From fe808eae0e1194be48923567c4e0f179aead5acf Mon Sep 17 00:00:00 2001 From: Tom Brow Date: Fri, 18 Sep 2026 16:46:49 -0700 Subject: [PATCH] fix(push): label plaintext push gateway service as HTTP (#7717) The gateway serves plaintext HTTP on its public container port, but the chart currently advertises that Service port as `https`. Label it `http` so protocol-aware proxies discover the application's actual protocol. Numeric port 8080, target port `public`, and the application version remain unchanged. Consumers that refer to the old Service port name must update that reference. Prepare chart version 0.3.1, which is absent from the current release tags and OCI registry. This ordinary fix branch does not trigger the chart release lane. Publishing and downstream dependency updates remain separate steps. This corrects protocol metadata; it is not evidence of a TLS-origination failure. Istio controls upstream TLS through DestinationRules and auto-mTLS independently of this port label. Validation: added rendered-Service and container-port assertions across default, production, and Gateway API fixtures. The assertion fails with the old label and passes with the fix. The full chart render/lint suite and release-contract checks pass. Repository-wide `just ci` is still running locally. --------- Signed-off-by: Tom Brow --- .../charts/buzz-push-gateway/templates/service.yaml | 2 +- deploy/charts/buzz-push-gateway/tests/render.sh | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/deploy/charts/buzz-push-gateway/templates/service.yaml b/deploy/charts/buzz-push-gateway/templates/service.yaml index 73c08c1efa..1ae933d329 100644 --- a/deploy/charts/buzz-push-gateway/templates/service.yaml +++ b/deploy/charts/buzz-push-gateway/templates/service.yaml @@ -6,4 +6,4 @@ metadata: spec: selector: {{- include "push.runtimeLabels" . | nindent 4 }} ports: - - { name: https, port: {{ .Values.service.port }}, targetPort: public } + - { name: http, port: {{ .Values.service.port }}, targetPort: public } diff --git a/deploy/charts/buzz-push-gateway/tests/render.sh b/deploy/charts/buzz-push-gateway/tests/render.sh index 675fea6fde..0f4f00bb65 100755 --- a/deploy/charts/buzz-push-gateway/tests/render.sh +++ b/deploy/charts/buzz-push-gateway/tests/render.sh @@ -34,6 +34,18 @@ def assert!(condition, detail = "assertion failed") raise detail unless condition end +# The application serves plaintext HTTP behind ingress TLS termination. Check +# every ingress mode so service discovery never advertises application TLS. +ARGV.each do |path| + resources = YAML.load_stream(File.read(path)).compact + service = resources.find { |x| x["kind"] == "Service" } + ports = service.dig("spec", "ports") + assert!(ports == [{ "name" => "http", "port" => 8080, "targetPort" => "public" }], ports.inspect) + deployment = resources.find { |x| x["kind"] == "Deployment" } + container_ports = deployment.dig("spec", "template", "spec", "containers", 0, "ports") + assert!(container_ports.any? { |port| port["name"] == "public" && port["containerPort"] == 8080 }) +end + xs = YAML.load_stream(File.read(ARGV[0])).compact svc = xs.find { |x| x["kind"] == "Service" } assert!(svc.dig("spec", "ports").map { |port| port["targetPort"] } == ["public"])