feat(helm): enable WebSocket upgrades by default on KGateway by kavix · Pull Request #4080 · openchoreo/openchoreo

kavix · 2026-07-03T11:59:54Z

Purpose

Websocket is a first-class workload endpoint type in OpenChoreo, but connections failed out of the box because KGateway (based on Envoy) disables WebSocket upgrades by default. Enabling upgrades requires an HTTPListenerPolicy (gateway.kgateway.dev/v1alpha1) on the Gateway listener.

This PR deploys a default HTTPListenerPolicy in the data-plane Helm chart so that WebSocket upgrades work out-of-the-box for all users without manual cluster-wide operations.

Approach

Added a new template install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml which creates an HTTPListenerPolicy targeting the default gateway (gateway-default) with WebSocket upgrades enabled.
Gated the generation on gateway.enabled and gateway.gatewayClassName == "kgateway" to align with the KGateway-specific CRD availability and prevent installation failures on non-KGateway configurations.
Added the gateway.httpListenerPolicy configuration under gateway in values.yaml and values.schema.json to allow users to toggle the policy.
Cleaned up the manual step to apply the HTTPListenerPolicy from samples/from-image/doclet/README.md and samples/from-image/echo-websocket-service/README.md.

Related Issues

Closes #4069
Refs #3915

Checklist

Tests added or updated (unit, integration, etc.)
Samples updated (if applicable)
Added backport/<release-branch> label if this should be backported (e.g., backport/release-v1.0)
This PR includes AI-generated code or content

coderabbitai · 2026-07-03T12:03:11Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fcf14546-8146-47fc-a814-8d87088f9e9c

📥 Commits

Reviewing files that changed from the base of the PR and between 09de6c9 and 62a36ef.

📒 Files selected for processing (1)

install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml

📝 Walkthrough

Changed files by top-level folder:

install/: 2
- install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml (new)
- install/helm/openchoreo-data-plane/values.yaml (1-line whitespace change)
samples/: 2
- samples/from-image/doclet/README.md
- samples/from-image/echo-websocket-service/README.md
api/: 0, config/: 0, internal/: 0, pkg/: 0, docs/: 0, openapi/: 0, agents/: 0, make/: 0, cmd/: 0

API/CRD surface:

Helm now conditionally creates a gateway.kgateway.dev/v1alpha1 HTTPListenerPolicy to enable WebSocket upgrades:
- Rendered only when gateway.enabled=true and gateway.gatewayClassName is kgateway (defaulted via | default "kgateway").
- Targets the chart-created Gateway named gateway-default.
- Sets spec.upgradeConfig.enabledUpgrades: [websocket].
Compatibility risk: medium (install/upgrade behavior). The template includes explicit warnings about prior manual creation of an HTTPListenerPolicy named default-httplistenerpolicy, which can cause Helm ownership/adoption/name-collision issues if it already exists.

Tests:

No tests were added/updated.
Missing coverage: Helm upgrade/adoption behavior when the policy already exists; end-to-end WebSocket connectivity verification for the default gateway listener.

Risk hotspots:

Install/upgrade paths (medium): pre-existing manual HTTPListenerPolicy resources may conflict with Helm management.
Reconciliation/ownership (medium): resource name/ownership/label expectations may differ for clusters that previously applied the manual policy.
Authn/authz / RBAC / secrets (low): no direct changes indicated.
WebSocket enablement scope (low/positive): gated to gatewayClassName=kgateway to avoid impacting non-kgateway installs.

README/sample updates:

Updated sample README step headings/numbering to remove the need for manual “enable WebSockets” policy instructions:
- doclet README: Step header restructured.
- echo-websocket-service README: Step 1 changed to “Deploy the Application” and subsequent section renumbered.

Walkthrough

Adds a Helm template that conditionally renders a kgateway HTTPListenerPolicy enabling WebSocket upgrades on the default data-plane gateway, and updates two sample READMEs to remove the manual WebSocket-enablement step and renumber subsequent steps.

Changes

HTTPListenerPolicy Helm template and configuration

Layer / File(s)	Summary
HTTPListenerPolicy template and values `install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml`, `install/helm/openchoreo-data-plane/values.yaml`	Adds a conditional Helm template rendering an `HTTPListenerPolicy` targeting `gateway-default` to enable WebSocket upgrades when `gateway.enabled` is true and `gatewayClassName` is `kgateway`, along with a gateway-scoped values.yaml spacing change.

Sample README step renumbering

Layer / File(s)	Summary
Remove manual WebSocket step and renumber `samples/from-image/doclet/README.md`, `samples/from-image/echo-websocket-service/README.md`	Replaces the manual "Enable WebSockets" Step 1 with a "Deploy" step and renumbers the subsequent test/promote steps in both README files.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: akila-i, binoyPeries, chathuranga95, ChathurangaKCD, isala404, JanakaSandaruwan, LakshanSS, mevan-karu, Mirage20, nilushancosta, sameerajayasoma, VajiraPrabuddhaka, yashodgayashan, rashadism, NomadXD

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: enabling WebSocket upgrades by default on KGateway.
Description check	✅ Passed	The description covers Purpose, Approach, Related Issues, and Checklist, with only the optional Remarks section missing.
Linked Issues check	✅ Passed	The chart now applies HTTPListenerPolicy by default for kgateway and removes the manual README steps, matching `#4069`.
Out of Scope Changes check	✅ Passed	The changes stay focused on default WebSocket enablement and sample cleanup, with no clear unrelated code added.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-07-03T12:06:24Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

akila-i · 2026-07-07T05:00:25Z

Thanks for the contribution @kavix. Here the httpListenerPolicy name (default-httplistenerpolicy) is same as the one in the old READMEs, which would break helm upgrade commands for existing users who already have applied the httpListenerPolicy from old READMEs, when upgrading OpenChoreo.

Shall we mention the instructions in the upgrade documention in a follow up PR (https://github.com/openchoreo/openchoreo.github.io/blob/main/docs/platform-engineer-guide/upgrades.mdx) to either delete or add helm ownership annotations before upgrading OpenChoreo dataplanes?

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml`:
- Line 1: The HTTPListenerPolicy template currently ignores the
gateway.httpListenerPolicy.enabled toggle, so the resource is still rendered
when the flag is false. Update the condition in httplistenerpolicy.yaml to also
check .Values.gateway.httpListenerPolicy.enabled alongside the existing
gateway.enabled and gatewayClassName logic, using the template block that
renders the HTTPListenerPolicy; if this flag is not intended to control
rendering, remove it from the values/schema instead to avoid a dead
configuration knob.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e6e4885f-5b6a-4956-a148-e72a86d862d8

📥 Commits

Reviewing files that changed from the base of the PR and between 0930efb and b7cd632.

📒 Files selected for processing (1)

install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml

Add a default HTTPListenerPolicy targeting the default-gateway in the data-plane Helm chart. Enable it by default, gated on gatewayClassName being 'kgateway'. This allows workloads with Websocket endpoints to function correctly out of the box without requiring manual cluster-wide operations. Also, remove the manual HTTPListenerPolicy creation steps from the doclet and echo-websocket-service sample READMEs. Refs openchoreo#4068, openchoreo#3915 Signed-off-by: kavix <[email protected]>

kavix · 2026-07-07T06:22:12Z

Thanks for the contribution @kavix. Here the httpListenerPolicy name (default-httplistenerpolicy) is same as the one in the old READMEs, which would break helm upgrade commands for existing users who already have applied the httpListenerPolicy from old READMEs, when upgrading OpenChoreo.

Shall we mention the instructions in the upgrade documention in a follow up PR (https://github.com/openchoreo/openchoreo.github.io/blob/main/docs/platform-engineer-guide/upgrades.mdx) to either delete or add helm ownership annotations before upgrading OpenChoreo dataplanes?

Yes, that makes perfect sense and sounds like the cleanest path forward. I'll open a follow-up PR in the openchoreo.github.io repository to update the upgrade guide.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml`:
- Line 5: The httplistenerpolicy resource name is hardcoded as a static literal,
which can cause Helm ownership conflicts on upgrade and collisions across
multiple releases. Update the name in the httplistenerpolicy template to use the
chart’s release/fullname helper so it is scoped per deployment, and make sure
the associated labels/annotations remain consistent with the chosen naming
helper. Also document how users should handle an already existing manually
created policy before upgrading, using the existing template symbols for the
gateway policy resource.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f90e32d5-b275-444c-81a0-039e578acf6c

📥 Commits

Reviewing files that changed from the base of the PR and between bd6e457 and 09de6c9.

📒 Files selected for processing (4)

install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml
install/helm/openchoreo-data-plane/values.yaml
samples/from-image/doclet/README.md
samples/from-image/echo-websocket-service/README.md

✅ Files skipped from review due to trivial changes (3)

install/helm/openchoreo-data-plane/values.yaml
samples/from-image/echo-websocket-service/README.md
samples/from-image/doclet/README.md

Signed-off-by: kavix <[email protected]>

kavix requested review from ChathurangaKCD, JanakaSandaruwan, LakshanSS, Mirage20, NomadXD, VajiraPrabuddhaka, akila-i, chalindukodikara, chathuranga95, isala404, mevan-karu, nilushancosta, sameerajayasoma and yashodgayashan as code owners July 3, 2026 11:59

github-actions Bot added the reportedBy/community label Jul 3, 2026

NomadXD requested changes Jul 7, 2026

View reviewed changes

Comment thread install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml Outdated

coderabbitai Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml

kavix requested a review from NomadXD July 7, 2026 06:15

kavix force-pushed the feat/websocket-upgrades-4069-2026-07-03 branch from bd6e457 to 09de6c9 Compare July 7, 2026 06:19

coderabbitai Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread install/helm/openchoreo-data-plane/templates/gateway/httplistenerpolicy.yaml Outdated

feat(helm): scope HTTPListenerPolicy name per deployment

62a36ef

Signed-off-by: kavix <[email protected]>

NomadXD approved these changes Jul 8, 2026

View reviewed changes

NomadXD merged commit ae1b10e into openchoreo:main Jul 8, 2026
14 checks passed

kavix mentioned this pull request Jul 8, 2026

docs: add migration note for default-httplistenerpolicy Helm ownership conflict openchoreo/openchoreo.github.io#751

Open

4 tasks done

coderabbitai Bot mentioned this pull request Jul 9, 2026

feat(cli): add resource to occ config context scope #4145

Merged

2 of 4 tasks

Navigation Menu

feat(helm): enable WebSocket upgrades by default on KGateway - #4080

feat(helm): enable WebSocket upgrades by default on KGateway#4080
NomadXD merged 2 commits into
openchoreo:mainfrom
kavix:feat/websocket-upgrades-4069-2026-07-03

kavix commented Jul 3, 2026

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Uh oh!

codecov Bot commented Jul 3, 2026

Uh oh!

Uh oh!

akila-i commented Jul 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

kavix commented Jul 7, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

kavix commented Jul 3, 2026

Purpose

Approach

Related Issues

Checklist

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

codecov Bot commented Jul 3, 2026

Codecov Report

Uh oh!

Uh oh!

akila-i commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

kavix commented Jul 7, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

akila-i commented Jul 7, 2026 •

edited

Loading