apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: longhorn
spec:
  parentRefs:
  - name: homelab
    namespace: envoy-gateway-system
    sectionName: https-longhorn
  hostnames:
  - longhorn.rubenhensen.nl
  rules:
  - backendRefs:
    - name: longhorn-frontend
      port: 80
    # No limit on the whole request, as with nginx. Envoy's default of 15s
    # cuts off uploads and long-lived connections.
    timeouts:
      request: 0s
---
# Longhorn has no login of its own. Envoy sends visitors through authentik
# first; the authentik application only lets admins in.
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: longhorn-oidc
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: longhorn
  oidc:
    provider:
      issuer: https://authentik.rubenhensen.nl/application/o/longhorn/
    clientID: longhorn
    clientSecret:
      name: longhorn-oidc-client-secret
    scopes:
    - openid
    - email
    - profile
    logoutPath: /logout
---
# Same client secret as authentik's, under the key Envoy Gateway expects.
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: longhorn-oidc-client-secret
spec:
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  refreshInterval: 15m
  target:
    name: longhorn-oidc-client-secret
    creationPolicy: Owner
  data:
    - secretKey: client-secret
      remoteRef:
        key: kv/longhorn-oidc
        property: client_secret
---
# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
apiVersion: gateway.networking.k8s.io/v1
kind: ReferenceGrant
metadata:
  name: gateway-tls
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: Gateway
    namespace: envoy-gateway-system
  to:
  - group: ""
    kind: Secret
    name: letsencrypt-prod