81 lines
1.9 KiB
YAML
81 lines
1.9 KiB
YAML
apiVersion: cert-manager.io/v1
|
|
kind: Certificate
|
|
metadata:
|
|
name: gateway-relay-tls
|
|
namespace: kube-system
|
|
spec:
|
|
secretName: gateway-relay-tls
|
|
secretTemplate:
|
|
annotations:
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
|
|
reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: zitadel,stalwart
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
|
|
reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: zitadel
|
|
issuerRef:
|
|
name: letsencrypt
|
|
kind: ClusterIssuer
|
|
commonName: quorate.dev
|
|
dnsNames:
|
|
- quorate.dev
|
|
- "*.quorate.dev"
|
|
duration: 2160h
|
|
renewBefore: 360h
|
|
privateKey:
|
|
algorithm: ECDSA
|
|
size: 256
|
|
rotationPolicy: Always
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: gateway-relay
|
|
namespace: kube-system
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "10.104.40.127"
|
|
spec:
|
|
gatewayClassName: cilium
|
|
listeners:
|
|
- name: https
|
|
port: 443
|
|
protocol: HTTPS
|
|
hostname: "*.quorate.dev"
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- kind: Secret
|
|
name: gateway-relay-tls
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
gateway.quorate.internal/allow-public: "true"
|
|
- name: http
|
|
port: 80
|
|
protocol: HTTP
|
|
hostname: "*.quorate.dev"
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
gateway.quorate.internal/allow-public: "true"
|
|
---
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: https-redirect-relay
|
|
namespace: kube-system
|
|
spec:
|
|
parentRefs:
|
|
- name: gateway-relay
|
|
namespace: kube-system
|
|
sectionName: http
|
|
hostnames:
|
|
- "*.quorate.dev"
|
|
rules:
|
|
- filters:
|
|
- type: RequestRedirect
|
|
requestRedirect:
|
|
scheme: https
|
|
statusCode: 301
|