feat(gateway-routes): add opt-in HTTPRoute for the nvcf-ui addon

ci/test/check-pr-issue.test.sh

@@ -131,6 +131,7 @@ fail_case_api() {
 pass_case "action keyword short ref" "$(issue_body 'Closes #286')"
 pass_case "action keyword repo ref" "$(issue_body 'Fixes NVIDIA/nvcf#286')"
 pass_case "NO-REF last resort" "$(issue_body 'NO-REF')"
+pass_case "CRLF line endings" $'## Issues\r\nCloses #286\r\n\r\n## Checklist\r\n'
 
 fail_case "missing Issues section" $'## TL;DR\nCloses #286\n'
 fail_case "reference outside Issues" $'## TL;DR\nCloses #286\n\n## Issues\n\n## Checklist\n'

deploy/helm/gateway-routes/chart/templates/_helpers.tpl

@@ -61,7 +61,7 @@ chart currently route PathPrefix /, so duplicate hostnames are ambiguous.
 {{- define "nvcf-gateway.validateUniqueRootHTTPRouteHostnames" -}}
 {{- if .Values.nvcfGatewayRoutes.enabled -}}
 {{- $seenHostnames := dict -}}
-{{- $httpRouteKeys := list "nvcfApi" "nvctApi" "apiKeys" "invocation" "llmApiGateway" "llmInvocation" "vanityGateway" "sis" -}}
+{{- $httpRouteKeys := list "nvcfApi" "nvctApi" "apiKeys" "invocation" "llmApiGateway" "llmInvocation" "vanityGateway" "sis" "nvcfUi" -}}
 {{- range $routeKey := $httpRouteKeys -}}
   {{- $route := index $.Values.nvcfGatewayRoutes.routes $routeKey -}}
   {{- if and $route $route.enabled -}}

deploy/helm/gateway-routes/chart/templates/httproute-nvcf-ui.yaml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- if and .Values.nvcfGatewayRoutes.enabled .Values.nvcfGatewayRoutes.routes.nvcfUi.enabled }}
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ .Values.nvcfGatewayRoutes.routes.nvcfUi.name }}
+  namespace: {{ .Values.nvcfGatewayRoutes.gateways.shared.namespace }}
+  labels:
+    {{- include "nvcf-gateway.labels" . | nindent 4 }}
+    app.kubernetes.io/component: nvcf-ui-route
+  annotations:
+    {{- toYaml .Values.nvcfGatewayRoutes.routes.nvcfUi.routeAnnotations | nindent 4 }}
+spec:
+  # Attach to the shared Gateway
+  parentRefs:
+    - name: {{ .Values.nvcfGatewayRoutes.gateways.shared.name }}
+      namespace: {{ .Values.nvcfGatewayRoutes.gateways.shared.namespace }}
+      sectionName: {{ .Values.nvcfGatewayRoutes.gateways.shared.listenerName }}
+
+  # Hostname matching for the NVCF UI
+  hostnames:
+    {{- range .Values.nvcfGatewayRoutes.routes.nvcfUi.hostnames }}
+    - {{ tpl . $ | quote }}
+    {{- end }}
+
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: {{ .Values.nvcfGatewayRoutes.routes.nvcfUi.backend.name }}
+          namespace: {{ .Values.nvcfGatewayRoutes.routes.nvcfUi.backend.namespace }}
+          port: {{ .Values.nvcfGatewayRoutes.routes.nvcfUi.backend.port }}
+{{- end }}

deploy/helm/gateway-routes/chart/templates/referencegrant-nvcf-ui.yaml

@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+{{- if and .Values.nvcfGatewayRoutes.enabled .Values.nvcfGatewayRoutes.routes.nvcfUi.enabled }}
+---
+# ReferenceGrant allows the HTTPRoute in the shared Gateway namespace to
+# reference the nvcf-ui Service in the nvcf-ui namespace (cross-namespace
+# reference).
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-httproute-to-nvcf-ui
+  namespace: {{ .Values.nvcfGatewayRoutes.routes.nvcfUi.backend.namespace }}
+  labels:
+    {{- include "nvcf-gateway.labels" . | nindent 4 }}
+spec:
+  # Allow references FROM the shared Gateway namespace
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: {{ .Values.nvcfGatewayRoutes.gateways.shared.namespace }}
+  # TO Services in the nvcf-ui namespace
+  to:
+    - group: ""
+      kind: Service
+{{- end }}

deploy/helm/gateway-routes/chart/values.yaml

@@ -175,6 +175,19 @@ nvcfGatewayRoutes:
         port: 8080
       routeAnnotations: {}
 
+    # NVCF UI HTTPRoute
+    # Disabled by default; opt in for deployments that install the nvcf-ui addon
+    nvcfUi:
+      enabled: false
+      name: nvcf-ui
+      hostnames:
+        - "nvcf-ui.{{ .Values.nvcfGatewayRoutes.domain }}"
+      backend:
+        name: nvcf-ui
+        namespace: nvcf-ui
+        port: 8300
+      routeAnnotations: {}
+
     # SIS (Service Identity Service) HTTPRoute
     # Exposes SIS outside the cluster so tools like `nvcf-cli cluster register`
     # can reach it without a kubectl port-forward workaround.