feat: add support for istio/virtualservices in LangGraph Platform

charts/langgraph-dataplane/templates/operator/deployment.yaml

@@ -112,6 +112,11 @@ spec:
             value: {{ .Values.gateway.name | quote }}
           - name: GATEWAY_NAMESPACE
             value: {{ .Values.gateway.namespace | default .Release.Namespace }}
+        {{- else if .Values.istioGateway.enabled }}
+          - name: ISTIO_GATEWAY_NAME
+            value: {{ .Values.istioGateway.name | quote }}
+          - name: ISTIO_GATEWAY_NAMESPACE
+            value: {{ .Values.istioGateway.namespace | default .Release.Namespace }}
         {{- else }}
           - name: SHARED_INGRESS_NAME
             value: {{ include "langgraphDataplane.fullname" . }}-ingress

charts/langsmith/Chart.yaml

@@ -5,5 +5,5 @@ maintainers:
     email: ankush@langchain.dev
 description: Helm chart to deploy the langsmith application and all services it depends on.
 type: application
-version: 0.11.22
-appVersion: "0.11.64"
+version: 0.11.23
+appVersion: "0.11.68"

charts/langsmith/README.md

@@ -1,6 +1,6 @@
 # langsmith
 
-![Version: 0.11.21](https://img.shields.io/badge/Version-0.11.21-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.11.64](https://img.shields.io/badge/AppVersion-0.11.64-informational?style=flat-square)
+![Version: 0.11.23](https://img.shields.io/badge/Version-0.11.23-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.11.68](https://img.shields.io/badge/AppVersion-0.11.68-informational?style=flat-square)
 
 Helm chart to deploy the langsmith application and all services it depends on.
 
@@ -29,29 +29,29 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | gateway.subdomain | string | `""` |  |
 | images.aceBackendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.aceBackendImage.repository | string | `"docker.io/langchain/langsmith-ace-backend"` |  |
-| images.aceBackendImage.tag | string | `"0.11.64"` |  |
+| images.aceBackendImage.tag | string | `"0.11.68"` |  |
 | images.backendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.backendImage.repository | string | `"docker.io/langchain/langsmith-backend"` |  |
-| images.backendImage.tag | string | `"0.11.64"` |  |
+| images.backendImage.tag | string | `"0.11.68"` |  |
 | images.clickhouseImage.pullPolicy | string | `"Always"` |  |
 | images.clickhouseImage.repository | string | `"docker.io/clickhouse/clickhouse-server"` |  |
 | images.clickhouseImage.tag | string | `"25.4"` |  |
 | images.frontendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.frontendImage.repository | string | `"docker.io/langchain/langsmith-frontend"` |  |
-| images.frontendImage.tag | string | `"0.11.64"` |  |
+| images.frontendImage.tag | string | `"0.11.68"` |  |
 | images.hostBackendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.hostBackendImage.repository | string | `"docker.io/langchain/hosted-langserve-backend"` |  |
-| images.hostBackendImage.tag | string | `"0.11.64"` |  |
+| images.hostBackendImage.tag | string | `"0.11.68"` |  |
 | images.imagePullSecrets | list | `[]` | Secrets with credentials to pull images from a private registry. Specified as name: value. |
 | images.operatorImage.pullPolicy | string | `"Always"` |  |
 | images.operatorImage.repository | string | `"docker.io/langchain/langgraph-operator"` |  |
-| images.operatorImage.tag | string | `"0.1.11"` |  |
+| images.operatorImage.tag | string | `"0.1.16"` |  |
 | images.platformBackendImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.platformBackendImage.repository | string | `"docker.io/langchain/langsmith-go-backend"` |  |
-| images.platformBackendImage.tag | string | `"0.11.64"` |  |
+| images.platformBackendImage.tag | string | `"0.11.68"` |  |
 | images.playgroundImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.playgroundImage.repository | string | `"docker.io/langchain/langsmith-playground"` |  |
-| images.playgroundImage.tag | string | `"0.11.64"` |  |
+| images.playgroundImage.tag | string | `"0.11.68"` |  |
 | images.postgresImage.pullPolicy | string | `"IfNotPresent"` |  |
 | images.postgresImage.repository | string | `"docker.io/postgres"` |  |
 | images.postgresImage.tag | string | `"14.7"` |  |
@@ -66,6 +66,13 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | ingress.labels | object | `{}` |  |
 | ingress.subdomain | string | `""` |  |
 | ingress.tls | list | `[]` |  |
+| istioGateway.annotations | object | `{}` |  |
+| istioGateway.enabled | bool | `false` |  |
+| istioGateway.hostname | string | `""` |  |
+| istioGateway.labels | object | `{}` |  |
+| istioGateway.name | string | `"istio-gateway"` |  |
+| istioGateway.namespace | string | `"istio-system"` |  |
+| istioGateway.subdomain | string | `""` |  |
 | nameOverride | string | `""` | Provide a name in place of `langsmith` |
 | namespace | string | `""` | Namespace to install the chart into. If not set, will use the namespace of the current context. |
 
@@ -1068,6 +1075,6 @@ For information on how to use this chart, up-to-date release notes, and other gu
 | Ankush | <ankush@langchain.dev> |  |
 
 ----------------------------------------------
-Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1)
+Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)
 ## Docs Generated by [helm-docs](https://github.com/norwoodj/helm-docs)
 `helm-docs -t ./charts/langsmith/README.md.gotmpl`

charts/langsmith/templates/ace-backend/deployment.yaml

@@ -6,18 +6,6 @@
 {{- end -}}
 {{- $envVars := concat (include "aceBackendEnvVars" . | fromYamlArray) .Values.aceBackend.deployment.extraEnv -}}
 {{- include "langsmith.detectDuplicates" $envVars -}}
-{{- /* Validate cache mounts when readOnlyRootFilesystem is enabled */ -}}
-{{- if .Values.aceBackend.deployment.securityContext.readOnlyRootFilesystem }}
-{{- $hasCacheMount := false }}
-{{- range .Values.aceBackend.deployment.volumeMounts }}
-  {{- if eq .mountPath "/.cache" }}
-    {{- $hasCacheMount = true }}
-  {{- end }}
-{{- end }}
-{{- if not $hasCacheMount }}
-{{- fail "ERROR: When aceBackend.deployment.securityContext.readOnlyRootFilesystem is true, you must mount /.cache as a writable volume. See read_only config example." }}
-{{- end }}
-{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

charts/langsmith/templates/ingress.yaml

@@ -1,10 +1,15 @@
 {{- define "validateIngress" -}}
-# Fail if ingress or gateway aren't enabled
-{{- if and (not .Values.ingress.enabled) (not .Values.gateway.enabled) .Values.config.langgraphPlatform.enabled }}
-{{- fail "Either ingress or gateway must be enabled if LangGraph Platform is enabled." -}}
+# Fail if none of ingress, gateway, or istioGateway are enabled
+{{- if and (not .Values.ingress.enabled) (not .Values.gateway.enabled) (not .Values.istioGateway.enabled) .Values.config.langgraphPlatform.enabled }}
+{{- fail "Either ingress, gateway, or istioGateway must be enabled if LangGraph Platform is enabled." -}}
 {{- end -}}
-{{- if and .Values.ingress.enabled .Values.gateway.enabled}}
-{{- fail "Both ingress and gateway cannot be enabled at the same time." -}}
+# Fail if more than one ingress type is enabled
+{{- $enabledCount := 0 -}}
+{{- if .Values.ingress.enabled }}{{ $enabledCount = add1 $enabledCount }}{{- end -}}
+{{- if .Values.gateway.enabled }}{{ $enabledCount = add1 $enabledCount }}{{- end -}}
+{{- if .Values.istioGateway.enabled }}{{ $enabledCount = add1 $enabledCount }}{{- end -}}
+{{- if gt $enabledCount 1 }}
+{{- fail "Only one of ingress, gateway, or istioGateway can be enabled at the same time." -}}
 {{- end -}}
 {{- end -}}
 {{- template "validateIngress" . -}}

charts/langsmith/templates/operator/deployment.yaml

@@ -123,14 +123,19 @@ spec:
             value: {{ .Values.gateway.name | quote }}
           - name: GATEWAY_NAMESPACE
             value: {{ .Values.gateway.namespace | default .Release.Namespace }}
+        {{- else if .Values.istioGateway.enabled }}
+          - name: ISTIO_GATEWAY_NAME
+            value: {{ .Values.istioGateway.name | quote }}
+          - name: ISTIO_GATEWAY_NAMESPACE
+            value: {{ .Values.istioGateway.namespace | default .Release.Namespace }}
         {{- else }}
           - name: SHARED_INGRESS_NAME
             value: {{ include "langsmith.fullname" . }}-ingress
           - name: SHARED_INGRESS_NAMESPACE
             value: {{ .Values.namespace | default .Release.Namespace }}
         {{- end }}
           - name: ROOT_DOMAIN
-            value: {{ coalesce .Values.config.langgraphPlatform.rootDomain .Values.ingress.hostname .Values.gateway.hostname | quote }}
+            value: {{ coalesce .Values.config.langgraphPlatform.rootDomain .Values.ingress.hostname .Values.gateway.hostname .Values.istioGateway.hostname | quote }}
           - name: TLS_ENABLED
             value: {{ .Values.config.langgraphPlatform.tlsEnabled | quote }}
         {{- with .Values.operator.deployment.extraEnv }}

charts/langsmith/templates/operator/rbac.yaml

@@ -136,6 +136,19 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - networking.istio.io
+  resources:
+  - virtualservices
+  - gateways
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
@@ -296,6 +309,19 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - networking.istio.io
+  resources:
+  - virtualservices
+  - gateways
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

charts/langsmith/templates/virtual_service.yaml

@@ -0,0 +1,40 @@
+{{- if .Values.istioGateway.enabled }}
+apiVersion: networking.istio.io/v1
+kind: VirtualService
+metadata:
+  name: {{ include "langsmith.fullname" . }}
+  namespace: {{ .Values.namespace | default .Release.Namespace }}
+  annotations:
+    {{- include "langsmith.annotations" . | nindent 4 }}
+    {{- with .Values.istioGateway.annotations }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+  labels:
+    {{- include "langsmith.labels" . | nindent 4 }}
+    {{- with .Values.istioGateway.labels }}
+      {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- if .Values.istioGateway.hostname }}
+  hosts:
+  - {{ .Values.istioGateway.hostname | quote }}
+  {{- else }}
+  hosts:
+  - "*"
+  {{- end }}
+  gateways:
+  {{- if .Values.istioGateway.namespace }}
+  - {{ .Values.istioGateway.namespace }}/{{ .Values.istioGateway.name }}
+  {{- else }}
+  - {{ .Values.istioGateway.name }}
+  {{- end }}
+  http:
+  - match:
+    - uri:
+        prefix: {{ ternary "/" (printf "/%s" .Values.istioGateway.subdomain) (empty .Values.istioGateway.subdomain) }}
+    route:
+    - destination:
+        host: {{ include "langsmith.fullname" . }}-{{ .Values.frontend.name }}.{{ .Values.namespace | default .Release.Namespace }}.svc.cluster.local
+        port:
+          number: {{ .Values.frontend.service.httpPort }}
+{{- end }}

charts/langsmith/values.yaml

@@ -27,31 +27,31 @@ images:
   aceBackendImage:
     repository: "docker.io/langchain/langsmith-ace-backend"
     pullPolicy: IfNotPresent
-    tag: "0.11.64"
+    tag: "0.11.68"
   backendImage:
     repository: "docker.io/langchain/langsmith-backend"
     pullPolicy: IfNotPresent
-    tag: "0.11.64"
+    tag: "0.11.68"
   frontendImage:
     repository: "docker.io/langchain/langsmith-frontend"
     pullPolicy: IfNotPresent
-    tag: "0.11.64"
+    tag: "0.11.68"
   hostBackendImage:
     repository: "docker.io/langchain/hosted-langserve-backend"
     pullPolicy: IfNotPresent
-    tag: "0.11.64"
+    tag: "0.11.68"
   operatorImage:
     repository: "docker.io/langchain/langgraph-operator"
     pullPolicy: Always
-    tag: "0.1.11"
+    tag: "0.1.16"
   platformBackendImage:
     repository: "docker.io/langchain/langsmith-go-backend"
     pullPolicy: IfNotPresent
-    tag: "0.11.64"
+    tag: "0.11.68"
   playgroundImage:
     repository: "docker.io/langchain/langsmith-playground"
     pullPolicy: IfNotPresent
-    tag: "0.11.64"
+    tag: "0.11.68"
   postgresImage:
     repository: "docker.io/postgres"
     pullPolicy: IfNotPresent
@@ -85,6 +85,16 @@ gateway:
   annotations: {}
   labels: {}
 
+# Whether to use Istio Gateway for ingress. Will create a VirtualService for LangSmith and a VirtualService for each LangGraph platform deployment.
+istioGateway:
+  enabled: false
+  name: "istio-gateway"
+  namespace: "istio-system"
+  hostname: ""
+  subdomain: ""
+  annotations: {}
+  labels: {}
+
 config:
   existingSecretName: ""
   langsmithLicenseKey: ""