d-b.ca/db-cd
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: d-b.ca:fc7f977ab54514ab9adc038299231b7acd698d87
Branches Tags
d-b.ca:main
...
compare: d-b.ca:d716c4bb6d77b256bfcaae1921d083af069e6936
Branches Tags
d-b.ca:main

3 Commits
fc7f977ab5 ... d716c4bb6d

Author SHA1 Message Date
Drew Bowering
d716c4bb6d migrate from ingress-nginx to gateway-api 2026-02-04 14:30:51 -07:00
Drew Bowering
c214ae7de8 update to modern syntax 2026-02-04 13:52:30 -07:00
Drew Bowering
af15c9715b update indentation 2026-02-04 13:51:48 -07:00
23 changed files with 255 additions and 74 deletions
Expand all files Collapse all files

14
apps/kustomize/web/base/gateway/backendtlspolicy.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
name: web-gw
spec:
targetRefs:
- kind: Service
name: web
group: ""
validation:
caCertificateRefs:
- kind: ConfigMap
name: brds-bundle
group: ""

8
apps/kustomize/web/base/gateway/gateway.yaml Normal file
View File

@@ -0,0 +1,8 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
annotations:
cert-manager.io/issuer: web-gw-issuer
name: web-gw
spec:
gatewayClassName: cilium

15
apps/kustomize/web/base/gateway/issuer.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: web-gw-issuer
spec:
acme:
email: drew@brds.ca
privateKeySecretRef:
name: web-gw-issuer
solvers:
- http01:
gatewayHTTPRoute:
parentRefs:
- name: web-gw
kind: Gateway

12
apps/kustomize/web/base/gateway/referencegrant.yaml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
name: web-gw
spec:
from:
- group: gateway.networking.k8s.io
kind: Gateway
namespace: gateway-prod
to:
- group: ""
kind: Secret

15
apps/kustomize/web/base/gateway/routes/http-v4.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-http-v4
spec:
rules:
- filters:
- requestRedirect:
scheme: https
statusCode: 301
type: RequestRedirect
matches:
- path:
type: PathPrefix
value: /

20
apps/kustomize/web/base/gateway/routes/http.yaml Normal file
View File

@@ -0,0 +1,20 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-http
spec:
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: web-gw
sectionName: http
rules:
- filters:
- requestRedirect:
scheme: https
statusCode: 301
type: RequestRedirect
matches:
- path:
type: PathPrefix
value: /

15
apps/kustomize/web/base/gateway/routes/https-v4.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-https-v4
spec:
rules:
- backendRefs:
- group: ""
kind: Service
name: web
port: 443
matches:
- path:
type: PathPrefix
value: /

20
apps/kustomize/web/base/gateway/routes/https.yaml Normal file
View File

@@ -0,0 +1,20 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-https
spec:
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: web-gw
sectionName: https
rules:
- backendRefs:
- group: ""
kind: Service
name: web
port: 443
matches:
- path:
type: PathPrefix
value: /

15
apps/kustomize/web/base/kustomization.yaml
View File

@@ -2,7 +2,14 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- web/deployment.yaml
- web/ingress.yaml
- web/service.yaml
- web/web-backend-tls.yaml
- gateway/routes/http.yaml
- gateway/routes/http-v4.yaml
- gateway/routes/https.yaml
- gateway/routes/https-v4.yaml
- gateway/backendtlspolicy.yaml
- gateway/gateway.yaml
- gateway/issuer.yaml
- gateway/referencegrant.yaml
- web/deployment.yaml
- web/service.yaml
- web/web-backend-tls.yaml

34
apps/kustomize/web/base/web/deployment.yaml
View File

@@ -15,21 +15,21 @@ spec:
app: web
spec:
containers:
- name: web
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
memory: 512Mi
ports:
- containerPort: 443
protocol: TCP
name: https
volumeMounts:
- mountPath: /tls
name: web-backend-tls
- name: web
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
memory: 512Mi
ports:
- containerPort: 443
protocol: TCP
name: https
volumeMounts:
- mountPath: /tls
name: web-backend-tls
volumes:
- name: web-backend-tls
secret:
secretName: web-backend-tls
- name: web-backend-tls
secret:
secretName: web-backend-tls

11
apps/kustomize/web/base/web/ingress.yaml
View File

@@ -1,11 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
acme.cert-manager.io/http01-ingress-class: nginx
nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
name: web
labels:
app: web
spec:
ingressClassName: nginx

8
apps/kustomize/web/base/web/service.yaml
View File

@@ -4,10 +4,10 @@ metadata:
name: web
spec:
ports:
- name: https
port: 443
protocol: TCP
targetPort: 443
- name: https
port: 443
protocol: TCP
targetPort: 443
selector:
app: web
type: ClusterIP

10
apps/kustomize/web/envs/stage/gateway/backendtlspolicy.yaml Normal file
View File

@@ -0,0 +1,10 @@
apiVersion: gateway.networking.k8s.io/v1
kind: BackendTLSPolicy
metadata:
name: web-gw
spec:
validation:
hostname: stage.d-b.ca
subjectAltNames:
- type: Hostname
hostname: stage.d-b.ca

26
apps/kustomize/web/envs/stage/gateway/gateway.yaml Normal file
View File

@@ -0,0 +1,26 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: web-gw
spec:
addresses:
- value: 2600:70ff:b815:802:88eb:2ce8:86c9:564c
listeners:
- name: http
hostname: stage.d-b.ca
port: 80
protocol: HTTP
allowedRoutes:
namespaces:
from: Same
- name: https
hostname: stage.d-b.ca
port: 443
protocol: HTTPS
allowedRoutes:
namespaces:
from: Same
tls:
mode: Terminate
certificateRefs:
- name: web-tls

7
apps/kustomize/web/envs/stage/gateway/issuer.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: web-gw-issuer
spec:
acme:
server: https://acme-v02.api.letsencrypt.org/directory

13
apps/kustomize/web/envs/stage/gateway/routes/http-v4.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-http-v4
spec:
hostnames:
- stage.d-b.ca
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: v4-gw
namespace: gateway-prod
sectionName: dbca-web-stage-http

7
apps/kustomize/web/envs/stage/gateway/routes/http.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-http
spec:
hostnames:
- stage.d-b.ca

13
apps/kustomize/web/envs/stage/gateway/routes/https-v4.yaml Normal file
View File

@@ -0,0 +1,13 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-https-v4
spec:
hostnames:
- stage.d-b.ca
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: v4-gw
namespace: gateway-prod
sectionName: dbca-web-stage-https

7
apps/kustomize/web/envs/stage/gateway/routes/https.yaml Normal file
View File

@@ -0,0 +1,7 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: web-https
spec:
hostnames:
- stage.d-b.ca

17
apps/kustomize/web/envs/stage/kustomization.yaml
View File

@@ -2,9 +2,16 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- ../../base
- ../../base
- namespace.yaml
patchesStrategicMerge:
- web/ingress.yaml
- web/web-backend-tls.yaml
- web/web-image.yaml
patches:
- path: gateway/routes/http.yaml
- path: gateway/routes/http-v4.yaml
- path: gateway/routes/https.yaml
- path: gateway/routes/https-v4.yaml
- path: gateway/backendtlspolicy.yaml
- path: gateway/gateway.yaml
- path: gateway/issuer.yaml
- path: web/web-backend-tls.yaml
- path: web/web-image.yaml

6
apps/kustomize/web/envs/stage/namespace.yaml Normal file
View File

@@ -0,0 +1,6 @@
apiVersion: v1
kind: Namespace
metadata:
name: dbca-web-stage
labels:
brds.ca/localca: enabled

30
apps/kustomize/web/envs/stage/web/ingress.yaml
View File

@@ -1,30 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
annotations:
cert-manager.io/cluster-issuer: letsencrypt-prod
nginx.ingress.kubernetes.io/auth-url: |-
http://ak-outpost-forward-auth-proxy-default.iam.svc.k8s.ho.brds.ca:9000/outpost.goauthentik.io/auth/nginx
nginx.ingress.kubernetes.io/auth-signin: |-
https://stage.d-b.ca/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri
nginx.ingress.kubernetes.io/auth-response-headers: |-
Set-Cookie,X-authentik-username,X-authentik-groups,X-authentik-entitlements,X-authentik-email,X-authentik-name,X-authentik-uid
nginx.ingress.kubernetes.io/auth-snippet: |
proxy_set_header X-Forwarded-Host $http_host;
name: web
spec:
rules:
- host: stage.d-b.ca
http:
paths:
- backend:
service:
name: web
port:
name: https
path: /
pathType: Prefix
tls:
- hosts:
- stage.d-b.ca
secretName: web-tls

6
apps/kustomize/web/envs/stage/web/web-backend-tls.yaml
View File

@@ -4,6 +4,6 @@ metadata:
name: web-backend-tls
spec:
dnsNames:
- web
- stage
- stage.d-b.ca
- web
- stage
- stage.d-b.ca