ce7cb702218693d08ea6d83464d2457c9250027c

vendor/infrastructure/cilium/config/gateway.yaml

@@ -0,0 +1,89 @@
+---
+# Shared Gateways live in kube-system; label for allowedRoutes Selector.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+  labels:
+    gateway.quorate.internal/allow-internal: "true"
+    gateway.quorate.internal/allow-public: "true"
+---
+# Wildcard TLS cert for all *.quorate.internal services on Gateway I.
+# cert-manager issues this via the vault-internal ClusterIssuer.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: gateway-internal-tls
+  namespace: kube-system
+spec:
+  secretName: gateway-internal-tls
+  issuerRef:
+    name: vault-internal
+    kind: ClusterIssuer
+  commonName: quorate.internal
+  dnsNames:
+    - quorate.internal
+    - "*.quorate.internal"
+  duration: 2160h
+  renewBefore: 360h
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+    rotationPolicy: Always
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: gateway-internal
+  namespace: kube-system
+  annotations:
+    io.cilium/lb-ipam-ips: "10.90.141.119"
+spec:
+  gatewayClassName: cilium
+  listeners:
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: "*.quorate.internal"
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            name: gateway-internal-tls
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway.quorate.internal/allow-internal: "true"
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: "*.quorate.internal"
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              gateway.quorate.internal/allow-internal: "true"
+---
+# Redirect all HTTP *.quorate.internal traffic to HTTPS.
+# cert.quorate.internal is excluded by hostname specificity — its own route wins.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: https-redirect
+  namespace: kube-system
+spec:
+  parentRefs:
+    - name: gateway-internal
+      namespace: kube-system
+      sectionName: http
+  hostnames:
+    - "*.quorate.internal"
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301