49 lines
1.6 KiB
YAML
49 lines
1.6 KiB
YAML
# ------------------------------------------------------------------------------
|
|
# ReferenceGrant — allow HTTPRoutes from app namespaces to attach to the Gateway
|
|
#
|
|
# IMPORTANT: Every new application namespace that needs to route traffic through
|
|
# the Cilium Gateway MUST have an entry added here. This is a Gateway API
|
|
# security requirement — the grant must live in the gateway namespace.
|
|
#
|
|
# When adding a new application:
|
|
# 1. Add a new `from` entry below with the app namespace
|
|
# 2. Push to main
|
|
# 3. ArgoCD will sync the updated ReferenceGrant automatically
|
|
#
|
|
# Namespaces currently permitted:
|
|
# - default (test workloads)
|
|
# - argocd (ArgoCD UI)
|
|
# - monitoring (Grafana)
|
|
# - authentik (Authentik SSO — future)
|
|
# - gitea (Gitea — future)
|
|
# ------------------------------------------------------------------------------
|
|
apiVersion: gateway.networking.k8s.io/v1beta1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: allow-httproutes
|
|
namespace: gateway
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: default
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: argocd
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: monitoring
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: authentik
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: gitea
|
|
- group: gateway.networking.k8s.io
|
|
kind: HTTPRoute
|
|
namespace: skyway
|
|
to:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
name: fastpass-gateway
|