docs(external-database-exposure): orchestrate exposure on the objects that exist - #68
Closed
Aleksei Sviridkin (lexfrei) wants to merge 2 commits into
Conversation
…ervice The proposal's orchestration story pointed at a layer that reconciled expose entries into ServiceExposure objects. That API group was removed in favour of native Service type: LoadBalancer with loadBalancerClass, on the ground that managed-application charts own their Service, so the document named an integration point the platform does not have. Write the decision down where its alternatives can be weighed once: what the removal settled, the three shapes it turned down and where each was argued, and what follows for a design that wanted an object in between. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
… that exist Section 5 handed the trigger and the per-release route to a layer that reconciled expose entries into ServiceExposure objects. Reground it on what the tenant Gateway offers: one tls-<name> passthrough listener per tlsPassthroughListeners entry, nothing routed until a TLSRoute attaches by sectionName and names a backend, and the release's own chart rendering that route from values it already reads. Native LoadBalancer Services remain the path for the engines that cannot be SNI-routed. Claims the same reading falsifies go with it: the listeners declare no route kinds rather than restricting them to TLSRoute, declaring an entry withdraws termination from every name its SNI covers, route attachment is confined to the Gateway's own namespace, the listener cap fails the whole render rather than one listener, and the shared listener does not disappear with an engine's last release. The flat-hostname phase gains the second gate that rule puts on it, in each place that describes the phase. Who declares the per-engine entry, the app chart or the tenant chart, is stated as an open question with the cost on each side rather than answered. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
Aleksei Sviridkin (lexfrei)
force-pushed
the
docs/exposure-orchestration-after-serviceexposure
branch
from
September 3, 2026 19:22
9dc4c26 to
a7c0c02
Compare
Contributor
Author
|
Folded into #36 as its last two commits, same content, so the exposure proposal and the TLS proposal move together in one review. Closing this one. |
Aleksei Sviridkin (lexfrei)
deleted the
docs/exposure-orchestration-after-serviceexposure
branch
September 3, 2026 21:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #36, which edits the same file. Base is
fix/tls-pki-canonical-name-and-ownerref; retarget tomainafter #36 merges.Section 5 gave the trigger and the per-release route to the layer that reconciled
exposeentries intoServiceExposureobjects. That API group is gone: cozystack/cozystack#3218 removed it for nativeServicetype: LoadBalancerwithpublishing.loadBalancerClass. It rode the v1.6.0 release candidates and was removed before v1.6.0 itself. The section pointed at something the platform does not have.Rewritten against what exists. The
TenantGatewaycontroller renders onetls-<name>passthrough listener pertlsPassthroughListenersentry (cozystack/cozystack#3342), nothing routes until aTLSRouteattaches bysectionNameand names a backend, and the release's own chart renders that route the waypackages/apps/harborrenders itsHTTPRoute. LoadBalancer Services stay the path for the engines that cannot be SNI-routed. Who declares the per-engine entry, the app chart or the tenant chart, stays an open question with the cost written on each side.Before review
decisions/directory, or says below why none is needed.decisions/0001-external-exposure-is-the-native-loadbalancer-service.md: what the removal settled, the three shapes it turned down and where each was argued.DCO
git commit --signoff).