Return native Engine NotFound faults and clear Web UI session on 401.

Include the bad id in host/datacenter/cluster errors, expire stale auth in the
console, and document Ingress annotations that preserve fault bodies.

helm/ovirt-api-simulator/README.md

@@ -15,8 +15,9 @@ helm upgrade --install ovirt-sim . \
   --set secrets.ticketSigningKey="$(openssl rand -hex 32)"
 ```
 
-Access via port-forward to Service `:8080` (Engine API, SSO, Web UI, `/docs`).
-The Compose nginx gateway is **not** part of this chart yet.
+Access via port-forward to Service `:8080` (Engine API, SSO, Web UI, `/docs`),
+or enable Ingress with
+[`values-ingress-example.yaml`](values-ingress-example.yaml).
 
 Full guide: [docs/kubernetes.md](../../docs/kubernetes.md).  
 Values: [`values.yaml`](values.yaml).

helm/ovirt-api-simulator/README.ru.md

@@ -15,8 +15,9 @@ helm upgrade --install ovirt-sim . \
   --set secrets.ticketSigningKey="$(openssl rand -hex 32)"
 ```
 
-Доступ через port-forward к Service `:8080` (Engine API, SSO, Web UI, `/docs`).
-Nginx gateway из Compose в этот чарт **пока не** входит.
+Доступ через port-forward к Service `:8080` (Engine API, SSO, Web UI, `/docs`)
+или через Ingress с
+[`values-ingress-example.yaml`](values-ingress-example.yaml).
 
 Полное руководство: [docs/ru/kubernetes.md](../../docs/ru/kubernetes.md).  
 Values: [`values.yaml`](values.yaml).

helm/ovirt-api-simulator/templates/ingress.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.ingress.enabled -}}
+{{- $fullName := include "ovirt-api-simulator.fullname" . -}}
+{{- $svcPort := .Values.service.port -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}
+  labels:
+    app: {{ include "ovirt-api-simulator.name" . }}
+  annotations:
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    {{- range .Values.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ $fullName }}
+                port:
+                  number: {{ $svcPort }}
+          {{- end }}
+    {{- end }}
+{{- end }}

helm/ovirt-api-simulator/values-ingress-example.yaml

@@ -0,0 +1,49 @@
+# Example: public Ingress + Hub image.
+#
+# WARNING: Laboratory / demo template. Always override weak secrets:
+#   --set secrets.ticketSigningKey="$(openssl rand -hex 32)"
+#   --set postgresql.auth.password="$(openssl rand -hex 16)"
+# Do not expose a public Ingress with the placeholder values below.
+#
+#   helm upgrade --install ovirt-sim ./helm/ovirt-api-simulator \
+#     -n ovirt-sim --create-namespace \
+#     -f helm/ovirt-api-simulator/values-ingress-example.yaml \
+#     --set ingress.hosts[0].host=ovirt-sim.example.com \
+#     --set secrets.ticketSigningKey="$(openssl rand -hex 32)" \
+#     --set postgresql.auth.password="$(openssl rand -hex 16)"
+
+image:
+  repository: inecs/ovirt-api-simulator
+  tag: "0.1.0"
+  pullPolicy: IfNotPresent
+
+secrets:
+  ticketSigningKey: "replace-me"
+
+postgresql:
+  enabled: true
+  auth:
+    username: ovirt
+    password: "replace-me-db-password"
+    database: ovirt_simulator
+
+seed:
+  enabled: true
+  profile: minimal
+
+ingress:
+  enabled: true
+  className: nginx
+  # Keep Engine XML/JSON fault bodies (404/405/401). Cluster-wide
+  # custom-http-errors HTML pages must not rewrite simulator error responses.
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+    # If the controller still injects branded HTML for 404/405, narrow or clear
+    # custom-http-errors on this Ingress (overrides controller defaults):
+    nginx.ingress.kubernetes.io/custom-http-errors: "502,503"
+  hosts:
+    - host: ovirt-sim.example.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []

helm/ovirt-api-simulator/values.yaml

@@ -20,11 +20,16 @@ gateway:
 ingress:
   enabled: false
   className: nginx
+  # Prefer values-ingress-example.yaml for public Ingress. Keep API fault bodies:
+  #   nginx.ingress.kubernetes.io/proxy-intercept-errors: "false"
+  #   nginx.ingress.kubernetes.io/custom-http-errors: "502,503"  # not 404/405
+  annotations: {}
   hosts:
     - host: ovirt-engine.local
       paths:
         - path: /
           pathType: Prefix
+  tls: []
 
 config:
   ovirtSeries: "4.5"