feat: add optional path-based routing mode for shared-domain app exposure#2802
Open
dorschs57 wants to merge 6 commits into
Open
feat: add optional path-based routing mode for shared-domain app exposure#2802dorschs57 wants to merge 6 commits into
dorschs57 wants to merge 6 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces optional path-based routing across UDS Core so built-in services (and application routes) can be exposed on shared domains using URL context paths, while preserving the legacy host/subdomain routing behavior when the feature is disabled.
Changes:
- Added new
ClusterConfig.spec.exposefields (contextPath,adminContextPath,pathRouting) and wired them into operator config/validation and URL construction. - Updated Pepr/operator controllers (authservice, uptime, auth policies, FQDN generation) to construct external URLs and issuers correctly when path routing is enabled.
- Updated Keycloak and Grafana packages/charts plus unit tests and documentation to support path-aware endpoints, rewrites, and troubleshooting guidance.
Reviewed changes
Copilot reviewed 52 out of 53 changed files in this pull request and generated 10 comments.
Show a summary per file
| File | Description |
|---|---|
| src/pepr/zarf.yaml | Adds Zarf variables for context paths and enabling path routing. |
| src/pepr/uds-operator-config/values.yaml | Wires new Zarf variables into the operator config chart values. |
| src/pepr/uds-operator-config/values.schema.json | Extends Helm values schema for new expose/pathRouting inputs. |
| src/pepr/uds-operator-config/tests/clusterconfig_test.yaml | Adds Helm-unittest coverage for rendering new expose fields. |
| src/pepr/uds-operator-config/templates/clusterconfig.yaml | Renders new ClusterConfig.spec.expose fields (domain, context paths, pathRouting). |
| src/pepr/uds-operator-config/templates/_helpers.tpl | Adds helper to derive adminDomain consistently (including placeholder handling). |
| src/pepr/uds-cluster-crds/templates/clusterconfig.uds.dev.yaml | Updates CRD template schema to include new expose fields. |
| src/pepr/operator/crd/validators/clusterconfig-validator.ts | Validates contextPath/adminContextPath format and collision constraints. |
| src/pepr/operator/crd/validators/clusterconfig-validator.spec.ts | Adds tests for expose path validation rules. |
| src/pepr/operator/crd/sources/cluster-config/v1alpha1.ts | Updates CRD source schema with new expose fields. |
| src/pepr/operator/crd/generated/clusterconfig-v1alpha1.ts | Updates generated TS types for Expose to include new fields. |
| src/pepr/operator/controllers/url-utils.ts | Introduces centralized URL building + context-path normalization helpers. |
| src/pepr/operator/controllers/uptime/config.ts | Builds OAuth token URL using path-aware SSO base URL when enabled. |
| src/pepr/operator/controllers/uptime/config.spec.ts | Adds tests ensuring uptime OAuth config uses path-routed token URL. |
| src/pepr/operator/controllers/keycloak/authservice/config.ts | Makes authservice base/oidc URLs path-aware via getSsoUrl. |
| src/pepr/operator/controllers/keycloak/authservice/config.spec.ts | Adds tests verifying buildInitialSecret() uses path-routed SSO URLs. |
| src/pepr/operator/controllers/keycloak/authservice/authservice.ts | Updates per-client chain OIDC override URLs to be path-aware. |
| src/pepr/operator/controllers/keycloak/authservice/authservice.spec.ts | Adds test coverage for path-routed chain URL construction. |
| src/pepr/operator/controllers/keycloak/authservice/authorization-policy.ts | Makes issuer/JWKS URLs path-aware for JWT authN/authZ resources. |
| src/pepr/operator/controllers/keycloak/authservice/authorization-policy.spec.ts | Adds test coverage for path-routed issuer/JWKS. |
| src/pepr/operator/controllers/domain-utils.ts | Adjusts FQDN generation for shared-host behavior when path routing is enabled. |
| src/pepr/operator/controllers/domain-utils.spec.ts | Adds tests for shared-host and URL helper behavior. |
| src/pepr/operator/controllers/config/types.ts | Extends operator config type with context/admin paths and pathRouting flag. |
| src/pepr/operator/controllers/config/config.ts | Normalizes and stores new expose fields into UDSConfig. |
| src/keycloak/zarf.yaml | Adds Zarf variables to Keycloak package for path routing and context paths. |
| src/keycloak/chart/values.yaml | Adds chart values for context paths and pathRouting. |
| src/keycloak/chart/values.schema.json | Extends Keycloak chart schema for pathRouting/context path values. |
| src/keycloak/chart/tests/kc_uptime_toggle_test.yaml | Updates uptime tests for admin/public routing behavior under path routing. |
| src/keycloak/chart/tests/kc_path_routing_test.yaml | Adds new test suite validating Keycloak chart path-routing behavior. |
| src/keycloak/chart/templates/uptime-recording-rules.yaml | Makes admin endpoint recording rules conditional under path routing. |
| src/keycloak/chart/templates/uds-package.yaml | Adds path-based matching/rewrites and host selection (.) for shared-host mode. |
| src/keycloak/chart/templates/statefulset.yaml | Configures Keycloak hostname/admin URLs when path routing is enabled. |
| src/keycloak/chart/templates/path-parameter-envoyfilter.yaml | Extends host matching for shared-host mode to protect against path-parameter bypasses. |
| src/keycloak/chart/templates/istio-authpol-admin.yaml | Adjusts admin auth policy to allow certain master realm endpoints under path routing. |
| src/keycloak/chart/templates/_helpers.tpl | Adds helpers for path normalization, URL building, and regex generation. |
| src/istio/values/config-tenant.yaml | Enables root-domain behavior on tenant gateway when path routing is enabled. |
| src/istio/values/config-admin.yaml | Enables root-domain behavior on admin gateway when path routing is enabled. |
| src/grafana/zarf.yaml | Adds Zarf variables to Grafana package for path routing and context paths. |
| src/grafana/values/values.yaml | Updates Grafana root_url/SSO URLs and serve_from_sub_path for path routing. |
| src/grafana/chart/values.yaml | Adds chart values for context paths and pathRouting. |
| src/grafana/chart/tests/grafana_uptime_toggle_test.yaml | Updates Grafana chart tests for host selection under shared-host mode. |
| src/grafana/chart/tests/grafana_sso_groups_test.yaml | Adds tests for path-routed redirect URIs and admin expose matching. |
| src/grafana/chart/templates/uds-package.yaml | Switches Grafana expose host to . and adds path match prefix in shared-host mode. |
| src/grafana/chart/templates/_helpers.tpl | Adds helpers for path routing enablement, external URL, and SSO URL building. |
| schemas/clusterconfig-v1alpha1.schema.json | Updates published JSON schema to include new expose fields. |
| docs/reference/operator-and-crds/clusterconfig-v1alpha1-cr.md | Updates ClusterConfig CR reference to document new expose fields. |
| docs/operations/troubleshooting-and-runbooks/path-routing-issues.mdx | Adds new troubleshooting runbook for path-based routing failures. |
| docs/operations/troubleshooting-and-runbooks/overview.mdx | Links the new path routing runbook from the runbooks overview. |
| docs/how-to-guides/networking/use-path-based-routing.mdx | Adds a new how-to guide for enabling and using path-based routing. |
| docs/how-to-guides/networking/overview.mdx | Links the new how-to guide from the networking overview. |
| docs/how-to-guides/networking/expose-apps-on-gateways.mdx | Adds guidance for using match.uri + rewrites to route multiple apps by path. |
| docs/getting-started/production/build-your-bundle.mdx | Adds optional path-routing configuration instructions for production bundles. |
| docs/concepts/core-features/networking.mdx | Adds conceptual documentation comparing domain-based vs path-based routing. |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds first-class, optional path-based routing support in UDS Core so apps can be exposed on shared domains using context paths, while preserving existing host/subdomain-based behavior.
Compared against
main, this branch includes:use-path-based-routingpath-routing-issuesNet change summary:
Related Issue
Fixes #2792
Type of change
Steps to Validate
/sso,/keycloak, etc.).Checklist before merging