Gateway api support (#890)

* Gateway api support Signed-off-by: Kevin Fox <[email protected]> * Update readme Signed-off-by: Kevin Fox <[email protected]> * Fix gateway name. a gateway doesnt need to be named gateway Signed-off-by: Kevin Fox <[email protected]> * Fix naming issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
2026-07-30 19:38:43 +00:00
parent 2d92b81ba4
commit 3cfefb72ba
39 changed files with 1015 additions and 5 deletions
@@ -0,0 +1,12 @@
+{{- if .Values.fetchCA.gatewayAPI.enabled -}}
+{{- $fullName := printf "%s-fetchca" (include "spiffe-step-ssh.fullname" .) -}}
+{{- include "spire-lib.gateway-routes" (dict
+      "root" .
+      "gatewayAPI" .Values.fetchCA.gatewayAPI
+      "name" $fullName
+      "namespace" .Release.Namespace
+      "svcName" $fullName
+      "port" .Values.fetchCA.service.port
+      "labels" (include "spiffe-step-ssh.labels" .)
+      "routeKind" "TLSRoute") }}
+{{- end }}
@@ -0,0 +1,12 @@
+{{- if .Values.gatewayAPI.enabled -}}
+{{- $fullName := include "spiffe-step-ssh.fullname" . -}}
+{{- include "spire-lib.gateway-routes" (dict
+      "root" .
+      "gatewayAPI" .Values.gatewayAPI
+      "name" $fullName
+      "namespace" .Release.Namespace
+      "svcName" $fullName
+      "port" .Values.step.service.port
+      "labels" (include "spiffe-step-ssh.labels" .)
+      "routeKind" "TLSRoute") }}
+{{- end }}
@@ -72,6 +72,21 @@ stepIngress:
  #  - hosts:
  #      - spiffe-step-ssh.example.org

+gatewayAPI:
+  ## @param gatewayAPI.enabled Flag to expose the step endpoint via Gateway API (TLS passthrough)
+  enabled: false
+  ## @param gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
+  host: "spiffe-step-ssh"
+  ## @param gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
+  annotations: {}
+  listenerSet:
+    ## @param gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
+    enabled: null
+  ## @param gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
+  parentRefs: []
+  ## @param gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
+  sectionName: ""
+
 ## @skip step
 step:
  service:
@@ -233,6 +248,21 @@ fetchCA:
    #  - hosts:
    #      - spiffe-step-ssh-fetchca.example.org

+  gatewayAPI:
+    ## @param fetchCA.gatewayAPI.enabled Flag to expose the fetchCA endpoint via Gateway API (TLS passthrough)
+    enabled: false
+    ## @param fetchCA.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
+    host: "spiffe-step-ssh-fetchca"
+    ## @param fetchCA.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
+    annotations: {}
+    listenerSet:
+      ## @param fetchCA.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
+      enabled: null
+    ## @param fetchCA.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
+    parentRefs: []
+    ## @param fetchCA.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
+    sectionName: ""
+
  ## @param fetchCA.autoscaling.enabled Enable autoscaling
  ## @param fetchCA.autoscaling.minReplicas Minimum number of replicas to deploy
  ## @param fetchCA.autoscaling.maxReplicas Maximum number of replicas to deploy