ce7cb702218693d08ea6d83464d2457c9250027c

services/short/k8s/gateway/gateway.yaml

@@ -0,0 +1,38 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata: {name: gateway-short, namespace: kube-system}
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: minecraft
+      port: 25565
+      protocol: TCP
+      allowedRoutes:
+        kinds: [{kind: TCPRoute}]
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels: {gateway.quorate.internal/allow-short: "true"}
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: nlb-canary.quorate.dev
+      tls:
+        mode: Terminate
+        certificateRefs: [{kind: Secret, name: gateway-relay-tls}]
+      allowedRoutes:
+        kinds: [{kind: HTTPRoute}]
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels: {gateway.quorate.internal/allow-short: "true"}
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: nlb-canary.quorate.dev
+      allowedRoutes:
+        kinds: [{kind: HTTPRoute}]
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels: {gateway.quorate.internal/allow-short: "true"}

services/short/k8s/gateway/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gateway.yaml
+  - ../../../../vendor/workloads/short-canary
+  - policy.yaml

services/short/k8s/gateway/policy.yaml

@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v2
+kind: CiliumClusterwideNetworkPolicy
+metadata: {name: gateway-short}
+spec:
+  endpointSelector:
+    matchLabels: {"reserved:ingress": ""}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            k8s:io.kubernetes.pod.namespace: short
+            app.kubernetes.io/name: tunnel
+            app.kubernetes.io/instance: short
+      toPorts:
+        - ports: [{port: "80", protocol: TCP}, {port: "443", protocol: TCP}]