deploy gateway

hello-world.yaml

@@ -4,16 +4,14 @@
 # Tests:
 #   - Cilium Gateway provisioning (10.1.71.90 from cilium-gateway pool)
 #   - cert-manager DNS-01 cert issuance (letsencrypt-staging)
-#   - external-dns CNAME creation in Technitium via RFC2136
+#   - external-dns A record creation in Technitium via RFC2136
 #   - HTTPRoute routing to backend service
 #
 # Cleanup when done:
 #   kubectl delete -f hello-world.yaml -n default
 # ------------------------------------------------------------------------------
 
-# Gateway — one per cluster (shared by all HTTPRoutes)
-# This is the only Gateway you'll ever need for internal cluster traffic.
-# Pin to 10.1.71.90 via annotation — first IP in the cilium-gateway pool.
+# Gateway — one per cluster, shared by all HTTPRoutes
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -43,7 +41,6 @@ spec:
           from: Same
 ---
 # Certificate — staging issuer to avoid LE rate limits during testing
-# Switch to letsencrypt-prod once staging validates successfully
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -57,7 +54,7 @@ spec:
   dnsNames:
     - hello.local.mk-labs.cloud
 ---
-# Deployment
+# Deployment — http-echo runs as non-root, restricted compliant
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -81,9 +78,12 @@ spec:
           type: RuntimeDefault
       containers:
         - name: hello-world
-          image: nginxdemos/hello:plain-text
+          image: hashicorp/http-echo:1.0
+          args:
+            - "-text=fastpass gateway test - hello from mk-labs!"
+            - "-listen=:8080"
           ports:
-            - containerPort: 80
+            - containerPort: 8080
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -101,11 +101,9 @@ spec:
     app: hello-world
   ports:
     - port: 80
-      targetPort: 80
+      targetPort: 8080
 ---
-# HTTPRoute — handles both HTTP and HTTPS listeners
-# external-dns watches this resource and creates the DNS record in Technitium
-# because the hostname annotation is present.
+# HTTPRoute
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata: