From 0af066f17e5ff78574f2ca09f81c584cb658c649 Mon Sep 17 00:00:00 2001 From: Felix Delattre Date: Thu, 23 Jul 2026 23:17:00 +0200 Subject: [PATCH] fix: keep chart rewrite and middleware annotations above user overrides --- .../eoapi/templates/networking/ingress.yaml | 42 ++++++++++--------- charts/eoapi/tests/ingress_test.yaml | 36 ++++++++++++++++ charts/eoapi/values.yaml | 2 +- docs/unified-ingress.md | 8 +++- 4 files changed, 65 insertions(+), 23 deletions(-) diff --git a/charts/eoapi/templates/networking/ingress.yaml b/charts/eoapi/templates/networking/ingress.yaml index bf37978f..35ecad7e 100644 --- a/charts/eoapi/templates/networking/ingress.yaml +++ b/charts/eoapi/templates/networking/ingress.yaml @@ -72,6 +72,26 @@ Helper template for generating ingress paths {{- if and .Values.ingress.enabled (include "eoapi.hasEnabledService" . | trim | eq "true") }} {{- $ingressAnnotations := .Values.ingress.annotations | default dict }} +{{- $annotations := dict }} +{{- if and (eq .Values.ingress.className "traefik") .Values.ingress.entrypoints }} +{{- $_ := set $annotations "traefik.ingress.kubernetes.io/router.entrypoints" (.Values.ingress.entrypoints | toString) }} +{{- end }} +{{- $annotations = mergeOverwrite $annotations $ingressAnnotations }} +{{- if eq .Values.ingress.className "nginx" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/rewrite-target" "/$2" }} +{{- $_ := set $annotations "nginx.ingress.kubernetes.io/use-regex" "true" }} +{{- end }} +{{- if eq .Values.ingress.className "traefik" }} +{{- /* strip-prefix always; also chain the browser bare-path redirect when the browser ingress is on. + Keep this condition in sync with the redirect Middleware in traefik-middleware.yaml. */}} +{{- $mwPrefix := printf "%s-%s" .Release.Namespace .Release.Name }} +{{- $middlewares := list (printf "%s-strip-prefix-middleware@kubernetescrd" $mwPrefix) }} +{{- $browser := .Values.browser }} +{{- if and $browser $browser.enabled (or (not $browser.ingress) $browser.ingress.enabled) }} +{{- $middlewares = append $middlewares (printf "%s-browser-redirect-middleware@kubernetescrd" $mwPrefix) }} +{{- end }} +{{- $_ := set $annotations "traefik.ingress.kubernetes.io/router.middlewares" (join "," $middlewares) }} +{{- end }} {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion }} apiVersion: networking.k8s.io/v1 {{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion }} @@ -84,28 +104,10 @@ metadata: name: {{ .Release.Name }}-ingress labels: app: {{ .Release.Name }}-ingress + {{- with $annotations }} annotations: - {{- if eq .Values.ingress.className "nginx" }} - nginx.ingress.kubernetes.io/rewrite-target: /$2 - nginx.ingress.kubernetes.io/use-regex: "true" - {{- end }} - {{- if eq .Values.ingress.className "traefik" }} - {{- if and .Values.ingress.entrypoints (not (hasKey $ingressAnnotations "traefik.ingress.kubernetes.io/router.entrypoints")) }} - traefik.ingress.kubernetes.io/router.entrypoints: {{ .Values.ingress.entrypoints | quote }} - {{- end }} - {{- /* strip-prefix always; also chain the browser bare-path redirect when the browser ingress is on. - Keep this condition in sync with the redirect Middleware in traefik-middleware.yaml. */}} - {{- $mwPrefix := printf "%s-%s" .Release.Namespace .Release.Name }} - {{- $middlewares := list (printf "%s-strip-prefix-middleware@kubernetescrd" $mwPrefix) }} - {{- $browser := .Values.browser }} - {{- if and $browser $browser.enabled (or (not $browser.ingress) $browser.ingress.enabled) }} - {{- $middlewares = append $middlewares (printf "%s-browser-redirect-middleware@kubernetescrd" $mwPrefix) }} - {{- end }} - traefik.ingress.kubernetes.io/router.middlewares: {{ join "," $middlewares }} - {{- end }} - {{- with $ingressAnnotations }} {{- toYaml . | nindent 4 }} - {{- end }} + {{- end }} spec: {{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} ingressClassName: {{ .Values.ingress.className }} diff --git a/charts/eoapi/tests/ingress_test.yaml b/charts/eoapi/tests/ingress_test.yaml index 5af6adff..c9a6b8cb 100644 --- a/charts/eoapi/tests/ingress_test.yaml +++ b/charts/eoapi/tests/ingress_test.yaml @@ -428,6 +428,42 @@ tests: cert-manager.io/cluster-issuer: "letsencrypt-prod" traefik.ingress.kubernetes.io/router.middlewares: NAMESPACE-RELEASE-NAME-strip-prefix-middleware@kubernetescrd + - it: "traefik chart middlewares win over user router.middlewares annotation" + set: + ingress.className: "traefik" + ingress.annotations: + traefik.ingress.kubernetes.io/router.middlewares: custom-auth@kubernetescrd + ingress.host: "eoapi.local" + raster.enabled: true + stac.enabled: false + vector.enabled: false + multidim.enabled: false + browser.enabled: false + asserts: + - equal: + path: metadata.annotations["traefik.ingress.kubernetes.io/router.middlewares"] + value: NAMESPACE-RELEASE-NAME-strip-prefix-middleware@kubernetescrd + + - it: "nginx chart rewrite annotations win over user rewrite-target/use-regex" + set: + ingress.className: "nginx" + ingress.annotations: + nginx.ingress.kubernetes.io/rewrite-target: /custom + nginx.ingress.kubernetes.io/use-regex: "false" + ingress.host: "eoapi.local" + raster.enabled: true + stac.enabled: false + vector.enabled: false + multidim.enabled: false + browser.enabled: false + asserts: + - equal: + path: metadata.annotations["nginx.ingress.kubernetes.io/rewrite-target"] + value: /$2 + - equal: + path: metadata.annotations["nginx.ingress.kubernetes.io/use-regex"] + value: "true" + - it: "docServer honors ingress.rootPath" template: templates/networking/ingress.yaml set: diff --git a/charts/eoapi/values.yaml b/charts/eoapi/values.yaml index 62311ebd..c19386dd 100644 --- a/charts/eoapi/values.yaml +++ b/charts/eoapi/values.yaml @@ -49,7 +49,7 @@ ingress: host: "" # Multiple host domains array - if specified, takes precedence over single host # hosts: [] - # Custom annotations to add to the ingress + # Custom annotations (chart owns rewrite-target/use-regex/router.middlewares) annotations: {} # TLS configuration tls: diff --git a/docs/unified-ingress.md b/docs/unified-ingress.md index 97cd2001..83ec93ce 100644 --- a/docs/unified-ingress.md +++ b/docs/unified-ingress.md @@ -44,7 +44,7 @@ ingress: rootPath: "" # Root path for doc server host: "" # Single host (or use hosts array) hosts: [] # Multiple hosts (takes precedence over host) - annotations: {} # Custom annotations + annotations: {} # Custom annotations (chart owns rewrite-target/use-regex/router.middlewares) tls: enabled: false secretName: eoapi-tls @@ -123,7 +123,11 @@ ingress: ``` If you set the same annotation via `ingress.annotations`, it overrides `ingress.entrypoints` -because user annotations are rendered after the chart defaults. +because user annotations are rendered after the chart defaults. Only path-rewrite annotations +are chart-owned and always win over `ingress.annotations`: +`nginx.ingress.kubernetes.io/rewrite-target`, `nginx.ingress.kubernetes.io/use-regex`, and +`traefik.ingress.kubernetes.io/router.middlewares`. Setting those keys in `ingress.annotations` +has no effect. ### Path Handling Details