Initial argo deployment

cluster/platform/gateway-api/application.yaml

@@ -0,0 +1,40 @@
+# ------------------------------------------------------------------------------
+# Platform: Gateway API CRDs
+# Wave 3.5 — must exist before cilium-config (wave 4) enables gatewayAPI
+#
+# The Gateway API CRDs are maintained separately from any implementation.
+# We install the standard channel CRDs from the upstream sig-network repo.
+# Cilium requires these CRDs to exist before gatewayAPI.enabled=true works.
+#
+# Standard channel includes: GatewayClass, Gateway, HTTPRoute, GRPCRoute,
+#                            ReferenceGrant
+# Experimental channel adds: TCPRoute, TLSRoute, UDPRoute (added below)
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gateway-api-crds
+  namespace: argocd
+  annotations:
+    # Wave 3.5 — after cert-manager (3), before cilium-config (4)
+    # ArgoCD sync waves are integers, so we use 3 here and rely on
+    # sync ordering within the wave. Add a sync-wave of 3 to cert-manager
+    # and this will naturally sequence correctly.
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+    targetRevision: main
+    path: cluster/platform/gateway-api/manifests
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: gateway-api
+  syncPolicy:
+    automated:
+      prune: false   # Never prune CRDs — too dangerous
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+      - Replace=true   # CRDs require Replace not Patch for updates

cluster/platform/gateway-api/gateway.yaml

@@ -0,0 +1,57 @@
+# ------------------------------------------------------------------------------
+# Gateway — fastpass-gateway
+# Wave 5.5 — after cilium-config (4) and ingress-nginx (5)
+#
+# This is the central Gateway that all HTTPRoute resources attach to.
+# Cilium operator creates a LoadBalancer service for this Gateway automatically,
+# which will receive an IP from the cilium-gateway-pool (10.1.71.90-.99).
+#
+# Listeners:
+#   - HTTP  (port 80)  — redirect to HTTPS or direct for internal services
+#   - HTTPS (port 443) — TLS termination via cert-manager certificates
+#   - TCP   (port configurable) — for non-HTTP services (future use)
+#
+# Usage: Applications create HTTPRoute resources that reference this Gateway:
+#
+#   spec:
+#     parentRefs:
+#       - name: fastpass-gateway
+#         namespace: gateway-system
+#
+# ------------------------------------------------------------------------------
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: fastpass-gateway
+  namespace: gateway-system
+  annotations:
+    # Request a specific IP from the cilium-gateway-pool
+    io.cilium/lb-ipam-ips: "10.1.71.90"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    # HTTP listener — accepts from all namespaces
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+
+    # HTTPS listener — TLS termination
+    # Each service provides its own cert via cert-manager Certificate resource
+    # and a ReferenceGrant allowing the Gateway to read it cross-namespace
+    - name: https
+      protocol: HTTPS
+      port: 443
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        mode: Terminate
+        certificateRefs:
+          # ArgoCD TLS cert — first service on the Gateway
+          # Add additional certs here as services are added, or use
+          # a wildcard cert (*.local.mk-labs.cloud) once the pattern is proven
+          - name: argocd-tls
+            namespace: argocd

cluster/platform/gateway-api/manifests/README.md

@@ -0,0 +1,40 @@
+# ------------------------------------------------------------------------------
+# Gateway API CRDs — Standard + Experimental Channel
+# Version: v1.2.1 (latest stable as of May 2026)
+#
+# We reference upstream CRD manifests directly. ArgoCD will apply them
+# from the upstream GitHub URL via the source config in application.yaml.
+#
+# To upgrade Gateway API CRDs:
+#   1. Update the version tag in the URLs below
+#   2. Commit and push — ArgoCD applies automatically
+#
+# Standard channel CRDs (stable, production-ready):
+#   - GatewayClass
+#   - Gateway
+#   - HTTPRoute
+#   - GRPCRoute
+#   - ReferenceGrant
+#
+# Experimental channel additions (used for TCPRoute for non-HTTP services):
+#   - TLSRoute
+#   - TCPRoute
+#
+# Source: https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.2.1
+# ------------------------------------------------------------------------------
+
+# NOTE: ArgoCD applies these from the upstream URL. This file documents
+# the versions in use. The actual application.yaml points ArgoCD at this
+# directory, so place the CRD manifests here by running:
+#
+#   curl -L https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml \
+#     -o cluster/platform/gateway-api/manifests/standard-install.yaml
+#
+#   curl -L https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/experimental-install.yaml \
+#     -o cluster/platform/gateway-api/manifests/experimental-install.yaml
+#
+# Commit both files. ArgoCD will apply them on next sync.
+#
+# The commands above should be run from city-hall or your workstation
+# and the resulting files committed to git. We vendor them rather than
+# fetching at runtime so the exact CRD versions are pinned in git.

cluster/platform/gateway-api/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gateway-system
+  labels:
+    # Allow all namespaces to attach Routes to Gateways in this namespace
+    kubernetes.io/metadata.name: gateway-system