[migmartri]

Add useSharedEndpoints, an opt-in chart flag that defaults to false. It follows the same approach as the chainloop-ee chart (chainloop-dev/platform#6964). When the flag is on:

• The control plane connects to the CAS through the shared CAS Service (<release>-cas:<service port>), not through the gRPC-only -api Service.
• The installation notes show the shared ingress hostnames (or the shared Service NodePort) as the CLI addresses.

The flag changes client selection, not endpoint exposure. The legacy serviceAPI and ingressAPI settings remain functional and are now marked deprecated. Their removal belongs to a later release, after existing clients migrate. Disabling the flag restores the previous client endpoint selection, and the defaults render the same output as before.

The chart README now says that the control plane and CAS have served gRPC and HTTP on one port since v1.126.0 (chart 1.469.0). The custom-domain examples now use the shared ingresses. A new "Opt in to shared client endpoints" section describes the migration.

Related: #3628

AI assistance: this change was prepared with Claude Code.

[chainloop-platform]

AI Session Checks — ⚠️ no AI session found

Missing AI Coding Sessions

This organization requires every PR to be backed by a Chainloop Trace AI coding session, and none was found for this one.

Please make sure the AI coding session evidence has been sent by the Chainloop CLI, or add the skip-ai-session label to this PR to bypass this check.

Learn more about Chainloop Trace.

---

Powered by Chainloop and Chainloop Trace

[cubic-dev-ai]

2 issues found across 15 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="deployment/chainloop/README.md">

<violation number="1" location="deployment/chainloop/README.md:345">
P2: `ingressAPI` is not enabled by default: both legacy Ingress values default to `false`, even though the legacy listener and Service remain enabled. Clarify that clients need `ingressAPI.enabled: true` for the legacy Ingress, and reserve the future deprecation statement for the port and Service.</violation>

<violation number="2" location="deployment/chainloop/README.md:349">
P2: This instruction hard-codes port 443 without requiring TLS on the shared ingresses. With the chart defaults (`ingress.tls: false`), the shared gRPC endpoints use port 80, so the documented command can fail; document the TLS prerequisite or use the configured shared-ingress port.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: ingressAPI is not enabled by default: both legacy Ingress values default to false, even though the legacy listener and Service remain enabled. Clarify that clients need ingressAPI.enabled: true for the legacy Ingress, and reserve the future deprecation statement for the port and Service.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At deployment/chainloop/README.md, line 345:

<comment>`ingressAPI` is not enabled by default: both legacy Ingress values default to `false`, even though the legacy listener and Service remain enabled. Clarify that clients need `ingressAPI.enabled: true` for the legacy Ingress, and reserve the future deprecation statement for the port and Service.</comment>

<file context>
@@ -299,72 +300,74 @@ The NGINX gRPC module path supports the shared endpoint without path or content-
 
+### Disable the legacy gRPC ports
+
+Since Chainloop v1.126.0 (chart version 1.469.0), the shared HTTP port of each service also serves native gRPC. The legacy gRPC port (`containerPorts.grpc`), its Service (`serviceAPI`) and its ingress (`ingressAPI`) are kept for backward compatibility and are enabled by default. They will be disabled by default in a future release and then removed.
+
+Before you disable them:
</file context>

Suggested change

Since Chainloop v1.126.0 (chart version 1.469.0), the shared HTTP port of each service also serves native gRPC. The legacy gRPC port (`containerPorts.grpc`), its Service (`serviceAPI`) and its ingress (`ingressAPI`) are kept for backward compatibility and are enabled by default. They will be disabled by default in a future release and then removed.

Since Chainloop v1.126.0 (chart version 1.469.0), the shared HTTP port of each service also serves native gRPC. The legacy gRPC port (`containerPorts.grpc`) and its Service (`serviceAPI`) remain enabled by default for backward compatibility; the legacy Ingress (`ingressAPI`) is opt-in with `ingressAPI.enabled: false` by default. The legacy port and Service will be disabled by default in a future release and then removed.

[cubic-dev-ai]

P2: This instruction hard-codes port 443 without requiring TLS on the shared ingresses. With the chart defaults (ingress.tls: false), the shared gRPC endpoints use port 80, so the documented command can fail; document the TLS prerequisite or use the configured shared-ingress port.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At deployment/chainloop/README.md, line 349:

<comment>This instruction hard-codes port 443 without requiring TLS on the shared ingresses. With the chart defaults (`ingress.tls: false`), the shared gRPC endpoints use port 80, so the documented command can fail; document the TLS prerequisite or use the configured shared-ingress port.</comment>

<file context>
@@ -299,72 +300,74 @@ The NGINX gRPC module path supports the shared endpoint without path or content-
+
+Before you disable them:
+
+1. Point the CLI and every other gRPC client to the shared hostnames (`controlplane.ingress.hostname` and `cas.ingress.hostname`) on port 443, for example `chainloop config save --control-plane cp.chainloop.dev:443 --artifact-cas cas.chainloop.dev:443`.
+2. Make sure that no client still uses an `ingressAPI` hostname. These hostnames stop working.
+
</file context>

Suggested change

	1. Point the CLI and every other gRPC client to the shared hostnames (`controlplane.ingress.hostname` and `cas.ingress.hostname`) on port 443, for example `chainloop config save --control-plane cp.chainloop.dev:443 --artifact-cas cas.chainloop.dev:443`.
	1. Point the CLI and every other gRPC client to the shared hostnames on the shared Ingress ports (443 when `controlplane.ingress.tls` and `cas.ingress.tls` are `true`; otherwise typically 80), for example `chainloop config save --control-plane cp.chainloop.dev:443 --artifact-cas cas.chainloop.dev:443` after enabling TLS.

[migmartri]

making it draft until we decide a rollout process