fix: add HTTP redirect route to ListenerSet for apex domain#517
Merged
Conversation
- Add balancer-http-redirect HTTPRoute attached to http sectionName in the ListenerSet, returning 301→HTTPS for balancerproject.org - Set disableNameSuffixHash to prevent ConfigMap hash suffix drift - Update ClusterIssuer annotation to letsencrypt-prod-gateway - Add overlay patches for both production and sandbox hostnames Refs: CodeForPhilly/cfp-live-cluster#160
This was referenced Jul 14, 2026
themightychris
added a commit
that referenced
this pull request
Jul 14, 2026
This repo cannot know the cluster it lands in, and gateway-listeners.yaml was
trying to. Between them, the ListenerSet and its routes hardcoded four facts
about cfp-live-cluster — the shared Gateway's name and namespace, the
ClusterIssuer, the TLS Secret name, and the ListenerSet API itself — and three
were wrong there:
- cert-manager.io/cluster-issuer: letsencrypt-prod is dead. It solves ACME
over ingress-nginx, which requires PROXY protocol on every connection and
is therefore unreachable from inside the cluster. No certificate has issued
through it since May.
- certificateRefs: balancer-tls is the legacy Ingress Secret. Gateway certs
are <app>-gw-tls.
- ListenerSet is not reconciled by Envoy Gateway v1.7.3. It watches
XListenerSet and logs "XListenerSet CRD not found, skipping XListenerSet
watch". The object applies cleanly and is then ignored — the app just has
no listener, with nothing in any log to say why.
None of that is a mistake anyone could have avoided from this repo. It isn't
knowable here. So stop trying to know it.
Split on what each side actually knows:
this repo -> HTTPRoute: paths, backend Services, ports. App facts. They
change when the app changes, in the same commit.
cluster -> Gateway: listeners, hostnames, TLS, issuers. Cluster facts. They
differ per environment and are shared with every other app.
The route now attaches to a Gateway the cluster provides, named after the app,
and declares no hostnames — a route that omits hostnames inherits them from the
listeners it attaches to. So one file serves balancerproject.org in live and
balancer.sandbox.k8s.phl.io in sandbox, with no patches and no placeholders.
The HOSTNAME_PLACEHOLDER substitutions and the overlay routing patches are gone.
Drops balancer-http-redirect too: the cluster already redirects every hostname
reaching it on port 80. Worse than redundant — a route claiming an exact
hostname on the shared HTTP listener outranks the catch-all redirect and can
shadow cert-manager's ACME solver route, which is what produced the apex 404
that #517 set out to fix. That 404 was a stuck certificate, and it cleared the
moment the cert issued.
Adds a README stating the contract, so the next person doesn't have to infer it.
Refs CodeForPhilly/cfp-live-cluster#166, #168
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes the HTTP 404 issue for
balancerproject.orgapex when DNS points at the Envoy LB. The per-app ListenerSet claimed the apex hostname for HTTPS only, which prevented the sharedmain-gateway's HTTP→HTTPS redirect from applying.Changes
base/httproute.yaml— Addedbalancer-http-redirectHTTPRoute attached to thesectionName: httplistener, returning 301→HTTPSbase/gateway-listeners.yaml— Updated ClusterIssuer annotation toletsencrypt-prod-gateway(matches the cluster's Gateway-specific issuer)base/kustomization.yaml— AddedgeneratorOptions.disableNameSuffixHash: trueto prevent ConfigMap hash suffix causing ArgoCD driftoverlays/production/kustomization.yaml— Added patch for newbalancer-http-redirecthostnameoverlays/sandbox/kustomization.yaml— Added patch for newbalancer-http-redirecthostnameRelated
Verification
Both builds include the redirect HTTPRoute with correct hostname.