feat(helm): render Twingate CRs instead of annotating the Gateway Service#332
Open
minhtule wants to merge 8 commits into
Open
feat(helm): render Twingate CRs instead of annotating the Gateway Service#332minhtule wants to merge 8 commits into
minhtule wants to merge 8 commits into
Conversation
Render TwingateGateway, TwingateCertificateAuthority, and an optional in-cluster Kubernetes TwingateResource, gated behind twingateOperator.gateway.enabled. The chart is the source of truth; the operator reconciles the CRs to the Twingate backend.
The operator now reconciles the Twingate CRs the chart renders directly, so the gateway.twingate.com Service annotations and the twingate.resource values are removed. The in-cluster resource alias (TLS cert SAN) and the data-plane kubernetes upstream block are now sourced from twingateOperator.kubernetesResource instead. BREAKING CHANGE: twingate.resource.* is removed; use twingateOperator.gateway.enabled and twingateOperator.kubernetesResource.*.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #332 +/- ##
==========================================
+ Coverage 86.07% 86.18% +0.10%
==========================================
Files 40 40
Lines 2830 2830
==========================================
+ Hits 2436 2439 +3
+ Misses 269 265 -4
- Partials 125 126 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Helm chart’s integration with the Twingate Kubernetes Operator by rendering Twingate Custom Resources (CRs) instead of annotating the Gateway Service, enabling a cleaner source-of-truth model and supporting operator-managed reconciliation.
Changes:
- Introduces
twingateOperator.gateway.enabledandtwingateOperator.kubernetesResource.enabledflags and values docs/schema to gate CR rendering. - Adds a new
twingate-cr.yamltemplate to renderTwingateCertificateAuthority,TwingateGateway, and optionalTwingateResource(Kubernetes API server). - Removes Service annotation-based resource integration and makes Service port configurable via
service.port.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| deploy/gateway/values.yaml | Adds twingateOperator.* values and introduces service.port default. |
| deploy/gateway/values.schema.json | Adds schema for twingateOperator.* values (operator/CR integration). |
| deploy/gateway/tests/twingate-cr_test.yaml | New unit tests validating CR rendering and gating behavior. |
| deploy/gateway/tests/tls-secret_test.yaml | Updates TLS regeneration test inputs to use twingateOperator.kubernetesResource.alias. |
| deploy/gateway/tests/service_test.yaml | Removes tests for deprecated Service annotation-based integration. |
| deploy/gateway/tests/gateway-configmap_test.yaml | Updates configmap tests to use twingateOperator.kubernetesResource.enabled. |
| deploy/gateway/tests/cert-manager_test.yaml | Updates cert-manager SAN test inputs to use twingateOperator.kubernetesResource.alias. |
| deploy/gateway/templates/twingate-cr.yaml | New template rendering Twingate CRs (CA, Gateway, optional Kubernetes Resource). |
| deploy/gateway/templates/service.yaml | Removes Twingate resource annotations and uses service.port. |
| deploy/gateway/templates/gateway-configmap.yaml | Switches “resource enabled” detection to twingateOperator.kubernetesResource.enabled. |
| deploy/gateway/templates/_helpers.tpl | Updates resource alias helper to read from twingateOperator.kubernetesResource.alias. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
minhtule
commented
Jun 11, 2026
clement0010
approved these changes
Jun 12, 2026
ekampf
reviewed
Jun 15, 2026
| # resource.twingate.com/alias: "myk8s.int" | ||
| # Any TwingateResource spec field passes straight through; the chart owns | ||
| # type/address/gatewayRef and defaults `name` to "<fullname> Kubernetes | ||
| # cluster". `alias` is also added to the auto-generated TLS cert SANs. |
Contributor
There was a problem hiding this comment.
If provided, alias is also added to the auto ...
Signed-off-by: Eran Kampf <205185+ekampf@users.noreply.github.com>
ekampf
approved these changes
Jun 15, 2026
|
This pull request is stale because it has been open 5 days with no activity. Remove stale label or comment or this will be closed in 5 days. |
|
This pull request is stale because it has been open 5 days with no activity. Remove stale label or comment or this will be closed in 5 days. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Tickets & Documents
Changes
Conditionally render Twingate Custom Resources to integrate with Twingate k8s operator
Notes