89 lines
2.2 KiB
YAML
89 lines
2.2 KiB
YAML
|
---
|
||
|
|
# Shared Gateways live in kube-system; label for allowedRoutes Selector.
|
||
|
|
apiVersion: v1
|
||
|
|
kind: Namespace
|
||
|
|
metadata:
|
||
|
|
name: kube-system
|
||
|
|
labels:
|
||
|
|
gateway.quorate.internal/allow-internal: "true"
|
||
|
|
gateway.quorate.internal/allow-public: "true"
|
||
|
|
---
|
||
|
|
# Wildcard TLS cert for all *.quorate.internal services on Gateway I.
|
||
|
|
# cert-manager issues this via the vault-internal ClusterIssuer.
|
||
|
|
apiVersion: cert-manager.io/v1
|
||
|
|
kind: Certificate
|
||
|
|
metadata:
|
||
|
|
name: gateway-internal-tls
|
||
|
|
namespace: kube-system
|
||
|
|
spec:
|
||
|
|
secretName: gateway-internal-tls
|
||
|
|
issuerRef:
|
||
|
|
name: vault-internal
|
||
|
|
kind: ClusterIssuer
|
||
|
|
commonName: quorate.internal
|
||
|
|
dnsNames:
|
||
|
|
- quorate.internal
|
||
|
|
- "*.quorate.internal"
|
||
|
|
duration: 2160h
|
||
|
|
renewBefore: 360h
|
||
|
|
privateKey:
|
||
|
|
algorithm: ECDSA
|
||
|
|
size: 256
|
||
|
|
rotationPolicy: Always
|
||
|
|
---
|
||
|
|
apiVersion: gateway.networking.k8s.io/v1
|
||
|
|
kind: Gateway
|
||
|
|
metadata:
|
||
|
|
name: gateway-internal
|
||
|
|
namespace: kube-system
|
||
|
|
annotations:
|
||
|
|
io.cilium/lb-ipam-ips: "10.90.141.119"
|
||
|
|
spec:
|
||
|
|
gatewayClassName: cilium
|
||
|
|
listeners:
|
||
|
|
- name: https
|
||
|
|
port: 443
|
||
|
|
protocol: HTTPS
|
||
|
|
hostname: "*.quorate.internal"
|
||
|
|
tls:
|
||
|
|
mode: Terminate
|
||
|
|
certificateRefs:
|
||
|
|
- kind: Secret
|
||
|
|
name: gateway-internal-tls
|
||
|
|
allowedRoutes:
|
||
|
|
namespaces:
|
||
|
|
from: Selector
|
||
|
|
selector:
|
||
|
|
matchLabels:
|
||
|
|
gateway.quorate.internal/allow-internal: "true"
|
||
|
|
- name: http
|
||
|
|
port: 80
|
||
|
|
protocol: HTTP
|
||
|
|
hostname: "*.quorate.internal"
|
||
|
|
allowedRoutes:
|
||
|
|
namespaces:
|
||
|
|
from: Selector
|
||
|
|
selector:
|
||
|
|
matchLabels:
|
||
|
|
gateway.quorate.internal/allow-internal: "true"
|
||
|
|
---
|
||
|
|
# Redirect all HTTP *.quorate.internal traffic to HTTPS.
|
||
|
|
# cert.quorate.internal is excluded by hostname specificity — its own route wins.
|
||
|
|
apiVersion: gateway.networking.k8s.io/v1
|
||
|
|
kind: HTTPRoute
|
||
|
|
metadata:
|
||
|
|
name: https-redirect
|
||
|
|
namespace: kube-system
|
||
|
|
spec:
|
||
|
|
parentRefs:
|
||
|
|
- name: gateway-internal
|
||
|
|
namespace: kube-system
|
||
|
|
sectionName: http
|
||
|
|
hostnames:
|
||
|
|
- "*.quorate.internal"
|
||
|
|
rules:
|
||
|
|
- filters:
|
||
|
|
- type: RequestRedirect
|
||
|
|
requestRedirect:
|
||
|
|
scheme: https
|
||
|
|
statusCode: 301
|