pelican: expose wings-mc and wings-ark on the public gateway

The console will not work from outside without this. WebsocketController hands
the browser wss://<node fqdn>:443/api/servers/<uuid>/ws built from
Node::getConnectionAddress(), so the browser talks to wings directly and never
through the panel. Same for file upload and download, which FileUploadController
builds from the same address. Everything else (login, server list, file
browsing, power actions, sending console commands) already worked publicly,
because those go through the panel API.

Adds public listeners for both nodes reusing the existing wings-mc-tls and
wings-ark-tls certificates, and a gateway-public parentRef on each route.

Extends the wings ClientTrafficPolicy to the two new listeners. Without it the
public listeners would negotiate h2 and long-lived consoles would drop: wings
only speaks HTTP/1.1, and the idle timeout needs to be 3600s rather than the
default.

CrowdSec ext_authz already covers every listener on gateway-public, so both
nodes are behind the WAF and community blocklist from the moment they are live.
Wings itself is JWT-gated and returns 401 unauthenticated.

applications/pelican/pelican-wings-ark-httproute.yaml

@@ -10,6 +10,11 @@ spec:
       name: gateway-internal
       namespace: envoy-gateway
       sectionName: wings-ark
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: wings-ark
   hostnames:
     - "wings-ark.jsme.be"
   rules:

applications/pelican/pelican-wings-mc-httproute.yaml

@@ -10,6 +10,11 @@ spec:
       name: gateway-internal
       namespace: envoy-gateway
       sectionName: wings-mc
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: wings-mc
   hostnames:
     - "wings-mc.jsme.be"
   rules:

infra/envoy-gateway/kustomization.yaml

@@ -385,6 +385,20 @@ patches:
       kind: Gateway
       name: gateway-public
     path: pelican/pelican-gateway-public-patch.yaml
+  # wings must be public for the console websocket and file transfers: the
+  # browser talks to the node directly, never through the panel.
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: pelican/pelican-wings-mc-gateway-public-patch.yaml
+  - target:
+      group: gateway.networking.k8s.io
+      version: v1
+      kind: Gateway
+      name: gateway-public
+    path: pelican/pelican-wings-ark-gateway-public-patch.yaml
   # Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first
   # - target:
   #     group: gateway.networking.k8s.io

infra/envoy-gateway/pelican/pelican-wings-ark-gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: wings-ark
+    protocol: HTTPS
+    port: 443
+    hostname: "wings-ark.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: pelican
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: wings-ark-tls
+          namespace: envoy-gateway

infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml

@@ -13,6 +13,14 @@ spec:
       kind: Gateway
       name: gateway-internal
       sectionName: wings-ark
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      sectionName: wings-mc
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      sectionName: wings-ark
   tls:
     # Wings only speaks HTTP/1.1; disabling h2 ALPN prevents Guzzle connection-reuse broken pipe
     alpnProtocols:

infra/envoy-gateway/pelican/pelican-wings-mc-gateway-public-patch.yaml

@@ -0,0 +1,19 @@
+- op: add
+  path: /spec/listeners/-
+  value:
+    name: wings-mc
+    protocol: HTTPS
+    port: 443
+    hostname: "wings-mc.jsme.be"
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            kubernetes.io/metadata.name: pelican
+    tls:
+      mode: Terminate
+      certificateRefs:
+        - kind: Secret
+          name: wings-mc-tls
+          namespace: envoy-gateway