Route k8s traffic through Gateway API (Traefik)

[hahn-kev-bot]

prepping to migrate from ingress to gateway

---

AI summary

This is the first of two PRs moving routing off ingress-nginx and onto Gateway API. It adds HTTPRoutes next to the existing Ingress, and switches local-dev and CI to Traefik.

Routes

• base/http-routes.yaml adds lexbox-web and lexbox-hosts:
  • lexbox-web sends /api, /hg, /security.txt and /.well-known to lexbox, /v1/traces to the otel port, and everything else to ui.
  • lexbox-hosts sends the hg, resumable and admin hosts to lexbox.
• Each environment sets its hostnames as a list in http-routes.patch.yaml. That replaces patching Ingress rules by position and the duplicated rule blocks in prod and develop. The route hostnames match the current Ingress hosts exactly in every environment.
• In the clusters, parentRefs point at a placeholder for the LTOps shared Gateway (ltops-shared-gateway / ltops-gateway, marked TODO(LTOps)). Until we have the real name, the routes attach to nothing and the Ingress keeps serving traffic.

Old Ingress

• The Ingress moved unchanged to a legacy-ingress/ kustomize component, which develop, staging and prod include. Their rendered Ingress is identical to develop.
• A follow-up PR deletes that component and the ingress-config*.yaml patches once each cluster has been cut over.

local-dev / CI

• The vendored ingress-nginx v1.8.0 is replaced by Traefik v3.7.14 (chart 41.7.1), rendered from local-dev/traefik/values.yaml. Re-render it with task k8s:render-traefik.
• Traefik settings:
  • Gateway provider only.
  • readTimeout: 0, so long hg pushes aren't cut off at Traefik's 60s default.
  • Trusts forwarded headers, which replaces nginx's use-forwarded-headers.
• local-dev/gateway.yaml defines a GatewayClass and a Gateway with HTTP and HTTPS listeners and no redirect. The HTTPS listener uses an explicit self-signed Certificate instead of the Ingress annotation.
• The local-dev patch that deleted the OAuth certificates now only matches oauth-*; before, it deleted every Certificate.
• Gateway API CRDs (v1.6.2) are now a cluster prerequisite, installed by task setup-k8s and the setup-k8s action. Existing local clusters need to re-run task setup-k8s once.
• In CI, the setup-k8s input ingress-controller-port is renamed to gateway-port. Port-forwards and log collection now use service/traefik and the app.kubernetes.io/name=traefik label.

Before the clusters can switch (needed from LTOps)

• The shared Gateway's name, namespace and sectionName, with allowedRoutes permitting languagedepot.
• How TLS is handled: LTOps' own certs, or ours. If ours, we add a ReferenceGrant.
• Traefik entrypoint readTimeout: 0 (or a high value), and forwardedHeaders.trustedIPs set to the Cloudflare ranges.
• A plan for the DNS/LB cutover for each environment.

Test plan

• kubectl kustomize renders local-dev, gha, develop, staging and production.
• The develop, staging and prod renders match develop except for the two added HTTPRoutes, and the Ingress is unchanged.
• kubeconform -strict passes on all 153 rendered resources.
• GHA integration tests pass on kind with Traefik (setup-k8s).
• fw-lite e2e passes, including the MSAL HTTPS flow through the service/traefik 443 port-forward.
• tilt up on Docker Desktop, after re-running task setup-k8s: https://localhost works, and hg clone and push work.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	✅ No changes detected	-	Oct 16, 2026, 8:14 AM
e2e (Inspect)	✅ No changes detected	-	Oct 16, 2026, 8:22 AM