From f56a7303b0692574ee227c08e9566ea0160e9a85 Mon Sep 17 00:00:00 2001
From: Stefan Richter <stefan.richter@temporal.io>
Date: Mon, 20 Jul 2026 21:28:13 -0700
Subject: [PATCH] feat(helm/coder): make HTTPS redirect status code
 configurable

Add coder.httproute.httpsRedirect.statusCode to configure the HTTPRoute redirect response code, defaulting to 308. Validate that the value is one of 301, 302, 303, 307, or 308.
---
 helm/coder/templates/httproute.yaml                   | 11 +++++++++--
 helm/coder/tests/testdata/listenerset_redirect.golden |  2 +-
 helm/coder/tests/testdata/listenerset_redirect.yaml   |  1 +
 .../tests/testdata/listenerset_redirect_coder.golden  |  2 +-
 helm/coder/values.yaml                                |  3 +++
 5 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/helm/coder/templates/httproute.yaml b/helm/coder/templates/httproute.yaml
index 68582d049a2c7..cf3a19bab6148 100644
--- a/helm/coder/templates/httproute.yaml
+++ b/helm/coder/templates/httproute.yaml
@@ -1,6 +1,12 @@
-{{- if and .Values.coder.httproute.enable .Values.coder.httproute.httpsRedirect.enable (empty .Values.coder.httproute.httpsRedirect.parentRefs) -}}
+{{- if and .Values.coder.httproute.enable .Values.coder.httproute.httpsRedirect.enable -}}
+{{- if empty .Values.coder.httproute.httpsRedirect.parentRefs -}}
 {{- fail "coder.httproute.httpsRedirect.parentRefs is required when coder.httproute.httpsRedirect.enable=true" -}}
 {{- end -}}
+{{- $httpsRedirectStatusCode := toString .Values.coder.httproute.httpsRedirect.statusCode -}}
+{{- if not (regexMatch "^(301|302|303|307|308)$" $httpsRedirectStatusCode) -}}
+{{- fail "coder.httproute.httpsRedirect.statusCode must be one of 301, 302, 303, 307, or 308." -}}
+{{- end -}}
+{{- end -}}
 
 {{- if .Values.coder.httproute.enable }}
 ---
@@ -29,6 +35,7 @@ spec:
     - {{ . | quote }}
     {{- end }}
   {{- if .Values.coder.httproute.httpsRedirect.enable }}
+{{- $httpsRedirectStatusCode := toString .Values.coder.httproute.httpsRedirect.statusCode }}
 ---
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
@@ -48,7 +55,7 @@ spec:
     - filters:
       - requestRedirect:
           scheme: https
-          statusCode: 308
+          statusCode: {{ $httpsRedirectStatusCode }}
         type: RequestRedirect
       matches:
       - path:
diff --git a/helm/coder/tests/testdata/listenerset_redirect.golden b/helm/coder/tests/testdata/listenerset_redirect.golden
index e0c9ffd3763cf..a9e6fe44a9f23 100644
--- a/helm/coder/tests/testdata/listenerset_redirect.golden
+++ b/helm/coder/tests/testdata/listenerset_redirect.golden
@@ -253,7 +253,7 @@ spec:
     - filters:
       - requestRedirect:
           scheme: https
-          statusCode: 308
+          statusCode: 301
         type: RequestRedirect
       matches:
       - path:
diff --git a/helm/coder/tests/testdata/listenerset_redirect.yaml b/helm/coder/tests/testdata/listenerset_redirect.yaml
index 0897dc47c6248..04548c3f6fddf 100644
--- a/helm/coder/tests/testdata/listenerset_redirect.yaml
+++ b/helm/coder/tests/testdata/listenerset_redirect.yaml
@@ -9,6 +9,7 @@ coder:
     host: coder.example.com
     httpsRedirect:
       enable: true
+      statusCode: 301
       parentRefs:
       - name: fake-gateway
         port: 80
diff --git a/helm/coder/tests/testdata/listenerset_redirect_coder.golden b/helm/coder/tests/testdata/listenerset_redirect_coder.golden
index 34029dd1815e5..471078c0ba321 100644
--- a/helm/coder/tests/testdata/listenerset_redirect_coder.golden
+++ b/helm/coder/tests/testdata/listenerset_redirect_coder.golden
@@ -253,7 +253,7 @@ spec:
     - filters:
       - requestRedirect:
           scheme: https
-          statusCode: 308
+          statusCode: 301
         type: RequestRedirect
       matches:
       - path:
diff --git a/helm/coder/values.yaml b/helm/coder/values.yaml
index a1c0c40ccafd9..b1389dab83d32 100644
--- a/helm/coder/values.yaml
+++ b/helm/coder/values.yaml
@@ -513,6 +513,9 @@ coder:
       enable: false
       # coder.httproute.httpsRedirect.annotations -- The redirect HTTPRoute annotations.
       annotations: {}
+      # coder.httproute.httpsRedirect.statusCode -- The redirect response status code.
+      # Supported values are 301, 302, 303, 307, and 308.
+      statusCode: 308
       # coder.httproute.httpsRedirect.parentRefs -- the parentRefs to bind the route to
       # - kind: ListenerSet
       #   name: coder