gatus: serve s2.rubenhensen.nl through the Gateway as well

First app on the Gateway API: an HTTPS listener for s2.rubenhensen.nl using the existing certificate in the gatus namespace, an HTTPRoute, and a ReferenceGrant for the certificate. Plain HTTP on the Gateway now redirects to HTTPS. The Ingress stays until the switch-over.

gateway/gateway.yaml

@@ -14,3 +14,19 @@ spec:
     allowedRoutes:
       namespaces:
         from: All
+  # One HTTPS listener per hostname, each limited to its app's namespace.
+  # The certificates stay in the app namespaces (ReferenceGrant there).
+  - name: https-s2
+    protocol: HTTPS
+    port: 443
+    hostname: s2.rubenhensen.nl
+    tls:
+      certificateRefs:
+      - name: letsencrypt-prod
+        namespace: gatus
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: gatus

gateway/https-redirect.yaml

@@ -0,0 +1,17 @@
+# Plain HTTP only redirects to HTTPS. cert-manager's HTTP-01 challenge
+# routes name an exact hostname, so they win over this catch-all.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: https-redirect
+  namespace: envoy-gateway-system
+spec:
+  parentRefs:
+  - name: homelab
+    sectionName: http
+  rules:
+  - filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301

gatus/httproute.yaml

@@ -0,0 +1,30 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: gatus
+spec:
+  parentRefs:
+  - name: homelab
+    namespace: envoy-gateway-system
+    sectionName: https-s2
+  hostnames:
+  - s2.rubenhensen.nl
+  rules:
+  - backendRefs:
+    - name: gatus
+      port: 8080
+---
+# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
+apiVersion: gateway.networking.k8s.io/v1
+kind: ReferenceGrant
+metadata:
+  name: gateway-tls
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: envoy-gateway-system
+  to:
+  - group: ""
+    kind: Secret
+    name: letsencrypt-prod

gatus/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - gatus-deployment.yaml
   - gatus-service.yaml
   - ingress.yaml
+  - httproute.yaml
 
 configMapGenerator:
   - name: gatus-config