Configure Google Cloud GKE ingress

Deployment model: On-premises
Configuration reference: Qodo Helm chart 7.22.0.

Use this pattern with the GKE Ingress controller and the HTTP load-balancing addon. Prepare a VPC-native cluster, load-balancer firewall access, the required Google Cloud permissions, and a ready qodo-tls Secret covering all resolved Qodo hosts. For more information, see Configure ingress.

Configure values

Download ingress-google-cloud-values.yaml in the values archive. This example creates an external GKE Application Load Balancer:

ingress-google-cloud-values.yaml

# Qodo chart values for external GKE Ingress.
# Also apply qodo-onprem/values-gke.yaml AFTER this overlay.
# qodo-tls must already contain the certificate and key for all six hosts.
global:
  tlsSecretName: qodo-tls
  ingress:
    enabled: true
    className: ""
    annotations:
      kubernetes.io/ingress.class: gce
      kubernetes.io/ingress.allow-http: "false"

Keep className empty. GKE selects its controller through the kubernetes.io/ingress.class annotation. The HTTPS-only configuration requires the TLS Secret to be ready first. Also apply values-gke.yaml from the same Qodo release. It annotates each public ClusterIP Service for network endpoint groups (NEGs), creates the Platform and QAR timeout BackendConfigs, and configures Zitadel’s /debug/healthz health check on port 8083. These settings belong on Services and BackendConfigs; setting only the Ingress annotation is insufficient. For more information, see GKE Ingress configuration.

helm upgrade --install qodo ./qodo-onprem \
  --kube-context "$KUBE_CONTEXT" --namespace "$NAMESPACE" \
  -f qodo-onprem/onprem-base.yaml -f my-values.yaml \
  -f ingress-google-cloud-values.yaml -f qodo-onprem/values-gke.yaml

Define KUBE_CONTEXT and NAMESPACE as in the shared ingress page. Keep the release’s GKE layer last, and do not use it with a different ingress controller. For an internal load balancer, change the annotation to gce-internal and satisfy GKE’s regional subnet, proxy-only subnet, firewall, certificate, and caller-connectivity prerequisites first. A private address must remain reachable from your Git webhook provider. For more information, see Configure an internal Application Load Balancer.

Verify the load balancer

kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" \
  get backendconfigs,ingress
kubectl --context "$KUBE_CONTEXT" -n "$NAMESPACE" \
  describe ingress qodo-qodo

Check the Service NEG annotations and cloud backend health. Complete the shared TLS, discovery, browser login, SDK, and webhook acceptance checks.

Symptom	Check and recovery
Controller expects NodePort or LoadBalancer Services	Apply the matching release’s `values-gke.yaml` and check NEGs
No address or the wrong controller handles the Ingress	Leave `className` empty and check the `gce` or `gce-internal` annotation
Zitadel is an unhealthy backend	Check `qodo-zitadel-hc`, its Service annotation, port `8083`, and `/debug/healthz`
HTTPS never becomes ready	Check the TLS Secret exists before applying the HTTPS-only Ingress

Helm charts

Operations

Git Integration

Configure Google Cloud GKE ingress

Configure values

Verify the load balancer

​Configure values

​Verify the load balancer

Configure values

Verify the load balancer