Feat: Add externalTrafficPolicy for DC products (#1160)

Author: pbhardwaj6

.github/workflows/e2e-tf-deployment.yaml

@@ -20,7 +20,7 @@ on:
         description: 'Use Gateway API (Envoy Gateway) instead of NGINX Ingress'
         required: false
         type: boolean
-        default: false
+        default: true
       terraform_branch:
         description: 'Terraform repo branch to use (leave empty for latest LTS tag)'
         required: false

src/main/charts/bamboo/README.md

@@ -90,6 +90,7 @@ Kubernetes: `>=1.21.x-0`
 | bamboo.seraphConfig.generateByHelm | bool | `false` | Mount seraph-config.xml as a ConfigMap. Override configuration elements if necessary  |
 | bamboo.service.annotations | object | `{}` | Additional annotations to apply to the Service  |
 | bamboo.service.contextPath | string | `nil` | The Tomcat context path that Bamboo will use. The ATL_TOMCAT_CONTEXTPATH will be set automatically.  |
+| bamboo.service.externalTrafficPolicy | string | `nil` | The external traffic policy for the Service. Set to "Local" to preserve the client source IP (e.g. for audit logging or when fronted by an AWS ALB/NLB with instance/NodePort targets). Only applied when service.type is "NodePort" or "LoadBalancer"; ignored for ClusterIP, where Kubernetes rejects this field.  |
 | bamboo.service.loadBalancerIP | string | `nil` | Use specific loadBalancerIP. Only applies to service type LoadBalancer.  |
 | bamboo.service.nodePort | string | `nil` | Only applicable if service.type is NodePort. NodePort for Bamboo service  |
 | bamboo.service.port | int | `80` | The port on which the Bamboo K8s Service will listen for http traffic  |

src/main/charts/bamboo/templates/service.yaml

@@ -10,6 +10,9 @@ metadata:
   {{- end }}
 spec:
   type: {{ .Values.bamboo.service.type }}
+  {{- if and .Values.bamboo.service.externalTrafficPolicy (or (eq .Values.bamboo.service.type "NodePort") (eq .Values.bamboo.service.type "LoadBalancer")) }}
+  externalTrafficPolicy: {{ .Values.bamboo.service.externalTrafficPolicy }}
+  {{- end }}
   sessionAffinity: {{ .Values.bamboo.service.sessionAffinity }}
   {{- if .Values.bamboo.service.sessionAffinityConfig.clientIP.timeoutSeconds }}
   sessionAffinityConfig:

src/main/charts/bamboo/values.yaml

@@ -725,6 +725,13 @@ bamboo:
     #
     loadBalancerIP:
 
+    # -- The external traffic policy for the Service. Set to "Local" to preserve the
+    # client source IP (e.g. for audit logging or when fronted by an AWS ALB/NLB with
+    # instance/NodePort targets). Only applied when service.type is "NodePort" or
+    # "LoadBalancer"; ignored for ClusterIP, where Kubernetes rejects this field.
+    #
+    externalTrafficPolicy:
+
     # -- The Tomcat context path that Bamboo will use. The ATL_TOMCAT_CONTEXTPATH
     # will be set automatically.
     #

src/main/charts/bitbucket/README.md

@@ -129,6 +129,7 @@ Kubernetes: `>=1.21.x-0`
 | bitbucket.securityContextEnabled | bool | `true` | Whether to apply security context to pod.  |
 | bitbucket.service.annotations | object | `{}` | Additional annotations to apply to the Service  |
 | bitbucket.service.contextPath | string | `nil` | The context path that Bitbucket will use.  |
+| bitbucket.service.externalTrafficPolicy | string | `nil` | The external traffic policy for the Service. Set to "Local" to preserve the client source IP (e.g. for audit logging or when fronted by an AWS ALB/NLB with instance/NodePort targets). Only applied when service.type is "NodePort" or "LoadBalancer"; ignored for ClusterIP, where Kubernetes rejects this field.  |
 | bitbucket.service.loadBalancerIP | string | `nil` | Use specific loadBalancerIP. Only applies to service type LoadBalancer.  |
 | bitbucket.service.nodePort | string | `nil` | Only applicable if service.type is NodePort. NodePort for Bitbucket service  |
 | bitbucket.service.port | int | `80` | The port on which the Bitbucket K8s HTTP Service will listen  |

src/main/charts/bitbucket/templates/service.yaml

@@ -11,6 +11,9 @@ metadata:
     {{- end }}
 spec:
   type: {{ .Values.bitbucket.service.type }}
+  {{- if and .Values.bitbucket.service.externalTrafficPolicy (or (eq .Values.bitbucket.service.type "NodePort") (eq .Values.bitbucket.service.type "LoadBalancer")) }}
+  externalTrafficPolicy: {{ .Values.bitbucket.service.externalTrafficPolicy }}
+  {{- end }}
   sessionAffinity: {{ .Values.bitbucket.service.sessionAffinity }}
   {{- if .Values.bitbucket.service.sessionAffinityConfig.clientIP.timeoutSeconds }}
   sessionAffinityConfig:

src/main/charts/bitbucket/values.yaml

@@ -705,6 +705,13 @@ bitbucket:
     #
     loadBalancerIP:
 
+    # -- The external traffic policy for the Service. Set to "Local" to preserve the
+    # client source IP (e.g. for audit logging or when fronted by an AWS ALB/NLB with
+    # instance/NodePort targets). Only applied when service.type is "NodePort" or
+    # "LoadBalancer"; ignored for ClusterIP, where Kubernetes rejects this field.
+    #
+    externalTrafficPolicy:
+
     # -- The context path that Bitbucket will use.
     #
     contextPath:

src/main/charts/confluence/README.md

@@ -91,6 +91,7 @@ Kubernetes: `>=1.21.x-0`
 | confluence.seraphConfig.generateByHelm | bool | `false` | Mount seraph-config.xml as a ConfigMap. Override configuration elements if necessary  |
 | confluence.service.annotations | object | `{}` | Additional annotations to apply to the Service  |
 | confluence.service.contextPath | string | `nil` | The Tomcat context path that Confluence will use. The ATL_TOMCAT_CONTEXTPATH will be set automatically.  |
+| confluence.service.externalTrafficPolicy | string | `nil` | The external traffic policy for the Service. Set to "Local" to preserve the client source IP (e.g. for audit logging or when fronted by an AWS ALB/NLB with instance/NodePort targets). Only applied when service.type is "NodePort" or "LoadBalancer"; ignored for ClusterIP, where Kubernetes rejects this field.  |
 | confluence.service.loadBalancerIP | string | `nil` | Use specific loadBalancerIP. Only applies to service type LoadBalancer.  |
 | confluence.service.nodePort | string | `nil` | Only applicable if service.type is NodePort. NodePort for Confluence service  |
 | confluence.service.port | int | `80` | The port on which the Confluence K8s Service will listen  |

src/main/charts/confluence/templates/service.yaml

@@ -10,6 +10,9 @@ metadata:
     {{- end }}
 spec:
   type: {{ .Values.confluence.service.type }}
+  {{- if and .Values.confluence.service.externalTrafficPolicy (or (eq .Values.confluence.service.type "NodePort") (eq .Values.confluence.service.type "LoadBalancer")) }}
+  externalTrafficPolicy: {{ .Values.confluence.service.externalTrafficPolicy }}
+  {{- end }}
   sessionAffinity: {{ .Values.confluence.service.sessionAffinity }}
   {{- if .Values.confluence.service.sessionAffinityConfig.clientIP.timeoutSeconds }}
   sessionAffinityConfig:

src/main/charts/confluence/values.yaml

@@ -742,6 +742,13 @@ confluence:
     #
     loadBalancerIP:
 
+    # -- The external traffic policy for the Service. Set to "Local" to preserve the
+    # client source IP (e.g. for audit logging or when fronted by an AWS ALB/NLB with
+    # instance/NodePort targets). Only applied when service.type is "NodePort" or
+    # "LoadBalancer"; ignored for ClusterIP, where Kubernetes rejects this field.
+    #
+    externalTrafficPolicy:
+
     # -- The Tomcat context path that Confluence will use. The ATL_TOMCAT_CONTEXTPATH
     # will be set automatically.
     #