Jeffrey/Kubernetes-Manifests
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Split manifests into infra/ and applications/

Browse Source
This commit is contained in:
Jeffrey
2026-06-21 12:14:38 +02:00
parent 64e8bf7d78
commit c40577589d
360 changed files with 69 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
infra/envoy-gateway/affine/affine-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: affine-tls
namespace: envoy-gateway
spec:
secretName: affine-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- affine.jsme.be

19
infra/envoy-gateway/affine/affine-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: affine
protocol: HTTPS
port: 443
hostname: "affine.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: affine
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: affine-tls
namespace: envoy-gateway

14
infra/envoy-gateway/argocd/argocd-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: argocd-tls
namespace: envoy-gateway
spec:
secretName: argocd-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- argocd.jsme.be

19
infra/envoy-gateway/argocd/argocd-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: argocd
protocol: HTTPS
port: 443
hostname: "argocd.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: argocd
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: argocd-tls
namespace: envoy-gateway

14
infra/envoy-gateway/authentik/authentik-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: authentik-tls
namespace: envoy-gateway
spec:
secretName: authentik-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- auth.jsme.be

19
infra/envoy-gateway/authentik/authentik-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: authentik
protocol: HTTPS
port: 443
hostname: "auth.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: authentik
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: authentik-tls
namespace: envoy-gateway

19
infra/envoy-gateway/authentik/authentik-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: authentik
protocol: HTTPS
port: 443
hostname: "auth.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: authentik
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: authentik-tls
namespace: envoy-gateway

14
infra/envoy-gateway/bentopdf/bentopdf-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: bentopdf-tls
namespace: envoy-gateway
spec:
secretName: bentopdf-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- pdf.jsme.be

19
infra/envoy-gateway/bentopdf/bentopdf-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: bentopdf
protocol: HTTPS
port: 443
hostname: "pdf.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: bentopdf
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: bentopdf-tls
namespace: envoy-gateway

19
infra/envoy-gateway/bentopdf/bentopdf-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: bentopdf
protocol: HTTPS
port: 443
hostname: "pdf.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: bentopdf
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: bentopdf-tls
namespace: envoy-gateway

21
infra/envoy-gateway/clientsettingspolicies.yaml Normal file
View File

@@ -0,0 +1,21 @@
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: gateway-internal-client-settings
namespace: envoy-gateway
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: gateway-internal
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: gateway-public-client-settings
namespace: envoy-gateway
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: gateway-public

14
infra/envoy-gateway/databasus/databasus-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: databasus-tls
namespace: envoy-gateway
spec:
secretName: databasus-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- databasus.jsme.be

19
infra/envoy-gateway/databasus/databasus-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: databasus
protocol: HTTPS
port: 443
hostname: "databasus.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: databasus
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: databasus-tls
namespace: envoy-gateway

14
infra/envoy-gateway/excalidraw/excalidraw-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: excalidraw-tls
namespace: envoy-gateway
spec:
secretName: excalidraw-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- draw.jsme.be

19
infra/envoy-gateway/excalidraw/excalidraw-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: excalidraw
protocol: HTTPS
port: 443
hostname: "draw.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: excalidraw
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: excalidraw-tls
namespace: envoy-gateway

19
infra/envoy-gateway/excalidraw/excalidraw-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: excalidraw
protocol: HTTPS
port: 443
hostname: "draw.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: excalidraw
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: excalidraw-tls
namespace: envoy-gateway

11
infra/envoy-gateway/gateway-public.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-public
namespace: envoy-gateway
spec:
gatewayClassName: eg
infrastructure:
annotations:
metallb.universe.tf/loadBalancerIPs: "10.8.11.105"
listeners: []

11
infra/envoy-gateway/gateway.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
name: gateway-internal
namespace: envoy-gateway
spec:
gatewayClassName: eg
infrastructure:
annotations:
metallb.universe.tf/loadBalancerIPs: "10.8.11.104"
listeners: []

14
infra/envoy-gateway/gitea/gitea-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: gitea-tls
namespace: envoy-gateway
spec:
secretName: gitea-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- gitea.jsme.be

19
infra/envoy-gateway/gitea/gitea-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: gitea
protocol: HTTPS
port: 443
hostname: "gitea.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: gitea
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gitea-tls
namespace: envoy-gateway

19
infra/envoy-gateway/gitea/gitea-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: gitea
protocol: HTTPS
port: 443
hostname: "gitea.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: gitea
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gitea-tls
namespace: envoy-gateway

14
infra/envoy-gateway/gotify/gotify-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: gotify-tls
namespace: envoy-gateway
spec:
secretName: gotify-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- gotify.jsme.be

19
infra/envoy-gateway/gotify/gotify-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: gotify
protocol: HTTPS
port: 443
hostname: "gotify.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: gotify
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gotify-tls
namespace: envoy-gateway

19
infra/envoy-gateway/gotify/gotify-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: gotify
protocol: HTTPS
port: 443
hostname: "gotify.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: gotify
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: gotify-tls
namespace: envoy-gateway

68
infra/envoy-gateway/httproute-template.yaml Normal file
View File

@@ -0,0 +1,68 @@
# =============================================================================
# PLACEHOLDERS:
# <SERVICE> - listener/route name (e.g. jellyfin)
# <NAMESPACE> - namespace the service runs in (e.g. jellyfin)
# <HOSTNAME> - full hostname (e.g. jellyfin.jsme.be)
# <BACKEND_SVC> - Kubernetes Service name (e.g. jellyfin)
# <BACKEND_PORT> - port the Service exposes (e.g. 8096)
# =============================================================================
# apiVersion: gateway.networking.k8s.io/v1
# kind: HTTPRoute
# metadata:
# name: <SERVICE>-route
# namespace: <NAMESPACE>
# spec:
# parentRefs:
# - group: gateway.networking.k8s.io
# kind: Gateway
# name: gateway-internal
# namespace: envoy-gateway
# sectionName: <SERVICE>
# # - group: gateway.networking.k8s.io # uncomment if publicly accessible
# # kind: Gateway
# # name: gateway-public
# # namespace: envoy-gateway
# # sectionName: <SERVICE>
# hostnames:
# - "<HOSTNAME>"
# rules:
# - filters:
# - type: RequestHeaderModifier
# requestHeaderModifier:
# set:
# - name: X-Forwarded-Host
# value: "<HOSTNAME>"
# - name: X-Forwarded-Proto
# value: https
# - type: ResponseHeaderModifier
# responseHeaderModifier:
# set:
# - name: Strict-Transport-Security
# value: "max-age=31536000; includeSubDomains"
# - name: X-Content-Type-Options
# value: nosniff
# - name: X-Frame-Options
# value: SAMEORIGIN
# - name: Referrer-Policy
# value: strict-origin-when-cross-origin
# - name: Permissions-Policy
# value: "camera=(), microphone=(), geolocation=(), payment=()"
# backendRefs:
# - name: <BACKEND_SVC>
# port: <BACKEND_PORT>
# kind: Service
# ---
# # Optional: only needed if you need to override body size limits
# # Remove this section if not needed
# apiVersion: gateway.nginx.org/v1alpha1
# kind: ClientSettingsPolicy
# metadata:
# name: <SERVICE>-client-settings
# namespace: <NAMESPACE>
# spec:
# targetRef:
# group: gateway.networking.k8s.io
# kind: HTTPRoute
# name: <SERVICE>-route
# body:
# maxSize: 100m # adjust as needed, use "0" for unlimited

14
infra/envoy-gateway/immich/immich-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: immich-tls
namespace: envoy-gateway
spec:
secretName: immich-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- photos.jsme.be

19
infra/envoy-gateway/immich/immich-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: immich
protocol: HTTPS
port: 443
hostname: "photos.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: immich
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: immich-tls
namespace: envoy-gateway

19
infra/envoy-gateway/immich/immich-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: immich
protocol: HTTPS
port: 443
hostname: "photos.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: immich
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: immich-tls
namespace: envoy-gateway

14
infra/envoy-gateway/infisical/infisical-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: infisical-tls
namespace: envoy-gateway
spec:
secretName: infisical-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- infisical.jsme.be

19
infra/envoy-gateway/infisical/infisical-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: infisical
protocol: HTTPS
port: 443
hostname: "infisical.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: infisical
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: infisical-tls
namespace: envoy-gateway

14
infra/envoy-gateway/it-tools/it-tools-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: it-tools-tls
namespace: envoy-gateway
spec:
secretName: it-tools-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- tools.jsme.be

19
infra/envoy-gateway/it-tools/it-tools-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: it-tools
protocol: HTTPS
port: 443
hostname: "tools.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: it-tools
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: it-tools-tls
namespace: envoy-gateway

19
infra/envoy-gateway/it-tools/it-tools-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: it-tools
protocol: HTTPS
port: 443
hostname: "tools.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: it-tools
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: it-tools-tls
namespace: envoy-gateway

14
infra/envoy-gateway/jellyfin/jellyfin-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: jellyfin-tls
namespace: envoy-gateway
spec:
secretName: jellyfin-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- jellyfin.jsme.be

19
infra/envoy-gateway/jellyfin/jellyfin-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: jellyfin
protocol: HTTPS
port: 443
hostname: "jellyfin.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: jellyfin
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: jellyfin-tls
namespace: envoy-gateway

19
infra/envoy-gateway/jellyfin/jellyfin-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: jellyfin
protocol: HTTPS
port: 443
hostname: "jellyfin.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: jellyfin
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: jellyfin-tls
namespace: envoy-gateway

14
infra/envoy-gateway/jenkins/jenkins-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: jenkins-tls
namespace: envoy-gateway
spec:
secretName: jenkins-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- jenkins.jsme.be

19
infra/envoy-gateway/jenkins/jenkins-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: jenkins
protocol: HTTPS
port: 443
hostname: "jenkins.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: jenkins
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: jenkins-tls
namespace: envoy-gateway

356
infra/envoy-gateway/kustomization.yaml Normal file
View File

@@ -0,0 +1,356 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- gateway.yaml
- gateway-public.yaml
# Policies
- pelican/pelican-wings-clienttrafficpolicy.yaml
- minio-aistor/minio-aistor-clienttrafficpolicy.yaml
- minio-aistor/minio-aistor-console-clienttrafficpolicy.yaml
# Certificates
- authentik/authentik-certificate.yaml
- argocd/argocd-certificate.yaml
- bentopdf/bentopdf-certificate.yaml
- gitea/gitea-certificate.yaml
- immich/immich-certificate.yaml
- infisical/infisical-certificate.yaml
- it-tools/it-tools-certificate.yaml
- jellyfin/jellyfin-certificate.yaml
- jenkins/jenkins-certificate.yaml
- longhorn/longhorn-certificate.yaml
- monitoring/monitoring-certificate.yaml
- n8n/n8n-certificate.yaml
- netbootxyz/netbootxyz-certificate.yaml
- passbolt/passbolt-certificate.yaml
- proxmox/proxmox-certificate.yaml
- resume/resume-certificate.yaml
- resume/resume-minio-certificate.yaml
- resume/resume-minio-webui-certificate.yaml
- minio-aistor/minio-aistor-api-certificate.yaml
- minio-aistor/minio-aistor-console-certificate.yaml
- technitium/technitium-certificate.yaml
- technitium/technitium-backup-certificate.yaml
- truenas/truenas-certificate.yaml
- unifi/unifi-certificate.yaml
- wikijs/wikijs-certificate.yaml
- zipline/zipline-certificate.yaml
- vaultwarden/vaultwarden-certificate.yaml
- databasus/databasus-certificate.yaml
- excalidraw/excalidraw-certificate.yaml
- gotify/gotify-certificate.yaml
- uptime-kuma/uptime-kuma-certificate.yaml
- ollama/ollama-certificate.yaml
- openwebui/openwebui-certificate.yaml
- searxng/searxng-certificate.yaml
- affine/affine-certificate.yaml
- pelican/pelican-certificate.yaml
- pelican/pelican-wings-certificate.yaml
patches:
# Internal gateway patches
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: authentik/authentik-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: argocd/argocd-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: gitea/gitea-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: immich/immich-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: infisical/infisical-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: jenkins/jenkins-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: longhorn/longhorn-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: n8n/n8n-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: netbootxyz/netbootxyz-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: resume/resume-minio-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: resume/resume-minio-webui-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: technitium/technitium-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: technitium/technitium-backup-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: unifi/unifi-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: proxmox/proxmox-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: truenas/truenas-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: monitoring/monitoring-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: bentopdf/bentopdf-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: it-tools/it-tools-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: jellyfin/jellyfin-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: passbolt/passbolt-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: resume/resume-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: wikijs/wikijs-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: zipline/zipline-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: minio-aistor/minio-aistor-api-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: minio-aistor/minio-aistor-console-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: vaultwarden/vaultwarden-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: databasus/databasus-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: excalidraw/excalidraw-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: gotify/gotify-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: uptime-kuma/uptime-kuma-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: ollama/ollama-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: openwebui/openwebui-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: searxng/searxng-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: affine/affine-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: pelican/pelican-gateway-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-internal
path: pelican/pelican-wings-gateway-patch.yaml
# Public gateway patches
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: gitea/gitea-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: authentik/authentik-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: bentopdf/bentopdf-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: it-tools/it-tools-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: jellyfin/jellyfin-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: immich/immich-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: passbolt/passbolt-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: resume/resume-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: wikijs/wikijs-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: zipline/zipline-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: excalidraw/excalidraw-gateway-public-patch.yaml
- target:
group: gateway.networking.k8s.io
version: v1
kind: Gateway
name: gateway-public
path: gotify/gotify-gateway-public-patch.yaml
# Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first
# - target:
# group: gateway.networking.k8s.io
# version: v1
# kind: Gateway
# name: gateway-public
# path: monitoring/monitoring-grafana-gateway-public-patch.yaml

14
infra/envoy-gateway/longhorn/longhorn-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: longhorn-tls
namespace: envoy-gateway
spec:
secretName: longhorn-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- longhorn.jsme.be

19
infra/envoy-gateway/longhorn/longhorn-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: longhorn
protocol: HTTPS
port: 443
hostname: "longhorn.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: longhorn-system
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: longhorn-tls
namespace: envoy-gateway

14
infra/envoy-gateway/minio-aistor/minio-aistor-api-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: minio-aistor-api-tls
namespace: envoy-gateway
spec:
secretName: minio-aistor-api-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- s3.jsme.be

19
infra/envoy-gateway/minio-aistor/minio-aistor-api-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: minio-aistor-api
protocol: HTTPS
port: 443
hostname: "s3.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: minio-aistor
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: minio-aistor-api-tls
namespace: envoy-gateway

15
infra/envoy-gateway/minio-aistor/minio-aistor-clienttrafficpolicy.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: minio-aistor-client-traffic
namespace: envoy-gateway
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: gateway-internal
sectionName: minio-aistor-api
timeout:
http:
requestReceivedTimeout: 0s
idleTimeout: 3600s

14
infra/envoy-gateway/minio-aistor/minio-aistor-console-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: minio-aistor-console-tls
namespace: envoy-gateway
spec:
secretName: minio-aistor-console-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- s3-console.jsme.be

15
infra/envoy-gateway/minio-aistor/minio-aistor-console-clienttrafficpolicy.yaml Normal file
View File

@@ -0,0 +1,15 @@
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: minio-aistor-console-client-traffic
namespace: envoy-gateway
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: gateway-internal
sectionName: minio-aistor-console
timeout:
http:
requestReceivedTimeout: 0s
idleTimeout: 3600s

19
infra/envoy-gateway/minio-aistor/minio-aistor-console-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: minio-aistor-console
protocol: HTTPS
port: 443
hostname: "s3-console.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: minio-aistor
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: minio-aistor-console-tls
namespace: envoy-gateway

44
infra/envoy-gateway/monitoring/monitoring-certificate.yaml Normal file
View File

@@ -0,0 +1,44 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: grafana-tls
namespace: envoy-gateway
spec:
secretName: grafana-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- grafana.jsme.be
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: vmagent-tls
namespace: envoy-gateway
spec:
secretName: vmagent-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- vmagent.jsme.be
---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: vmetrics-tls
namespace: envoy-gateway
spec:
secretName: vmetrics-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- vmetrics.jsme.be

57
infra/envoy-gateway/monitoring/monitoring-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,57 @@
- op: add
path: /spec/listeners/-
value:
name: grafana
protocol: HTTPS
port: 443
hostname: "grafana.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: victoria-metrics
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: grafana-tls
namespace: envoy-gateway
- op: add
path: /spec/listeners/-
value:
name: vmagent
protocol: HTTPS
port: 443
hostname: "vmagent.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: victoria-metrics
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: vmagent-tls
namespace: envoy-gateway
- op: add
path: /spec/listeners/-
value:
name: vmetrics
protocol: HTTPS
port: 443
hostname: "vmetrics.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: victoria-metrics
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: vmetrics-tls
namespace: envoy-gateway

19
infra/envoy-gateway/monitoring/monitoring-grafana-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: grafana
protocol: HTTPS
port: 443
hostname: "grafana.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: victoria-metrics
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: grafana-tls
namespace: envoy-gateway

14
infra/envoy-gateway/n8n/n8n-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: n8n-tls
namespace: envoy-gateway
spec:
secretName: n8n-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- n8n.jsme.be

19
infra/envoy-gateway/n8n/n8n-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: n8n
protocol: HTTPS
port: 443
hostname: "n8n.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: n8n
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: n8n-tls
namespace: envoy-gateway

14
infra/envoy-gateway/netbootxyz/netbootxyz-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: netbootxyz-tls
namespace: envoy-gateway
spec:
secretName: netbootxyz-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- netboot.jsme.be

19
infra/envoy-gateway/netbootxyz/netbootxyz-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: netbootxyz
protocol: HTTPS
port: 443
hostname: "netboot.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: netbootxyz
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: netbootxyz-tls
namespace: envoy-gateway

14
infra/envoy-gateway/ollama/ollama-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: ollama-tls
namespace: envoy-gateway
spec:
secretName: ollama-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- ollama.jsme.be

19
infra/envoy-gateway/ollama/ollama-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: ollama
protocol: HTTPS
port: 443
hostname: "ollama.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: ollama
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: ollama-tls
namespace: envoy-gateway

14
infra/envoy-gateway/openwebui/openwebui-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: forge-tls
namespace: envoy-gateway
spec:
secretName: forge-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- forge.jsme.be

19
infra/envoy-gateway/openwebui/openwebui-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: forge
protocol: HTTPS
port: 443
hostname: "forge.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: openwebui
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: forge-tls
namespace: envoy-gateway

14
infra/envoy-gateway/passbolt/passbolt-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: passbolt-tls
namespace: envoy-gateway
spec:
secretName: passbolt-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- passbolt.jsme.be

19
infra/envoy-gateway/passbolt/passbolt-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: passbolt
protocol: HTTPS
port: 443
hostname: "passbolt.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: passbolt
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: passbolt-tls
namespace: envoy-gateway

19
infra/envoy-gateway/passbolt/passbolt-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: passbolt
protocol: HTTPS
port: 443
hostname: "passbolt.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: passbolt
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: passbolt-tls
namespace: envoy-gateway

14
infra/envoy-gateway/pelican/pelican-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: pelican-tls
namespace: envoy-gateway
spec:
secretName: pelican-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- pelican.jsme.be

19
infra/envoy-gateway/pelican/pelican-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: pelican
protocol: HTTPS
port: 443
hostname: "pelican.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: pelican
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: pelican-tls
namespace: envoy-gateway

14
infra/envoy-gateway/pelican/pelican-wings-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wings-tls
namespace: envoy-gateway
spec:
secretName: wings-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- wings.jsme.be

19
infra/envoy-gateway/pelican/pelican-wings-clienttrafficpolicy.yaml Normal file
View File

@@ -0,0 +1,19 @@
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: wings-client-traffic
namespace: envoy-gateway
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: gateway-internal
sectionName: wings
tls:
# Wings only speaks HTTP/1.1; disabling h2 ALPN prevents Guzzle connection-reuse broken pipe
alpnProtocols:
- http/1.1
timeout:
http:
requestReceivedTimeout: 0s
idleTimeout: 3600s

19
infra/envoy-gateway/pelican/pelican-wings-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: wings
protocol: HTTPS
port: 443
hostname: "wings.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: pelican
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: wings-tls
namespace: envoy-gateway

14
infra/envoy-gateway/proxmox/proxmox-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: proxmox-tls
namespace: envoy-gateway
spec:
secretName: proxmox-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- proxmox.jsme.be

19
infra/envoy-gateway/proxmox/proxmox-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: proxmox
protocol: HTTPS
port: 443
hostname: "proxmox.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: proxmox
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: proxmox-tls
namespace: envoy-gateway

14
infra/envoy-gateway/resume/resume-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: resume-tls
namespace: envoy-gateway
spec:
secretName: resume-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- resume.jsme.be

19
infra/envoy-gateway/resume/resume-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: resume
protocol: HTTPS
port: 443
hostname: "resume.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: resume
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: resume-tls
namespace: envoy-gateway

19
infra/envoy-gateway/resume/resume-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: resume
protocol: HTTPS
port: 443
hostname: "resume.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: resume
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: resume-tls
namespace: envoy-gateway

14
infra/envoy-gateway/resume/resume-minio-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: minio-tls
namespace: envoy-gateway
spec:
secretName: minio-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- resume-minio.jsme.be

19
infra/envoy-gateway/resume/resume-minio-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: minio
protocol: HTTPS
port: 443
hostname: "resume-minio.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: resume
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: minio-tls
namespace: envoy-gateway

14
infra/envoy-gateway/resume/resume-minio-webui-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: minio-webui-tls
namespace: envoy-gateway
spec:
secretName: minio-webui-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- resume-minioweb.jsme.be

19
infra/envoy-gateway/resume/resume-minio-webui-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: minio-webui
protocol: HTTPS
port: 443
hostname: "resume-minioweb.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: resume
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: minio-webui-tls
namespace: envoy-gateway

14
infra/envoy-gateway/searxng/searxng-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: searxng-tls
namespace: envoy-gateway
spec:
secretName: searxng-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- search.jsme.be

19
infra/envoy-gateway/searxng/searxng-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: searxng
protocol: HTTPS
port: 443
hostname: "search.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: searxng
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: searxng-tls
namespace: envoy-gateway

19
infra/envoy-gateway/searxng/searxng-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: searxng
protocol: HTTPS
port: 443
hostname: "search.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: searxng
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: searxng-tls
namespace: envoy-gateway

14
infra/envoy-gateway/technitium/technitium-backup-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: technitium-backup-tls
namespace: envoy-gateway
spec:
secretName: technitium-backup-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- dns2.jsme.be

19
infra/envoy-gateway/technitium/technitium-backup-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: technitium-backup
protocol: HTTPS
port: 443
hostname: "dns2.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: technitium
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: technitium-backup-tls
namespace: envoy-gateway

14
infra/envoy-gateway/technitium/technitium-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: technitium-tls
namespace: envoy-gateway
spec:
secretName: technitium-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- dns1.jsme.be

19
infra/envoy-gateway/technitium/technitium-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: technitium
protocol: HTTPS
port: 443
hostname: "dns1.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: technitium
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: technitium-tls
namespace: envoy-gateway

14
infra/envoy-gateway/truenas/truenas-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: truenas-tls
namespace: envoy-gateway
spec:
secretName: truenas-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- truenas.jsme.be

19
infra/envoy-gateway/truenas/truenas-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: truenas
protocol: HTTPS
port: 443
hostname: "truenas.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: truenas
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: truenas-tls
namespace: envoy-gateway

14
infra/envoy-gateway/unifi/unifi-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: unifi-tls
namespace: envoy-gateway
spec:
secretName: unifi-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- unifi.jsme.be

19
infra/envoy-gateway/unifi/unifi-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: unifi
protocol: HTTPS
port: 443
hostname: "unifi.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: unifi
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: unifi-tls
namespace: envoy-gateway

14
infra/envoy-gateway/uptime-kuma/uptime-kuma-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: uptime-kuma-tls
namespace: envoy-gateway
spec:
secretName: uptime-kuma-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- status.jsme.be

19
infra/envoy-gateway/uptime-kuma/uptime-kuma-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: uptime-kuma
protocol: HTTPS
port: 443
hostname: "status.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: uptime-kuma
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: uptime-kuma-tls
namespace: envoy-gateway

14
infra/envoy-gateway/vaultwarden/vaultwarden-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: vaultwarden-tls
namespace: envoy-gateway
spec:
secretName: vaultwarden-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- vault.jsme.be

19
infra/envoy-gateway/vaultwarden/vaultwarden-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: vaultwarden
protocol: HTTPS
port: 443
hostname: "vault.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: vaultwarden
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: vaultwarden-tls
namespace: envoy-gateway

14
infra/envoy-gateway/wikijs/wikijs-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: wikijs-tls
namespace: envoy-gateway
spec:
secretName: wikijs-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- wiki.jsme.be

19
infra/envoy-gateway/wikijs/wikijs-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: wikijs
protocol: HTTPS
port: 443
hostname: "wiki.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: wiki
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: wikijs-tls
namespace: envoy-gateway

19
infra/envoy-gateway/wikijs/wikijs-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: wikijs
protocol: HTTPS
port: 443
hostname: "wiki.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: wiki
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: wikijs-tls
namespace: envoy-gateway

14
infra/envoy-gateway/zipline/zipline-certificate.yaml Normal file
View File

@@ -0,0 +1,14 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: zipline-tls
namespace: envoy-gateway
spec:
secretName: zipline-tls
privateKey:
rotationPolicy: Always
issuerRef:
name: azure-dns
kind: ClusterIssuer
dnsNames:
- share.jsme.be

19
infra/envoy-gateway/zipline/zipline-gateway-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: zipline
protocol: HTTPS
port: 443
hostname: "share.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: zipline
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: zipline-tls
namespace: envoy-gateway

19
infra/envoy-gateway/zipline/zipline-gateway-public-patch.yaml Normal file
View File

@@ -0,0 +1,19 @@
- op: add
path: /spec/listeners/-
value:
name: zipline
protocol: HTTPS
port: 443
hostname: "share.jsme.be"
allowedRoutes:
namespaces:
from: Selector
selector:
matchLabels:
kubernetes.io/metadata.name: zipline
tls:
mode: Terminate
certificateRefs:
- kind: Secret
name: zipline-tls
namespace: envoy-gateway