feat(networking): move to gateway api

kubernetes/apps/databases/emqx/cluster/kustomization.yaml

@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - ./cluster.yaml
-  - ./ingress.yaml
   - ./podmonitor.yaml

kubernetes/apps/external-secrets/onepassword/app/helmrelease.yaml

@@ -106,16 +106,6 @@ spec:
         runAsNonRoot: true
         runAsUser: 999
         runAsGroup: 999
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
     persistence:
       config:
         type: emptyDir

kubernetes/apps/home/atuin/app/helmrelease.yaml

@@ -76,21 +76,22 @@ spec:
         runAsNonRoot: true
         runAsUser: 568
         runAsGroup: 568
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths: &paths
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-          - host: sh.ktwo.io
-            paths: *paths
     persistence:
       config:
         type: emptyDir
+    route:
+      app:
+        hostnames:
+          - "{{ .Release.Name }}.ktwo.io"
+          - sh.ktwo.io
+        parentRefs:
+          - name: internal
+            namespace: kube-system
+            sectionName: https
+        rules:
+          - backendRefs:
+              - port: *port
+                name: *app
     service:
       app:
         controller: *app

kubernetes/apps/home/go2rtc/app/helmrelease.yaml

@@ -66,16 +66,6 @@ spec:
         runAsUser: 568
         runAsGroup: 568
         supplementalGroups: [44]
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
     persistence:
       config:
         type: configMap
@@ -84,6 +74,18 @@ spec:
           - path: /config/go2rtc.yaml
             subPath: go2rtc.yaml
             readOnly: true
+    route:
+      app:
+        hostnames:
+          - "{{ .Release.Name }}.ktwo.io"
+        parentRefs:
+          - name: internal
+            namespace: kube-system
+            sectionName: https
+        rules:
+          - backendRefs:
+              - port: *port
+                name: *app
     service:
       app:
         controller: *app

kubernetes/apps/home/home-assistant/app/helmrelease.yaml

@@ -54,18 +54,6 @@ spec:
         runAsGroup: 568
         fsGroup: 568
         fsGroupChangePolicy: OnRootMismatch
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths: &paths
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-          - host: hass.ktwo.io
-            paths: *paths
     persistence:
       config:
         existingClaim: *app
@@ -79,9 +67,22 @@ spec:
           - path: /config/tts
       tmp:
         type: emptyDir
+    route:
+      app:
+        hostnames:
+          - "{{ .Release.Name }}.ktwo.io"
+          - hass.ktwo.io
+        parentRefs:
+          - name: internal
+            namespace: kube-system
+            sectionName: https
+        rules:
+          - backendRefs:
+              - port: &port 8123
+                name: *app
     service:
       app:
         controller: *app
         ports:
           http:
-            port: 8123
+            port: *port

kubernetes/apps/home/zigbee2mqtt/app/helmrelease.yaml

@@ -80,25 +80,26 @@ spec:
         runAsGroup: 568
         fsGroup: 568
         fsGroupChangePolicy: OnRootMismatch
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths: &paths
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-          - host: zigbee.ktwo.io
-            paths: *paths
     persistence:
       config:
         existingClaim: *app
       config-logs:
         type: emptyDir
         globalMounts:
           - path: /config/log
+    route:
+      app:
+        hostnames:
+          - "{{ .Release.Name }}.ktwo.io"
+          - zigbee.ktwo.io
+        parentRefs:
+          - name: internal
+            namespace: kube-system
+            sectionName: https
+        rules:
+          - backendRefs:
+              - port: *port
+                name: *app
     service:
       app:
         controller: *app

kubernetes/apps/kube-system/cilium/app/helm/values.yaml

@@ -25,7 +25,10 @@ enableIPv4BIGTCP: true
 endpointRoutes:
   enabled: true
 envoy:
-  enabled: false
+  enabled: true
+gatewayAPI:
+  enabled: true
+  enableAlpn: true
 hubble:
   enabled: false
 ipam:
@@ -77,6 +80,3 @@ securityContext:
       - NET_ADMIN
       - SYS_ADMIN
       - SYS_RESOURCE
-tls:
-  secretsNamespace:
-    create: false

kubernetes/apps/kube-system/cilium/ingress/internal.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: internal
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: internal.ktwo.io
+spec:
+  gatewayClassName: cilium
+  addresses:
+    - type: IPAddress
+      value: 192.168.20.81
+    - type: IPAddress
+      value: ::ffff:c0a8:1451
+    - type: Hostname
+      value: internal.ktwo.io
+  infrastructure:
+    annotations:
+      lbipam.cilium.io/ips: 192.168.20.81, ::ffff:c0a8:1451
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.ktwo.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: "*.ktwo.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: ktwo-io-tls
+            namespace: cert-manager

kubernetes/apps/networking/nginx/internal/kustomization.yaml → kubernetes/apps/kube-system/cilium/ingress/kustomization.yaml

@@ -2,4 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./helmrelease.yaml
+  - ./internal.yaml

kubernetes/apps/kube-system/cilium/ks.yaml

@@ -41,3 +41,30 @@ spec:
   targetNamespace: *namespace
   timeout: 5m
   wait: true
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cilium-ingress
+  namespace: &namespace kube-system
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-tls
+      namespace: cert-manager
+    - name: cilium
+      namespace: *namespace
+    - name: cilium-config
+      namespace: *namespace
+  interval: 1h
+  path: ./kubernetes/apps/kube-system/cilium/ingress
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: *namespace
+  timeout: 5m
+  wait: true

kubernetes/apps/media/autobrr/app/helmrelease.yaml

@@ -72,19 +72,21 @@ spec:
         runAsNonRoot: true
         runAsUser: 568
         runAsGroup: 568
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
     persistence:
       tmp:
         type: emptyDir
+    route:
+      app:
+        hostnames:
+          - "{{ .Release.Name }}.ktwo.io"
+        parentRefs:
+          - name: internal
+            namespace: kube-system
+            sectionName: https
+        rules:
+          - backendRefs:
+              - port: *port
+                name: *app
     service:
       app:
         controller: *app

kubernetes/apps/media/bazarr/app/helmrelease.yaml

@@ -78,16 +78,6 @@ spec:
         fsGroup: 568
         fsGroupChangePolicy: OnRootMismatch
         supplementalGroups: [65536]
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
     persistence:
       add-ons:
         type: emptyDir
@@ -113,6 +103,18 @@ spec:
           - readOnly: true
       tmp:
         type: emptyDir
+    route:
+      app:
+        hostnames:
+          - "{{ .Release.Name }}.ktwo.io"
+        parentRefs:
+          - name: internal
+            namespace: kube-system
+            sectionName: https
+        rules:
+          - backendRefs:
+              - port: *port
+                name: *app
     service:
       app:
         controller: *app

kubernetes/apps/media/prowlarr/app/helmrelease.yaml

@@ -72,21 +72,23 @@ spec:
         runAsNonRoot: true
         runAsUser: 568
         runAsGroup: 568
-    ingress:
-      app:
-        className: internal
-        hosts:
-          - host: "{{ .Release.Name }}.ktwo.io"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
     persistence:
       config:
         type: emptyDir
       tmp:
         type: emptyDir
+    route:
+      app:
+        hostnames:
+          - "{{ .Release.Name }}.ktwo.io"
+        parentRefs:
+          - name: internal
+            namespace: kube-system
+            sectionName: https
+        rules:
+          - backendRefs:
+              - port: *port
+                name: *app
     service:
       app:
         controller: *app