From 69a0661d093c346a42a4ad0ce408550532889998 Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Fri, 23 Oct 2026 17:39:04 +0200 Subject: [PATCH] Add HTTPRoutes for the apps behind ingress-nginx Each app gets an HTTPS listener on the Gateway with its existing certificate, an HTTPRoute, and a ReferenceGrant for that certificate. The routes drop Envoy's 15s request timeout, as nginx has no overall limit either. Argo CD and Longhorn follow separately; the Ingresses stay until the switch-over. --- actual-budget/httproute.yaml | 34 +++++++ authentik/httproute.yaml | 34 +++++++ bolletjestrui/httproute.yaml | 34 +++++++ freshrss/httproute.yaml | 34 +++++++ gateway/gateway.yaml | 168 ++++++++++++++++++++++++++++++++++ gitea/httproute.yaml | 34 +++++++ home-assistant/httproute.yaml | 34 +++++++ immich/httproute.yaml | 34 +++++++ mbgwp/httproute.yaml | 38 ++++++++ ntfy/httproute.yaml | 34 +++++++ ntfy/kustomization.yaml | 1 + serpbear/httproute.yaml | 34 +++++++ vault/httproute.yaml | 34 +++++++ 13 files changed, 547 insertions(+) create mode 100644 actual-budget/httproute.yaml create mode 100644 authentik/httproute.yaml create mode 100644 bolletjestrui/httproute.yaml create mode 100644 freshrss/httproute.yaml create mode 100644 gitea/httproute.yaml create mode 100644 home-assistant/httproute.yaml create mode 100644 immich/httproute.yaml create mode 100644 mbgwp/httproute.yaml create mode 100644 ntfy/httproute.yaml create mode 100644 serpbear/httproute.yaml create mode 100644 vault/httproute.yaml diff --git a/actual-budget/httproute.yaml b/actual-budget/httproute.yaml new file mode 100644 index 0000000..6dc9fb3 --- /dev/null +++ b/actual-budget/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: actual-budget +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-ynab + hostnames: + - ynab.rubenhensen.nl + rules: + - backendRefs: + - name: helm-actual-budget-actualbudget + port: 5006 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: actual-budget-tls diff --git a/authentik/httproute.yaml b/authentik/httproute.yaml new file mode 100644 index 0000000..4105e83 --- /dev/null +++ b/authentik/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: authentik +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-authentik + hostnames: + - authentik.rubenhensen.nl + rules: + - backendRefs: + - name: authentik-server + port: 80 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: authentik-tls diff --git a/bolletjestrui/httproute.yaml b/bolletjestrui/httproute.yaml new file mode 100644 index 0000000..1a98630 --- /dev/null +++ b/bolletjestrui/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: bolletjestrui +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-vic + hostnames: + - vic.rubenhensen.nl + rules: + - backendRefs: + - name: bolletjestrui + port: 3000 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod diff --git a/freshrss/httproute.yaml b/freshrss/httproute.yaml new file mode 100644 index 0000000..800cbc7 --- /dev/null +++ b/freshrss/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: freshrss +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-rss + hostnames: + - rss.rubenhensen.nl + rules: + - backendRefs: + - name: freshrss + port: 8080 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod diff --git a/gateway/gateway.yaml b/gateway/gateway.yaml index 4067d6d..06ee4e2 100644 --- a/gateway/gateway.yaml +++ b/gateway/gateway.yaml @@ -30,3 +30,171 @@ spec: selector: matchLabels: kubernetes.io/metadata.name: gatus + - name: https-ynab + protocol: HTTPS + port: 443 + hostname: ynab.rubenhensen.nl + tls: + certificateRefs: + - name: actual-budget-tls + namespace: actual-budget + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: actual-budget + - name: https-authentik + protocol: HTTPS + port: 443 + hostname: authentik.rubenhensen.nl + tls: + certificateRefs: + - name: authentik-tls + namespace: authentik + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: authentik + - name: https-vic + protocol: HTTPS + port: 443 + hostname: vic.rubenhensen.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: bolletjestrui + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: bolletjestrui + - name: https-rss + protocol: HTTPS + port: 443 + hostname: rss.rubenhensen.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: freshrss + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: freshrss + - name: https-git + protocol: HTTPS + port: 443 + hostname: git.rubenhensen.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: gitea + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: gitea + - name: https-ha + protocol: HTTPS + port: 443 + hostname: ha.rubenhensen.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: home-assistant + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: home-assistant + - name: https-foto + protocol: HTTPS + port: 443 + hostname: foto.scoutingmbg.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: immich + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: immich + - name: https-scoutingmbg + protocol: HTTPS + port: 443 + hostname: scoutingmbg.nl + tls: + certificateRefs: + - name: scoutingmbg-nl-tls + namespace: mbgwp + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: mbgwp + - name: https-www-scoutingmbg + protocol: HTTPS + port: 443 + hostname: www.scoutingmbg.nl + tls: + certificateRefs: + - name: scoutingmbg-nl-tls + namespace: mbgwp + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: mbgwp + - name: https-ntfy2 + protocol: HTTPS + port: 443 + hostname: ntfy2.rubenhensen.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: ntfy + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: ntfy + - name: https-serpbear + protocol: HTTPS + port: 443 + hostname: serpbear.rubenhensen.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: serpbear + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: serpbear + - name: https-vault + protocol: HTTPS + port: 443 + hostname: vault.rubenhensen.nl + tls: + certificateRefs: + - name: letsencrypt-prod + namespace: vault + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: vault diff --git a/gitea/httproute.yaml b/gitea/httproute.yaml new file mode 100644 index 0000000..af042fb --- /dev/null +++ b/gitea/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: gitea +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-git + hostnames: + - git.rubenhensen.nl + rules: + - backendRefs: + - name: gitea + port: 3000 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod diff --git a/home-assistant/httproute.yaml b/home-assistant/httproute.yaml new file mode 100644 index 0000000..c78d71b --- /dev/null +++ b/home-assistant/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: home-assistant +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-ha + hostnames: + - ha.rubenhensen.nl + rules: + - backendRefs: + - name: home-assistant-external + port: 8123 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod diff --git a/immich/httproute.yaml b/immich/httproute.yaml new file mode 100644 index 0000000..f222c74 --- /dev/null +++ b/immich/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: immich +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-foto + hostnames: + - foto.scoutingmbg.nl + rules: + - backendRefs: + - name: sol-auth-svc + port: 8002 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod diff --git a/mbgwp/httproute.yaml b/mbgwp/httproute.yaml new file mode 100644 index 0000000..f89fceb --- /dev/null +++ b/mbgwp/httproute.yaml @@ -0,0 +1,38 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: wordpress +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-scoutingmbg + - name: homelab + namespace: envoy-gateway-system + sectionName: https-www-scoutingmbg + hostnames: + - scoutingmbg.nl + - www.scoutingmbg.nl + rules: + - backendRefs: + - name: mbgwp-official-helm-wordpress + port: 80 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: scoutingmbg-nl-tls diff --git a/ntfy/httproute.yaml b/ntfy/httproute.yaml new file mode 100644 index 0000000..99d1340 --- /dev/null +++ b/ntfy/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: ntfy +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-ntfy2 + hostnames: + - ntfy2.rubenhensen.nl + rules: + - backendRefs: + - name: ntfy + port: 80 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod diff --git a/ntfy/kustomization.yaml b/ntfy/kustomization.yaml index 4c25539..feb1ec8 100644 --- a/ntfy/kustomization.yaml +++ b/ntfy/kustomization.yaml @@ -9,3 +9,4 @@ resources: - ntfy-deployment.yaml - ntfy-service.yaml - ingress.yaml + - httproute.yaml diff --git a/serpbear/httproute.yaml b/serpbear/httproute.yaml new file mode 100644 index 0000000..f553d78 --- /dev/null +++ b/serpbear/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: serpbear +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-serpbear + hostnames: + - serpbear.rubenhensen.nl + rules: + - backendRefs: + - name: serpbear + port: 3000 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod diff --git a/vault/httproute.yaml b/vault/httproute.yaml new file mode 100644 index 0000000..b643c82 --- /dev/null +++ b/vault/httproute.yaml @@ -0,0 +1,34 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: vault +spec: + parentRefs: + - name: homelab + namespace: envoy-gateway-system + sectionName: https-vault + hostnames: + - vault.rubenhensen.nl + rules: + - backendRefs: + - name: vault-active + port: 8200 + # No limit on the whole request, as with nginx. Envoy's default of 15s + # cuts off uploads and long-lived connections. + timeouts: + request: 0s +--- +# Lets the Gateway serve the certificate cert-manager keeps in this namespace. +apiVersion: gateway.networking.k8s.io/v1 +kind: ReferenceGrant +metadata: + name: gateway-tls +spec: + from: + - group: gateway.networking.k8s.io + kind: Gateway + namespace: envoy-gateway-system + to: + - group: "" + kind: Secret + name: letsencrypt-prod