akeyless-gateway: add externalTrafficPolicy to SRA SSH service

[avii-wix]

Summary

• Add support for configuring externalTrafficPolicy on the SRA SSH LoadBalancer service via .Values.sra.sshConfig.service.externalTrafficPolicy.
• Field is only rendered when set, so existing installs are unaffected. The default in values.yaml is Cluster, preserving current behavior.

Why

Setting externalTrafficPolicy: Local on the SRA SSH LoadBalancer is necessary when the source client IP must be preserved (e.g. for audit/allowlisting). Today this requires post-install patching of the Service; this change makes it a first-class chart value.

Summary by CodeRabbit

• New Features
  • SSH service now supports a configurable external traffic policy.
• Bug Fixes / Validation
  • The external traffic policy setting is validated and only accepted when the SSH service type is LoadBalancer or NodePort; invalid combinations are rejected to prevent misconfiguration.

[coderabbitai]

📝 Walkthrough

Walkthrough

The Helm SSH Service template now conditionally emits spec.externalTrafficPolicy from .Values.sra.sshConfig.service.externalTrafficPolicy and fails rendering if set for non-LoadBalancer/NodePort service types; values.yaml exposes the externalTrafficPolicy key (empty string by default).

Changes

SSH Service External Traffic Policy

Layer / File(s)	Summary
SSH Service external traffic policy setting charts/akeyless-gateway/templates/akeyless-secure-remote-access/service.yaml, charts/akeyless-gateway/values.yaml	Template conditionally outputs externalTrafficPolicy from .Values.sra.sshConfig.service.externalTrafficPolicy with a template-time fail unless service.type is LoadBalancer or NodePort. Values file adds the externalTrafficPolicy key for the SSH service (empty string).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I hopped through charts to tweak a YAML key,
Now traffic policy shows when it's meant to be,
The template checks types, so rendering's neat —
A tiny change, secure and sweet! 🥕✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding externalTrafficPolicy configuration support to the SRA SSH service in the akeyless-gateway Helm chart.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

charts/akeyless-gateway/values.yaml (1)

604-604: ⚡ Quick win

Consider adding a brief comment explaining the field.

The new externalTrafficPolicy field lacks documentation. A brief comment explaining its purpose, valid values (Local/Cluster), and use case (e.g., preserving source IP for audit/allowlisting) would help users understand when and how to configure it.

📝 Suggested documentation

      type: LoadBalancer
      port: 22
+      ## externalTrafficPolicy controls whether external traffic is routed to node-local or cluster-wide endpoints.
+      ## Valid values: "Local" (preserves source IP, requires service type LoadBalancer or NodePort) or "Cluster" (default).
+      ## Set to "Local" to preserve client source IP for audit/allowlisting. Leave empty to use Kubernetes default (Cluster).
+      ##
      externalTrafficPolicy: ""

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/akeyless-gateway/values.yaml` at line 604, The new values.yaml entry
externalTrafficPolicy is missing inline documentation; add a one-line comment
above the externalTrafficPolicy key explaining its purpose (controls how Service
routes external traffic and whether source IP is preserved), valid values
("Local" or "Cluster"), common use-case (use "Local" to preserve source IP for
audit/allowlisting at the cost of pod availability), and the default behavior if
unset (Cluster). Place the comment adjacent to the externalTrafficPolicy key so
users editing values.yaml see the guidance immediately.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@charts/akeyless-gateway/values.yaml`:
- Line 604: The new values.yaml entry externalTrafficPolicy is missing inline
documentation; add a one-line comment above the externalTrafficPolicy key
explaining its purpose (controls how Service routes external traffic and whether
source IP is preserved), valid values ("Local" or "Cluster"), common use-case
(use "Local" to preserve source IP for audit/allowlisting at the cost of pod
availability), and the default behavior if unset (Cluster). Place the comment
adjacent to the externalTrafficPolicy key so users editing values.yaml see the
guidance immediately.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fec2c4bd-7742-42b6-8573-b7fde0e5e1c5

📥 Commits

Reviewing files that changed from the base of the PR and between 4e157f3 and a2ab638.

📒 Files selected for processing (2)

• charts/akeyless-gateway/templates/akeyless-secure-remote-access/service.yaml
• charts/akeyless-gateway/values.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• charts/akeyless-gateway/templates/akeyless-secure-remote-access/service.yaml