feat(stack): surface apiKeys/sis/reval gateway-route enable flags

[sparve-nv]

Summary

Surface the apiKeys, sis, and reval gateway-route enable flags in the self-managed stack so they can be toggled from environments/<env>.yaml, instead of only by patching global.yaml.gotmpl. Each flag defaults to true (the chart default), so existing deployments are unchanged.

Additional Details

global.yaml.gotmpl's nvcfGatewayRoutes.routes block already passes the enable flags through from ingress.gatewayApi.routes.* for nats, ess, nvcfApi.grpc, nvctApi.grpc, and grpcWorker, but for apiKeys it emitted only routeAnnotations and did not emit sis / reval at all. The ingress release reads only global.yaml.gotmpl, so ingress.gatewayApi.routes.{apiKeys,sis,reval}.enabled set in an environment file never reached the release — the only way to disable those routes was a carried patch to global.yaml.gotmpl.

The nvcf-gateway-routes chart already gates all three via nvcfGatewayRoutes.routes.{apiKeys,sis,reval}.enabled (default true); this change only adds the missing stack passthrough. No chart change.

• deploy/stacks/self-managed/global.yaml.gotmpl — add enabled dig passthroughs (default true) for apiKeys / sis / reval, alongside their existing routeAnnotations.
• deploy/stacks/self-managed/environments/base.yaml — document the three flags (enabled: true) under ingress.gatewayApi.routes.

Example — keep api-keys off the public edge and drop the unused sis/reval routes:

# environments/<env>.yaml
ingress:
  gatewayApi:
    routes:
      apiKeys: { enabled: false }
      sis:     { enabled: false }
      reval:   { enabled: false }

For the Reviewer

• Backward-compatible: each flag dig-defaults to true, matching the chart default, so an unset flag renders identically.
• This is the same default-preserving mechanism the stack already uses for the other surfaced routes and for api.accountBootstrap.enabled (Allow disabling the NVCF API account-bootstrap post-install hook in the nvcf-api chart #894 / feat(nvcf-api): add api.accountBootstrap.enabled flag to gate account-bootstrap hook #895): add the knob, default to current behavior, let operators opt out.

For QA

Automated test (make test). Added deploy/stacks/self-managed/tests/gateway-routes-enable-wiring.sh, wired into the offline make test target next to gateway-routes-local-chart.sh. It follows the existing value-wiring pattern (pdb-value-wiring.sh): it renders the ingress release values with helmfile write-values and asserts, via yq, that nvcfGatewayRoutes.routes.{apiKeys,sis,reval}.enabled is true by default and false when the environment file sets ingress.gatewayApi.routes.{apiKeys,sis,reval}.enabled: false. As a teeth-check, reverting only global.yaml.gotmpl to main (keeping the base.yaml docs) makes the test fail (expected enabled=true), confirming it guards the passthrough and that base.yaml alone is inert without it.

Manual render. Also rendered the ingress release with helmfile template -l name=ingress (helmfile v1.7.4) against the local nvcf-gateway-routes chart, using a minimal env file that supplies the operator-required gateway names.

• Case A — default (flags unset): api-keys, sis, and reval HTTPRoutes all render, alongside nvcf-api, nvct-api, invocation-service, llm-api-gateway, and the grpc TCPRoute. A diff of this render against the same render on origin/main (before the change) is empty — byte-identical, confirming no behavior change when the flags are unset.
• Case B — override (ingress.gatewayApi.routes.{apiKeys,sis,reval}.enabled=false): the api-keys, sis, and reval HTTPRoutes are absent; every other route still renders.

Issues

Fixes #1374

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for DCO compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• New Features

  • Added configurable enablement for API keys, SIS, and revalidation gateway routes.
  • Routes are enabled by default and can be disabled independently.
  • Existing route annotations remain configurable.
  • Gateway route settings can now be controlled consistently across deployment environments.

• Tests

  • Added validation to confirm default route behavior and environment-specific disablement settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 45f694c9-800b-4525-a8ea-54494503068b

📥 Commits

Reviewing files that changed from the base of the PR and between a1318f7 and 9ef97d5.

📒 Files selected for processing (2)

• deploy/stacks/self-managed/Makefile
• deploy/stacks/self-managed/tests/gateway-routes-enable-wiring.sh

Included review availability: Your plan provides up to 12 included reviews per hour; 10 remain after this review.

---

📝 Walkthrough

Walkthrough

The self-managed stack exposes apiKeys, sis, and reval gateway route enable flags. Each flag defaults to true and can be overridden through environment configuration. An integration test validates both states.

Changes

Gateway route flags

Layer / File(s)	Summary
Expose route enable flags deploy/stacks/self-managed/environments/base.yaml, deploy/stacks/self-managed/global.yaml.gotmpl	The configuration defines apiKeys, sis, and reval enable flags. The global template passes environment values through with true defaults and retains configurable apiKeys route annotations.
Validate rendered route flags deploy/stacks/self-managed/tests/gateway-routes-enable-wiring.sh, deploy/stacks/self-managed/Makefile	The integration test renders ingress values and verifies default true values and environment overrides to false. The Makefile runs the test target.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9ef97

This change exposes existing gateway-route enable flags while preserving current behavior when unset; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: raitnao

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy issue #1374 by surfacing apiKeys, sis, and reval enable flags, defaulting them to true, allowing environment-level disabling, documenting the options, and leaving the gatew…
Out of Scope Changes check	✅ Passed	All changes support the linked objective. The configuration, documentation, Makefile wiring, and integration test are directly related to exposing and validating the gateway-route enable flags.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title uses the required Conventional Commits format, includes the required scope for a customer-impacting feat, and accurately describes the gateway-route enable flag changes.

Full details: Linked Issues check

Explanation

The changes satisfy issue #1374 by surfacing apiKeys, sis, and reval enable flags, defaulting them to true, allowing environment-level disabling, documenting the options, and leaving the gateway-routes chart unchanged.

Full details: Docstring Coverage

Explanation

Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 5 functions across 1 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}