fix referencegrant

cluster/platform/gateway/referencegrant.yaml

@@ -2,11 +2,12 @@
 # ReferenceGrant — allow HTTPRoutes from any namespace to attach to the Gateway
 #
 # Required by Gateway API spec when parentRef crosses namespace boundaries.
-# Without this, HTTPRoutes in app namespaces (monitoring, gitea, etc.) cannot
-# attach to the Gateway in the gateway namespace.
+# `namespace` is required in the from stanza — use a specific namespace or
+# create one ReferenceGrant per namespace that needs access.
 #
-# Note: omitting `namespace` in the `from` stanza means all namespaces are
-# permitted. Add explicit namespace entries to restrict if needed later.
+# For a homelab cluster where all namespaces are trusted, we create a single
+# catch-all by listing the namespaces we expect to use. Add entries as new
+# app namespaces are created.
 # ------------------------------------------------------------------------------
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: ReferenceGrant
@@ -17,6 +18,19 @@ spec:
   from:
     - group: gateway.networking.k8s.io
       kind: HTTPRoute
+      namespace: default
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: monitoring
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: argocd
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: authentik
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: gitea
   to:
     - group: gateway.networking.k8s.io
       kind: Gateway