules }}
30+
{{- with .matches }}
3331
- matches:
34-
- path:
35-
type: {{ .Values.server.httproute.pathType }}
36-
value: {{ .Values.server.httproute.path }}
32+
{{- toYaml . | nindent 8 }}
33+
{{- end }}
34+
{{- with .filters }}
35+
filters:
36+
{{- toYaml . | nindent 8 }}
37+
{{- end }}
3738
backendRefs:
38-
- name: {{ include "argo-cd.server.fullname" . }}
39+
- name: {{ $fullName }}
3940
port: {{ $servicePort }}
40-
{{- with .Values.server.httproute.extraRules }}
41-
{{- tpl (toYaml .) $ | nindent 4 }}
41+
weight: 1
4242
{{- end }}
4343
{{- end }}

0 commit comments

Comments
 (0)
⚡