refactor(helm): unify ingress and envoy proxy as a single gateway

access-control-service/src/main/scala/org/apache/texera/service/resource/AccessControlResource.scala

@@ -26,7 +26,7 @@ import jakarta.ws.rs.{Consumes, GET, POST, Path, Produces}
 import org.apache.texera.auth.JwtParser.parseToken
 import org.apache.texera.auth.SessionUser
 import org.apache.texera.auth.util.{ComputingUnitAccess, HeaderField}
-import org.apache.texera.config.{GuiConfig, LLMConfig}
+import org.apache.texera.config.{GuiConfig, KubernetesConfig, LLMConfig}
 import org.apache.texera.dao.jooq.generated.enums.PrivilegeEnum
 
 import java.net.URLDecoder
@@ -121,12 +121,21 @@ object AccessControlResource extends LazyLogging {
         return Response.status(Response.Status.FORBIDDEN).build()
     }
 
+    // Dynamic Routing Logic
+    val workflowComputingUnitPoolName = KubernetesConfig.computeUnitPoolName
+    val workflowComputingUnitPoolNamespace = KubernetesConfig.computeUnitPoolNamespace
+    val workflowComputingUnitPoolPort = KubernetesConfig.computeUnitPortNumber
+
+    val targetHost =
+      s"computing-unit-$cuidInt.$workflowComputingUnitPoolName-svc.$workflowComputingUnitPoolNamespace.svc.cluster.local:$workflowComputingUnitPoolPort"
+
     Response
       .ok()
       .header(HeaderField.UserComputingUnitAccess, cuAccess.toString)
       .header(HeaderField.UserId, userSession.get().getUid.toString)
       .header(HeaderField.UserName, userSession.get().getName)
       .header(HeaderField.UserEmail, userSession.get().getEmail)
+      .header("Host", targetHost) // Envoy ExtAuth: Rewrite Host
       .build()
   }
 

bin/k8s/Chart.yaml

@@ -42,11 +42,6 @@ appVersion: "1.16.0"
 
 
 dependencies:
-  - name: ingress-nginx
-    version: 4.11.3
-    repository: https://kubernetes.github.io/ingress-nginx
-    condition: ingress-nginx.enabled
-
   - name: postgresql
     version: 16.5.6
     repository: https://charts.bitnami.com/bitnami
@@ -59,6 +54,11 @@ dependencies:
     version: 1.4.5
     repository: https://charts.lakefs.io
 
+  - name: gateway-helm
+    version: 1.6.3
+    repository: oci://docker.io/envoyproxy
+    alias: envoy-gateway
+
   - name: metrics-server
     version: 3.12.2
     repository: https://kubernetes-sigs.github.io/metrics-server/

bin/k8s/templates/access-control-service-deployment.yaml

@@ -46,6 +46,10 @@ spec:
                 secretKeyRef:
                   name: {{ .Release.Name }}-postgresql
                   key: postgres-password
+            - name: KUBERNETES_COMPUTE_UNIT_POOL_NAME
+              value: {{ .Values.workflowComputingUnitPool.name }}
+            - name: KUBERNETES_COMPUTE_UNIT_POOL_NAMESPACE
+              value: {{ .Values.workflowComputingUnitPool.namespace }}
           livenessProbe:
             httpGet:
               path: /api/healthcheck

bin/k8s/templates/envoy-service.yaml → bin/k8s/templates/gateway-backend.yaml

@@ -15,20 +15,10 @@
 # specific language governing permissions and limitations
 # under the License.
 
-apiVersion: v1
-kind: Service
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: Backend
 metadata:
-  name: envoy-svc
+  name: {{ .Release.Name }}-dynamic-backend
   namespace: {{ .Release.Namespace }}
 spec:
-  type: {{ .Values.envoy.service.type }}
-  selector:
-    app: envoy
-  ports:
-    - protocol: TCP
-      port: {{ .Values.envoy.service.port }}
-      targetPort: {{ .Values.envoy.service.port }}
-      # if service type is set to NodePort, include nodePort attribute
-      {{- if eq .Values.envoy.service.type "NodePort" }}
-      nodePort: {{ .Values.envoy.service.nodePort }}
-      {{- end }}
+  type: DynamicResolver