fix: allow istioGateway common values in schema

chart/templates/_helpers.tpl

@@ -342,6 +342,7 @@ stringData:
 
 {{- define "enabledGateways" -}}
   {{- $userGateways := deepCopy ($.Values.istioGateway.values.gateways | default dict) -}}
+  {{- $commonGatewayValues := omit ($.Values.istioGateway.values | default dict) "gateways" -}}
   {{- $defaults := include "bigbang.defaults.istio-gateway" $ | fromYaml -}}
   {{- $istioPodAnnotations := (include "istioAnnotation" $ | fromYaml) | default dict -}}
 
@@ -354,7 +355,8 @@ stringData:
 
   {{- range $name, $mergedGW := merge $userGateways $defaults.gateways }}
     {{- if and $name $mergedGW }}
-      {{- $gwType := dig "upstream" "labels" "istio" "" $mergedGW -}}
+      {{- $effectiveGW := mustMergeOverwrite (deepCopy (get $defaults.gateways $name | default dict)) (deepCopy $commonGatewayValues) (deepCopy (dig "gateways" $name dict $.Values.istioGateway.values)) -}}
+      {{- $gwType := dig "upstream" "labels" "istio" "" $effectiveGW -}}
 
       {{- if not (has $gwType (list "ingressgateway" "egressgateway")) }}
         {{- fail (printf "istio-gateway: Gateway '%s' does not have a valid type; upstream.labels.istio must be one of 'ingressgateway' or 'egressgateway'" $name) -}}
@@ -384,13 +386,12 @@ stringData:
         {{- $gwRecord = set $gwRecord "defaults" $gwDefaults -}}
       {{ end -}}
 
-      {{- $gwOverlays := dig "gateways" $name dict $.Values.istioGateway.values -}}
+      {{- $gwOverlays := mustMergeOverwrite (dict "upstream" $defaultImagePullConfig) (deepCopy $commonGatewayValues) (deepCopy (dig "gateways" $name dict $.Values.istioGateway.values)) -}}
       {{- if $gwOverlays }}
-        {{- $gwOverlays = deepCopy $gwOverlays -}}
         {{- if $istioPodAnnotations }}
           {{- $gwOverlays = mergeOverwrite $gwOverlays (dict "upstream" (dict "podAnnotations" $istioPodAnnotations)) -}}
         {{- end }}
-        {{- $gwRecord = set $gwRecord "overlays" (merge $gwOverlays (dict "upstream" $defaultImagePullConfig)) -}}
+        {{- $gwRecord = set $gwRecord "overlays" $gwOverlays -}}
       {{ end -}}
 
       {{- $enabledGateways = set $enabledGateways $name $gwRecord -}}
@@ -853,7 +854,7 @@ Args:
 {{- $gateways := (include "enabledGateways" .root) | fromYaml }}
 {{- $gw := get $gateways $gateway }}
 {{- if $gw }}
-  {{- toYaml (dict "app" $gw.serviceName "istio" "ingressgateway") }}
+  {{- toYaml (dict "app" $gw.serviceName "istio" $gw.type) }}
 {{- end }}
 {{- end -}}
 
@@ -875,7 +876,7 @@ Args:
 
 {{- define "bigbang.istio-gateway.ingress-netpol-spec" }}
   {{- $ctx := index . 0 }}
-  {{- $name := index . 1 }}
+  {{- $serviceName := index . 1 }}
   {{- $ports := index . 2 }}
 networkPolicies:
   enabled: {{ $ctx.Values.networkPolicies.enabled }}
@@ -885,7 +886,7 @@ networkPolicies:
       {{- $ctx.Values.networkPolicies.ingress.definitions | toYaml | nindent 8 }}
     {{- end }}
     to:
-      "{{ $name }}-ingressgateway:{{ $ports | toJson }}":
+      "{{ $serviceName }}:{{ $ports | toJson }}":
         from:
           definition:
             load-balancer-subnets: true
@@ -895,7 +896,7 @@ networkPolicies:
       {{- $ctx.Values.networkPolicies.egress.definitions | toYaml | nindent 8 }}
     {{- end }}
     from:
-      "{{ $name }}-ingressgateway":
+      "{{ $serviceName }}":
         to:
           k8s:
             '*': true
@@ -920,7 +921,7 @@ networkPolicies:
       {{- $ports = append $ports $server.port.number }}
     {{- end }}
 
-    {{- $newGateway = merge (dict "defaults" (include "bigbang.istio-gateway.ingress-netpol-spec" (list $ctx $name $ports) | fromYaml)) $newGateway }}
+    {{- $newGateway = merge (dict "defaults" (include "bigbang.istio-gateway.ingress-netpol-spec" (list $ctx $gateway.serviceName $ports) | fromYaml)) $newGateway }}
 
     {{- $_ := set $newGateways $name $newGateway }}
   {{- end }}

chart/unittests/packages/istio-gateway/gateway_type_test.yaml

@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
+suite: Package - Istio Gateway - Gateway Type Tests
+templates:
+  - templates/istio-gateway/helmrelease.yaml
+  - templates/istio-gateway/values.yaml
+release:
+  name: bb
+set:
+  istiod.enabled: true
+  istioGateway.enabled: true
+tests:
+  - it: should use the shared gateway type for built-in gateways
+    template: templates/istio-gateway/helmrelease.yaml
+    set:
+      istioGateway.values.upstream.labels.istio: egressgateway
+    documentSelector:
+      path: metadata.labels["app.kubernetes.io/name"]
+      value: istio-gateway-public
+    asserts:
+      - equal:
+          path: metadata.name
+          value: public-egressgateway
+
+  - it: should use the shared gateway type for custom gateways
+    template: templates/istio-gateway/helmrelease.yaml
+    set:
+      istioGateway.values:
+        upstream:
+          labels:
+            istio: ingressgateway
+        gateways:
+          internal:
+            gateway:
+              servers: []
+            waitJob:
+              enabled: false
+    documentSelector:
+      path: metadata.labels["app.kubernetes.io/name"]
+      value: istio-gateway-internal
+    asserts:
+      - equal:
+          path: metadata.name
+          value: internal-ingressgateway

chart/unittests/packages/istio-gateway/values_test.yaml

@@ -0,0 +1,76 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/helm-unittest/helm-unittest/main/schema/helm-testsuite.json
+suite: Package - Istio Gateway - Values Tests
+templates:
+  - templates/istio-gateway/values.yaml
+release:
+  name: bb
+tests:
+  - it: should apply root common values to the public gateway overlays
+    postRenderer:
+      cmd: "sh"
+      args:
+        - "-c"
+        - "yq eval 'select(.metadata.name == \"bb-istio-public-gateway-values\") | .stringData.overlays' - | yq eval '.'"
+    set:
+      istioGateway.values:
+        waitJob:
+          enabled: false
+        networkPolicies:
+          enabled: false
+        mtls:
+          mode: PERMISSIVE
+        upstream:
+          service:
+            type: ClusterIP
+    asserts:
+      - equal:
+          path: waitJob.enabled
+          value: false
+      - equal:
+          path: networkPolicies.enabled
+          value: false
+      - equal:
+          path: mtls.mode
+          value: PERMISSIVE
+      - equal:
+          path: upstream.service.type
+          value: ClusterIP
+
+  - it: should apply root common values to the passthrough gateway overlays
+    postRenderer:
+      cmd: "sh"
+      args:
+        - "-c"
+        - "yq eval 'select(.metadata.name == \"bb-istio-passthrough-gateway-values\") | .stringData.overlays' - | yq eval '.'"
+    set:
+      istioGateway.values:
+        waitJob:
+          enabled: false
+        mtls:
+          mode: PERMISSIVE
+    asserts:
+      - equal:
+          path: waitJob.enabled
+          value: false
+      - equal:
+          path: mtls.mode
+          value: PERMISSIVE
+
+  - it: should let gateway-specific values override root common values
+    postRenderer:
+      cmd: "sh"
+      args:
+        - "-c"
+        - "yq eval 'select(.metadata.name == \"bb-istio-public-gateway-values\") | .stringData.overlays' - | yq eval '.'"
+    set:
+      istioGateway.values:
+        waitJob:
+          enabled: false
+        gateways:
+          public:
+            waitJob:
+              enabled: true
+    asserts:
+      - equal:
+          path: waitJob.enabled
+          value: true

chart/unittests/schema/istio-gateway-values_test.yaml

@@ -26,12 +26,85 @@ tests:
                     mode: SIMPLE
     asserts:
       - notFailedTemplate: {}
-  - it: should fail validation with invalid istioGateway values
+  - it: should pass validation with waitJob values
     set:
       istioGateway:
         values:
           waitJob:
-            image: foo
+            enabled: false
+    asserts:
+      - notFailedTemplate: {}
+  - it: should pass validation with classificationBanner values
+    set:
+      istioGateway:
+        values:
+          classificationBanner:
+            enabled: true
+            classificationLevel: cui
+    asserts:
+      - notFailedTemplate: {}
+  - it: should pass validation with gateway values
+    set:
+      istioGateway:
+        values:
+          gateway:
+            servers:
+              - hosts:
+                  - '*.dev.bigbang.mil'
+                port:
+                  name: http
+                  number: 8080
+                  protocol: HTTP
+    asserts:
+      - notFailedTemplate: {}
+  - it: should pass validation with gluon values
+    set:
+      istioGateway:
+        values:
+          gluon:
+            wait:
+              enabled: true
+    asserts:
+      - notFailedTemplate: {}
+  - it: should pass validation with networkPolicies values
+    set:
+      istioGateway:
+        values:
+          networkPolicies:
+            enabled: true
+    asserts:
+      - notFailedTemplate: {}
+  - it: should pass validation with mtls values
+    set:
+      istioGateway:
+        values:
+          mtls:
+            mode: STRICT
+    asserts:
+      - notFailedTemplate: {}
+  - it: should pass validation with tracing values
+    set:
+      istioGateway:
+        values:
+          tracing:
+            enabled: true
+    asserts:
+      - notFailedTemplate: {}
+  - it: should pass validation with upstream values
+    set:
+      istioGateway:
+        values:
+          upstream:
+            image:
+              registry: registry1.dso.mil
+    asserts:
+      - notFailedTemplate: {}
+  - it: should fail validation with invalid istioGateway values
+    set:
+      istioGateway:
+        values:
+          invalidProperty:
+            foo: bar
     asserts:
       - failedTemplate:
-          errorPattern: ".*"
+          errorPattern: ".*"

chart/unittests/templates/bigbang.istio-gateway.generate-ingress-netpols_test.yaml

@@ -11,6 +11,7 @@ tests:
         args:
         - helm:context
         - custom:
+            serviceName: custom-ingressgateway
             defaults: {}
             overlays:
               gateway:
@@ -99,6 +100,7 @@ tests:
         args:
         - helm:context
         - custom:
+            serviceName: custom-ingressgateway
             defaults: {}
             overlays:
               gateway:
@@ -176,6 +178,7 @@ tests:
         args:
         - helm:context
         - custom:
+            serviceName: custom-ingressgateway
             defaults:
               networkPolicies:
                 egress:
@@ -266,6 +269,7 @@ tests:
         args:
         - helm:context
         - custom:
+            serviceName: custom-ingressgateway
             defaults:
               networkPolicies:
                 egress:

chart/unittests/templates/bigbang.istio-gateway.ingress-netpol-spec_test.yaml

@@ -18,7 +18,7 @@ tests:
                     from:
                       - ipBlock:
                           cidr: 10.0.0.0/8
-        - test
+        - test-ingressgateway
         - - 80
           - 443
   asserts:
@@ -56,7 +56,7 @@ tests:
         - Values:
             networkPolicies:
               enabled: true
-        - test
+        - test-ingressgateway
         - - 80
           - 443
   asserts:
@@ -79,3 +79,28 @@ tests:
                 to:
                   k8s:
                     '*': true
+
+- it: must use the effective egress gateway service name
+  set:
+    _selfTest:
+      bigbang.istio-gateway.ingress-netpol-spec:
+        resultIsYaml: true
+        args:
+        - Values:
+            networkPolicies:
+              enabled: true
+        - test-egressgateway
+        - - 8080
+  asserts:
+  - equal:
+      path: result.networkPolicies.ingress.to["test-egressgateway:[8080]"]
+      value:
+        from:
+          definition:
+            load-balancer-subnets: true
+  - equal:
+      path: result.networkPolicies.egress.from.test-egressgateway
+      value:
+        to:
+          k8s:
+            '*': true