# ------------------------------------------------------------------------------
# fastpass-gateway — cluster-wide Gateway
#
# Single Gateway for all internal cluster traffic.
# All HTTPRoutes across all namespaces attach to this Gateway.
# IP: 10.1.71.90 (first address in cilium-gateway LB pool)
#
# TLS terminated here using wildcard cert from cert-manager.
# HTTP listener included for redirect (handled at HTTPRoute level).
# ------------------------------------------------------------------------------
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: fastpass-gateway
  namespace: gateway
  annotations:
    io.cilium/lb-ipam-ips: "10.1.71.90"
spec:
  gatewayClassName: cilium
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: All
    - name: https
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - name: fastpass-wildcard-tls
            kind: Secret
      allowedRoutes:
        namespaces:
          from: All