From c8f75bef8aef3ca7220551cedfec63c86e7ecaec Mon Sep 17 00:00:00 2001
From: Ryan Blundon <ryan.blundon@protonmail.com>
Date: Mon, 18 May 2026 19:25:41 -0500
Subject: [PATCH] fix referencegrant

---
 cluster/platform/gateway/referencegrant.yaml | 22 ++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/cluster/platform/gateway/referencegrant.yaml b/cluster/platform/gateway/referencegrant.yaml
index 84e39c0..1ca62f2 100644
--- a/cluster/platform/gateway/referencegrant.yaml
+++ b/cluster/platform/gateway/referencegrant.yaml
@@ -2,11 +2,12 @@
 # ReferenceGrant — allow HTTPRoutes from any namespace to attach to the Gateway
 #
 # Required by Gateway API spec when parentRef crosses namespace boundaries.
-# Without this, HTTPRoutes in app namespaces (monitoring, gitea, etc.) cannot
-# attach to the Gateway in the gateway namespace.
+# `namespace` is required in the from stanza — use a specific namespace or
+# create one ReferenceGrant per namespace that needs access.
 #
-# Note: omitting `namespace` in the `from` stanza means all namespaces are
-# permitted. Add explicit namespace entries to restrict if needed later.
+# For a homelab cluster where all namespaces are trusted, we create a single
+# catch-all by listing the namespaces we expect to use. Add entries as new
+# app namespaces are created.
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: ReferenceGrant
@@ -17,6 +18,19 @@ spec:
   from:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
+      namespace: default
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: monitoring
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: argocd
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: authentik
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: gitea
   to:
     - group: gateway.networking.k8s.io
       kind: Gateway