From 2d078e10c0efd894281f770e74cf951441e351b2 Mon Sep 17 00:00:00 2001 From: Jeffrey Smeets Date: Wed, 26 Aug 2026 21:54:49 +0200 Subject: [PATCH] pelican: expose wings-mc and wings-ark on the public gateway The console will not work from outside without this. WebsocketController hands the browser wss://:443/api/servers//ws built from Node::getConnectionAddress(), so the browser talks to wings directly and never through the panel. Same for file upload and download, which FileUploadController builds from the same address. Everything else (login, server list, file browsing, power actions, sending console commands) already worked publicly, because those go through the panel API. Adds public listeners for both nodes reusing the existing wings-mc-tls and wings-ark-tls certificates, and a gateway-public parentRef on each route. Extends the wings ClientTrafficPolicy to the two new listeners. Without it the public listeners would negotiate h2 and long-lived consoles would drop: wings only speaks HTTP/1.1, and the idle timeout needs to be 3600s rather than the default. CrowdSec ext_authz already covers every listener on gateway-public, so both nodes are behind the WAF and community blocklist from the moment they are live. Wings itself is JWT-gated and returns 401 unauthenticated. --- .../pelican/pelican-wings-ark-httproute.yaml | 5 +++++ .../pelican/pelican-wings-mc-httproute.yaml | 5 +++++ infra/envoy-gateway/kustomization.yaml | 14 ++++++++++++++ ...elican-wings-ark-gateway-public-patch.yaml | 19 +++++++++++++++++++ .../pelican-wings-clienttrafficpolicy.yaml | 8 ++++++++ ...pelican-wings-mc-gateway-public-patch.yaml | 19 +++++++++++++++++++ 6 files changed, 70 insertions(+) create mode 100644 infra/envoy-gateway/pelican/pelican-wings-ark-gateway-public-patch.yaml create mode 100644 infra/envoy-gateway/pelican/pelican-wings-mc-gateway-public-patch.yaml diff --git a/applications/pelican/pelican-wings-ark-httproute.yaml b/applications/pelican/pelican-wings-ark-httproute.yaml index b08c0e9..fc220dc 100644 --- a/applications/pelican/pelican-wings-ark-httproute.yaml +++ b/applications/pelican/pelican-wings-ark-httproute.yaml @@ -10,6 +10,11 @@ spec: name: gateway-internal namespace: envoy-gateway sectionName: wings-ark + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + namespace: envoy-gateway + sectionName: wings-ark hostnames: - "wings-ark.jsme.be" rules: diff --git a/applications/pelican/pelican-wings-mc-httproute.yaml b/applications/pelican/pelican-wings-mc-httproute.yaml index ac3434b..5707972 100644 --- a/applications/pelican/pelican-wings-mc-httproute.yaml +++ b/applications/pelican/pelican-wings-mc-httproute.yaml @@ -10,6 +10,11 @@ spec: name: gateway-internal namespace: envoy-gateway sectionName: wings-mc + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + namespace: envoy-gateway + sectionName: wings-mc hostnames: - "wings-mc.jsme.be" rules: diff --git a/infra/envoy-gateway/kustomization.yaml b/infra/envoy-gateway/kustomization.yaml index ecb5e98..f26816c 100644 --- a/infra/envoy-gateway/kustomization.yaml +++ b/infra/envoy-gateway/kustomization.yaml @@ -385,6 +385,20 @@ patches: kind: Gateway name: gateway-public path: pelican/pelican-gateway-public-patch.yaml + # wings must be public for the console websocket and file transfers: the + # browser talks to the node directly, never through the panel. + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: pelican/pelican-wings-mc-gateway-public-patch.yaml + - target: + group: gateway.networking.k8s.io + version: v1 + kind: Gateway + name: gateway-public + path: pelican/pelican-wings-ark-gateway-public-patch.yaml # Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first # - target: # group: gateway.networking.k8s.io diff --git a/infra/envoy-gateway/pelican/pelican-wings-ark-gateway-public-patch.yaml b/infra/envoy-gateway/pelican/pelican-wings-ark-gateway-public-patch.yaml new file mode 100644 index 0000000..928d483 --- /dev/null +++ b/infra/envoy-gateway/pelican/pelican-wings-ark-gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: wings-ark + protocol: HTTPS + port: 443 + hostname: "wings-ark.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: pelican + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: wings-ark-tls + namespace: envoy-gateway diff --git a/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml b/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml index 14f1c07..267a50d 100644 --- a/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml +++ b/infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml @@ -13,6 +13,14 @@ spec: kind: Gateway name: gateway-internal sectionName: wings-ark + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + sectionName: wings-mc + - group: gateway.networking.k8s.io + kind: Gateway + name: gateway-public + sectionName: wings-ark tls: # Wings only speaks HTTP/1.1; disabling h2 ALPN prevents Guzzle connection-reuse broken pipe alpnProtocols: diff --git a/infra/envoy-gateway/pelican/pelican-wings-mc-gateway-public-patch.yaml b/infra/envoy-gateway/pelican/pelican-wings-mc-gateway-public-patch.yaml new file mode 100644 index 0000000..c6de90b --- /dev/null +++ b/infra/envoy-gateway/pelican/pelican-wings-mc-gateway-public-patch.yaml @@ -0,0 +1,19 @@ +- op: add + path: /spec/listeners/- + value: + name: wings-mc + protocol: HTTPS + port: 443 + hostname: "wings-mc.jsme.be" + allowedRoutes: + namespaces: + from: Selector + selector: + matchLabels: + kubernetes.io/metadata.name: pelican + tls: + mode: Terminate + certificateRefs: + - kind: Secret + name: wings-mc-tls + namespace: envoy-gateway