mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
69a0661d09
Each app gets an HTTPS listener on the Gateway with its existing certificate, an HTTPRoute, and a ReferenceGrant for that certificate. The routes drop Envoy's 15s request timeout, as nginx has no overall limit either. Argo CD and Longhorn follow separately; the Ingresses stay until the switch-over.
35 lines
803 B
YAML
35 lines
803 B
YAML
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: authentik
|
|
spec:
|
|
parentRefs:
|
|
- name: homelab
|
|
namespace: envoy-gateway-system
|
|
sectionName: https-authentik
|
|
hostnames:
|
|
- authentik.rubenhensen.nl
|
|
rules:
|
|
- backendRefs:
|
|
- name: authentik-server
|
|
port: 80
|
|
# No limit on the whole request, as with nginx. Envoy's default of 15s
|
|
# cuts off uploads and long-lived connections.
|
|
timeouts:
|
|
request: 0s
|
|
---
|
|
# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: gateway-tls
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
namespace: envoy-gateway-system
|
|
to:
|
|
- group: ""
|
|
kind: Secret
|
|
name: authentik-tls
|