deploy gateway

cluster/platform/gateway/application.yaml

@@ -0,0 +1,30 @@
+# ------------------------------------------------------------------------------
+# Platform: gateway
+# Wave 4 — depends on cert-manager (wave 3) for wildcard TLS cert
+# Single source: plain manifests from repo (no Helm chart)
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gateway
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+    targetRevision: main
+    path: cluster/platform/gateway
+    directory:
+      exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: gateway
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/platform/gateway/certificate.yaml

@@ -0,0 +1,17 @@
+# ------------------------------------------------------------------------------
+# Wildcard certificate for fastpass cluster
+# Covers *.local.mk-labs.cloud — all cluster services use this cert
+# Issued via letsencrypt-prod (staging validated during hello-world test)
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fastpass-wildcard-tls
+  namespace: gateway
+spec:
+  secretName: fastpass-wildcard-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - "*.local.mk-labs.cloud"

cluster/platform/gateway/gateway.yaml

@@ -0,0 +1,37 @@
+# ------------------------------------------------------------------------------
+# fastpass-gateway — cluster-wide Gateway
+#
+# Single Gateway for all internal cluster traffic.
+# All HTTPRoutes across all namespaces attach to this Gateway.
+# IP: 10.1.71.90 (first address in cilium-gateway LB pool)
+#
+# TLS terminated here using wildcard cert from cert-manager.
+# HTTP listener included for redirect (handled at HTTPRoute level).
+# ------------------------------------------------------------------------------
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: fastpass-gateway
+  namespace: gateway
+  annotations:
+    io.cilium/lb-ipam-ips: "10.1.71.90"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: fastpass-wildcard-tls
+            kind: Secret
+      allowedRoutes:
+        namespaces:
+          from: All

cluster/platform/gateway/namespace.yaml

@@ -0,0 +1,12 @@
+# ------------------------------------------------------------------------------
+# gateway namespace
+# Platform-owned — all cluster ingress traffic flows through here
+# ------------------------------------------------------------------------------
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gateway
+  labels:
+    # Allow privileged pods if needed by Cilium gateway components
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: restricted

cluster/platform/gateway/referencegrant.yaml

@@ -0,0 +1,23 @@
+# ------------------------------------------------------------------------------
+# ReferenceGrant — allow HTTPRoutes from any namespace to attach to the Gateway
+#
+# Required by Gateway API spec when parentRef crosses namespace boundaries.
+# Without this, HTTPRoutes in app namespaces (monitoring, gitea, etc.) cannot
+# attach to the Gateway in the gateway namespace.
+#
+# Note: omitting `namespace` in the `from` stanza means all namespaces are
+# permitted. Add explicit namespace entries to restrict if needed later.
+# ------------------------------------------------------------------------------
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-httproutes
+  namespace: gateway
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+  to:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: fastpass-gateway