feat(helm): add generic service and ingress annotation support (#2541)

Co-authored-by: cxymds <Cxymds@qq.com>
Co-authored-by: houseme <housemecn@gmail.com>

helm/rustfs/templates/_helpers.tpl

@@ -99,6 +99,66 @@ Render imagePullSecrets for workloads - appends registry secret
 {{- toYaml $secrets }}
 {{- end }}
 
+{{/*
+Render annotations for the main Service resource.
+Merges (in order of increasing precedence):
+  - service.traefikAnnotations  (when ingress.className=traefik)
+  - ingress.traefikAnnotations  (when ingress.className=traefik, backwards-compat alias)
+  - service.annotations
+*/}}
+{{- define "rustfs.serviceAnnotations" -}}
+{{- $annotations := dict }}
+{{- if and .Values.mode.distributed.enabled (eq .Values.ingress.className "traefik") }}
+{{- $annotations = merge $annotations (default (dict) .Values.service.traefikAnnotations) }}
+{{- $annotations = merge $annotations (default (dict) .Values.ingress.traefikAnnotations) }}
+{{- end }}
+{{- $annotations = merge $annotations (default (dict) .Values.service.annotations) }}
+{{- if and .Values.mode.distributed.enabled .Values.mtls.enabled (eq .Values.ingress.className "traefik") }}
+{{- $mtls := dict
+  "traefik.ingress.kubernetes.io/service.serversscheme" "https"
+  "traefik.ingress.kubernetes.io/service.serverstransport" (printf "%s-%s-transport@kubernetescrd" .Release.Namespace (include "rustfs.fullname" .))
+}}
+{{- $annotations = merge $annotations $mtls }}
+{{- end }}
+{{- if $annotations }}
+{{- toYaml $annotations }}
+{{- end }}
+{{- end }}
+
+{{/*
+Render annotations for the headless Service resource.
+Merges:
+  - service.headlessAnnotations
+*/}}
+{{- define "rustfs.headlessServiceAnnotations" -}}
+{{- $annotations := default (dict) .Values.service.headlessAnnotations }}
+{{- if $annotations }}
+{{- toYaml $annotations }}
+{{- end }}
+{{- end }}
+
+{{/*
+Render annotations for the Ingress resource.
+Merges (in order of increasing precedence):
+  - ingress.nginxAnnotations    (when ingress.className=nginx)
+  - ingress.traefikAnnotations  (when ingress.className=traefik)
+  - ingress.customAnnotations   (backwards-compat)
+  - ingress.annotations
+*/}}
+{{- define "rustfs.ingressAnnotations" -}}
+{{- $annotations := dict }}
+{{- if eq .Values.ingress.className "nginx" }}
+{{- $annotations = merge $annotations (default (dict) .Values.ingress.nginxAnnotations) }}
+{{- else if eq .Values.ingress.className "traefik" }}
+{{- $annotations = merge $annotations (default (dict) .Values.ingress.traefikAnnotations) }}
+{{- end }}
+{{- $annotations = merge $annotations (default (dict) .Values.ingress.customAnnotations) }}
+{{- $annotations = merge $annotations (default (dict) .Values.ingress.annotations) }}
+{{- if $annotations }}
+{{- toYaml $annotations }}
+{{- end }}
+{{- end }}
+
 {{/*
 Render RUSTFS_VOLUMES
 */}}

helm/rustfs/templates/ingress.yaml

@@ -1,13 +1,4 @@
 {{- if .Values.ingress.enabled -}}
-{{- $ingressAnnotations := dict }}
-{{- if eq .Values.ingress.className "nginx" }}
-{{- $ingressAnnotations = deepCopy (default (dict) .Values.ingress.nginxAnnotations) }}
-{{- else if eq .Values.ingress.className "traefik" }}
-{{- $ingressAnnotations = deepCopy (default (dict) .Values.ingress.traefikAnnotations) }}
-{{- end }}
-{{- with .Values.ingress.customAnnotations }}
-{{- $ingressAnnotations = merge $ingressAnnotations . }}
-{{- end }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -18,9 +9,9 @@ metadata:
     {{- with .Values.commonLabels }}
     {{- toYaml . | nindent 4 }}
     {{- end }}
-  {{- with $ingressAnnotations }}
+  {{- with (include "rustfs.ingressAnnotations" .) }}
   annotations:
-    {{- toYaml . | nindent 4 }}
+    {{- . | nindent 4 }}
   {{- end }}
 spec:
   {{- with .Values.ingress.className }}

helm/rustfs/templates/service.yaml

@@ -4,6 +4,10 @@ kind: Service
 metadata:
   name: {{ include "rustfs.fullname" . }}-headless
   namespace: {{ .Release.Namespace }}
+  {{- with (include "rustfs.headlessServiceAnnotations" .) }}
+  annotations:
+    {{- . | nindent 4 }}
+  {{- end }}
   labels:
     {{- include "rustfs.labels" . | nindent 4 }}
     {{- with .Values.commonLabels }}
@@ -29,13 +33,9 @@ kind: Service
 metadata:
   name: {{ include "rustfs.fullname" . }}-svc
   namespace: {{ .Release.Namespace }}
-  {{- if and .Values.mode.distributed.enabled (eq .Values.ingress.className "traefik")}}
+  {{- with (include "rustfs.serviceAnnotations" .) }}
   annotations:
-    {{- toYaml .Values.ingress.traefikAnnotations | nindent 4 }}
+    {{- . | nindent 4 }}
-    {{- if and .Values.mtls.enabled (eq .Values.ingress.className "traefik") }}
-    traefik.ingress.kubernetes.io/service.serversscheme: https
-    traefik.ingress.kubernetes.io/service.serverstransport: {{ .Release.Namespace }}-{{ include "rustfs.fullname" . }}-transport@kubernetescrd
-    {{- end }}
   {{- end }}
   labels:
     {{- include "rustfs.labels" . | nindent 4 }}

helm/rustfs/values.yaml

@@ -143,6 +143,14 @@ containerSecurityContext:
   runAsNonRoot: true
 
 service:
+  annotations: {}
+  headlessAnnotations: {} # Applied to the headless Service when mode.distributed.enabled=true
+  traefikAnnotations: # Applied to the Service when mode.distributed.enabled=true and ingress.className=traefik
+    traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
+    traefik.ingress.kubernetes.io/service.sticky.cookie.httponly: "true"
+    traefik.ingress.kubernetes.io/service.sticky.cookie.name: rustfs
+    traefik.ingress.kubernetes.io/service.sticky.cookie.samesite: none
+    traefik.ingress.kubernetes.io/service.sticky.cookie.secure: "true"
   type: ClusterIP
   endpoint:
     port: 9000
@@ -155,12 +163,7 @@ service:
 ingress:
   enabled: true
   className: "nginx" # Specify the classname, traefik or nginx. Different classname has different annotations for session sticky.
-  traefikAnnotations:
+  traefikAnnotations: {} # Deprecated: use service.traefikAnnotations instead
-    traefik.ingress.kubernetes.io/service.sticky.cookie: "true"
-    traefik.ingress.kubernetes.io/service.sticky.cookie.httponly: "true"
-    traefik.ingress.kubernetes.io/service.sticky.cookie.name: rustfs
-    traefik.ingress.kubernetes.io/service.sticky.cookie.samesite: none
-    traefik.ingress.kubernetes.io/service.sticky.cookie.secure: "true"
   nginxAnnotations:
     nginx.ingress.kubernetes.io/affinity: cookie
     nginx.ingress.kubernetes.io/proxy-body-size: "0"
@@ -168,7 +171,8 @@ ingress:
     nginx.ingress.kubernetes.io/session-cookie-hash: sha1
     nginx.ingress.kubernetes.io/session-cookie-max-age: "3600"
     nginx.ingress.kubernetes.io/session-cookie-name: rustfs
-  customAnnotations: # Additional custom annotations (merged with class-specific annotations)
+  annotations: {}
+  customAnnotations: # Deprecated: use ingress.annotations instead
     {}
   hosts:
     - host: example.rustfs.com