Enable Cilium Gateway API #923 - #924

packages/system/gateway-api/Chart.yaml (1)

1-3: Add chart metadata and verify version handling
The Chart.yaml correctly defines apiVersion, name, and uses a version: 0.0.0 placeholder for CI-driven updates. Consider adding a description field to improve chart discoverability:

description: Cozystack Gateway API Helm chart

Also ensure your build pipeline replaces the placeholder version as intended to avoid packaging/installation failures.

packages/system/gateway-api/Makefile (1)

1-9: Parameterize the CRD version
Hardcoding v1.2.0 in the kubectl kustomize command will require manual updates for future Gateway API releases. Introduce a CRD_VERSION variable and reference it:

-export NAME=gateway-api
-export NAMESPACE=cozy-$(NAME)
+export NAME := gateway-api
+export NAMESPACE := cozy-$(NAME)
+CRD_VERSION := v1.2.0

 update:
 	rm -rf templates
 	mkdir templates
-	kubectl kustomize "github.com/kubernetes-sigs/gateway-api/config/crd/experimental?ref=v1.2.0" > templates/crds-experimental.yaml
+	kubectl kustomize "github.com/kubernetes-sigs/gateway-api/config/crd/experimental?ref=$(CRD_VERSION)" > templates/crds-experimental.yaml

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

packages/apps/kubernetes/templates/helmreleases/gateway-api.yaml (2)

9-18: Pin your chart version to avoid unintended upgrades
Right now this will always track the latest chart in the repo. It’s safer to add a version field under spec.chart (e.g. version: 0.0.0 or a templated placeholder) so that automated rollouts only happen when you explicitly bump it.

 spec:
   interval: 5m
   releaseName: gateway-api
   chart:
     spec:
       chart: cozy-gateway-api
+      version: 0.0.0   # pin to the initial version; update via your build pipeline
       reconcileStrategy: Revision

---

23-26: Consider isolating the Gateway API in its own namespace
Deploying in kube-system can blur the line between system and workload components. You might improve security and manageability by creating a dedicated namespace (e.g. gateway-system) instead of reusing kube-system.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

packages/apps/kubernetes/templates/helmreleases/gateway-api.yaml (1)

32-36: Fixed self-referential dependsOn block
This block currently creates a dependency on itself, which has no effect. To depend on the Cilium HelmRelease (named {{ .Release.Name }}-cilium), replace it as follows:

-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
+  dependsOn:
+    - name: {{ .Release.Name }}-cilium
+      namespace: {{ .Release.Namespace }}

packages/apps/kubernetes/templates/helmreleases/gateway-api.yaml (3)

1-4: Quote templating for valid YAML and suppress linter false positives
YAML linters (e.g., yamllint) will error on unquoted Go template scalars. Wrap templated values in quotes to maintain valid YAML syntax:

metadata:
-  name: {{ .Release.Name }}-gateway-api
+  name: "{{ .Release.Name }}-gateway-api"

You can apply the same quoting pattern to other templated fields or disable YAMLLint on this file if preferred.

🧰 Tools

🪛 YAMLlint (1.35.1)

[error] 4-4: syntax error: expected , but found ''

(syntax)

---

23-24: Namespace selection for installation
Using kube-system for both targetNamespace and storageNamespace may introduce resource noise in the core namespace. Consider isolating the Gateway API resources in a dedicated namespace (e.g., cozy-system-networking) for clearer ownership and easier cleanup.

---

25-31: Reconsider unlimited retry strategy
Setting both install.remediation.retries and upgrade.remediation.retries to -1 allows infinite retries, which could mask persistent failures and lead to resource churn. You may want to use a finite retry count (e.g., 3 or 5) or add a timeout:

 install:
-  remediation:
-    retries: -1
+  remediation:
+    retries: 5

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

packages/apps/kubernetes/templates/helmreleases/gateway-api.yaml (1)

32-36: Remove self-dependency and fix indentation
This block creates a self-referential dependency (.Release.Name) which has no effect and introduces invalid YAML indentation. To depend on the Cilium HelmRelease instead, update as follows:

-spec:
-  dependsOn:
-  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace .Release.Name }}
-  - name: {{ .Release.Name }}
-    namespace: {{ .Release.Namespace }}
-  {{- end }}
+spec:
+  dependsOn:
+  {{- if lookup "helm.toolkit.fluxcd.io/v2" "HelmRelease" .Release.Namespace (printf "%s-cilium" .Release.Name) }}
+    - name: {{ printf "%s-cilium" .Release.Name }}
+      namespace: {{ .Release.Namespace }}
+  {{- end }}

packages/apps/kubernetes/templates/helmreleases/gateway-api.yaml (3)

9-10: Ensure dynamic Helm release naming
Currently you use a static releaseName: gateway-api. If you deploy multiple clusters or need to avoid name collisions, consider making this dynamic to match metadata.name:

-spec:
-  releaseName: gateway-api
+spec:
+  releaseName: {{ printf "%s-gateway-api" .Release.Name }}

---

11-18: Pin chart version and validate sourceRef

• You’re relying on reconcileStrategy: Revision without specifying a version:. Adding a version constraint improves reproducibility:

      spec:
        chart: cozy-gateway-api

•   version: <semver>
    reconcileStrategy: Revision
  

• Verify that a HelmRepository named cozystack-system exists in the cozy-system namespace.

---

23-31: Consider namespace isolation for Gateway API
Deploying both control-plane and release artifacts into kube-system can blur system boundaries. You might:

• Use a dedicated namespace (e.g., gateway-system) for targetNamespace.
• Revert storageNamespace to Flux’s default (flux-system) unless you have a specific reason to store Helm artifacts in kube-system.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

packages/apps/kubernetes/templates/helmreleases/gateway-api-crds.yaml (2)

11-11: Consider using a dynamic releaseName.

Hardcoding releaseName: gateway-api-crds may conflict if multiple clusters share the same storage namespace. For consistency with metadata.name, consider:

-releaseName: gateway-api-crds
+releaseName: {{ .Release.Name }}-gateway-api-crds

---

33-37: Ensure dependsOn indentation is correct.

The dependsOn: block must have its list items properly indented in the rendered YAML (dependsOn: at one level, items two spaces deeper). Misalignment can cause the dependency to be ignored.

packages/apps/kubernetes/templates/helmreleases/delete.yaml (1)

33-33: ⚠️ Potential issue

Missing RBAC permission for gateway-api-crds.

You added {{ .Release.Name }}-gateway-api-crds to the patch command, but the Role’s resourceNames list does not include it. Without that entry, the pre-delete hook cannot suspend this HelmRelease. Please update the Role to grant patch rights on {{ .Release.Name }}-gateway-api-crds.

Suggested diff:

--- a/packages/apps/kubernetes/templates/helmreleases/delete.yaml
+++ b/packages/apps/kubernetes/templates/helmreleases/delete.yaml
@@ resourceNames:
-        - {{ .Release.Name }}-cilium
+        - {{ .Release.Name }}-cilium
+        - {{ .Release.Name }}-gateway-api-crds
         - {{ .Release.Name }}-csi

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

@@ resourceNames:
-        - {{ .Release.Name }}-cilium
+        - {{ .Release.Name }}-cilium
+        - {{ .Release.Name }}-gateway-api-crds
         - {{ .Release.Name }}-csi