chore(helm): Add GatewayAPI route support to helm chart#2544
chore(helm): Add GatewayAPI route support to helm chart#2544M0NsTeRRR merged 8 commits intoseerr-team:developfrom
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds Gateway API HTTPRoute support to the seerr-chart Helm chart: new Helm template Changes
Sequence Diagram(s)sequenceDiagram
participant Helm as Helm chart
participant K8s as Kubernetes API
participant GW as Gateway controller
participant Svc as Seerr backend
Helm->>K8s: Render & apply HTTPRoute (templates/route.yaml using values.route.main)
K8s->>GW: Inform Gateway controller of new/updated HTTPRoute
GW->>K8s: Resolve parentRefs & attach HTTPRoute to Gateway
GW->>Svc: Forward traffic per HTTPRoute rules (matches, filters, redirects, backendRefs)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Tip Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord. Comment |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@charts/seerr-chart/templates/route.yaml`:
- Around line 30-36: The httpsRedirect branch currently emits a filters block
with a RequestRedirect but omits any user-supplied route.matches, causing the
redirect to apply globally; update the template so when $route.httpsRedirect is
true it also preserves and renders existing route.matches (the same values used
when httpsRedirect is false) before the filters: RequestRedirect block (ensure
correct YAML indentation and handle empty/nil $route.matches gracefully) so the
redirect only applies within the original match scope.
- Around line 4-50: The template emits HTTP-only fields for every route kind
causing invalid manifests; update the logic around $route.kind (used in the kind
default and rendering) to branch per supported Gateway API kinds: allow
rules[].matches, rules[].filters and the RequestRedirect filter only when
$route.kind is "HTTPRoute" or "GRPCRoute", and for
"TCPRoute"/"UDPRoute"/"TLSRoute" render only rules[].backendRefs (and optional
name) without matches/filters or RequestRedirect; also when $route.httpsRedirect
is set, ensure the RequestRedirect filter is applied inside the same rule
alongside any configured $route.matches (not as a standalone unconditional rule)
so redirects respect match conditions; adjust any documentation/defaults to
constrain allowed kinds accordingly.
There was a problem hiding this comment.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@charts/seerr-chart/templates/route.yaml`:
- Around line 4-5: The template unconditionally emits HTTP-specific fields
(matches, filters, RequestRedirect) even when $route.kind can be
TCPRoute/UDPRoute/TLSRoute, causing Gateway API validation failures; update the
route.yaml template to branch on $route.kind (the $route.kind/$route.apiVersion
values) and only render matches, filters and RequestRedirect when the kind is an
HTTP-compatible type (e.g., "HTTPRoute" or "GRPCRoute"), or alternatively
restrict the allowed default/values for $route.kind in the chart defaults/docs
to HTTPRoute/GRPCRoute; locate the conditional blocks that output
matches/filters/RequestRedirect and wrap them in checks against $route.kind (or
change defaults) so non-HTTP kinds do not receive invalid fields.
There was a problem hiding this comment.
Pull request overview
This PR adds Gateway API HTTPRoute support to the Seerr Helm chart, enabling users to create Gateway API route resources alongside or instead of traditional Ingress resources. The implementation follows a flexible multi-route pattern where users can define multiple named route configurations (e.g., route.main, route.http, route.https) for different routing scenarios.
Changes:
- Added new Gateway API route template supporting HTTPRoute and other route kinds with configurable apiVersion
- Added comprehensive route configuration options in values.yaml including parentRefs, hostnames, filters, matches, and HTTPS redirect support
- Bumped chart version from 3.1.0 to 3.2.0
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| charts/seerr-chart/templates/route.yaml | New template that creates Gateway API route resources with support for multiple named routes, HTTPS redirects, and flexible rule configuration |
| charts/seerr-chart/values.yaml | Added route configuration section with main route defaults and comprehensive options for Gateway API integration |
| charts/seerr-chart/Chart.yaml | Version bump to 3.2.0 reflecting the new feature addition |
| charts/seerr-chart/README.md | Auto-generated documentation updates reflecting the new route configuration options |
Comments suppressed due to low confidence (5)
charts/seerr-chart/templates/route.yaml:29
- The placement of additionalRules before the main rule creates a problematic ordering. When additionalRules are present, they will be rendered first, followed by either the httpsRedirect rule or the normal backend rule. This means the main route rule is always appended last, which may not match user expectations. Consider either: (1) placing additionalRules after the main rule, or (2) not generating a default rule when additionalRules are present and the user wants full control, or (3) documenting this behavior clearly in values.yaml that additionalRules come before the main rule.
rules:
{{- if $route.additionalRules }}
{{- tpl (toYaml $route.additionalRules) $ | nindent 4 }}
{{- end }}
charts/seerr-chart/values.yaml:144
- The documentation comment is misleading. It says "create a new route object under the main route" but the actual structure is to create a sibling route object at the same level as 'main' in the route map (e.g., route.http for HTTP and route.https for HTTPS redirect). The phrase "under the main route" suggests nesting within the main object, which is not the case. Consider clarifying to: "To redirect to HTTPS, create a separate route object (e.g., route.http) alongside the main route with this option enabled."
# -- To redirect to HTTPS, create a new route object under the main route and enable this option.
# This should only be used with HTTP-like routes, such as HTTPRoute or GRPCRoute.
# [Reference]( https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/ )
httpsRedirect: false
charts/seerr-chart/templates/route.yaml:55
- When additionalRules are provided, a default rule (either httpsRedirect or normal backend) is always appended after them. This means users cannot use additionalRules alone without getting an extra rule they may not want. Consider adding a flag (e.g., 'defaultRule: true') that allows users to disable the automatic default rule generation when they want full control via additionalRules. Alternatively, document this behavior clearly in values.yaml.
rules:
{{- if $route.additionalRules }}
{{- tpl (toYaml $route.additionalRules) $ | nindent 4 }}
{{- end }}
{{- if $route.httpsRedirect }}
- filters:
- type: RequestRedirect
requestRedirect:
scheme: https
statusCode: 301
{{- with $route.matches }}
matches:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- else }}
- backendRefs:
- name: {{ include "seerr.fullname" $ }}
port: {{ $.Values.service.port }}
group: ''
kind: Service
weight: 1
{{- with $route.filters }}
filters:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with $route.matches }}
matches:
{{- toYaml . | nindent 8 }}
{{- end }}
{{- end }}
charts/seerr-chart/values.yaml:143
- There's an extra space in the markdown link syntax. The reference link has a space after the opening parenthesis: '[Reference]( https://...' should be '[Reference](https://...' without the space. This may cause the link to not render properly in some markdown parsers.
# [Reference]( https://gateway-api.sigs.k8s.io/guides/http-redirect-rewrite/ )
charts/seerr-chart/templates/route.yaml:7
- The template uses 'template' instead of 'include' for the fullname helper, which is inconsistent with other templates in this chart. The ingress template (ingress.yaml:5,36) and the route template itself (line 42) use 'include'. The 'include' function is preferred in Helm as it allows piping the output to other functions. This should be changed to: {{ include "seerr.fullname" $ }}
name: {{ template "seerr.fullname" $ }}{{ if ne $name "main" }}-{{ $name }}{{ end }}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Co-authored-by: Ludovic Ortega <github@mail.adminafk.fr>
Co-authored-by: Ludovic Ortega <github@mail.adminafk.fr>
Co-authored-by: Ludovic Ortega <github@mail.adminafk.fr>
|
Thanks for your contribution ! |
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/seerr-team/seerr](https://github.com/seerr-team/seerr) | minor | `v3.0.1` → `v3.1.0` | | [seerr-team/seerr](https://github.com/seerr-team/seerr) | minor | `v3.0.1` → `v3.1.0` | --- ### Release Notes <details> <summary>seerr-team/seerr (ghcr.io/seerr-team/seerr)</summary> ### [`v3.1.0`](https://github.com/seerr-team/seerr/releases/tag/v3.1.0) [Compare Source](seerr-team/seerr@v3.0.1...v3.1.0) ##### 🛡️ Security - Patch [CVE-2026-27707](GHSA-rc4w-7m3r-c2f7) - Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint - ([4ae2068](seerr-team/seerr@4ae2068)) - Patch [CVE-2026-27793](GHSA-f7xw-jcqr-57hp) - Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials - ([4f089b2](seerr-team/seerr@4f089b2)) - Patch [CVE-2026-27792](GHSA-gx3h-3jg5-q65f) - Missing authentication on pushSubscription endpoints - ([946bdecec](seerr-team/seerr@946bdec)) ##### 🚀 Features - *(helm)* Use an existing PVC as config volume ([#​2447](seerr-team/seerr#2447)) - ([8f0c904](seerr-team/seerr@8f0c904)) - *(servarr-api)* Make Servarr API request timeout configurable ([#​2556](seerr-team/seerr#2556)) - ([3bcb4da](seerr-team/seerr@3bcb4da)) - Self-host font for better privacy ([#​2540](seerr-team/seerr#2540)) - ([10ea21b](seerr-team/seerr@10ea21b)) ##### 🐛 Bug Fixes - *(helm)* Add "v" as prefix for appVersion tag ([#​2445](seerr-team/seerr#2445)) - ([04b9d87](seerr-team/seerr@04b9d87)) - *(jellyfin-scanner)* Include unmatched seasons in processable seasons ([#​2538](seerr-team/seerr#2538)) - ([68f56d2](seerr-team/seerr@68f56d2)) - *(link-account)* Fix error-message override ([#​2547](seerr-team/seerr#2547)) - ([b843be0](seerr-team/seerr@b843be0)) - *(plex-scanner)* Add TVDb to TMDB fallback in plex scanner ([#​2537](seerr-team/seerr#2537)) - ([7c60a5c](seerr-team/seerr@7c60a5c)) - *(radarr)* Trigger search for existing monitored movies without files ([#​2391](seerr-team/seerr#2391)) - ([55776ea](seerr-team/seerr@55776ea)) - *(servarr)* Increase default API timeout from 5000ms to 10000ms ([#​2442](seerr-team/seerr#2442)) - ([b499976](seerr-team/seerr@b499976)) - *(sonarr)* Use configured metadata provider for season filtering ([#​2516](seerr-team/seerr#2516)) - ([5013d1d](seerr-team/seerr@5013d1d)) - *(watch-data)* Use sentinel values to avoid invalid SQL syntax ([#​2552](seerr-team/seerr#2552)) - ([947f70c](seerr-team/seerr@947f70c)) - *(watchlist-sync)* Correct permission typo for TV auto requests ([#​2488](seerr-team/seerr#2488)) - ([e0e4b6f](seerr-team/seerr@e0e4b6f)) - Preserve blocklist on media deletion & optimise watchlist-sync ([#​2478](seerr-team/seerr#2478)) - ([9da8bb6](seerr-team/seerr@9da8bb6)) ##### 🚜 Refactor - *(tailwind)* Replace deprecated tailwind utilities ([#​2542](seerr-team/seerr#2542)) - ([f42a4ec](seerr-team/seerr@f42a4ec)) ##### 📖 Documentation - *(synology)* Add installation guide via SynoCommunity ([#​2503](seerr-team/seerr#2503)) - ([0e636a3](seerr-team/seerr@0e636a3)) - *(truenas)* Update install/migration guide ([#​2491](seerr-team/seerr#2491)) - ([dc1734d](seerr-team/seerr@dc1734d)) - *(unraid)* Improve unraid migration guide ([#​2470](seerr-team/seerr#2470)) - ([5e64d49](seerr-team/seerr@5e64d49)) - Update Unraid install and migration guides with dual permission methods ([#​2532](seerr-team/seerr#2532)) - ([a0d0eb1](seerr-team/seerr@a0d0eb1)) - Add a warning in migration-guide for third party installation ([#​2527](seerr-team/seerr#2527)) - ([7e9dff3](seerr-team/seerr@7e9dff3)) - Remove double quotes (") from DB\_HOST environment variable ([#​2514](seerr-team/seerr#2514)) - ([fa905be](seerr-team/seerr@fa905be)) - Add Unraid installation and migration guide ([#​2440](seerr-team/seerr#2440)) - ([b6a9132](seerr-team/seerr@b6a9132)) - Fix migration guide title ([#​2425](seerr-team/seerr#2425)) - ([39ae32f](seerr-team/seerr@39ae32f)) ##### ⚡ Performance - Add missing indexes on all foreign key columns ([#​2461](seerr-team/seerr#2461)) - ([c6bcfe0](seerr-team/seerr@c6bcfe0)) ##### ⚙️ Miscellaneous Tasks - *(changelog)* Fix changelog template ([#​2431](seerr-team/seerr#2431)) - ([c2977f6](seerr-team/seerr@c2977f6)) - *(eslint)* Add react/self-closing-comp ([#​2563](seerr-team/seerr#2563)) - ([cd8b386](seerr-team/seerr@cd8b386)) - *(github)* Add docs and maintenance issue templates ([#​2467](seerr-team/seerr#2467)) - ([cf4883a](seerr-team/seerr@cf4883a)) - *(helm)* Add GatewayAPI route support to helm chart ([#​2544](seerr-team/seerr#2544)) - ([3a42f59](seerr-team/seerr@3a42f59)) - *(helm)* Update ghcr.io/seerr-team/seerr ( 3.0.0 → 3.0.1 ) \[skip-ci] ([#​2441](seerr-team/seerr#2441)) - ([87fb0df](seerr-team/seerr@87fb0df)) - *(husky)* Fixed husky commit message from bash/zsh syntax to sh syntax ([#​2572](seerr-team/seerr#2572)) - ([a00c9e5](seerr-team/seerr@a00c9e5)) - *(release)* Prepare ${TAG\_VERSION} - ([94a70bb](seerr-team/seerr@94a70bb)) - Updated the Contributing and Security guides to reflect our current practices ([#​2579](seerr-team/seerr#2579)) - ([0d40a42](seerr-team/seerr@0d40a42)) - Disable nextjs telemetry ([#​2517](seerr-team/seerr#2517)) - ([cecdd63](seerr-team/seerr@cecdd63)) - Update contributing guide regarding Automated AI Agent ([#​2518](seerr-team/seerr#2518)) - ([880fbc9](seerr-team/seerr@880fbc9)) - Remove discord notification from release ([#​2501](seerr-team/seerr#2501)) - ([fba20c1](seerr-team/seerr@fba20c1)) - Add create-tag workflow to streamline release process ([#​2493](seerr-team/seerr#2493)) - ([06e5eb0](seerr-team/seerr@06e5eb0)) - Update concurrency logic ([#​2481](seerr-team/seerr#2481)) - ([4939f13](seerr-team/seerr@4939f13)) - Add semantic-pr workflow to enforce conventional commits ([#​2472](seerr-team/seerr#2472)) - ([5e57fdc](seerr-team/seerr@5e57fdc)) ##### New Contributors ❤️ - [@​caillou](https://github.com/caillou) made their first contribution - [@​Kenshin9977](https://github.com/Kenshin9977) made their first contribution - [@​MagicLegend](https://github.com/MagicLegend) made their first contribution - [@​wiiaam](https://github.com/wiiaam) made their first contribution - [@​mjonkus](https://github.com/mjonkus) made their first contribution - [@​nova-api](https://github.com/nova-api) made their first contribution - [@​mreid-tt](https://github.com/mreid-tt) made their first contribution - [@​DataBitz](https://github.com/DataBitz) made their first contribution - [@​Hyperion2220](https://github.com/Hyperion2220) made their first contribution - [@​blassley](https://github.com/blassley) made their first contribution - [@​JanKleine](https://github.com/JanKleine) made their first contribution - [@​koiralasandesh](https://github.com/koiralasandesh) made their first contribution<!-- generated by git-cliff --> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNS43IiwidXBkYXRlZEluVmVyIjoiNDMuMjUuNyIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiaW1hZ2UiXX0=--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/4284 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
Description
Adds support for creating a GatewayAPI HTTPRoute (or other routes)
Follows existing patterns in mainstream helm charts, using a
mainroute and allowing the user to configure more routes if neededHow Has This Been Tested?
Verified output with helm template and tested on my cluster
Checklist:
pnpm buildpnpm i18n:extractSummary by CodeRabbit
New Features
Documentation