From e30781654d26006cda575fa0746775eb3d29b8d3 Mon Sep 17 00:00:00 2001
From: majinghe <42570491+majinghe@users.noreply.github.com>
Date: Wed, 4 Feb 2026 20:21:42 +0800
Subject: [PATCH] =?UTF-8?q?enhancement:=20add=20support=20for=20http=20to?=
 =?UTF-8?q?=20https=20redirect=20for=20traefik=20gatew=E2=80=A6=20(#1712)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 helm/rustfs/templates/gateway-api/gateway.yml | 12 ++++++---
 .../templates/gateway-api/httproute.yml       | 26 +++++++++++++++++++
 .../gateway-api/traefik-service.yaml          |  4 +--
 helm/rustfs/templates/ingress.yaml            |  3 +--
 helm/rustfs/values.yaml                       |  5 ++++
 5 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/helm/rustfs/templates/gateway-api/gateway.yml b/helm/rustfs/templates/gateway-api/gateway.yml
index d6a0a60a8..6f5419566 100644
--- a/helm/rustfs/templates/gateway-api/gateway.yml
+++ b/helm/rustfs/templates/gateway-api/gateway.yml
@@ -5,19 +5,25 @@ metadata:
   name: {{ include "rustfs.fullname" . }}-gateway
 spec:
   gatewayClassName: {{ .Values.gatewayApi.gatewayClass }}
+  {{- with .Values.gatewayApi.listeners }}
   listeners:
+  {{- if .web }}
     - name: http
-      port: 80
+      port: {{ .web.port }}
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: Same
+  {{- end }}
+  {{- if .websecure }}
     - name: https
-      port: 443
+      port: {{ .websecure.port }}
       protocol: HTTPS
       tls:
         mode: Terminate
         certificateRefs:
-          - name: {{ .Values.ingress.tls.secretName }}
+          - name: {{ include "rustfs.fullname" $ }}-tls
             kind: Secret
+  {{- end }}
+  {{- end }}
 {{- end }}
diff --git a/helm/rustfs/templates/gateway-api/httproute.yml b/helm/rustfs/templates/gateway-api/httproute.yml
index 24ac4e473..3b6d6f196 100644
--- a/helm/rustfs/templates/gateway-api/httproute.yml
+++ b/helm/rustfs/templates/gateway-api/httproute.yml
@@ -10,8 +10,10 @@ spec:
       {{- if .Values.gatewayApi.existingGateway.namespace }}
       namespace: {{ .Values.gatewayApi.existingGateway.namespace }}
       {{- end }}
+      sectionName: https
   {{- else }}
     - name: {{ include "rustfs.fullname" . }}-gateway
+      sectionName: https
   {{- end }}
   hostnames:
     - {{ .Values.gatewayApi.hostname }}
@@ -25,4 +27,28 @@ spec:
           port: {{ .Values.service.console.port }}
           kind: TraefikService
           group: traefik.io
+
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "rustfs.fullname" . }}-redirect
+spec:
+  parentRefs:
+  {{- if .Values.gatewayApi.existingGateway.name }}
+    - name: {{ .Values.gatewayApi.existingGateway.name }}
+      {{- if .Values.gatewayApi.existingGateway.namespace }}
+      namespace: {{ .Values.gatewayApi.existingGateway.namespace }}
+      {{- end }}
+      sectionName: http
+  {{- else }}
+    - name: {{ include "rustfs.fullname" . }}-gateway
+      sectionName: http
+  {{- end }}
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
 {{- end }}
\ No newline at end of file
diff --git a/helm/rustfs/templates/gateway-api/traefik-service.yaml b/helm/rustfs/templates/gateway-api/traefik-service.yaml
index 9bd9c50b2..cf1cd3b70 100644
--- a/helm/rustfs/templates/gateway-api/traefik-service.yaml
+++ b/helm/rustfs/templates/gateway-api/traefik-service.yaml
@@ -14,6 +14,6 @@ spec:
           cookie:
             name: rustfs
             httpOnly: true
-            secure: true
-            sameSite: none
+            secure: {{ .Values.ingress.tls.enabled | default false }}
+            sameSite: {{ if .Values.ingress.tls.enabled }}none{{ else }}lax{{ end }}
 {{- end }}
diff --git a/helm/rustfs/templates/ingress.yaml b/helm/rustfs/templates/ingress.yaml
index 89f99c4d8..026f5559e 100644
--- a/helm/rustfs/templates/ingress.yaml
+++ b/helm/rustfs/templates/ingress.yaml
@@ -1,5 +1,4 @@
 {{- if .Values.ingress.enabled -}}
-{{- $secretName := .Values.ingress.tls.secretName }}
 {{- $ingressAnnotations := dict }}
 {{- if eq .Values.ingress.className "nginx" }}
 {{- $ingressAnnotations = .Values.ingress.nginxAnnotations }}
@@ -29,7 +28,7 @@ spec:
         {{- range .Values.ingress.hosts }}
         - {{ .host | quote }}
         {{- end }}
-      secretName: {{ $secretName }}
+      secretName: {{ include "rustfs.fullname" $ }}-tls
   {{- end }}
   rules:
     {{- range .Values.ingress.hosts }}
diff --git a/helm/rustfs/values.yaml b/helm/rustfs/values.yaml
index 05f5ef4c7..8d35dcf50 100644
--- a/helm/rustfs/values.yaml
+++ b/helm/rustfs/values.yaml
@@ -150,6 +150,11 @@ ingress:
 gatewayApi:
   enabled: false
   gatewayClass: traefik
+  listeners: # Specify which listeners to create on the Gateway. Only support for traefik gatewayClass at the moment.
+    web:
+      port: 8000
+    websecure:
+      port: 8443
   hostname: example.rustfs.com
   existingGateway:
     name: ""