From fc171b48e9b7d7148cd59bd86179eb513b0fa6bd Mon Sep 17 00:00:00 2001 From: Ryan Blundon Date: Mon, 18 May 2026 19:11:42 -0500 Subject: [PATCH] deploy gateway --- cluster/platform/gateway/application.yaml | 30 ++++++++++++++++ cluster/platform/gateway/certificate.yaml | 17 +++++++++ cluster/platform/gateway/gateway.yaml | 37 ++++++++++++++++++++ cluster/platform/gateway/namespace.yaml | 12 +++++++ cluster/platform/gateway/referencegrant.yaml | 23 ++++++++++++ hello-world.yaml | 22 ++++++------ 6 files changed, 129 insertions(+), 12 deletions(-) create mode 100644 cluster/platform/gateway/application.yaml create mode 100644 cluster/platform/gateway/certificate.yaml create mode 100644 cluster/platform/gateway/gateway.yaml create mode 100644 cluster/platform/gateway/namespace.yaml create mode 100644 cluster/platform/gateway/referencegrant.yaml diff --git a/cluster/platform/gateway/application.yaml b/cluster/platform/gateway/application.yaml new file mode 100644 index 0000000..744904f --- /dev/null +++ b/cluster/platform/gateway/application.yaml @@ -0,0 +1,30 @@ +# ------------------------------------------------------------------------------ +# Platform: gateway +# Wave 4 — depends on cert-manager (wave 3) for wildcard TLS cert +# Single source: plain manifests from repo (no Helm chart) +# ------------------------------------------------------------------------------ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: gateway + namespace: argocd + annotations: + argocd.argoproj.io/sync-wave: "4" +spec: + project: default + source: + repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git + targetRevision: main + path: cluster/platform/gateway + directory: + exclude: "application.yaml" + destination: + server: https://kubernetes.default.svc + namespace: gateway + syncPolicy: + automated: + prune: true + selfHeal: true + syncOptions: + - CreateNamespace=true + - ServerSideApply=true diff --git a/cluster/platform/gateway/certificate.yaml b/cluster/platform/gateway/certificate.yaml new file mode 100644 index 0000000..5106502 --- /dev/null +++ b/cluster/platform/gateway/certificate.yaml @@ -0,0 +1,17 @@ +# ------------------------------------------------------------------------------ +# Wildcard certificate for fastpass cluster +# Covers *.local.mk-labs.cloud — all cluster services use this cert +# Issued via letsencrypt-prod (staging validated during hello-world test) +# ------------------------------------------------------------------------------ +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: fastpass-wildcard-tls + namespace: gateway +spec: + secretName: fastpass-wildcard-tls + issuerRef: + name: letsencrypt-prod + kind: ClusterIssuer + dnsNames: + - "*.local.mk-labs.cloud" diff --git a/cluster/platform/gateway/gateway.yaml b/cluster/platform/gateway/gateway.yaml new file mode 100644 index 0000000..403af77 --- /dev/null +++ b/cluster/platform/gateway/gateway.yaml @@ -0,0 +1,37 @@ +# ------------------------------------------------------------------------------ +# fastpass-gateway — cluster-wide Gateway +# +# Single Gateway for all internal cluster traffic. +# All HTTPRoutes across all namespaces attach to this Gateway. +# IP: 10.1.71.90 (first address in cilium-gateway LB pool) +# +# TLS terminated here using wildcard cert from cert-manager. +# HTTP listener included for redirect (handled at HTTPRoute level). +# ------------------------------------------------------------------------------ +apiVersion: gateway.networking.k8s.io/v1 +kind: Gateway +metadata: + name: fastpass-gateway + namespace: gateway + annotations: + io.cilium/lb-ipam-ips: "10.1.71.90" +spec: + gatewayClassName: cilium + listeners: + - name: http + port: 80 + protocol: HTTP + allowedRoutes: + namespaces: + from: All + - name: https + port: 443 + protocol: HTTPS + tls: + mode: Terminate + certificateRefs: + - name: fastpass-wildcard-tls + kind: Secret + allowedRoutes: + namespaces: + from: All diff --git a/cluster/platform/gateway/namespace.yaml b/cluster/platform/gateway/namespace.yaml new file mode 100644 index 0000000..6082cb4 --- /dev/null +++ b/cluster/platform/gateway/namespace.yaml @@ -0,0 +1,12 @@ +# ------------------------------------------------------------------------------ +# gateway namespace +# Platform-owned — all cluster ingress traffic flows through here +# ------------------------------------------------------------------------------ +apiVersion: v1 +kind: Namespace +metadata: + name: gateway + labels: + # Allow privileged pods if needed by Cilium gateway components + pod-security.kubernetes.io/enforce: baseline + pod-security.kubernetes.io/warn: restricted diff --git a/cluster/platform/gateway/referencegrant.yaml b/cluster/platform/gateway/referencegrant.yaml new file mode 100644 index 0000000..84e39c0 --- /dev/null +++ b/cluster/platform/gateway/referencegrant.yaml @@ -0,0 +1,23 @@ +# ------------------------------------------------------------------------------ +# ReferenceGrant — allow HTTPRoutes from any namespace to attach to the Gateway +# +# Required by Gateway API spec when parentRef crosses namespace boundaries. +# Without this, HTTPRoutes in app namespaces (monitoring, gitea, etc.) cannot +# attach to the Gateway in the gateway namespace. +# +# Note: omitting `namespace` in the `from` stanza means all namespaces are +# permitted. Add explicit namespace entries to restrict if needed later. +# ------------------------------------------------------------------------------ +apiVersion: gateway.networking.k8s.io/v1beta1 +kind: ReferenceGrant +metadata: + name: allow-httproutes + namespace: gateway +spec: + from: + - group: gateway.networking.k8s.io + kind: HTTPRoute + to: + - group: gateway.networking.k8s.io + kind: Gateway + name: fastpass-gateway diff --git a/hello-world.yaml b/hello-world.yaml index f44c29d..d986761 100644 --- a/hello-world.yaml +++ b/hello-world.yaml @@ -4,16 +4,14 @@ # Tests: # - Cilium Gateway provisioning (10.1.71.90 from cilium-gateway pool) # - cert-manager DNS-01 cert issuance (letsencrypt-staging) -# - external-dns CNAME creation in Technitium via RFC2136 +# - external-dns A record creation in Technitium via RFC2136 # - HTTPRoute routing to backend service # # Cleanup when done: # kubectl delete -f hello-world.yaml -n default # ------------------------------------------------------------------------------ -# Gateway — one per cluster (shared by all HTTPRoutes) -# This is the only Gateway you'll ever need for internal cluster traffic. -# Pin to 10.1.71.90 via annotation — first IP in the cilium-gateway pool. +# Gateway — one per cluster, shared by all HTTPRoutes apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: @@ -43,7 +41,6 @@ spec: from: Same --- # Certificate — staging issuer to avoid LE rate limits during testing -# Switch to letsencrypt-prod once staging validates successfully apiVersion: cert-manager.io/v1 kind: Certificate metadata: @@ -57,7 +54,7 @@ spec: dnsNames: - hello.local.mk-labs.cloud --- -# Deployment +# Deployment — http-echo runs as non-root, restricted compliant apiVersion: apps/v1 kind: Deployment metadata: @@ -81,9 +78,12 @@ spec: type: RuntimeDefault containers: - name: hello-world - image: nginxdemos/hello:plain-text + image: hashicorp/http-echo:1.0 + args: + - "-text=fastpass gateway test - hello from mk-labs!" + - "-listen=:8080" ports: - - containerPort: 80 + - containerPort: 8080 securityContext: allowPrivilegeEscalation: false capabilities: @@ -101,11 +101,9 @@ spec: app: hello-world ports: - port: 80 - targetPort: 80 + targetPort: 8080 --- -# HTTPRoute — handles both HTTP and HTTPS listeners -# external-dns watches this resource and creates the DNS record in Technitium -# because the hostname annotation is present. +# HTTPRoute apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: