Moving to Kubernetes

Operations guide: configure, deploy and observe the gateway. What the capability does, product side: product guide; calling it: developer guide.

Goal: the same contract, in a cluster, in one command - with nothing installed beforehand.

Command (short path: a contract, an upstream URL)

helm install orders oci://ghcr.io/flexwiz/charts/flexway --version <version> \
  --set-file openapi=examples/rest-minimal/openapi.yaml \
  --set upstream=http://orders.internal:8080

Full path: the whole flexway.yaml as config, the files it names as contracts.

# values.yaml
config:
  version: 1
  contracts: { openapi: ./orders.yaml }
  upstreams:
    default: { url: "http://orders.internal:8080" }
contracts:
  orders.yaml: |
    openapi: 3.1.0
    ...
secretMounts:
  - name: llm-keys          # read as file:/etc/flexway-secrets/llm-keys/<key>

helm install orders oci://ghcr.io/flexwiz/charts/flexway --version <version> -f values.yaml

Check

kubectl port-forward svc/orders-flexway 8080:8080 &
curl -i http://localhost:8080/orders          # relayed to the upstream
curl -i http://localhost:8080/nope            # 404: closed by default
kubectl port-forward svc/orders-flexway-admin 9090:9090 &
curl -s http://localhost:9090/readyz          # {"status":"ready","operations":3}

/readyz green means: contract loaded, routes, chains, expressions and validation schemas compiled for every mode - no compilation waits for the first request (1.6.0). It does not say that an upstream connection is open (the first request to an upstream opens it: DNS, TCP, TLS) nor that an OIDC issuer's keys are read yet (discovery runs in the background).

Without a contract, the install fails in the terminal, with the command to type - never a pod that does not start.

The contract and the configuration are one ConfigMap mounted as a directory: a helm upgrade with a changed contract is served without a restart (Changing the configuration without a restart). Secrets are Secrets the chart does not create. The admin port has a Service of its own, ClusterIP: never expose it. The core requires nothing Kubernetes-specific: the same file runs on a VM.

cluster, ready in 5 s. While the image is private, add imagePullSecrets.*