feat: add Gateway API HTTPRoute support

[charlychiu]

Summary

Adds Gateway API HTTPRoute support to the chart, as an alternative to the existing Ingress.

Two parts:

1. templates/httproute.yaml — renders a gateway.networking.k8s.io/v1 HTTPRoute, driven by new sourcebot.httpRoute.* values. When rules is empty, a default rule forwarding all traffic to the Sourcebot service is generated, so the common case is just enabled + parentRefs + hostnames.

2. AUTH_URL also derived from httpRoute.hostnames — this is the part I'd like to highlight, because a template-only change would be incomplete.

Why the AUTH_URL change is needed

Today AUTH_URL is set only from ingress.hosts[0]:

https://github.com/sourcebot-dev/sourcebot-helm-chart/blob/main/charts/sourcebot/templates/deployment.yaml#L63-L66

Anyone who sets ingress.enabled=false in order to route traffic through a Gateway loses AUTH_URL entirely, and the entrypoint falls back to http://localhost:3000. That silently breaks login callbacks, links in search results, and the MCP OAuth issuer — with no error at deploy time, which makes it fairly unpleasant to debug.

We hit exactly this when migrating an internal deployment from Ingress to Gateway API, and worked around it by hand-setting AUTH_URL via additionalEnv. Since every user switching to HTTPRoute would hit the same thing, it seemed better to fix it in the chart.

The derivation now lives in a sourcebot.authUrl helper. It prefers the first ingress host, falls back to the first non-wildcard httpRoute hostname, and returns nothing otherwise. Wildcards are skipped because https://*.example.com is not a usable URL, and wildcard listeners are common with Gateway API.

Behaviour

• Everything is off by default. With default values the rendered output is unchanged, and the rendered output for existing ingress configurations is byte-identical to main.
• Ingress keeps precedence for AUTH_URL. Existing installations are unaffected, and exactly one AUTH_URL entry is ever emitted.
• Enabling httpRoute without parentRefs fails the render with an explanatory message, rather than producing a route attached to no Gateway that silently receives no traffic.
• No TLS section on httpRoute — TLS is terminated at the Gateway listener.

Three decisions I'd like your take on

1. apiVersion is hardcoded to gateway.networking.k8s.io/v1 rather than detected via .Capabilities. This matches how ingress.yaml hardcodes networking.k8s.io/v1. Happy to switch to capability detection if you'd prefer.

2. ingress and httpRoute are not mutually exclusive — enabling both renders both objects rather than failing. I assumed people may want both during a migration, and only made AUTH_URL pick a winner. If you'd rather this be a hard fail, that's a small change.

3. A wildcard-only hostnames list produces no AUTH_URL — and therefore the http://localhost:3000 fallback this PR is trying to eliminate. I want to flag this explicitly rather than leave it in a values comment, because it is the same failure mode, just narrowed to one configuration.

   I chose not to fail there because a wildcard-only HTTPRoute is a legitimate Gateway API configuration, and the operator may be supplying AUTH_URL through envFrom, whose contents the template cannot inspect — so a hard failure would have false positives. Checking additionalEnv for an AUTH_URL entry would not close that gap either.

   The options I see are: leave it documented as it is; fail and accept the false positives; or emit a helm.sh/hook-free warning, which Helm does not really have a mechanism for. Happy to go whichever way you prefer.

Also happy to rename the values key (httpRoute vs gateway vs gatewayApi) if you have a preference.

Testing

• helm unittest charts/sourcebot/ — 29 passed, including 11 new cases in tests/httproute_test.yaml covering: not rendered by default, rendering when enabled, the generated default rule, custom rules overriding it, annotations, the parentRefs failure, AUTH_URL derived from a hostname, wildcard hostnames skipped, no AUTH_URL when all hostnames are wildcards, ingress winning when both are enabled, and no AUTH_URL when neither is enabled.
• helm lint charts/sourcebot/ -f charts/sourcebot/values.lint.yaml — passes
• helm-docs (v1.14.2, same as CI) run and committed; a second run produces no diff
• helm template with default values, and with an ingress configuration, produces output identical to main

One small thing unrelated to this PR: CONTRIBUTING.md documents the test command as helm test sourcebot, which is the command for helm test hooks. The chart's tests are helm-unittest specs, run with helm unittest charts/sourcebot/ and needing no cluster. Happy to fix that in a separate PR if useful.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1f35cb4a-0f59-4d38-9681-db57e8258c7d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}