Initial argo deployment

cluster/platform/gateway-api/gateway.yaml

@@ -0,0 +1,57 @@
+# ------------------------------------------------------------------------------
+# Gateway — fastpass-gateway
+# Wave 5.5 — after cilium-config (4) and ingress-nginx (5)
+#
+# This is the central Gateway that all HTTPRoute resources attach to.
+# Cilium operator creates a LoadBalancer service for this Gateway automatically,
+# which will receive an IP from the cilium-gateway-pool (10.1.71.90-.99).
+#
+# Listeners:
+#   - HTTP  (port 80)  — redirect to HTTPS or direct for internal services
+#   - HTTPS (port 443) — TLS termination via cert-manager certificates
+#   - TCP   (port configurable) — for non-HTTP services (future use)
+#
+# Usage: Applications create HTTPRoute resources that reference this Gateway:
+#
+#   spec:
+#     parentRefs:
+#       - name: fastpass-gateway
+#         namespace: gateway-system
+#
+# ------------------------------------------------------------------------------
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: fastpass-gateway
+  namespace: gateway-system
+  annotations:
+    # Request a specific IP from the cilium-gateway-pool
+    io.cilium/lb-ipam-ips: "10.1.71.90"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    # HTTP listener — accepts from all namespaces
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+
+    # HTTPS listener — TLS termination
+    # Each service provides its own cert via cert-manager Certificate resource
+    # and a ReferenceGrant allowing the Gateway to read it cross-namespace
+    - name: https
+      protocol: HTTPS
+      port: 443
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        mode: Terminate
+        certificateRefs:
+          # ArgoCD TLS cert — first service on the Gateway
+          # Add additional certs here as services are added, or use
+          # a wildcard cert (*.local.mk-labs.cloud) once the pattern is proven
+          - name: argocd-tls
+            namespace: argocd