---
# Shared Gateways live in kube-system; label for allowedRoutes Selector.
apiVersion: v1
kind: Namespace
metadata:
  name: kube-system
  labels:
    gateway.quorate.internal/allow-internal: "true"
    gateway.quorate.internal/allow-public: "true"
---
# Wildcard TLS cert for all *.quorate.internal services on Gateway I.
# cert-manager issues this via the vault-internal ClusterIssuer.
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: gateway-internal-tls
  namespace: kube-system
spec:
  secretName: gateway-internal-tls
  issuerRef:
    name: vault-internal
    kind: ClusterIssuer
  commonName: quorate.internal
  dnsNames:
    - quorate.internal
    - "*.quorate.internal"
  duration: 2160h
  renewBefore: 360h
  privateKey:
    algorithm: ECDSA
    size: 256
    rotationPolicy: Always
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway-internal
  namespace: kube-system
  annotations:
    io.cilium/lb-ipam-ips: "10.90.141.119"
spec:
  gatewayClassName: cilium
  listeners:
    - name: https
      port: 443
      protocol: HTTPS
      hostname: "*.quorate.internal"
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: gateway-internal-tls
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway.quorate.internal/allow-internal: "true"
    - name: http
      port: 80
      protocol: HTTP
      hostname: "*.quorate.internal"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway.quorate.internal/allow-internal: "true"
---
# Redirect all HTTP *.quorate.internal traffic to HTTPS.
# cert.quorate.internal is excluded by hostname specificity — its own route wins.
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: https-redirect
  namespace: kube-system
spec:
  parentRefs:
    - name: gateway-internal
      namespace: kube-system
      sectionName: http
  hostnames:
    - "*.quorate.internal"
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            statusCode: 301