Codestin Search App

0xmeyer · 2026-05-06T09:25:49Z

Adds support for Gateway API ListenerSet.

This PR was validated using kgateway-v2.3.0-main using the following values:

coder:
  image:
    tag: v2.31.11
  listenerset:
    enable: true
    annotations:
      cert-manager.io/cluster-issuer: my-cluster-issuer
      cert-manager.io/private-key-algorithm: ECDSA
      cert-manager.io/private-key-size: "384"
    parentRef:
      name: shared-internal-gateway
      namespace: kgateway-system
    listeners:
    - name: http
      hostname: "chart-example.local"
      port: 80
      protocol: HTTP
    - name: http-wildcard
      hostname: "*.chart-example.local"
      port: 80
      protocol: HTTP
    - name: https
      hostname: "*.chart-example.local"
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: chart-example-tls
    - name: https-wildcard
      hostname: "chart-example.local"
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: chart-example-tls
  httproute:
    enable: true
    parentRefs:
    - kind: ListenerSet
      name: coder
      port: 443
    host: "chart-example.local"
    wildcardHost: "*.chart-example.local"
    httpsRedirect:
      enable: true
      parentRefs:
      - kind: ListenerSet
        name: coder
        port: 80

Validate:

$ GW_ADDR=$(kubectl get svc -n kgateway-system shared-internal-gateway -o=jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")

$ curl -so /dev/null -w "%{http_code}" --resolve chart-example.local:80:${GW_ADDR} http://chart-example.local
308

$ curl -L --resolve chart-example.local:80:${GW_ADDR} http://chart-example.local/api/v2/buildinfo
{"external_url":"https://github.com/coder/coder/commit/49be5f31d35ff8beac0c0f489bdcf7a2e4d24872","version":"v2.31.11+49be5f3","dashboard_url":"http://coder.dev-ome.svc.cluster.local","telemetry":true,"workspace_proxy":false,"agent_api_version":"1.0","provisioner_api_version":"1.15","upgrade_message":"","deployment_id":"8e5917d5-7fea-4658-b7d9-0f3b3e99b861"}

$ curl --resolve chart-example.local:443:${GW_ADDR} https://chart-example.local/api/v2/buildinfo
{"external_url":"https://github.com/coder/coder/commit/49be5f31d35ff8beac0c0f489bdcf7a2e4d24872","version":"v2.31.11+49be5f3","dashboard_url":"http://coder.dev-ome.svc.cluster.local","telemetry":true,"workspace_proxy":false,"agent_api_version":"1.0","provisioner_api_version":"1.15","upgrade_message":"","deployment_id":"8e5917d5-7fea-4658-b7d9-0f3b3e99b861"}

github-actions · 2026-05-06T09:26:08Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

0xmeyer · 2026-05-06T09:32:48Z

I have read the CLA Document and I hereby sign the CLA

bpmct · 2026-05-06T12:53:34Z

thanks for putting this together — nice that you validated end-to-end against kgateway in the description. a few things i'd want addressed before this merges:

bugs

httproute.yaml: the --- separator is outside the redirect's if block, so when httpsRedirect.enable: false the rendered output still has a trailing empty doc. it should be inside the conditional
listenerset.yaml: parentRef is required by the gateway api spec but nothing enforces it. if someone sets listenerset.enable: true and forgets parentRef, you'll render parentRef: with no content and only catch it at apply time. same goes for httpsRedirect.parentRefs. a fail with a friendly message would be nicer
values.yaml: the helm-doc tag says coder.listenerset.parentRefs (plural), but the actual key below is parentRef (singular). the commented example also isn't indented under parentRef:, so copy-pasting it won't work
minor: 3-space indent on the labels line in listenerset.yaml vs 4 everywhere else. nindent masks it at runtime but the source is inconsistent

gaps

no tests. there's a thorough golden-file suite in helm/coder/tests/ with cases for every other feature (tls, sa, ingress variants, etc.), and this PR adds 100+ lines of new template with zero coverage. should add at least a listenerset and httproute_redirect test case + golden
worth a note in the values.yaml comments about gateway api version requirements. ListenerSet only graduated to standard gateway.networking.k8s.io/v1 in gateway api v1.5 (april 2026). anyone on v1.4 or earlier is still on XListenerSet under gateway.networking.x-k8s.io/v1alpha1, plus the parent gateway needs allowedListeners set. people on older clusters will hit confusing failures otherwise
nit: i'd split the redirect into its own httproute_redirect.yaml rather than mixing it into httproute.yaml. easier to reason about and consistent with how ingress.yaml is its own file

Comment posted by Coder Agents on behalf of @bpmct

0xmeyer · 2026-05-07T05:02:39Z

Hi @bpmct,

thanks for the review.

the --- separator is outside the redirect's if block ...

fixed.

parentRef is required by the gateway api spec but nothing enforces it ...

Added parentRef / parentRefs validation for both HTTPRoute objects and the ListenerSet object.

the helm-doc tag says coder.listenerset.parentRefs (plural), but the actual key below is parentRef (singular)

fixed.

minor: 3-space indent on the labels line in listenerset.yaml

fixed.

no tests.

I've never written Helm tests before. If they're needed, I'll take a closer look.

worth a note in the values.yaml comments about gateway api version requirements.

done.

nit: i'd split the redirect into its own httproute_redirect.yaml rather than mixing it into httproute.yaml.

I don't agree with that, since these two resources belong together. However, if you'd still like me to, I can put the redirect route in a separate file.

bpmct · 2026-05-07T12:43:38Z

Thanks! Giving this a shot on my machine now, then will likely flag for someone else on the dev team to review too!

0xmeyer · 2026-05-19T04:32:18Z

Hi @bpmct, any updates?

rowansmithau

hey @0xmeyer thanks for the contribution. I've added some review notes if you could take a look at those please.

on the tests, if you take a look at https://github.com/coder/coder/blob/main/helm/coder/tests/testdata/host_aliases.yaml (and the others in that directory) you will get an idea of the required structure. those test files are used to generate the .golden files which are used across version/code changes for comparison.

1. Remove parentRefs required validation for httproute — parentRefs are optional per the Gateway API spec and enforcing them is a breaking change for existing users. 2. Add listeners required validation for listenerset — listeners is required per the ListenerSet spec and omitting it only surfaces at apply time with a confusing error.

rowansmithau

the two issues were resolved, thanks.

I ran the CI but it looks to me like the failures are unrelated to this PR.

Now we just need some tests added.

I tested locally with:

helm template coder . \
  --set coder.image.tag=v2.34.2 \
  --set coder.httproute.enable=true \
  --set "coder.httproute.parentRefs[0].name=fake-gateway" \
  --set "coder.httproute.parentRefs[0].namespace=fake-ns" \
  --set coder.httproute.host=coder.example.com \
  --set coder.listenerset.enable=true \
  --set "coder.listenerset.parentRef.name=fake-gateway" \
  --set "coder.listenerset.parentRef.namespace=fake-ns" \
  --set "coder.listenerset.listeners[0].name=https" \
  --set "coder.listenerset.listeners[0].port=443" \
  --set "coder.listenerset.listeners[0].protocol=HTTPS"

and:

helm template coder . \
  --set coder.image.tag=v2.34.2 \
  --set coder.httproute.enable=true \
  --set "coder.httproute.parentRefs[0].name=fake-gateway" \
  --set "coder.httproute.parentRefs[0].namespace=fake-ns" \
  --set coder.httproute.host=coder.example.com \
  --set coder.httproute.httpsRedirect.enable=true \
  --set "coder.httproute.httpsRedirect.parentRefs[0].name=fake-gateway" \
  --set "coder.httproute.httpsRedirect.parentRefs[0].port=80" \
  --set coder.listenerset.enable=true \
  --set "coder.listenerset.parentRef.name=fake-gateway" \
  --set "coder.listenerset.parentRef.namespace=fake-ns" \
  --set "coder.listenerset.listeners[0].name=https" \
  --set "coder.listenerset.listeners[0].port=443" \
  --set "coder.listenerset.listeners[0].protocol=HTTPS" \
  --set "coder.listenerset.listeners[1].name=http" \
  --set "coder.listenerset.listeners[1].port=80" \
  --set "coder.listenerset.listeners[1].protocol=HTTP"

they are probably the ideal params to build a test around (like https://github.com/coder/coder/blob/main/helm/coder/tests/testdata/tls.yaml as an example)

rowansmithau · 2026-06-18T05:52:06Z

/coder-agents-review

coder-agents-review · 2026-06-18T05:52:10Z

Chat: Review posted | View chat
Requested: 2026-06-18 05:52 UTC by @rowansmithau
Spend: $3.70 / $100.00

Review history

R1 (2026-06-18), 1 Nit, 1 P2, COMMENT. Review

deep-review v0.8.0 | Round 1 | 3c3708f..db0dcc8

Last posted: Round 1, 2 findings (1 P2, 1 Nit), COMMENT. Review

Finding inventory

Finding Inventory

Findings

#	Sev	Status	Location	Summary	Round	Reviewer	Posted
CRF-1	P2	Open	listenerset.yaml:1	No golden file test cases for new ListenerSet template or HTTPS redirect route	R1	Netero	Yes
CRF-2	Nit	Open	listenerset.yaml:9	Missing `---` YAML document separator before apiVersion	R1	Netero	Yes

Round log

Round 1

Netero-only. 1 P2, 1 Nit. Reviewed against 3c3708f..db0dcc8.

About deep-review

CRF = Coder Review Finding (P0-P4, Nit, Note)

Reviewer	Focus
Bisky	tests
Chopper	ops/errors
Churn-guard	change verification
Ging	language modernization
Gon	naming
Hisoka	edge cases
Killua	perf
Kite	change integrity
Knov	contracts
Knuckle	SQL
Komugi	flake/determinism
Kurapika	security
Law	decomposition
Leorio	docs
Luffy	product
Mafu-san	process
Mafuuu	contracts
Melody	dispatch/pairing
Meruem	structural
Nami	frontend
Netero	mechanical checks
Pariston	premise testing
Pen-botter	product gaps
Razor	verification
Robin	duplication
Ryosuke	Go arch
Takumi	concurrency
Zoro	shape

🤖 Managed by Coder Agents.

coder-agents-review

This is a first-pass review only. These are mechanical findings; the full review panel has not yet reviewed this PR. The panel will review after these findings are addressed.

This PR adds Gateway API ListenerSet support and HTTPS redirect to the Helm chart. The implementation is clean: validation checks with clear error messages, correct API version targeting, and the template structure renders valid YAML. The author's end-to-end validation against kgateway is thorough.

Severity summary: 1 P2, 1 Nit.

The chart has 30+ golden file test fixtures covering every other feature (TLS, service accounts, ingress, host aliases, etc.). The new ListenerSet template and HTTPS redirect route add 64 lines of template logic with 3 validation checks at 0% test density. Both human reviewers (@rowansmithau and @bpmct) also flagged this gap.

🤖 This review was automatically generated with Coder Agents.

coder-agents-review · 2026-06-18T06:11:12Z

@@ -0,0 +1,28 @@
+{{- if and .Values.coder.listenerset.enable (empty .Values.coder.listenerset.parentRef) -}}


P2 [CRF-1] No golden file test cases for the new ListenerSet template or the HTTPS redirect HTTPRoute.

The chart's test infrastructure in helm/coder/tests/ uses values YAML fixtures with golden file comparison. There are 30+ test cases covering other features, verified by:

grep -rl 'listenerset\|httpsRedirect\|ListenerSet\|https-redirect' helm/coder/tests/testdata/ # (no results)

This template has 3 fail validation checks and multi-document rendering (the redirect route shares a template with the main HTTPRoute). At minimum, two test fixtures would cover the core paths:

listenerset.yaml: listenerset.enable=true with required parentRef and listeners

httproute_redirect.yaml: httproute.enable=true + httpsRedirect.enable=true with required parentRefs

@rowansmithau provided ready-to-use helm template invocations in their second review that map directly to test fixtures. See helm/coder/tests/testdata/tls.yaml for the structure. (Netero)

🤖

Add two test cases matching the scenarios from review: 1. listenerset — enables ListenerSet + HTTPRoute with parentRefs 2. listenerset_redirect — adds HTTPS redirect HTTPRoute on top Each generates golden files for both default and coder namespaces, consistent with the existing test suite (tls, host_aliases, etc.).

bpmct · 2026-06-22T21:53:57Z

Added golden-file tests in c6a2915 covering both scenarios from your review:

listenerset — ListenerSet + HTTPRoute with parentRefs
listenerset_redirect — ListenerSet + HTTPRoute + HTTPS redirect

Each generates golden files for both default and coder namespaces, consistent with the existing test suite (tls, host_aliases, etc.).

Comment posted by Coder Agents on behalf of @bpmct

rowansmithau

LGTM!

github-actions Bot added the community Pull Requests and issues created by the community. label May 6, 2026

github-actions Bot assigned 0xmeyer May 6, 2026

0xmeyer force-pushed the main branch from 6a18861 to 1040210 Compare May 6, 2026 09:28

cdrci2 added a commit to coder/cla that referenced this pull request May 6, 2026

@0xmeyer has signed the CLA in coder/coder#24993

6f1ceea

0xmeyer marked this pull request as ready for review May 6, 2026 10:44

0xmeyer added 3 commits May 7, 2026 06:31

feat: add ListenerSet

86447a6

feat: add HTTPS redirect option for httproute

ae57777

feat: add validation for httproute/listenerset parentRefs

a10d490

0xmeyer force-pushed the main branch from 1040210 to a10d490 Compare May 7, 2026 04:50

github-actions Bot added the stale This issue is like stale bread. label May 17, 2026

github-actions Bot removed the stale This issue is like stale bread. label May 20, 2026

matifali requested review from bpmct and rowansmithau May 26, 2026 10:51

rowansmithau requested changes May 28, 2026

View reviewed changes

Comment thread helm/coder/templates/httproute.yaml Outdated

Comment thread helm/coder/templates/listenerset.yaml

bpmct requested a review from rowansmithau June 17, 2026 19:24

rowansmithau requested changes Jun 18, 2026

View reviewed changes

coder-agents-review Bot reviewed Jun 18, 2026

View reviewed changes

rowansmithau and others added 2 commits June 18, 2026 16:13

add ---

254a4e6

bpmct requested a review from rowansmithau June 22, 2026 21:59

This comment has been minimized.

Sign in to view

Merge branch 'main' into main

d65e81a

rowansmithau approved these changes Jun 23, 2026

View reviewed changes

bpmct merged commit d0f68cb into coder:main Jun 29, 2026
50 of 52 checks passed

github-actions Bot locked and limited conversation to collaborators Jun 29, 2026

		@@ -0,0 +1,28 @@
		{{- if and .Values.coder.listenerset.enable (empty .Values.coder.listenerset.parentRef) -}}

Uh oh!

Conversation

0xmeyer commented May 6, 2026

Uh oh!

github-actions Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

0xmeyer commented May 6, 2026

Uh oh!

bpmct commented May 6, 2026

Uh oh!

0xmeyer commented May 7, 2026

Uh oh!

bpmct commented May 7, 2026

Uh oh!

0xmeyer commented May 19, 2026

Uh oh!

rowansmithau left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rowansmithau left a comment

Choose a reason for hiding this comment

Uh oh!

rowansmithau commented Jun 18, 2026

Uh oh!

coder-agents-review Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Finding Inventory

Findings

Round log

Round 1

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coder-agents-review Bot Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

bpmct commented Jun 22, 2026

Uh oh!

This comment has been minimized.

rowansmithau left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions Bot commented May 6, 2026 •

edited

Loading

coder-agents-review Bot commented Jun 18, 2026 •

edited

Loading