Add support for envoy gateway by smatting · Pull Request #5150 · wireapp/wire-server

smatting · 2026-03-23T13:52:27Z

This PR:

Introduces a new Helm chart wire-ingress that targets Envoy Gateway. It is intended as a
replacement for the nginx-ingress-services chart, which uses ingress-nginx.
The wire-ingress chart is not production-ready yet.
Changes the integration test suite: all tests now run against the wire-ingress chart. The
ingress solution can be selected via the WIRE_INGRESS_MODE environment variable.
The federation domains change in Envoy mode — see comments in the code.
Changes to the federator and integration charts are made to accommodate both variants for
testing. As a consequence, any changes to nginx-ingress-services will be untested once this PR
is merged. I've added a check integration-setup-federation.sh that prevents any changes to
nginx-ingress-services to avoid this being overlooked.
Changes the temporary filenames used in the integration test suite. This fixes issues with
filenames that were too long for nginz to handle.
Deletes the unused file hack/helmfile-federation-v0.yaml.gotmpl.
Add a post-upgrade to all objects needed for testing. This makes running tests on the cluster manually more convenient

Checklist

Add a new entry in an appropriate subdirectory of changelog.d
Read and follow the PR guidelines

wartraxx51 · 2026-03-24T09:30:19Z

Naming thing that bugs me across the whole PR, the chart is wire-ingress, the file is ingress-envoy.yaml the route is nginz-websockets. None of thes have any Ingress in them. My point of view, name it like the replacement wire-gateway , gateway-envoy.yaml etc... not blocking when I open a file called ingress-envoy.yaml and the first thing I see is kind: gateway. I have to stop and double check.

wartraxx51 · 2026-03-24T09:48:35Z

A BackendTrafficPolicy is missing for WebSockets, the default timeouts will terminate long-lived connections, I didn't check the default value, https://gateway.envoyproxy.io/latest/api/extension_types/#backendtrafficpolicy

only

This makes it possible to update integration test setup during development

this lets the federator throw the appropiate error when a cert is missing. this is what the backend expects

why remove? No integration tests actually cover these ingresses

smatting · 2026-03-25T14:24:49Z

Naming thing that bugs me across the whole PR, the chart is wire-ingress, the file is ingress-envoy.yaml the route is nginz-websockets. None of thes have any Ingress in them. My point of view, name it like the replacement wire-gateway , gateway-envoy.yaml etc... not blocking when I open a file called ingress-envoy.yaml and the first thing I see is kind: gateway. I have to stop and double check.

I changed the ingress-envoy.yaml filename. But I couldn't find other occurences. Everywhere the filenames should be <kind>...
Can you please more concrete?

smatting · 2026-03-25T14:25:37Z

A BackendTrafficPolicy is missing for WebSockets, the default timeouts will terminate long-lived connections, I didn't check the default value, https://gateway.envoyproxy.io/latest/api/extension_types/#backendtrafficpolicy

Thank you! Added the policy. We need to run QA tests against this on staging to see if it really works

wartraxx51 · 2026-04-17T11:45:20Z

+    - type: Inline
+      inline: |
+        function envoy_on_request(request_handle)
+          local ssl = request_handle:connection():ssl()


Something feels off here, we are trusting a header that the client may be able to forge themselves. Since we do not remove it first, it looks spoofable. Is that really expected on the Federator side?

wartraxx51 · 2026-04-17T11:47:41Z

+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyExtensionPolicy
+metadata:
+  name: {{ include "wire-ingress.fullname" . }}-federator-cert-header


Other policies in this chart set namespace: {{ .Release.Namespace }} ?

wartraxx51 · 2026-04-17T11:49:39Z

+    - type: Inline
+      inline: |
+        function envoy_on_request(request_handle)
+          local ssl = request_handle:connection():ssl()


same headers():add issue

wartraxx51 · 2026-04-17T12:00:40Z

+      name: {{ printf "%s/%s/https" .Release.Namespace $gatewayName | quote }}
+      operation:
+        op: add
+        path: "/filter_chains/0/filters/0/typed_config/strip_trailing_host_dot"


Why don't you use the same approach las in charts/wire-ingress/templates/envoypatchpolicy-federator.yaml:36-41

wartraxx51 · 2026-04-17T12:02:31Z

@@ -0,0 +1,154 @@
+{{- if .Values.envoy.enabled }}


None of the five kinds here carry chart/release label

wartraxx51 · 2026-04-17T12:53:43Z

+apiVersion: v1
+kind: Service
+metadata:
+  name: account-pages-http


no label, no namespace

wartraxx51 · 2026-04-17T12:53:49Z

+apiVersion: v1
+kind: Service
+metadata:
+  name: team-settings-http


no label, no namespace

wartraxx51 · 2026-04-17T12:54:02Z

+kind: Service
+metadata:
+  name: {{ .Release.Namespace }}-fed
+  namespace: {{ .Values.gateway.controllerNamespace }}


wartraxx51 · 2026-04-17T12:54:07Z

+apiVersion: v1
+kind: Service
+metadata:
+  name: webapp-http


no label, no namespace

wartraxx51 · 2026-04-17T13:02:00Z

+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Namespace }}-fed


The -fed suffix here is also hardcoded in integration/_helpers.tpl .Both need to stay aligned renaming one side breaks federation discovery with no obvious error.
Ideally a shared helper ? otherwise at least a cross-reference comment in both files pointing to each other ? that would also explain why we don't use wire-ingress.fullname here like everywhere else

wartraxx51 · 2026-04-20T08:53:04Z

+#     -----END PRIVATE KEY-----
+#
+# When federator.enabled is true, a ConfigMap named `federator-ca` with a `ca.crt` key
+# must exist in the release namespace. It is created by the wire-server chart


This ConfigMap is created by the federator chart, not wire-server ?

wartraxx51 · 2026-04-20T08:55:20Z

+### Gateway API
+
+Install the [Gateway API](https://gateway-api.sigs.k8s.io/) into your cluster.
+This chart makes use of the of the kinds defined in the `gateway.networking.k8s.io/v1` API.


use of the of the, bad copy paste :)

wartraxx51 · 2026-04-20T08:56:56Z

+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+```
+
+You need to refer to this object in the `gateway.className` paramter.


wartraxx51 · 2026-04-20T08:57:59Z

+| `config.dns.base` | Only used for CSP header rendering, which is a multi-ingress feature |
+| `tls.verify_depth` | Envoy Gateway `ClientTrafficPolicy` does not expose a direct verify-depth knob; the CA chain itself controls this |
+| `tls.enabled` | Removed — had no effect; all routes are always TLS-terminated |
+| `secrets.tlsClientCA` | No longer supplied via values. The `federator-ca` ConfigMap is created by the wire-server chart and referenced directly. |


is created by federator chart ?

wartraxx51 · 2026-04-20T10:12:28Z

@@ -0,0 +1,75 @@
+{{/* vim: set filetype=mustache: */}}


getCertificateSecretName, getCustomSolversSecretName, getIssuerName, getGatewayName
I would use it without get, because in Helm charts you usually use short names focused on the result but that's just my opinion

smatting force-pushed the WPB-23903-routes-1 branch from c4a1b87 to 28aad07 Compare March 23, 2026 13:59

zebot added the ok-to-test Approved for running tests in CI, overrides not-ok-to-test if both labels exist label Mar 23, 2026

smatting added 26 commits March 25, 2026 14:59

wip

f3a0ef5

checkboxes

eb734a9

mention nginx-ingress-services in the backwards compatbility section

34b0a2e

only

scaffolding + helpers

3dcd29f

modify .envrc for development

98f715b

update plan

0201e4e

phase 2-3

6bb3be0

Allow for externally created secret

5c8b760

nginz routes

a7354e0

more routes

6c73756

Adjust plan: routes together with services

19705d0

team settings and account pages

8c92a84

fake-s3 route

8f930bb

complete federator phase

dcdb0d0

use different secret name for federators certificate

4d7a772

udpate plan notes for federation helper

aea6297

wip integrations tests

7366934

Add post-upgrade hook to all tests

3f5ba90

This makes it possible to update integration test setup during development

use type: ClusterIP on gateway instead of LoadBlancer, use port 10443

64743f1

make mtls client cert validation optional at the ingress level

0ce80c1

this lets the federator throw the appropiate error when a cert is missing. this is what the backend expects

add todo

7c751ed

support sharing envoyproxy objects

7d4de25

remove skipPriviledgedPortCheck

730b55c

integration chart: remove ingress (and service targeting ingress)

d0169cb

why remove? No integration tests actually cover these ingresses

complete todo

779b88e

drop customSolversSecrets

7261a9b

smatting added 16 commits March 25, 2026 15:01

update parameter documentation

60ce5af

use a different patch policy to support the FQDMs

6163c60

test envoy by default

52b18e4

follow-up to patch policies: make configurable

b7c1bfa

update envoypatchpolicy section

46b5ea4

wip migration guide

c5999d8

polish a bit

57a4159

move planning out of readme

e3df974

small corrections

26ddbde

revert to normal

1bed378

remove unused file

b0313a0

revert file

6518213

update comment

d293c8e

rename file ingress-envoy.aml to envoy-gateway.yaml

24b354b

add missing backentrafficpolicy to support websockets

4e4e758

remove CLAUDE.md

83b86e7

smatting force-pushed the WPB-23903-routes-1 branch from 8e81e3f to 83b86e7 Compare March 25, 2026 14:02

moved todo to ticket

aec2051

smatting marked this pull request as ready for review March 25, 2026 14:26

smatting requested review from a team as code owners March 25, 2026 14:26

smatting added 3 commits March 27, 2026 10:56

prevent any untested changes to the nginx-ingress-services chart

7f2173d

remove PLAN.md

3cc3c42

add changelog entry

f8ead45

wartraxx51 reviewed Apr 17, 2026

View reviewed changes

wartraxx51 reviewed Apr 20, 2026

View reviewed changes

Conversation

smatting commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Uh oh!

wartraxx51 commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wartraxx51 commented Mar 24, 2026

Uh oh!

smatting commented Mar 25, 2026

Uh oh!

smatting commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wartraxx51 Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

smatting commented Mar 23, 2026 •

edited

Loading

wartraxx51 commented Mar 24, 2026 •

edited

Loading

smatting commented Mar 25, 2026 •

edited

Loading

wartraxx51 Apr 20, 2026 •

edited

Loading