deploy gateway

cluster/platform/gateway/application.yaml

@@ -0,0 +1,30 @@
+# ------------------------------------------------------------------------------
+# Platform: gateway
+# Wave 4 — depends on cert-manager (wave 3) for wildcard TLS cert
+# Single source: plain manifests from repo (no Helm chart)
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gateway
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "4"
+spec:
+  project: default
+  source:
+    repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+    targetRevision: main
+    path: cluster/platform/gateway
+    directory:
+      exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: gateway
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true

cluster/platform/gateway/certificate.yaml

@@ -0,0 +1,17 @@
+# ------------------------------------------------------------------------------
+# Wildcard certificate for fastpass cluster
+# Covers *.local.mk-labs.cloud — all cluster services use this cert
+# Issued via letsencrypt-prod (staging validated during hello-world test)
+# ------------------------------------------------------------------------------
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: fastpass-wildcard-tls
+  namespace: gateway
+spec:
+  secretName: fastpass-wildcard-tls
+  issuerRef:
+    name: letsencrypt-prod
+    kind: ClusterIssuer
+  dnsNames:
+    - "*.local.mk-labs.cloud"

cluster/platform/gateway/gateway.yaml

@@ -0,0 +1,37 @@
+# ------------------------------------------------------------------------------
+# fastpass-gateway — cluster-wide Gateway
+#
+# Single Gateway for all internal cluster traffic.
+# All HTTPRoutes across all namespaces attach to this Gateway.
+# IP: 10.1.71.90 (first address in cilium-gateway LB pool)
+#
+# TLS terminated here using wildcard cert from cert-manager.
+# HTTP listener included for redirect (handled at HTTPRoute level).
+# ------------------------------------------------------------------------------
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: fastpass-gateway
+  namespace: gateway
+  annotations:
+    io.cilium/lb-ipam-ips: "10.1.71.90"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: fastpass-wildcard-tls
+            kind: Secret
+      allowedRoutes:
+        namespaces:
+          from: All

cluster/platform/gateway/namespace.yaml

@@ -0,0 +1,12 @@
+# ------------------------------------------------------------------------------
+# gateway namespace
+# Platform-owned — all cluster ingress traffic flows through here
+# ------------------------------------------------------------------------------
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gateway
+  labels:
+    # Allow privileged pods if needed by Cilium gateway components
+    pod-security.kubernetes.io/enforce: baseline
+    pod-security.kubernetes.io/warn: restricted

cluster/platform/gateway/referencegrant.yaml

@@ -0,0 +1,23 @@
+# ------------------------------------------------------------------------------
+# ReferenceGrant — allow HTTPRoutes from any namespace to attach to the Gateway
+#
+# Required by Gateway API spec when parentRef crosses namespace boundaries.
+# Without this, HTTPRoutes in app namespaces (monitoring, gitea, etc.) cannot
+# attach to the Gateway in the gateway namespace.
+#
+# Note: omitting `namespace` in the `from` stanza means all namespaces are
+# permitted. Add explicit namespace entries to restrict if needed later.
+# ------------------------------------------------------------------------------
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-httproutes
+  namespace: gateway
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+  to:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: fastpass-gateway

hello-world.yaml

@@ -4,16 +4,14 @@
 # Tests:
 #   - Cilium Gateway provisioning (10.1.71.90 from cilium-gateway pool)
 #   - cert-manager DNS-01 cert issuance (letsencrypt-staging)
-#   - external-dns CNAME creation in Technitium via RFC2136
+#   - external-dns A record creation in Technitium via RFC2136
 #   - HTTPRoute routing to backend service
 #
 # Cleanup when done:
 #   kubectl delete -f hello-world.yaml -n default
 # ------------------------------------------------------------------------------
 
-# Gateway — one per cluster (shared by all HTTPRoutes)
-# This is the only Gateway you'll ever need for internal cluster traffic.
-# Pin to 10.1.71.90 via annotation — first IP in the cilium-gateway pool.
+# Gateway — one per cluster, shared by all HTTPRoutes
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -43,7 +41,6 @@ spec:
           from: Same
 ---
 # Certificate — staging issuer to avoid LE rate limits during testing
-# Switch to letsencrypt-prod once staging validates successfully
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
@@ -57,7 +54,7 @@ spec:
   dnsNames:
     - hello.local.mk-labs.cloud
 ---
-# Deployment
+# Deployment — http-echo runs as non-root, restricted compliant
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -81,9 +78,12 @@ spec:
           type: RuntimeDefault
       containers:
         - name: hello-world
-          image: nginxdemos/hello:plain-text
+          image: hashicorp/http-echo:1.0
+          args:
+            - "-text=fastpass gateway test - hello from mk-labs!"
+            - "-listen=:8080"
           ports:
-            - containerPort: 80
+            - containerPort: 8080
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -101,11 +101,9 @@ spec:
     app: hello-world
   ports:
     - port: 80
-      targetPort: 80
+      targetPort: 8080
 ---
-# HTTPRoute — handles both HTTP and HTTPS listeners
-# external-dns watches this resource and creates the DNS record in Technitium
-# because the hostname annotation is present.
+# HTTPRoute
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata: