Step 4: enable frontend + path-based routing + tower:0.2.0

templates/frontend-deployment.yaml

@@ -0,0 +1,42 @@
+{{- if .Values.frontend.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tower-frontend
+  labels:
+    {{- include "tower.labels" . | nindent 4 }}
+    odoosky.io/role: frontend
+spec:
+  replicas: {{ .Values.frontend.replicas }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tower
+      odoosky.io/role: frontend
+  template:
+    metadata:
+      labels:
+        {{- include "tower.labels" . | nindent 8 }}
+        odoosky.io/role: frontend
+    spec:
+      containers:
+        - name: tower-ui
+          image: "{{ .Values.frontend.image.repository }}:{{ .Values.frontend.image.tag }}"
+          imagePullPolicy: {{ .Values.frontend.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 80
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 10
+            periodSeconds: 15
+          resources:
+            {{- toYaml .Values.frontend.resources | nindent 12 }}
+{{- end }}

templates/frontend-service.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.frontend.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: tower-frontend
+  labels:
+    {{- include "tower.labels" . | nindent 4 }}
+spec:
+  selector:
+    app.kubernetes.io/name: tower
+    odoosky.io/role: frontend
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+  type: ClusterIP
+{{- end }}

templates/ingressroute.yaml

@@ -1,11 +1,13 @@
-# Tower IngressRoute. Routes by path:
-#   /api/*  → backend (8080)
-#   /*      → frontend (when Step 4 builds it; currently a 503 from
-#               Traefik because backend.frontend.enabled=false)
+# Tower IngressRoute — path-based split between API and UI on the
+# same hostname.
 #
-# Once frontend lands, we add a second route block with a Path matcher
-# for the `/api` prefix going to backend, and the catch-all for static
-# files going to frontend.
+# Routing rules (Traefik picks longest-match-with-priority):
+#   - API endpoints (/healthz, /instances, future /api/*) → backend
+#   - everything else → frontend (Vue SPA)
+#
+# Priority is set explicitly so Traefik doesn't fall back to its
+# heuristic; the API rule outranks the catchall, which outranks no
+# rule at all.
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
@@ -17,15 +19,15 @@ spec:
     - {{ .Values.ingress.entryPoint }}
   routes:
 {{- if .Values.backend.enabled }}
-    - match: Host(`{{ .Values.ingress.domain }}`)
+    - match: Host(`{{ .Values.ingress.domain }}`) && (PathPrefix(`/healthz`) || PathPrefix(`/instances`) || PathPrefix(`/api`))
       kind: Rule
+      priority: 200
       services:
         - name: tower-backend
           port: 8080
 {{- end }}
 {{- if .Values.frontend.enabled }}
-    # Frontend slot — enabled when Step 4 builds the UI.
-    - match: Host(`{{ .Values.ingress.domain }}`) && !PathPrefix(`/api`) && !PathPrefix(`/healthz`) && !PathPrefix(`/instances`)
+    - match: Host(`{{ .Values.ingress.domain }}`)
       kind: Rule
       priority: 100
       services: