feat(base): add gateway_public_load_balancer_type and fix public gateway name#392
Merged
gdrojas merged 4 commits intoJun 16, 2026
Conversation
The hardcoded rename of the public Gateway from "gateway-public" to "internet-facing" is a breaking change for every existing install: on the next helm upgrade, Helm deletes the old Gateway and creates the new one, orphaning every HTTPRoute whose parentRef points to "gateway-public" and cutting traffic until routes are regenerated. This module is used in production by 100+ customers, so the name must stay backward compatible by default. This keeps the AKS / Cloudflare Tunnel fix available: setups where the agent resolves the gateway name from container-orchestration.gateway.public_name can now pass gateway_public_name = "internet-facing" explicitly, while everyone else keeps the current Gateway untouched. Also adds tofu tests covering the default and override of both gateway_public_name and gateway_public_load_balancer_type.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
Three issues were found when deploying nullplatform on AKS with a Cloudflare Zero Trust tunnel:
Wrong public gateway name: The
nullplatform-basechart was creating the Gateway resource asgateway-public, but the NP agent resolves the gateway name fromcontainer-orchestration.gateway.public_nameregistered via thecontainer_orchestration/aksmodule, which defaults tointernet-facing. The mismatch caused HTTPRoutes to have an unresolvableparentRef—status.parentswas always empty and traffic never reached the gateway.No way to deploy gateway-public as internal LB: Some setups (e.g. Cloudflare Tunnel, VPN) require the public gateway LB to be internal. There was no variable to control this.
helm upgradeaborts with "cannot import" onnullplatform-toolsnamespace: When Terraform pre-creates the namespace without Helm ownership labels, Helm refuses to take ownership during upgrade and aborts — silently deleting all managed resources including thegatewaysnamespace.Test plan
tofu validatepassesgateway_public_load_balancer_type = "internal"→ LB provisioned as internalgateway_public_load_balancer_type = "external"(default) → behavior unchanged from beforehelm upgradeon existing install → does not abort,gatewaysnamespace preserved