feat(ingress): Add native Traefik IngressRoute support (#1972)

Author: salehi

charts/sentry/templates/_helpers.tpl

@@ -0,0 +1,8 @@
+# Add this to templates/_helpers.tpl if not already present
+
+{{/*
+Relay port
+*/}}
+{{- define "relay.port" -}}
+{{- default 3000 .Values.relay.service.port -}}
+{{- end -}}

charts/sentry/templates/ingressroute.yaml

@@ -0,0 +1,100 @@
+{{- if .Values.traefikIngressRoute.enabled }}
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ template "sentry.fullname" . }}-relay
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "sentry.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    {{- with .Values.traefikIngressRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.traefikIngressRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.traefikIngressRoute.entryPoints }}
+  entryPoints:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  routes:
+    # Route for project-specific API endpoints (e.g., /api/2/store/, /api/123/envelope/)
+    # This handles SDK event ingestion
+    - match: Host(`{{ .Values.traefikIngressRoute.hostname | default .Values.ingress.hostname }}`) && PathRegexp(`/api/[0-9]+/`)
+      kind: Rule
+      priority: {{ .Values.traefikIngressRoute.priority | default 100 }}
+      services:
+        - name: {{ template "sentry.fullname" . }}-relay
+          port: {{ template "relay.port" . }}
+    
+    # Route for /api/store (legacy endpoint)
+    - match: Host(`{{ .Values.traefikIngressRoute.hostname | default .Values.ingress.hostname }}`) && PathPrefix(`/api/store`)
+      kind: Rule
+      priority: {{ .Values.traefikIngressRoute.priority | default 100 }}
+      services:
+        - name: {{ template "sentry.fullname" . }}-relay
+          port: {{ template "relay.port" . }}
+    
+    # Route for relay-to-relay communication
+    - match: Host(`{{ .Values.traefikIngressRoute.hostname | default .Values.ingress.hostname }}`) && PathPrefix(`/api/0/relays`)
+      kind: Rule
+      priority: {{ .Values.traefikIngressRoute.priority | default 100 }}
+      services:
+        - name: {{ template "sentry.fullname" . }}-relay
+          port: {{ template "relay.port" . }}
+  {{- if .Values.traefikIngressRoute.tls }}
+  tls:
+    {{- with .Values.traefikIngressRoute.tls.secretName }}
+    secretName: {{ . }}
+    {{- end }}
+    {{- with .Values.traefikIngressRoute.tls.options }}
+    options:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  {{- end }}
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: {{ template "sentry.fullname" . }}-web
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: {{ template "sentry.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+    {{- with .Values.traefikIngressRoute.labels }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+  {{- with .Values.traefikIngressRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.traefikIngressRoute.entryPoints }}
+  entryPoints:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  routes:
+    # Catch-all route for Sentry web UI and API
+    - match: Host(`{{ .Values.traefikIngressRoute.hostname | default .Values.ingress.hostname }}`)
+      kind: Rule
+      priority: {{ sub (.Values.traefikIngressRoute.priority | default 100) 10 }}
+      services:
+        - name: {{ template "sentry.fullname" . }}-web
+          port: {{ .Values.service.externalPort }}
+  {{- if .Values.traefikIngressRoute.tls }}
+  tls:
+    {{- with .Values.traefikIngressRoute.tls.secretName }}
+    secretName: {{ . }}
+    {{- end }}
+    {{- with .Values.traefikIngressRoute.tls.options }}
+    options:
+      {{- toYaml . | nindent 6 }}
+    {{- end }}
+  {{- end }}
+{{- end }}

charts/sentry/values.yaml

@@ -2401,6 +2401,36 @@ ingress:
   # - secretName:
   #   hosts:
 
+traefikIngressRoute:
+  # -- Enable Traefik IngressRoute instead of standard Ingress
+  # Use this when running Traefik as your ingress controller for proper regex path matching
+  enabled: false
+
+  # -- Traefik entrypoints to use
+  entryPoints:
+    - web
+    - websecure
+
+  # -- Hostname for the IngressRoute
+  # hostname: sentry.example.com
+
+  # -- TLS configuration (optional, omit if TLS is terminated upstream)
+  tls: {}
+    # secretName: sentry-tls
+    # options:
+    #   name: default
+    #   namespace: default
+
+  # -- Additional route annotations
+  annotations: {}
+
+  # -- Additional route labels
+  labels: {}
+
+  # -- Route priority (higher = matched first)
+  priority: 100
+
+
 filestore:
   # Set to one of filesystem, gcs or s3 as supported by Sentry.
   backend: filesystem