rblundonandClaude Sonnet 5.5
ebe4681438
- cluster/applications/litellm: multi-source Application (oci litellm-helm 1.106.1), values, ExternalSecrets (1Password wdw-labs), HTTPRoute, ExternalName services for fantasmic/wishes, namespace - gateway: https-skyliner listener + skyliner.wdw-labs.cloud certificate, ReferenceGrant for litellm namespace - cert-manager: add wdw-labs.cloud to ClusterIssuer dnsZones - external-dns: add wdw-labs.cloud zone (Technitium RFC2136) - onepassword-connect: add wdw-labs vault to ClusterSecretStore Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0118eUSMQitZMHN7qaCvynA3
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# ReferenceGrant — allow HTTPRoutes from app namespaces to attach to the Gateway
|
|
#
|
|
# IMPORTANT: Every new application namespace that needs to route traffic through
|
|
# the Cilium Gateway MUST have an entry added here. This is a Gateway API
|
|
# security requirement — the grant must live in the gateway namespace.
|
|
#
|
|
# When adding a new application:
|
|
# 1. Add a new `from` entry below with the app namespace
|
|
# 2. Push to main
|
|
# 3. ArgoCD will sync the updated ReferenceGrant automatically
|
|
#
|
|
# Namespaces currently permitted:
|
|
# - default (test workloads)
|
|
# - argocd (ArgoCD UI)
|
|
# - monitoring (Grafana)
|
|
# - authentik (Authentik SSO — future)
|
|
# - gitea (Gitea — future)
|
|
# - litellm (LiteLLM / skyliner)
|
|
# ------------------------------------------------------------------------------
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-httproutes
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: default
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: argocd
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: monitoring
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: authentik
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: gitea
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: skyway
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: firecrawl
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: litellm
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: fastpass-gateway
|