From 5477fde7020b01c35aa9a59196a943efc601f033 Mon Sep 17 00:00:00 2001
From: Arnob kumar saha <arnob@appscode.com>
Date: Wed, 23 Sep 2026 17:11:11 +0600
Subject: [PATCH] Resolve prom-label-proxy gateway class and cert from the
 cluster

Signed-off-by: Arnob kumar saha <arnob@appscode.com>
---
 charts/prom-label-proxy/templates/_helpers.tpl  | 17 +++++++++++++++++
 .../prom-label-proxy/templates/deployment.yaml  |  2 +-
 charts/prom-label-proxy/templates/gw.yaml       |  6 +++---
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/charts/prom-label-proxy/templates/_helpers.tpl b/charts/prom-label-proxy/templates/_helpers.tpl
index e433f1d8..a5da2cc4 100644
--- a/charts/prom-label-proxy/templates/_helpers.tpl
+++ b/charts/prom-label-proxy/templates/_helpers.tpl
@@ -69,6 +69,23 @@ Create the name of the service account to use
   {{- end -}}
 {{- end -}}
 
+{{/*
+On the ACE hub, service-gateway runs in its own tenant namespace and its cert is synced into
+this namespace by config-syncer, so fall back to the default GatewayClass when none matches the namespace.
+*/}}
+{{- define "prom-label-proxy.gatewayClass" -}}
+{{- $ns := include "prom-label-proxy.namespace" . -}}
+{{- $gc := $ns -}}
+{{- if not (lookup "gateway.networking.k8s.io/v1" "GatewayClass" "" $ns) -}}
+  {{- range (dig "items" list (lookup "gateway.networking.k8s.io/v1" "GatewayClass" "" "")) -}}
+    {{- if eq (dig "metadata" "annotations" "catalog.appscode.com/is-default-gatewayclass" "" .) "true" -}}
+      {{- $gc = .metadata.name -}}
+    {{- end -}}
+  {{- end -}}
+{{- end -}}
+{{- $gc -}}
+{{- end -}}
+
 {{/*
 The image to use for kubeRBACProxy
 */}}
diff --git a/charts/prom-label-proxy/templates/deployment.yaml b/charts/prom-label-proxy/templates/deployment.yaml
index 4f5ac778..ddadc823 100644
--- a/charts/prom-label-proxy/templates/deployment.yaml
+++ b/charts/prom-label-proxy/templates/deployment.yaml
@@ -171,7 +171,7 @@ spec:
         - name: proxy-tls
           secret:
             defaultMode: 420
-            secretName: {{ template "prom-label-proxy.namespace" . }}-gw-cert
+            secretName: {{ include "prom-label-proxy.gatewayClass" . }}-gw-cert
       {{-  if and .Values.kubeRBACProxy.enabled .Values.kubeRBACProxy.config }}
         - name: kube-rbac-proxy-config
           configMap:
diff --git a/charts/prom-label-proxy/templates/gw.yaml b/charts/prom-label-proxy/templates/gw.yaml
index 0f64ca96..284e37c6 100644
--- a/charts/prom-label-proxy/templates/gw.yaml
+++ b/charts/prom-label-proxy/templates/gw.yaml
@@ -4,7 +4,7 @@ metadata:
   name: {{ include "prom-label-proxy.name" . }}-gw
   namespace: {{ template "prom-label-proxy.namespace" . }}
 spec:
-  gatewayClassName: {{ template "prom-label-proxy.namespace" . }}
+  gatewayClassName: {{ include "prom-label-proxy.gatewayClass" . }}
   listeners:
     - name: https
       port: 443
@@ -13,7 +13,7 @@ spec:
         mode: Terminate
         certificateRefs:
           - kind: Secret
-            name: {{ template "prom-label-proxy.namespace" . }}-gw-cert
+            name: {{ include "prom-label-proxy.gatewayClass" . }}-gw-cert
             namespace: {{ template "prom-label-proxy.namespace" . }}
     - name: mtls
       port: 10001
@@ -61,7 +61,7 @@ spec:
     caCertificateRefs:
       - group: ""
         kind: Secret
-        name: {{ template "prom-label-proxy.namespace" . }}-gw-cert
+        name: {{ include "prom-label-proxy.gatewayClass" . }}-gw-cert
     hostname: {{ include "prom-label-proxy.name" . }}.{{ template "prom-label-proxy.namespace" . }}.svc.cluster.local
 
 ---