mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 22:29:09 +01:00
Ruben Hensen
134774509d
With server.insecure, TLS ends at nginx or Envoy and argocd-server serves plain HTTP, which is how Argo CD documents the Gateway API setup. The nginx Ingress now talks HTTP to the http port; the ssl-passthrough annotation did nothing without the controller flag. argocd-folder diffs server-side for the new HTTPRoute.
35 lines
794 B
YAML
35 lines
794 B
YAML
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: argocd
|
|
spec:
|
|
parentRefs:
|
|
- name: homelab
|
|
namespace: envoy-gateway-system
|
|
sectionName: https-argocd
|
|
hostnames:
|
|
- argocd.rubenhensen.nl
|
|
rules:
|
|
- backendRefs:
|
|
- name: argocd-server
|
|
port: 80
|
|
# No limit on the whole request, as with nginx. Envoy's default of 15s
|
|
# cuts off uploads and long-lived connections.
|
|
timeouts:
|
|
request: 0s
|
|
---
|
|
# Lets the Gateway serve the certificate cert-manager keeps in this namespace.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: ReferenceGrant
|
|
metadata:
|
|
name: gateway-tls
|
|
spec:
|
|
from:
|
|
- group: gateway.networking.k8s.io
|
|
kind: Gateway
|
|
namespace: envoy-gateway-system
|
|
to:
|
|
- group: ""
|
|
kind: Secret
|
|
name: letsencrypt-prod
|