jakman85andClaude Opus 4.8
af4f6c07ae
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
43 lines
1.5 KiB
YAML
43 lines
1.5 KiB
YAML
---
|
|
# Shared Gateway — HTTPS listeners on *.home.keithjackson.dev, TLS terminated with the wildcard cert
|
|
# (docs/09). Implemented by Cilium (GatewayClass `cilium`). The ingress VIP is announced via Cilium
|
|
# L2 announcement on the flat LAN (docs/09, OQ-1 resolved). Phase 0 STUB.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: Gateway
|
|
metadata:
|
|
name: shared
|
|
namespace: gateway
|
|
spec:
|
|
gatewayClassName: cilium
|
|
listeners:
|
|
- name: https
|
|
protocol: HTTPS
|
|
port: 443
|
|
hostname: "*.home.keithjackson.dev"
|
|
tls:
|
|
mode: Terminate
|
|
certificateRefs:
|
|
- kind: Secret
|
|
name: wildcard-home-tls # produced by wildcard-certificate.yaml
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
# App namespaces opt in to attach HTTPRoutes here (WS-APPS renders the label +
|
|
# ReferenceGrant from ServiceDefinition `exposure`). docs/09.
|
|
gateway-access: "shared"
|
|
- name: http-redirect
|
|
protocol: HTTP
|
|
port: 80
|
|
hostname: "*.home.keithjackson.dev"
|
|
allowedRoutes:
|
|
namespaces:
|
|
from: Selector
|
|
selector:
|
|
matchLabels:
|
|
gateway-access: "shared"
|
|
# TODO(WS-NET, Phase 2): pin the L2-announced VIP / IP pool; add HTTP->HTTPS redirect HTTPRoute;
|
|
# confirm cross-namespace ReferenceGrant pattern with WS-APPS. Ingress opens NORTH-SOUTH only —
|
|
# it does not relax east-west default-deny (docs/09).
|