Migrate ingress from NGINX to Envoy Gateway

[laurigates]

Summary

Migrate OLMap applications from ingress-nginx to Envoy Gateway (Gateway API) for ingress traffic routing.

Affected Applications

Application	Values File
olmap-backend	deploy/backend-values.yaml
olmap-frontend	deploy/frontend-values.yaml

Background

The platform is migrating from ingress-nginx to Envoy Gateway as the ingress controller (infrastructure#955). The helm-webapp chart already supports Gateway API via the gateway.enabled flag.

Changes Required

In each values file listed above, add:

gateway:
  enabled: true

This automatically:

• Creates an HTTPRoute pointing to the shared dataportal-gateway
• Suppresses the Ingress resource (mutually exclusive)
• Auto-generates the hostname as {release-name}.dataportal.fi (same as current ingress default)

Review each values file for any NGINX-specific ingress annotations that may need equivalent Envoy Gateway configuration.

Verification

For each application:

1. After merge, confirm ArgoCD syncs successfully
2. Verify the HTTPRoute is created: kubectl get httproute -n <namespace>
3. Verify DNS resolves to the Envoy Gateway IP
4. Test application accessibility
5. Monitor for 24-48h

References

• ADR-0012: Envoy Gateway
• helm-webapp chart gateway support

[laurigates]

• Let's work on this by following the suggested solution
• Research latest documentation and best practices

@claude

[claude]

Claude finished @laurigates's task in 1m 57s —— View job • claude/issue-62-20260320-2010 • Create PR ➔

---

Migrating Ingress from NGINX to Envoy Gateway

Todo

• Gather context and understand the request
• Read current deploy values files
• Add gateway.enabled: true to deploy/backend-values.yaml
• Add gateway.enabled: true to deploy/frontend-values.yaml
• Handle NGINX-specific annotation (frontend SPA routing)
• Commit and push changes

Changes Made

deploy/backend-values.yaml and deploy/frontend-values.yaml: Replaced the ingress block with gateway.enabled: true in both files and explicitly set ingress.enabled: false.

Important Note: Frontend SPA Routing

The frontend previously used this NGINX-specific ingress annotation to handle React SPA routing:

nginx.ingress.kubernetes.io/configuration-snippet: |
  location ~* ^/(?!api|admin|static|rest-auth|accounts|health).*$ {
    try_files $uri $uri/ /index.html;
  }

This annotation injects a location block into the ingress controller's nginx config. With Envoy Gateway this does not apply — the HTTPRoute only routes traffic to the service; it doesn't rewrite requests at the path level.

Action required: Verify that the frontend nginx container's own nginx.conf (inside the Docker image) includes the equivalent try_files $uri $uri/ /index.html; directive for the root location block. If it does not, React client-side routes will return 404 after the migration. Check the frontend Dockerfile or nginx config in the image build.

Verification Steps (from issue)

1. After merge, confirm ArgoCD syncs successfully
2. kubectl get httproute -n <namespace> — confirm HTTPRoute is created
3. Verify DNS resolves to the Envoy Gateway IP
4. Test application accessibility at olmap.dataportal.fi
5. Specifically test React client-side routes (e.g. /Notes/, /note/123) to confirm SPA routing works
6. Monitor for 24-48h

|