Centralize Envoy Gateway routing

argocd-apps/applications/infrastructure/gateway.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gateway
+  namespace: argocd
+spec:
+  project: platform
+  source:
+    repoURL: https://www.symcrest.com/internal/dev/git/symcrest/k8s-platform.git
+    targetRevision: main
+    path: infrastructure/gateway/envoy
+    directory:
+      recurse: true
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: apps
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true

charts/argocd/templates/httproute.yaml

@@ -1,21 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ .Values.route.name }}
-  namespace: {{ .Values.route.namespace }}
-spec:
-  parentRefs:
-    - name: {{ .Values.route.gatewayName }}
-      namespace: {{ .Values.route.gatewayNamespace }}
-  hostnames:
-{{- range .Values.route.hostnames }}
-    - {{ . | quote }}
-{{- end }}
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ .Values.argocd.basePath | quote }}
-      backendRefs:
-        - name: {{ .Values.route.serviceName }}
-          port: {{ .Values.route.servicePort }}

charts/longhorn/templates/httproute.yaml

@@ -1,39 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ .Values.route.name }}
-  namespace: {{ .Values.route.namespace }}
-spec:
-  parentRefs:
-    - name: {{ .Values.route.gatewayName }}
-      namespace: {{ .Values.route.gatewayNamespace }}
-  hostnames:
-{{- range .Values.route.hostnames }}
-    - {{ . | quote }}
-{{- end }}
-  rules:
-    - matches:
-        - path:
-            type: Exact
-            value: {{ .Values.longhorn.basePath | quote }}
-      filters:
-        - type: RequestRedirect
-          requestRedirect:
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: {{ printf "%s/" .Values.longhorn.basePath | quote }}
-            statusCode: 301
-
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ printf "%s/" .Values.longhorn.basePath | quote }}
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              type: ReplacePrefixMatch
-              replacePrefixMatch: {{ .Values.longhorn.rewriteTo | quote }}
-      backendRefs:
-        - name: {{ .Values.route.serviceName }}
-          port: {{ .Values.route.servicePort }}

charts/openproject/templates/httproute.yaml

@@ -1,24 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: openproject
-  namespace: {{ .Release.Namespace }}
-spec:
-  parentRefs:
-    - name: {{ .Values.gateway.name }}
-      namespace: {{ .Values.gateway.namespace }}
-
-  hostnames:
-{{- range .Values.hostnames }}
-    - {{ . | quote }}
-{{- end }}
-
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ .Values.basePath | quote }}
-
-      backendRefs:
-        - name: {{ .Values.service.name }}
-          port: {{ .Values.service.port }}

charts/pgadmin/templates/httproute.yaml

@@ -1,33 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ .Values.route.name }}
-  namespace: {{ .Values.namespace }}
-spec:
-  parentRefs:
-    - name: {{ .Values.route.gatewayName }}
-      namespace: {{ .Values.route.gatewayNamespace }}
-  hostnames:
-{{- range .Values.route.hostnames }}
-    - {{ . | quote }}
-{{- end }}
-  rules:
-    - matches:
-        - path:
-            type: Exact
-            value: {{ .Values.route.basePath | quote }}
-      filters:
-        - type: RequestRedirect
-          requestRedirect:
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: {{ printf "%s/" .Values.route.basePath | quote }}
-            statusCode: 301
-
-    - matches:
-        - path:
-            type: PathPrefix
-            value: {{ printf "%s/" .Values.route.basePath | quote }}
-      backendRefs:
-        - name: {{ .Values.route.serviceName }}
-          port: {{ .Values.route.servicePort }}

charts/symcrest-web/templates/httproute.yaml

@@ -1,21 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: {{ .Values.route.name }}
-  namespace: {{ .Values.namespace }}
-spec:
-  parentRefs:
-    - name: {{ .Values.route.gatewayName }}
-      namespace: {{ .Values.route.gatewayNamespace }}
-  hostnames:
-{{- range .Values.route.hostnames }}
-    - {{ . | quote }}
-{{- end }}
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - name: {{ .Values.service.name }}
-          port: {{ .Values.service.port }}

infrastructure/gateway/envoy/envoyproxy.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: public-gateway-nodeport
+  namespace: apps
+spec:
+  logging:
+    level:
+      default: warn
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        pod:
+          nodeSelector:
+            workload: app
+      envoyService:
+        type: NodePort
+        externalTrafficPolicy: Local

infrastructure/gateway/envoy/gatewayclass.yaml

@@ -0,0 +1,6 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: envoy-gateway-class
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller

infrastructure/gateway/envoy/routes/argocd.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: argocd
+  namespace: argocd
+spec:
+  parentRefs:
+    - name: public-gateway
+      namespace: apps
+  hostnames:
+    - "www.symcrest.com"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /internal/ops/gitops
+      backendRefs:
+        - name: argocd-server
+          port: 80

infrastructure/gateway/envoy/routes/forgejo.yaml

@@ -1,33 +1,31 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: {{ .Values.route.name }}
+  name: forgejo
-  namespace: {{ .Values.namespace }}
+  namespace: forgejo
 spec:
   parentRefs:
-    - name: {{ .Values.route.gatewayName }}
+    - name: public-gateway
-      namespace: {{ .Values.route.gatewayNamespace }}
+      namespace: apps
   hostnames:
-{{- range .Values.route.hostnames }}
+    - "www.symcrest.com"
-    - {{ . | quote }}
-{{- end }}
   rules:
     - matches:
         - path:
             type: Exact
-            value: {{ .Values.route.basePath | quote }}
+            value: /internal/dev/git
       filters:
         - type: RequestRedirect
           requestRedirect:
             path:
               type: ReplaceFullPath
-              replaceFullPath: {{ printf "%s/" .Values.route.basePath | quote }}
+              replaceFullPath: /internal/dev/git/
             statusCode: 301
 
     - matches:
         - path:
             type: PathPrefix
-            value: {{ printf "%s/" .Values.route.basePath | quote }}
+            value: /internal/dev/git/
       filters:
         - type: URLRewrite
           urlRewrite:
@@ -35,13 +33,13 @@ spec:
               type: ReplacePrefixMatch
               replacePrefixMatch: /
       backendRefs:
-        - name: {{ .Values.route.serviceName }}
+        - name: forgejo
-          port: {{ .Values.route.servicePort }}
+          port: 3000
 
     - matches:
         - path:
             type: PathPrefix
             value: /v2/
       backendRefs:
-        - name: {{ .Values.route.serviceName }}
+        - name: forgejo
-          port: {{ .Values.route.servicePort }}
+          port: 3000

infrastructure/gateway/envoy/routes/longhorn.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  parentRefs:
+    - name: public-gateway
+      namespace: apps
+  hostnames:
+    - "www.symcrest.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /internal/ops/volumes
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /internal/ops/volumes/
+            statusCode: 301
+
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /internal/ops/volumes/
+      filters:
+        - type: URLRewrite
+          urlRewrite:
+            path:
+              type: ReplacePrefixMatch
+              replacePrefixMatch: /
+      backendRefs:
+        - name: longhorn-frontend
+          port: 80

infrastructure/gateway/envoy/routes/openproject.yaml

@@ -1,5 +1,3 @@
----
-# Source: openproject/templates/httproute.yaml
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -9,16 +7,13 @@ spec:
   parentRefs:
     - name: public-gateway
       namespace: apps
-
   hostnames:
     - "www.symcrest.com"
-
   rules:
     - matches:
         - path:
             type: PathPrefix
-            value: "/internal/dev/projectmanagement"
+            value: /internal/dev/projectmanagement
-
       backendRefs:
         - name: openproject
           port: 8080

infrastructure/gateway/envoy/routes/pgadmin.yaml

@@ -0,0 +1,31 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: pgadmin
+  namespace: pgadmin
+spec:
+  parentRefs:
+    - name: public-gateway
+      namespace: apps
+  hostnames:
+    - "www.symcrest.com"
+  rules:
+    - matches:
+        - path:
+            type: Exact
+            value: /internal/dev/dbadmin/postgres
+      filters:
+        - type: RequestRedirect
+          requestRedirect:
+            path:
+              type: ReplaceFullPath
+              replaceFullPath: /internal/dev/dbadmin/postgres/
+            statusCode: 301
+
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /internal/dev/dbadmin/postgres/
+      backendRefs:
+        - name: pgadmin
+          port: 80

infrastructure/gateway/envoy/routes/symcrest-web.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: symcrest-web
+  namespace: apps
+spec:
+  parentRefs:
+    - name: public-gateway
+      namespace: apps
+  hostnames:
+    - "www.symcrest.com"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: symcrest-web
+          port: 80

infrastructure/gateway/envoy/shared-public-gateway.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: public-gateway
+  namespace: apps
+spec:
+  gatewayClassName: envoy-gateway-class
+  infrastructure:
+    parametersRef:
+      group: gateway.envoyproxy.io
+      kind: EnvoyProxy
+      name: public-gateway-nodeport
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All

rendered/argocd/argocd.yaml

@@ -1,21 +1 @@
----
+
-# Source: argocd-wrapper/templates/httproute.yaml
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: argocd
-  namespace: argocd
-spec:
-  parentRefs:
-    - name: public-gateway
-      namespace: apps
-  hostnames:
-    - "www.symcrest.com"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/internal/ops/gitops"
-      backendRefs:
-        - name: argocd-server
-          port: 80

rendered/forgejo/forgejo.yaml

@@ -82,50 +82,3 @@ spec:
         - name: forgejo-data
           persistentVolumeClaim:
             claimName: forgejo-data
----
-# Source: forgejo/templates/httproute.yaml
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: forgejo
-  namespace: forgejo
-spec:
-  parentRefs:
-    - name: public-gateway
-      namespace: apps
-  hostnames:
-    - "www.symcrest.com"
-  rules:
-    - matches:
-        - path:
-            type: Exact
-            value: "/internal/dev/git"
-      filters:
-        - type: RequestRedirect
-          requestRedirect:
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: "/internal/dev/git/"
-            statusCode: 301
-
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/internal/dev/git/"
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              type: ReplacePrefixMatch
-              replacePrefixMatch: /
-      backendRefs:
-        - name: forgejo
-          port: 3000
-
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /v2/
-      backendRefs:
-        - name: forgejo
-          port: 3000

rendered/longhorn/longhorn.yaml

@@ -1,39 +1 @@
----
-# Source: longhorn-wrapper/templates/httproute.yaml
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  parentRefs:
-    - name: public-gateway
-      namespace: apps
-  hostnames:
-    - "www.symcrest.com"
-  rules:
-    - matches:
-        - path:
-            type: Exact
-            value: "/internal/ops/volumes"
-      filters:
-        - type: RequestRedirect
-          requestRedirect:
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: "/internal/ops/volumes/"
-            statusCode: 301
 
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/internal/ops/volumes/"
-      filters:
-        - type: URLRewrite
-          urlRewrite:
-            path:
-              type: ReplacePrefixMatch
-              replacePrefixMatch: "/"
-      backendRefs:
-        - name: longhorn-frontend
-          port: 80

rendered/pgadmin/pgadmin.yaml

@@ -71,36 +71,3 @@ spec:
         - name: pgadmin-data
           persistentVolumeClaim:
             claimName: pgadmin-data
----
-# Source: pgadmin/templates/httproute.yaml
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: pgadmin
-  namespace: pgadmin
-spec:
-  parentRefs:
-    - name: public-gateway
-      namespace: apps
-  hostnames:
-    - "www.symcrest.com"
-  rules:
-    - matches:
-        - path:
-            type: Exact
-            value: "/internal/dev/dbadmin/postgres"
-      filters:
-        - type: RequestRedirect
-          requestRedirect:
-            path:
-              type: ReplaceFullPath
-              replaceFullPath: "/internal/dev/dbadmin/postgres/"
-            statusCode: 301
-
-    - matches:
-        - path:
-            type: PathPrefix
-            value: "/internal/dev/dbadmin/postgres/"
-      backendRefs:
-        - name: pgadmin
-          port: 80

rendered/symcrest-web/symcrest-web.yaml

@@ -64,24 +64,3 @@ spec:
             requests:
               cpu: 50m
               memory: 64Mi
----
-# Source: symcrest-web/templates/httproute.yaml
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: symcrest-web
-  namespace: apps
-spec:
-  parentRefs:
-    - name: public-gateway
-      namespace: apps
-  hostnames:
-    - "www.symcrest.com"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - name: symcrest-web
-          port: 80