Gateway api support (#890)

* Gateway api support Signed-off-by: Kevin Fox <[email protected]> * Update readme Signed-off-by: Kevin Fox <[email protected]> * Fix gateway name. a gateway doesnt need to be named gateway Signed-off-by: Kevin Fox <[email protected]> * Fix naming issue Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> * Incorperate feedback Signed-off-by: Kevin Fox <[email protected]> --------- Signed-off-by: Kevin Fox <[email protected]>
2026-07-30 19:38:43 +00:00
parent 2d92b81ba4
commit 3cfefb72ba
39 changed files with 1015 additions and 5 deletions
@@ -284,6 +284,31 @@ rest:
    #    hosts:
    #      - spire-identity-exchange-rest.example.org

+  ## Gateway API exposure for the REST endpoint. Independent of rest.ingress. The
+  ## backend serves HTTPS, so a set tlsSecret => HTTPRoute + BackendTLSPolicy
+  ## (reencrypt); blank tlsSecret => TLSRoute (SNI passthrough).
+  gatewayAPI:
+    ## @param rest.gatewayAPI.enabled Flag to expose the REST endpoint via Gateway API
+    enabled: false
+    ## @param rest.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
+    host: "spire-identity-exchange-rest"
+    ## @param rest.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
+    tlsSecret: ""
+    ## @param rest.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
+    annotations: {}
+    listenerSet:
+      ## @param rest.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
+      enabled: null
+    ## @param rest.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
+    parentRefs: []
+    ## @param rest.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
+    sectionName: ""
+    # BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
+    # HTTPS backend when gatewayAPI.tlsSecret is set.
+    backendTLS:
+      ## @param rest.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
+      caCertificateRefs: []
+
 grpc:
  ## @param grpc.enabled Enable the grpc service
  enabled: false
@@ -331,6 +356,31 @@ grpc:
    #    hosts:
    #      - spire-identiy-exchange-grpc.example.org

+  ## Gateway API exposure for the gRPC endpoint. Independent of grpc.ingress. The
+  ## backend serves HTTPS, so a set tlsSecret => HTTPRoute + BackendTLSPolicy
+  ## (reencrypt); blank tlsSecret => TLSRoute (SNI passthrough).
+  gatewayAPI:
+    ## @param grpc.gatewayAPI.enabled Flag to expose the gRPC endpoint via Gateway API
+    enabled: false
+    ## @param grpc.gatewayAPI.host Host name for the route. If no '.' in host, trustDomain is automatically appended.
+    host: "spire-identity-exchange-grpc"
+    ## @param grpc.gatewayAPI.tlsSecret Secret with the TLS cert for edge termination. Blank keeps passthrough.
+    tlsSecret: ""
+    ## @param grpc.gatewayAPI.annotations [object] Annotations for the route (and its ListenerSet)
+    annotations: {}
+    listenerSet:
+      ## @param grpc.gatewayAPI.listenerSet.enabled Manage a ListenerSet for this service's SNI listener. Null inherits global.spire.gatewayAPI.manageListenerSets.
+      enabled: null
+    ## @param grpc.gatewayAPI.parentRefs [array] parentRefs used when ListenerSet management is disabled (direct attach)
+    parentRefs: []
+    ## @param grpc.gatewayAPI.sectionName Listener sectionName override when attaching directly to a Gateway
+    sectionName: ""
+    # BackendTLSPolicy (reencrypt) is emitted automatically for the terminated
+    # HTTPS backend when gatewayAPI.tlsSecret is set.
+    backendTLS:
+      ## @param grpc.gatewayAPI.backendTLS.caCertificateRefs [array] ConfigMap refs holding the backend CA used to validate the re-encrypted connection. Defaults to the SPIRE bundle configmap.
+      caCertificateRefs: []
+
 tools:
  kubectl:
    ## @param tools.kubectl.image.registry The OCI registry to pull the image from