Gateway-HttpRoute-Guide.md

Gateway-HttpRoute-Guide.md.md

Hoop Gateway Helm Chart

Prerequisites

• Kubernetes 1.19+
• Helm 3.x
• A running PostgreSQL instance

Installation

Install the chart from the OCI registry:

helm upgrade hoop --install \
  oci://ghcr.io/hoophq/helm-charts/hoop-chart --version 1466.0.0-g4b3c77b \
  --namespace hoopdev --create-namespace \
  --set 'config.POSTGRES_DB_URI=postgres://user:password@host:5432/hoop' \
  --set config.API_URL=https://hoop.yourdomain.org

Exposing Hoop

The chart supports three approaches to expose the gateway. Choose one.

Approach	Values key	Use when
Kubernetes Ingress	ingressApi / ingressGrpc	You have an Ingress controller (nginx, traefik, etc.)
Gateway API	gatewayApi	You use Istio, Cilium, or another Gateway API implementation
LoadBalancer Service	proxyService	You need direct TCP access for PostgreSQL, SSH, or RDP proxies

Gateway API (Istio)

The chart can create a Gateway and HTTPRoute using the standard gateway.networking.k8s.io/v1 API.

Hoop runs two ports that both need to be reachable:

Port	Traffic
8009	Web UI and REST API
8010	CLI and agent gRPC connections

HTTP

config:
  POSTGRES_DB_URI: 'postgres://user:password@host:5432/hoop'
  API_URL: 'http://hoop.yourdomain.org'

gatewayApi:
  enabled: true
  gateway:
    gatewayClassName: istio
    listeners:
    - name: http
      hostname: hoop.yourdomain.org
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
  httpRoute:
    hostnames:
    - hoop.yourdomain.org
    parentRefs:
    - name: hoopgateway
    rules:
    - matches:
      - path:
          type: PathPrefix
          value: /protobuf.Transport
      backendRefs:
      - name: hoopgateway
        port: 8010
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
      - name: hoopgateway
        port: 8009

The /protobuf.Transport rule must come before the / catch-all so that gRPC traffic is matched first.

HTTPS

Provide a TLS certificate as a Kubernetes Secret in the same namespace, then reference it in the listener:

config:
  POSTGRES_DB_URI: 'postgres://user:password@host:5432/hoop'
  API_URL: 'https://hoop.yourdomain.org'

gatewayApi:
  enabled: true
  gateway:
    gatewayClassName: istio
    listeners:
    - name: https
      hostname: hoop.yourdomain.org
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
        - name: hoop-tls-cert
      allowedRoutes:
        namespaces:
          from: Same
  httpRoute:
    hostnames:
    - hoop.yourdomain.org
    parentRefs:
    - name: hoopgateway
      sectionName: https
    rules:
    - matches:
      - path:
          type: PathPrefix
          value: /protobuf.Transport
      backendRefs:
      - name: hoopgateway
        port: 8010
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
      - name: hoopgateway
        port: 8009

Attaching to an existing Gateway

If your cluster already has a shared Gateway, set createGateway: false and reference it in parentRefs:

gatewayApi:
  enabled: true
  createGateway: false
  httpRoute:
    hostnames:
    - hoop.yourdomain.org
    parentRefs:
    - name: shared-gateway
      namespace: infra     # omit if the Gateway is in the same namespace
      sectionName: https   # omit to attach to all listeners
    rules:
    - matches:
      - path:
          type: PathPrefix
          value: /protobuf.Transport
      backendRefs:
      - name: hoopgateway
        port: 8010
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
      - name: hoopgateway
        port: 8009

When referencing a Gateway in a different namespace, a ReferenceGrant must exist in the Gateway's namespace permitting the attachment. This resource is not created by this chart.