Skip to content

Commit f0ee67f

Browse files
waleedlatif1claude
waleedlatif1
and
claude
authored
improvement(helm): add internal ingress support and same-host path consolidation (#2960)
* improvement(helm): add internal ingress support and same-host path consolidation * improvement(helm): clean up ingress template comments Simplify verbose inline Helm comments and section dividers to match the minimal style used in services.yaml. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix(helm): add missing copilot path consolidation for realtime host When copilot.host equals realtime.host but differs from app.host, copilot paths were not being routed. Added logic to consolidate copilot paths into the realtime rule for this scenario. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * improvement(helm): follow ingress best practices - Remove orphan comments that appeared when services were disabled - Add documentation about path ordering requirements - Paths rendered in order: realtime, copilot, app (specific before catch-all) - Clean template output matching industry Helm chart standards --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
1 parent f44594c commit f0ee67f

File tree

4 files changed

+228
-30
lines changed

4 files changed

+228
-30
lines changed

‎helm/sim/examples/values-azure.yaml‎

Lines changed: 33 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -172,29 +172,56 @@ ollama:
172172
OLLAMA_KEEP_ALIVE: "-1"
173173
OLLAMA_DEBUG: "1"
174174

175-
# Ingress configuration (NGINX ingress controller on Azure AKS)
175+
# Ingress configuration
176176
ingress:
177177
enabled: true
178178
className: nginx
179-
179+
180180
annotations:
181181
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
182-
182+
183183
# Main application
184184
app:
185185
host: simstudio.acme.com
186186
paths:
187187
- path: /
188188
pathType: Prefix
189-
189+
190190
# Realtime service
191191
realtime:
192192
host: simstudio-ws.acme.com
193193
paths:
194194
- path: /
195195
pathType: Prefix
196-
196+
197+
# TLS configuration
198+
tls:
199+
enabled: true
200+
secretName: simstudio-tls-secret
201+
202+
# Internal Ingress configuration
203+
ingressInternal:
204+
enabled: false
205+
className: azure-application-gateway
206+
207+
annotations:
208+
appgw.ingress.kubernetes.io/use-private-ip: "true"
209+
210+
# Main application
211+
app:
212+
host: simstudio-internal.acme.local
213+
paths:
214+
- path: /
215+
pathType: Prefix
216+
217+
# Realtime service
218+
realtime:
219+
host: simstudio-internal.acme.local
220+
paths:
221+
- path: /socket.io
222+
pathType: Prefix
223+
197224
# TLS configuration
198225
tls:
199226
enabled: true
200-
secretName: simstudio-tls-secret
227+
secretName: simstudio-internal-tls-secret

‎helm/sim/templates/ingress-internal.yaml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
{{- if .Values.ingressInternal.enabled }}
2+
apiVersion: networking.k8s.io/v1
3+
kind: Ingress
4+
metadata:
5+
name: {{ include "sim.fullname" . }}-ingress-internal
6+
namespace: {{ .Release.Namespace }}
7+
labels:
8+
{{- include "sim.labels" . | nindent 4 }}
9+
{{- with .Values.ingressInternal.annotations }}
10+
annotations:
11+
{{- toYaml . | nindent 4 }}
12+
{{- end }}
13+
spec:
14+
{{- if .Values.ingressInternal.className }}
15+
ingressClassName: {{ .Values.ingressInternal.className }}
16+
{{- end }}
17+
{{- if .Values.ingressInternal.tls.enabled }}
18+
tls:
19+
- hosts:
20+
- {{ .Values.ingressInternal.app.host | quote }}
21+
{{- if and .Values.realtime.enabled (ne .Values.ingressInternal.realtime.host .Values.ingressInternal.app.host) }}
22+
- {{ .Values.ingressInternal.realtime.host | quote }}
23+
{{- end }}
24+
{{- if and .Values.copilot.enabled .Values.ingressInternal.copilot }}
25+
{{- if and (ne .Values.ingressInternal.copilot.host .Values.ingressInternal.app.host) (ne .Values.ingressInternal.copilot.host .Values.ingressInternal.realtime.host) }}
26+
- {{ .Values.ingressInternal.copilot.host | quote }}
27+
{{- end }}
28+
{{- end }}
29+
secretName: {{ .Values.ingressInternal.tls.secretName }}
30+
{{- end }}
31+
rules:
32+
- host: {{ .Values.ingressInternal.app.host | quote }}
33+
http:
34+
paths:
35+
{{- if and .Values.realtime.enabled (eq .Values.ingressInternal.realtime.host .Values.ingressInternal.app.host) }}
36+
{{- range .Values.ingressInternal.realtime.paths }}
37+
- path: {{ .path }}
38+
pathType: {{ .pathType }}
39+
backend:
40+
service:
41+
name: {{ include "sim.fullname" $ }}-realtime
42+
port:
43+
number: {{ $.Values.realtime.service.port }}
44+
{{- end }}
45+
{{- end }}
46+
{{- if and .Values.copilot.enabled .Values.ingressInternal.copilot (eq .Values.ingressInternal.copilot.host .Values.ingressInternal.app.host) }}
47+
{{- range .Values.ingressInternal.copilot.paths }}
48+
- path: {{ .path }}
49+
pathType: {{ .pathType }}
50+
backend:
51+
service:
52+
name: {{ include "sim.fullname" $ }}-copilot
53+
port:
54+
number: {{ $.Values.copilot.server.service.port }}
55+
{{- end }}
56+
{{- end }}
57+
{{- range .Values.ingressInternal.app.paths }}
58+
- path: {{ .path }}
59+
pathType: {{ .pathType }}
60+
backend:
61+
service:
62+
name: {{ include "sim.fullname" $ }}-app
63+
port:
64+
number: {{ $.Values.app.service.port }}
65+
{{- end }}
66+
{{- if and .Values.realtime.enabled (ne .Values.ingressInternal.realtime.host .Values.ingressInternal.app.host) }}
67+
- host: {{ .Values.ingressInternal.realtime.host | quote }}
68+
http:
69+
paths:
70+
{{- range .Values.ingressInternal.realtime.paths }}
71+
- path: {{ .path }}
72+
pathType: {{ .pathType }}
73+
backend:
74+
service:
75+
name: {{ include "sim.fullname" $ }}-realtime
76+
port:
77+
number: {{ $.Values.realtime.service.port }}
78+
{{- end }}
79+
{{- if and .Values.copilot.enabled .Values.ingressInternal.copilot (eq .Values.ingressInternal.copilot.host .Values.ingressInternal.realtime.host) }}
80+
{{- range .Values.ingressInternal.copilot.paths }}
81+
- path: {{ .path }}
82+
pathType: {{ .pathType }}
83+
backend:
84+
service:
85+
name: {{ include "sim.fullname" $ }}-copilot
86+
port:
87+
number: {{ $.Values.copilot.server.service.port }}
88+
{{- end }}
89+
{{- end }}
90+
{{- end }}
91+
{{- if and .Values.copilot.enabled .Values.ingressInternal.copilot (and (ne .Values.ingressInternal.copilot.host .Values.ingressInternal.app.host) (ne .Values.ingressInternal.copilot.host .Values.ingressInternal.realtime.host)) }}
92+
- host: {{ .Values.ingressInternal.copilot.host | quote }}
93+
http:
94+
paths:
95+
{{- range .Values.ingressInternal.copilot.paths }}
96+
- path: {{ .path }}
97+
pathType: {{ .pathType }}
98+
backend:
99+
service:
100+
name: {{ include "sim.fullname" $ }}-copilot
101+
port:
102+
number: {{ $.Values.copilot.server.service.port }}
103+
{{- end }}
104+
{{- end }}
105+
{{- end }}

‎helm/sim/templates/ingress.yaml‎

Lines changed: 45 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,20 +17,43 @@ spec:
1717
{{- if .Values.ingress.tls.enabled }}
1818
tls:
1919
- hosts:
20-
- {{ .Values.ingress.app.host }}
21-
{{- if .Values.realtime.enabled }}
22-
- {{ .Values.ingress.realtime.host }}
20+
- {{ .Values.ingress.app.host | quote }}
21+
{{- if and .Values.realtime.enabled (ne .Values.ingress.realtime.host .Values.ingress.app.host) }}
22+
- {{ .Values.ingress.realtime.host | quote }}
2323
{{- end }}
2424
{{- if and .Values.copilot.enabled .Values.ingress.copilot }}
25-
- {{ .Values.ingress.copilot.host }}
25+
{{- if and (ne .Values.ingress.copilot.host .Values.ingress.app.host) (ne .Values.ingress.copilot.host .Values.ingress.realtime.host) }}
26+
- {{ .Values.ingress.copilot.host | quote }}
27+
{{- end }}
2628
{{- end }}
2729
secretName: {{ .Values.ingress.tls.secretName }}
2830
{{- end }}
2931
rules:
30-
# Main application ingress rule
31-
- host: {{ .Values.ingress.app.host }}
32+
- host: {{ .Values.ingress.app.host | quote }}
3233
http:
3334
paths:
35+
{{- if and .Values.realtime.enabled (eq .Values.ingress.realtime.host .Values.ingress.app.host) }}
36+
{{- range .Values.ingress.realtime.paths }}
37+
- path: {{ .path }}
38+
pathType: {{ .pathType }}
39+
backend:
40+
service:
41+
name: {{ include "sim.fullname" $ }}-realtime
42+
port:
43+
number: {{ $.Values.realtime.service.port }}
44+
{{- end }}
45+
{{- end }}
46+
{{- if and .Values.copilot.enabled .Values.ingress.copilot (eq .Values.ingress.copilot.host .Values.ingress.app.host) }}
47+
{{- range .Values.ingress.copilot.paths }}
48+
- path: {{ .path }}
49+
pathType: {{ .pathType }}
50+
backend:
51+
service:
52+
name: {{ include "sim.fullname" $ }}-copilot
53+
port:
54+
number: {{ $.Values.copilot.server.service.port }}
55+
{{- end }}
56+
{{- end }}
3457
{{- range .Values.ingress.app.paths }}
3558
- path: {{ .path }}
3659
pathType: {{ .pathType }}
@@ -40,9 +63,8 @@ spec:
4063
port:
4164
number: {{ $.Values.app.service.port }}
4265
{{- end }}
43-
{{- if .Values.realtime.enabled }}
44-
# Realtime service ingress rule
45-
- host: {{ .Values.ingress.realtime.host }}
66+
{{- if and .Values.realtime.enabled (ne .Values.ingress.realtime.host .Values.ingress.app.host) }}
67+
- host: {{ .Values.ingress.realtime.host | quote }}
4668
http:
4769
paths:
4870
{{- range .Values.ingress.realtime.paths }}
@@ -54,10 +76,20 @@ spec:
5476
port:
5577
number: {{ $.Values.realtime.service.port }}
5678
{{- end }}
79+
{{- if and .Values.copilot.enabled .Values.ingress.copilot (eq .Values.ingress.copilot.host .Values.ingress.realtime.host) }}
80+
{{- range .Values.ingress.copilot.paths }}
81+
- path: {{ .path }}
82+
pathType: {{ .pathType }}
83+
backend:
84+
service:
85+
name: {{ include "sim.fullname" $ }}-copilot
86+
port:
87+
number: {{ $.Values.copilot.server.service.port }}
88+
{{- end }}
89+
{{- end }}
5790
{{- end }}
58-
{{- if and .Values.copilot.enabled .Values.ingress.copilot }}
59-
# Copilot service ingress rule
60-
- host: {{ .Values.ingress.copilot.host }}
91+
{{- if and .Values.copilot.enabled .Values.ingress.copilot (and (ne .Values.ingress.copilot.host .Values.ingress.app.host) (ne .Values.ingress.copilot.host .Values.ingress.realtime.host)) }}
92+
- host: {{ .Values.ingress.copilot.host | quote }}
6193
http:
6294
paths:
6395
{{- range .Values.ingress.copilot.paths }}
@@ -70,4 +102,4 @@ spec:
70102
number: {{ $.Values.copilot.server.service.port }}
71103
{{- end }}
72104
{{- end }}
73-
{{- end }}
105+
{{- end }}

‎helm/sim/values.yaml‎

Lines changed: 45 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -552,36 +552,70 @@ ollama:
552552
extraVolumeMounts: []
553553

554554
# Ingress configuration
555+
# When services share the same host, paths are consolidated into a single rule.
556+
# Path order: realtime paths, copilot paths, then app paths (most specific first).
557+
# Ensure specific paths (e.g., /socket.io, /copilot) come before catch-all paths (/).
555558
ingress:
556-
# Enable/disable ingress
557559
enabled: false
558-
559-
# Ingress class name
560560
className: nginx
561-
562-
# Annotations
561+
563562
annotations:
564563
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
565-
566-
# Main application host configuration
564+
565+
# Main application (use / as catch-all)
567566
app:
568567
host: sim.local
569568
paths:
570569
- path: /
571570
pathType: Prefix
572-
573-
# Realtime service host configuration
571+
572+
# Realtime service (use /socket.io when sharing host with app)
574573
realtime:
575574
host: sim-ws.local
576575
paths:
577576
- path: /
578577
pathType: Prefix
579-
580-
# TLS configuration
578+
579+
# Copilot service (optional, use /copilot when sharing host)
580+
# copilot:
581+
# host: sim.local
582+
# paths:
583+
# - path: /copilot
584+
# pathType: Prefix
585+
581586
tls:
582587
enabled: false
583588
secretName: sim-tls-secret
584589

590+
# Internal Ingress configuration
591+
# Same path ordering rules apply as above.
592+
ingressInternal:
593+
enabled: false
594+
className: nginx
595+
annotations: {}
596+
597+
app:
598+
host: sim-internal.local
599+
paths:
600+
- path: /
601+
pathType: Prefix
602+
603+
realtime:
604+
host: sim-internal.local
605+
paths:
606+
- path: /socket.io
607+
pathType: Prefix
608+
609+
# copilot:
610+
# host: sim-internal.local
611+
# paths:
612+
# - path: /copilot
613+
# pathType: Prefix
614+
615+
tls:
616+
enabled: false
617+
secretName: sim-internal-tls-secret
618+
585619
# Service Account configuration
586620
serviceAccount:
587621
# Specifies whether a service account should be created

0 commit comments

Comments
 (0)