From 10034c27c992c218632bfa6192bac80b6b499583 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:09:23 -0400
Subject: [PATCH 01/11] Handle namespace consistently

---
 .../templates/rbac/leader_election_role.yaml                  | 2 +-
 .../templates/rbac/leader_election_role_binding.yaml          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role.yaml
index 675dc68d..b0390bd1 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role.yaml
@@ -5,7 +5,7 @@ metadata:
   labels:
     app.kubernetes.io/name: jumpstarter-router
   name: leader-election-role
-  namespace: {{ .Values.namespace }}
+  namespace: {{ default .Release.Namespace .Values.namespace }}
 rules:
 - apiGroups:
   - ""
diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role_binding.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role_binding.yaml
index a9fa9f44..d60dc3c9 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role_binding.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role_binding.yaml
@@ -3,7 +3,7 @@ kind: RoleBinding
 metadata:
   labels:
     app.kubernetes.io/name: jumpstarter-router
-  namespace: {{ .Values.namespace }}
+  namespace: {{ default .Release.Namespace .Values.namespace }}
   name: leader-election-rolebinding
 roleRef:
   apiGroup: rbac.authorization.k8s.io
@@ -12,4 +12,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: controller-manager
-  namespace: {{ .Values.namespace }}
+  namespace: {{ default .Release.Namespace .Values.namespace }}

From e25bd70108030beeea33bd65db0b4664239d23cb Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:18:38 -0400
Subject: [PATCH 02/11] Add additionalRouters field to value schema

---
 .../charts/jumpstarter-controller/model.py    | 13 ++-
 .../jumpstarter-controller/values.schema.json | 79 ++++++++++++++++++-
 .../charts/jumpstarter-controller/values.yaml |  1 +
 3 files changed, 91 insertions(+), 2 deletions(-)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/model.py b/deploy/helm/jumpstarter/charts/jumpstarter-controller/model.py
index 30e758bc..292f43e7 100755
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/model.py
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/model.py
@@ -236,7 +236,7 @@ class Grpc1(BaseModel):
         None, description="Hostname for the controller to use for the controller gRPC"
     )
     routerHostname: Optional[str] = Field(
-        None, description="Hostname for the controller to use for the controller gRPC"
+        None, description="Hostname for the router to use for the router gRPC"
     )
     endpoint: Optional[str] = Field(
         None,
@@ -246,6 +246,9 @@ class Grpc1(BaseModel):
         None,
         description="The endpoints are passed down to the services to know where to announce the endpoints to the clients",
     )
+    additionalRouters: dict[str, Router] | None = Field(
+        None, description="Additional routers to deploy"
+    )
     ingress: Optional[Ingress] = None
     route: Optional[Route] = None
     nodeport: Optional[Nodeport] = None
@@ -253,6 +256,14 @@ class Grpc1(BaseModel):
     tls: Optional[Tls] = None
 
 
+class Router(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+    hostname: str | None = None
+    endpoint: str | None = None
+    labels: dict[str, str] | None = None
+    nodeSelector: dict[str, str] | None = None
+
+
 class Model(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.schema.json b/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.schema.json
index f972cc72..53c76adc 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.schema.json
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.schema.json
@@ -319,7 +319,7 @@
             }
           ],
           "default": null,
-          "description": "Hostname for the controller to use for the controller gRPC",
+          "description": "Hostname for the router to use for the router gRPC",
           "title": "Routerhostname"
         },
         "endpoint": {
@@ -348,6 +348,22 @@
           "description": "The endpoints are passed down to the services to know where to announce the endpoints to the clients",
           "title": "Routerendpoint"
         },
+        "additionalRouters": {
+          "anyOf": [
+            {
+              "additionalProperties": {
+                "$ref": "#/$defs/Router"
+              },
+              "type": "object"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "description": "Additional routers to deploy",
+          "title": "Additionalrouters"
+        },
         "ingress": {
           "anyOf": [
             {
@@ -854,6 +870,67 @@
       "title": "Route",
       "type": "object"
     },
+    "Router": {
+      "additionalProperties": false,
+      "properties": {
+        "hostname": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Hostname"
+        },
+        "endpoint": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Endpoint"
+        },
+        "labels": {
+          "anyOf": [
+            {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Labels"
+        },
+        "nodeSelector": {
+          "anyOf": [
+            {
+              "additionalProperties": {
+                "type": "string"
+              },
+              "type": "object"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "title": "Nodeselector"
+        }
+      },
+      "title": "Router",
+      "type": "object"
+    },
     "Tls": {
       "additionalProperties": false,
       "properties": {
diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.yaml
index 48834801..821d701b 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/values.yaml
@@ -10,6 +10,7 @@ grpc:
   endpoint: ""
   routerEndpoint: ""
 
+  additionalRouters: {}
 
   tls:
     enabled: false

From 6f99f24603fad17fb72d683dfd7b3541f72cd766 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:19:47 -0400
Subject: [PATCH 03/11] Fix reloading controller on config change

---
 .../jumpstarter-controller/templates/controller-deployment.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/controller-deployment.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/controller-deployment.yaml
index 9b338ca2..55cce444 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/controller-deployment.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/controller-deployment.yaml
@@ -10,7 +10,6 @@ metadata:
     deployment.timestamp: {{ .Values.global.timestamp | quote }}
     {{ end }}
   annotations:
-    configmap-sha256: {{ include (print $.Template.BasePath "/cms/controller-cm.yaml") . | sha256sum }}
     argocd.argoproj.io/sync-wave: "1"
 spec:
   selector:
@@ -21,6 +20,7 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: manager
+        configmap-sha256: {{ include (print $.Template.BasePath "/cms/controller-cm.yaml") . | sha256sum }}
       labels:
         control-plane: controller-manager
       {{ if .Values.global.timestamp }}

From fb3a00739378362c113804cf631a52c5cb44d8df Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:24:15 -0400
Subject: [PATCH 04/11] Pass router information to controller cm

---
 .../templates/cms/controller-cm.yaml               | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml
index 19c082b5..b7f554a0 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml
@@ -26,3 +26,17 @@ data:
       {{ else }}
       endpoint: router.{{ .Values.global.baseDomain }}:{{ .Values.grpc.tls.port }}
       {{ end }}
+  {{ range $k, $v := .Values.grpc.additionalRouters }}
+    {{ $k }}:
+      {{ if $v.endpoint }}
+      endpoint: {{ $v.endpoint }}
+      {{ else if $v.hostname }}
+      endpoint: {{ $v.hostname }}:{{ .Values.grpc.tls.port }}
+      {{ else }}
+      endpoint: router-{{ $k }}.{{ .Values.global.baseDomain }}:{{ .Values.grpc.tls.port }}
+      {{ end }}
+      {{ if $v.labels }}
+      labels:
+        {{ $v.labels | toYaml | indent 1 }}
+      {{ end }}
+  {{ end }}

From 72731d5f2b5f33afdfb16e3e3db129d86aff9e93 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:32:01 -0400
Subject: [PATCH 05/11] Add deployment for additional routers

---
 .../additional-router-deployment.yaml         | 111 ++++++++++++++++++
 .../templates/router-deployment.yaml          |   2 +-
 2 files changed, 112 insertions(+), 1 deletion(-)
 create mode 100644 deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml
new file mode 100644
index 00000000..a846333e
--- /dev/null
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml
@@ -0,0 +1,111 @@
+{{ range $k, $v := .Values.grpc.additionalRouters }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: jumpstarter-router-{{ $k }}
+  namespace: {{ default $.Release.Namespace $.Values.namespace }}
+  labels:
+    control-plane: controller-router-{{ $k }}
+    app.kubernetes.io/name: jumpstarter-controller
+    {{ if $.Values.global.timestamp }}
+    deployment.timestamp: {{ $.Values.global.timestamp | quote }}
+    {{ end }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  selector:
+    matchLabels:
+      control-plane: controller-router-{{ $k }}
+  replicas: 1
+  template:
+    metadata:
+      annotations:
+        kubectl.kubernetes.io/default-container: router
+        configmap-sha256: {{ include (print $.Template.BasePath "/cms/controller-cm.yaml") $ | sha256sum }}
+      labels:
+        control-plane: controller-router-{{ $k }}
+      {{ if $.Values.global.timestamp }}
+        deployment.timestamp: {{ $.Values.global.timestamp | quote }}
+      {{ end }}
+    spec:
+      # TODO(user): Uncomment the following code to configure the nodeAffinity expression
+      # according to the platforms which are supported by your solution.
+      # It is considered best practice to support multiple architectures. You can
+      # build your manager image using the makefile target docker-buildx.
+      # affinity:
+      #   nodeAffinity:
+      #     requiredDuringSchedulingIgnoredDuringExecution:
+      #       nodeSelectorTerms:
+      #         - matchExpressions:
+      #           - key: kubernetes.io/arch
+      #             operator: In
+      #             values:
+      #               - amd64
+      #               - arm64
+      #               - ppc64le
+      #               - s390x
+      #           - key: kubernetes.io/os
+      #             operator: In
+      #             values:
+      #               - linux
+      {{ if $v.nodeSelector }}
+      nodeSelector:
+        {{ $v.nodeSelector | toYaml | indent 1 }}
+      {{ end }}
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - command:
+          - /router
+        env:
+        - name: GRPC_ROUTER_ENDPOINT
+          {{ if $v.endpoint }}
+          value : {{ $v.endpoint }}
+          {{ else if $v.hostname }}
+          value: {{ $v.hostname }}:{{ $.Values.grpc.tls.port }}
+          {{ else }}
+          value: router-{{ $k }}.{{ $.Values.global.baseDomain }}:{{ $.Values.grpc.tls.port }}
+          {{ end }}
+        - name: ROUTER_KEY
+          valueFrom:
+            secretKeyRef:
+              name: jumpstarter-router-secret
+              key: key
+        - name: NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+
+        image: {{ $.Values.image }}:{{ default $.Chart.AppVersion $.Values.tag }}
+        imagePullPolicy: {{ $.Values.imagePullPolicy }}
+        name: router
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - "ALL"
+        # livenessProbe:
+        #   httpGet:
+        #     path: /healthz
+        #     port: 8081
+        #   initialDelaySeconds: 15
+        #   periodSeconds: 20
+        # readinessProbe:
+        #   httpGet:
+        #     path: /readyz
+        #     port: 8081
+        #   initialDelaySeconds: 5
+        #   periodSeconds: 10
+        resources:
+          limits:
+            cpu: 2000m
+            memory: 1024Mi
+          requests:
+            cpu: 1000m
+            memory: 256Mi
+      serviceAccountName: controller-manager
+      terminationGracePeriodSeconds: 10
+{{ end }}
diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml
index 2a5352f3..d128a358 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml
@@ -10,7 +10,6 @@ metadata:
     deployment.timestamp: {{ .Values.global.timestamp | quote }}
   {{ end }}
   annotations:
-    configmap-sha256: {{ include (print $.Template.BasePath "/cms/controller-cm.yaml") . | sha256sum }}
     argocd.argoproj.io/sync-wave: "1"
 spec:
   selector:
@@ -21,6 +20,7 @@ spec:
     metadata:
       annotations:
         kubectl.kubernetes.io/default-container: router
+        configmap-sha256: {{ include (print $.Template.BasePath "/cms/controller-cm.yaml") . | sha256sum }}
       labels:
         control-plane: controller-router
       {{ if .Values.global.timestamp }}

From e83df053b0a726d70f82c45a8bb180dedf7d1510 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:37:44 -0400
Subject: [PATCH 06/11] Add addtional router ingress and route

---
 .../templates/additional-router-ingress.yaml  | 47 +++++++++++++++++++
 .../templates/additional-router-route.yaml    | 42 +++++++++++++++++
 2 files changed, 89 insertions(+)
 create mode 100644 deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml
 create mode 100644 deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml
new file mode 100644
index 00000000..1b9a186c
--- /dev/null
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml
@@ -0,0 +1,47 @@
+{{ if eq .Values.grpc.mode "ingress" }}
+{{ range $k, $v := .Values.grpc.additionalRouters }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "300"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "300"
+    {{ if eq $.Values.grpc.tls.mode "passthrough" }}
+    nginx.ingress.kubernetes.io/ssl-passthrough: "true"
+    {{ end }}
+  name: jumpstarter-router-ingress-{{ $k }}
+  namespace: {{ default $.Release.Namespace $.Values.namespace }}
+spec:
+  {{ if .Values.grpc.ingress.class }}
+  ingressClassName: {{ .Values.grpc.ingress.class }}
+  {{ end }}
+  rules:
+  {{ if $v.hostname }}
+  - host: {{ $v.hostname }}
+  {{ else }}
+  - host: router-{{ $k }}.{{ .Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
+  {{ end }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: jumpstarter-router-grpc-{{ $k }}
+            port:
+              number: 8083
+  tls:
+  - hosts:
+      {{ if $v.hostname }}
+      - {{ $v.hostname }}
+      {{ else }}
+      - router-{{ $k }}.{{ .Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
+      {{ end }}
+    {{ if $.Values.grpc.tls.routerCertSecret }}
+    secretName: {{ $.Values.grpc.tls.routerCertSecret }}
+    {{ end }}
+{{ end }}
+{{ end }}
diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml
new file mode 100644
index 00000000..e8ed949e
--- /dev/null
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml
@@ -0,0 +1,42 @@
+{{ if eq .Values.grpc.mode "route" }}
+{{ range $k, $v := .Values.grpc.additionalRouters }}
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  labels:
+    external-exposed: "true"
+    shard: external
+  annotations:
+    haproxy.router.openshift.io/timeout: 2d
+    haproxy.router.openshift.io/timeout-tunnel: 2d
+  name: jumpstarter-router-route-{{ $k }}
+  namespace: {{ default $.Release.Namespace $.Values.namespace }}
+spec:
+  {{ if $v.hostname }}
+  host: {{ $v.hostname }}
+  {{ else }}
+  host: router-{{ $k }}.{{ .Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
+  {{ end }}
+  port:
+    targetPort: 8083
+  tls:
+    {{ if eq $.Values.grpc.tls.mode "passthrough" }}
+    termination: passthrough
+    {{ end }}
+    {{ if eq $.Values.grpc.tls.mode "reencrypt" }}
+    termination: reencrypt
+    {{ end }}
+    insecureEdgeTerminationPolicy: None
+    {{ if $.Values.grpc.tls.routerCertSecret }}
+    externalCertificate:
+      name: {{ $.Values.grpc.tls.routerCertSecret }}
+    {{ end }}
+
+  to:
+    kind: Service
+    name: jumpstarter-router-grpc-{{ $k }}
+    weight: 100
+  wildcardPolicy: None
+{{ end }}
+{{ end }}

From 3c2e36d3670457195bbaf07668db63cc779736f6 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:39:06 -0400
Subject: [PATCH 07/11] Add additional router service

---
 .../templates/additional-router-service.yaml  | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-service.yaml

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-service.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-service.yaml
new file mode 100644
index 00000000..0b0de609
--- /dev/null
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-service.yaml
@@ -0,0 +1,27 @@
+{{ range $k, $v := .Values.grpc.additionalRouters }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    control-plane: controller-router-{{ $k }}
+    app.kubernetes.io/name: jumpstarter-controller
+  name: jumpstarter-router-grpc-{{ $k }}
+  namespace: {{ default $.Release.Namespace $.Values.namespace }}
+spec:
+  {{ if .Values.grpc.nodeport.enabled }}
+  type: NodePort
+  {{ end }}
+
+  ports:
+  - name: grpc
+    port: 8083
+    protocol: TCP
+    targetPort: 8083
+    appProtocol: h2c # HTTP/2 over cleartext for gRPC (fixes edge termination in ingress/router)
+    {{ if .Values.grpc.nodeport.enabled }}
+    nodePort: {{ .Values.grpc.nodeport.routerPort }}
+    {{ end }}
+  selector:
+    control-plane: controller-router-{{ $k }}
+{{ end }}

From 8b238e265cfe80e336dd1189e27afb9b216b9ded Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 11:59:36 -0400
Subject: [PATCH 08/11] Update
 deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 .../templates/additional-router-deployment.yaml             | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml
index a846333e..49cc0272 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml
@@ -63,11 +63,11 @@ spec:
         env:
         - name: GRPC_ROUTER_ENDPOINT
           {{ if $v.endpoint }}
-          value : {{ $v.endpoint }}
+          value: {{ $v.endpoint }}
           {{ else if $v.hostname }}
-          value: {{ $v.hostname }}:{{ $.Values.grpc.tls.port }}
+          value: {{ $v.hostname }}:{{ default 443 $.Values.grpc.tls.port }}
           {{ else }}
-          value: router-{{ $k }}.{{ $.Values.global.baseDomain }}:{{ $.Values.grpc.tls.port }}
+          value: router-{{ $k }}.{{ $.Values.global.baseDomain | required "set .global.baseDomain, or provide grpc.additionalRouters[...].endpoint/hostname" }}:{{ default 443 $.Values.grpc.tls.port }}
           {{ end }}
         - name: ROUTER_KEY
           valueFrom:

From 995cefdd3ecd2f8af7ea4c52cf08afd34ddb5b45 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 12:00:28 -0400
Subject: [PATCH 09/11] Update
 deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 .../templates/additional-router-route.yaml                      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml
index e8ed949e..b001804a 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-route.yaml
@@ -16,7 +16,7 @@ spec:
   {{ if $v.hostname }}
   host: {{ $v.hostname }}
   {{ else }}
-  host: router-{{ $k }}.{{ .Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
+  host: router-{{ $k }}.{{ $.Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
   {{ end }}
   port:
     targetPort: 8083

From f31e82cbbe2fe436d4f6b1fa1a80f90196721389 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 12:00:54 -0400
Subject: [PATCH 10/11] Update
 deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 .../jumpstarter-controller/templates/cms/controller-cm.yaml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml
index b7f554a0..7f75608d 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/cms/controller-cm.yaml
@@ -31,9 +31,9 @@ data:
       {{ if $v.endpoint }}
       endpoint: {{ $v.endpoint }}
       {{ else if $v.hostname }}
-      endpoint: {{ $v.hostname }}:{{ .Values.grpc.tls.port }}
+      endpoint: {{ $v.hostname }}:{{ $.Values.grpc.tls.port }}
       {{ else }}
-      endpoint: router-{{ $k }}.{{ .Values.global.baseDomain }}:{{ .Values.grpc.tls.port }}
+      endpoint: router-{{ $k }}.{{ $.Values.global.baseDomain }}:{{ $.Values.grpc.tls.port }}
       {{ end }}
       {{ if $v.labels }}
       labels:

From 3556b41f91afd39a8e77075a852c2d4ad091238f Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Fri, 12 Sep 2025 12:19:53 -0400
Subject: [PATCH 11/11] Fixup additional router ingress

---
 .../templates/additional-router-ingress.yaml              | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml
index 1b9a186c..92522341 100644
--- a/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml
+++ b/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-ingress.yaml
@@ -15,14 +15,14 @@ metadata:
   name: jumpstarter-router-ingress-{{ $k }}
   namespace: {{ default $.Release.Namespace $.Values.namespace }}
 spec:
-  {{ if .Values.grpc.ingress.class }}
-  ingressClassName: {{ .Values.grpc.ingress.class }}
+  {{ if $.Values.grpc.ingress.class }}
+  ingressClassName: {{ $.Values.grpc.ingress.class }}
   {{ end }}
   rules:
   {{ if $v.hostname }}
   - host: {{ $v.hostname }}
   {{ else }}
-  - host: router-{{ $k }}.{{ .Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
+  - host: router-{{ $k }}.{{ $.Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
   {{ end }}
     http:
       paths:
@@ -38,7 +38,7 @@ spec:
       {{ if $v.hostname }}
       - {{ $v.hostname }}
       {{ else }}
-      - router-{{ $k }}.{{ .Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
+      - router-{{ $k }}.{{ $.Values.global.baseDomain | required "a global.baseDomain or a grpc.routerHostname must be provided"}}
       {{ end }}
     {{ if $.Values.grpc.tls.routerCertSecret }}
     secretName: {{ $.Values.grpc.tls.routerCertSecret }}