feat(helm): add optional networking.k8s.io/v1 Ingress for the UI

[elihai-risk]

What

Adds an optional classic networking.k8s.io/v1 Ingress for the UI (ui.ingress, disabled by default) — className, labels/annotations, hosts/paths with per-path backend override, and tls passthrough.

Why

The chart currently exposes the UI via Gateway API HTTPRoute and OpenShift Route, but clusters on classic ingress controllers (AWS ALB, ingress-nginx, Traefik) have no built-in option and must hand-roll an Ingress out-of-band. We hit this deploying kagent 0.9.11 on EKS behind an internal ALB.

The per-path backend override covers the common auth pattern of pointing the Ingress at the bundled oauth2-proxy instead of the UI Service:

ui:
  ingress:
    enabled: true
    className: alb
    hosts:
      - host: kagent.example.com
        paths:
          - path: /
            pathType: Prefix
            backend:
              name: kagent-oauth2-proxy
              port: 4180

Notes

• Disabled by default; no behavior change.
• Follows the ui.httpRoute conventions (labels merged with chart labels, annotations passthrough, backend defaults to the UI Service on ui.service.ports.port).
• helm-unittest coverage: default off, class/host/default-backend, per-path backend override, tls+annotations passthrough (4 tests).

Related: #2237 (podLabels for controller/UI pods) — together these let the chart run unmodified behind cluster admission policies + classic ingress.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Note

Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds an optional networking.k8s.io/v1 Ingress for exposing the UI on clusters that use classic ingress controllers, with per-path backend overrides, annotations/labels, and TLS passthrough.

Changes:

• Add ui.ingress values (disabled by default) to configure a classic Ingress.
• Add ui-ingress.yaml Helm template rendering networking.k8s.io/v1 Ingress with per-path backend override.
• Add helm-unittest coverage for default-off, default backend, override backend, and tls/annotations passthrough.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
helm/kagent/values.yaml	Adds ui.ingress configuration schema and examples for classic Ingress.
helm/kagent/templates/ui-ingress.yaml	Implements optional UI Ingress rendering with per-host/path rules and backend override.
helm/kagent/tests/ui-ingress_test.yaml	Adds unit tests validating render behavior and key fields.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[EItanya]

Hey there, I really appreciate the PR but frankly I think this is too specific for the core kagent helm chart, this could be a good use case for extraObjects as proposed in #2174

[elihai-risk]

Addressed the review: fail-fast on enabled with no hosts and on a host without paths (previously rendered an invalid Ingress), nil-safe backend access via a defaulted local, and ingressClassName/path quoted. Added negative tests for both guards — 6 tests, all passing.

[elihai-risk]

Fair call — extraObjects (#2174) is the right generic mechanism for this. We'll move our resources to it once it lands. Feel free to lift anything from this PR (templates/tests) into docs or examples if useful. Thanks for the quick review!