Skip to content

feat: migrate ingress from NGINX to Envoy Gateway #80

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
laurigates wants to merge 2 commits into
base: master
Choose a base branch
from
Open

feat: migrate ingress from NGINX to Envoy Gateway #80

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f97d029
feat(deploy): migrate ingress from NGINX to Envoy Gateway
github-actions[bot] Mar 20, 2026
fe993d0
fix(deploy): update backend env vars for new hostname-based routing
github-actions[bot] Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 11 additions & 25 deletions deploy/backend-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,9 +77,9 @@ env:
name: olmap-backend-secrets
key: DJANGO_SECRET_KEY
DJANGO_ALLOWED_HOSTS:
value: "olmap.dataportal.fi,localhost"
value: "olmap-backend.dataportal.fi,localhost"
DJANGO_CORS_ALLOWED_ORIGINS:
value: "https://olmap.dataportal.fi"
value: "https://olmap-frontend.dataportal.fi"
DJANGO_MIGRATE:
value: "true"
# Database configuration (Cloud SQL via proxy with IAM auth)
Expand All @@ -95,7 +95,7 @@ env:
value: "olmap-app@fvh-project-containers-etc.iam"
# Frontend URL for CORS and redirects
FRONTEND_ROOT:
value: "https://olmap.dataportal.fi"
value: "https://olmap-frontend.dataportal.fi"
# Admin email
ADMIN_EMAIL:
value: "admin@forumvirium.fi"
Expand Down Expand Up @@ -125,29 +125,15 @@ service:
port: 80
targetPort: 8000

# Ingress configuration - API endpoint (same domain as frontend, path-based routing)
ingress:
# Gateway API configuration (Envoy Gateway)
# Replaces ingress-nginx; creates HTTPRoute pointing to shared dataportal-gateway
# Hostname auto-generated as olmap-backend.dataportal.fi from release name
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

critical

This comment indicates the backend will be served from olmap-backend.dataportal.fi. This is a change from the previous single-host setup (olmap.dataportal.fi).

This change requires corresponding updates to other configuration values in this file, which appear to have been missed:

  • DJANGO_ALLOWED_HOSTS (line 80) should include olmap-backend.dataportal.fi.
  • DJANGO_CORS_ALLOWED_ORIGINS (line 82) should be updated to the new frontend URL, which seems to be https://olmap-frontend.dataportal.fi based on the changes in deploy/frontend-values.yaml.
  • FRONTEND_ROOT (line 98) should also be updated to https://olmap-frontend.dataportal.fi.

Without these changes, the application will likely fail with CORS errors, incorrect redirects, and other issues.

gateway:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
hosts:
- host: olmap.dataportal.fi
paths:
- path: /api
pathType: Prefix
- path: /admin
pathType: Prefix
- path: /static
pathType: Prefix
- path: /rest-auth
pathType: Prefix
- path: /accounts
pathType: Prefix
tls:
- hosts:
- olmap.dataportal.fi
secretName: olmap-backend-tls # pragma: allowlist secret

# Ingress configuration - disabled in favour of Gateway API above
ingress:
enabled: false

# Health checks for Django
livenessProbe:
Expand Down
29 changes: 10 additions & 19 deletions deploy/frontend-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,26 +37,17 @@ service:
port: 80
targetPort: 80

# Ingress configuration - serves the SPA, proxies /api to backend
ingress:
# Gateway API configuration (Envoy Gateway)
# Replaces ingress-nginx; creates HTTPRoute pointing to shared dataportal-gateway
# Hostname auto-generated as olmap-frontend.dataportal.fi from release name
# Note: SPA catch-all routing (try_files $uri $uri/ /index.html) must be handled
# by the nginx container's own nginx.conf - it cannot be delegated to the gateway.
gateway:
enabled: true
className: nginx
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
# SPA catch-all routing - serve index.html for non-file paths
nginx.ingress.kubernetes.io/configuration-snippet: |
location ~* ^/(?!api|admin|static|rest-auth|accounts|health).*$ {
try_files $uri $uri/ /index.html;
}
hosts:
- host: olmap.dataportal.fi
paths:
- path: /
pathType: Prefix
tls:
- hosts:
- olmap.dataportal.fi
secretName: olmap-frontend-tls # pragma: allowlist secret

# Ingress configuration - disabled in favour of Gateway API above
ingress:
enabled: false

# Health check for nginx
livenessProbe:
Expand Down