feature: the example plugin ships Gateway API routes beside its Ingress install (#4)

Author: lukepolo

k8s/gateway/http/httproute.yaml

@@ -0,0 +1,25 @@
+# Both of the shared Gateway's listeners: a proxy may forward to the node over
+# HTTP on 80 or HTTPS on 443.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: example-plugin
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      sectionName: web
+    - name: traefik-gateway
+      namespace: traefik
+      sectionName: websecure
+  hostnames:
+    - ${EXAMPLE_PLUGIN_DOMAIN}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: example-plugin
+          port: 80

k8s/gateway/http/kustomization.yaml

@@ -0,0 +1,30 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# For panels that route through Traefik and the Gateway API, behind a reverse
+# proxy: the base without its Ingress, served by an HTTPRoute on the panel's
+# shared Gateway. k8s/overlays stays the install for panels on ingress-nginx.
+resources:
+  - ../../base
+  - httproute.yaml
+
+patches:
+  - patch: |-
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: example-plugin
+        namespace: 5stack
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: example-plugin-config
+      fieldPath: data.EXAMPLE_PLUGIN_DOMAIN
+    targets:
+      - select:
+          kind: HTTPRoute
+          name: example-plugin
+        fieldPaths:
+          - spec.hostnames.0

k8s/gateway/https/certificate.yaml

@@ -0,0 +1,27 @@
+# The plugin's own certificate.
+#
+# Not an entry added to the panel's shared 5stack-ssl cert: the panel rebuilds
+# that one from its own overlay on every ./update.sh, so anything a plugin added
+# there would be silently dropped on the next panel update.
+#
+# The Issuer is the namespaced Issuer the panel install creates when the site
+# terminates TLS itself. If yours is named something else, change issuerRef —
+# nothing else in this overlay depends on the name.
+#
+# ${EXAMPLE_PLUGIN_DOMAIN} is substituted by the replacement in
+# kustomization.yaml, from the same file the ingress host comes from.
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: example-plugin-ssl
+  namespace: 5stack
+spec:
+  secretName: example-plugin-ssl
+  # Matches the panel's cert cadence: 90d lifetime, renewed with 10d to spare.
+  duration: 2160h
+  renewBefore: 240h
+  dnsNames:
+    - ${EXAMPLE_PLUGIN_DOMAIN}
+  issuerRef:
+    name: 5stack-issuer
+    kind: Issuer

k8s/gateway/https/gateway.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: example-plugin
+  namespace: 5stack
+spec:
+  gatewayClassName: traefik
+  listeners:
+    - name: https
+      hostname: ${EXAMPLE_PLUGIN_DOMAIN}
+      protocol: HTTPS
+      port: 8443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - name: example-plugin-ssl
+      allowedRoutes:
+        namespaces:
+          from: Same

k8s/gateway/https/httproute.yaml

@@ -0,0 +1,19 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: example-plugin
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: example-plugin
+      sectionName: https
+  hostnames:
+    - ${EXAMPLE_PLUGIN_DOMAIN}
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: example-plugin
+          port: 80

k8s/gateway/https/https-redirect.yaml

@@ -0,0 +1,20 @@
+# No port on the redirect: browsers come back on 443 whatever HTTPS port the
+# node uses.
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: example-plugin-https-redirect
+  namespace: 5stack
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      namespace: traefik
+      sectionName: web
+  hostnames:
+    - ${EXAMPLE_PLUGIN_DOMAIN}
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 308

k8s/gateway/https/kustomization.yaml

@@ -0,0 +1,49 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+# For panels that route through Traefik and the Gateway API and terminate TLS
+# themselves: the plugin's own HTTPS listener on its cert-manager certificate,
+# and plain HTTP on the shared listener redirected to it. That listener is
+# also where cert-manager's HTTP-01 solver answers.
+resources:
+  - ../../base
+  - certificate.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - https-redirect.yaml
+
+patches:
+  - patch: |-
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: example-plugin
+        namespace: 5stack
+
+replacements:
+  - source:
+      kind: ConfigMap
+      name: example-plugin-config
+      fieldPath: data.EXAMPLE_PLUGIN_DOMAIN
+    targets:
+      - select:
+          kind: Certificate
+          name: example-plugin-ssl
+        fieldPaths:
+          - spec.dnsNames.0
+      - select:
+          kind: Gateway
+          name: example-plugin
+        fieldPaths:
+          - spec.listeners.0.hostname
+      - select:
+          kind: HTTPRoute
+          name: example-plugin
+        fieldPaths:
+          - spec.hostnames.0
+      - select:
+          kind: HTTPRoute
+          name: example-plugin-https-redirect
+        fieldPaths:
+          - spec.hostnames.0

public/5stack-plugin.json

@@ -14,6 +14,12 @@
       "http": "k8s/overlays/http",
       "https": "k8s/overlays/https"
     },
+    "gateway": {
+      "overlays": {
+        "http": "k8s/gateway/http",
+        "https": "k8s/gateway/https"
+      }
+    },
     "certificate": "example-plugin-ssl",
     "domain": {
       "prefix": "hello",