jakman85andClaude Opus 4.8
1749603f87
Deploy Homepage (gethomepage) as the apex landing dashboard aggregating links to cluster services, in its OWN non-gating post-platform Flux Kustomization (clusters/base/homepage.yaml, dependsOn platform-config, wait:false) — mirrors headlamp/oauth2-proxy so a leaf UI can never gate the platform chain. - platform/homepage/: plain manifests (ns, config ConfigMap, Deployment, Service, default-deny+Cilium ingress NP, apex HTTPRoute). Non-root pod, HOMEPAGE_ALLOWED_HOSTS, bundled mdi-* icons (DNS-only egress). - gateway.yaml: add https-apex + http-apex-redirect listeners for the bare apex (the *.home wildcard listener does NOT match it). Apex is already a SAN on the wildcard cert — no new Certificate. - Forward-auth annotated (auth-mode=forward-auth) but NOT enforced: the Gateway ext-authz mechanism is an unbuilt Phase-6 WS-NET TODO (same status as all other forward-auth apps). Flagged as PM follow-up. Gate: lint/l0/render-golden(10/10)/l1 green; conformance skipped (no cluster). Co-Authored-By: Claude Opus 4.8 <[email protected]>
74 lines
2.7 KiB
YAML
74 lines
2.7 KiB
YAML
---
|
|
# Shared Gateway — HTTPS listeners on *.home.keithjackson.dev, TLS terminated with the wildcard cert
|
|
# (docs/09). Implemented by Cilium (GatewayClass `cilium`). The ingress VIP is announced via Cilium
|
|
# L2 announcement on the flat LAN (docs/09, OQ-1 resolved). Phase 0 STUB.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: shared
|
|
namespace: gateway
|
|
spec:
|
|
gatewayClassName: cilium
|
|
listeners:
|
|
- name: https
|
|
protocol: HTTPS
|
|
port: 443
|
|
hostname: "*.home.keithjackson.dev"
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- kind: Secret
|
|
name: wildcard-home-tls # produced by wildcard-certificate.yaml
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
# App namespaces opt in to attach HTTPRoutes here (WS-APPS renders the label +
|
|
# ReferenceGrant from ServiceDefinition `exposure`). docs/09.
|
|
gateway-access: "shared"
|
|
- name: http-redirect
|
|
protocol: HTTP
|
|
port: 80
|
|
hostname: "*.home.keithjackson.dev"
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
gateway-access: "shared"
|
|
# APEX listeners. The wildcard listeners above match ONLY subdomains: `*.home.keithjackson.dev`
|
|
# does NOT intersect the bare apex `home.keithjackson.dev`, so an HTTPRoute for the apex host
|
|
# (the Homepage landing dashboard, clusters/base/homepage.yaml) would bind to NO listener and
|
|
# never serve. These two listeners give the apex its own hostname. TLS is the SAME wildcard cert:
|
|
# `home.keithjackson.dev` is already a SAN on wildcard-certificate.yaml, so `wildcard-home-tls`
|
|
# terminates the apex too — no extra Certificate needed. Same gateway-access=shared opt-in.
|
|
- name: https-apex
|
|
protocol: HTTPS
|
|
port: 443
|
|
hostname: "home.keithjackson.dev"
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- kind: Secret
|
|
name: wildcard-home-tls # apex is a SAN on the wildcard cert (wildcard-certificate.yaml)
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
gateway-access: "shared"
|
|
- name: http-apex-redirect
|
|
protocol: HTTP
|
|
port: 80
|
|
hostname: "home.keithjackson.dev"
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
gateway-access: "shared"
|
|
# TODO(WS-NET, Phase 2): pin the L2-announced VIP / IP pool; add HTTP->HTTPS redirect HTTPRoute;
|
|
# confirm cross-namespace ReferenceGrant pattern with WS-APPS. Ingress opens NORTH-SOUTH only —
|
|
# it does not relax east-west default-deny (docs/09).
|