127 lines
3.1 KiB
YAML
127 lines
3.1 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# hello-world — Gateway API + cert-manager + external-dns end-to-end test
|
|
#
|
|
# Tests:
|
|
# - Cilium Gateway provisioning (10.1.71.90 from cilium-gateway pool)
|
|
# - cert-manager DNS-01 cert issuance (letsencrypt-staging)
|
|
# - external-dns CNAME creation in Technitium via RFC2136
|
|
# - HTTPRoute routing to backend service
|
|
#
|
|
# Cleanup when done:
|
|
# kubectl delete -f hello-world.yaml -n default
|
|
# ------------------------------------------------------------------------------
|
|
|
|
# Gateway — one per cluster (shared by all HTTPRoutes)
|
|
# This is the only Gateway you'll ever need for internal cluster traffic.
|
|
# Pin to 10.1.71.90 via annotation — first IP in the cilium-gateway pool.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: fastpass-gateway
|
|
namespace: default
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "10.1.71.90"
|
|
spec:
|
|
gatewayClassName: cilium
|
|
listeners:
|
|
- name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
- name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- name: hello-world-tls
|
|
kind: Secret
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Same
|
|
---
|
|
# Certificate — staging issuer to avoid LE rate limits during testing
|
|
# Switch to letsencrypt-prod once staging validates successfully
|
|
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: hello-world-tls
|
|
namespace: default
|
|
spec:
|
|
secretName: hello-world-tls
|
|
issuerRef:
|
|
name: letsencrypt-staging
|
|
kind: ClusterIssuer
|
|
dnsNames:
|
|
- hello.local.mk-labs.cloud
|
|
---
|
|
# Deployment
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: hello-world
|
|
namespace: default
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: hello-world
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: hello-world
|
|
spec:
|
|
securityContext:
|
|
runAsNonRoot: true
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: hello-world
|
|
image: nginxdemos/hello:plain-text
|
|
ports:
|
|
- containerPort: 80
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
---
|
|
# Service
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: hello-world
|
|
namespace: default
|
|
spec:
|
|
selector:
|
|
app: hello-world
|
|
ports:
|
|
- port: 80
|
|
targetPort: 80
|
|
---
|
|
# HTTPRoute — handles both HTTP and HTTPS listeners
|
|
# external-dns watches this resource and creates the DNS record in Technitium
|
|
# because the hostname annotation is present.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: hello-world
|
|
namespace: default
|
|
annotations:
|
|
external-dns.alpha.kubernetes.io/hostname: hello.local.mk-labs.cloud
|
|
external-dns.alpha.kubernetes.io/target: "10.1.71.90"
|
|
spec:
|
|
parentRefs:
|
|
- name: fastpass-gateway
|
|
sectionName: https
|
|
hostnames:
|
|
- hello.local.mk-labs.cloud
|
|
rules:
|
|
- backendRefs:
|
|
- name: hello-world
|
|
port: 80
|