Release: v1.1.7#519
Merged
Merged
Conversation
This repo cannot know the cluster it lands in, and gateway-listeners.yaml was
trying to. Between them, the ListenerSet and its routes hardcoded four facts
about cfp-live-cluster — the shared Gateway's name and namespace, the
ClusterIssuer, the TLS Secret name, and the ListenerSet API itself — and three
were wrong there:
- cert-manager.io/cluster-issuer: letsencrypt-prod is dead. It solves ACME
over ingress-nginx, which requires PROXY protocol on every connection and
is therefore unreachable from inside the cluster. No certificate has issued
through it since May.
- certificateRefs: balancer-tls is the legacy Ingress Secret. Gateway certs
are <app>-gw-tls.
- ListenerSet is not reconciled by Envoy Gateway v1.7.3. It watches
XListenerSet and logs "XListenerSet CRD not found, skipping XListenerSet
watch". The object applies cleanly and is then ignored — the app just has
no listener, with nothing in any log to say why.
None of that is a mistake anyone could have avoided from this repo. It isn't
knowable here. So stop trying to know it.
Split on what each side actually knows:
this repo -> HTTPRoute: paths, backend Services, ports. App facts. They
change when the app changes, in the same commit.
cluster -> Gateway: listeners, hostnames, TLS, issuers. Cluster facts. They
differ per environment and are shared with every other app.
The route now attaches to a Gateway the cluster provides, named after the app,
and declares no hostnames — a route that omits hostnames inherits them from the
listeners it attaches to. So one file serves balancerproject.org in live and
balancer.sandbox.k8s.phl.io in sandbox, with no patches and no placeholders.
The HOSTNAME_PLACEHOLDER substitutions and the overlay routing patches are gone.
Drops balancer-http-redirect too: the cluster already redirects every hostname
reaching it on port 80. Worse than redundant — a route claiming an exact
hostname on the shared HTTP listener outranks the catch-all redirect and can
shadow cert-manager's ACME solver route, which is what produced the apex 404
that #517 set out to fix. That 404 was a stuck certificate, and it cleared the
moment the cert issued.
Adds a README stating the contract, so the next person doesn't have to infer it.
Refs CodeForPhilly/cfp-live-cluster#166, #168
Author
Changelog- fix(deploy): let the cluster own the Gateway, keep only the route (#518) @themightychris |
themightychris
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Deployment manifests only — no application code changes.
Changes the deployment contract: the cluster now owns the
Gateway(hostnames, TLS, issuers), and this repo ships only theHTTPRoute(paths, backend Services, ports). TheListenerSetis gone — it hardcoded four facts about the target cluster, three of which were wrong there, and Envoy Gateway v1.7.3 silently ignores it. Seedeploy/manifests/balancer/README.md.Downstream cluster repos must consume
base/httproute.yamland provide aGatewaynamed after the app.Technical