JeffreyandClaude Opus 5
964ace4986
Adds the LDAP outpost deployment and routes ports 389 and 636 on gateway-internal to it. 636 is a TLS listener in Terminate mode so cert-manager renews the LDAPS certificate automatically, and both listeners forward to the outpost's plaintext 3389. allowedRoutes.kinds is set explicitly on both listeners: a TCP listener permits no route kinds by default and a TLS listener defaults to TLSRoute, so the TCPRoute would not attach otherwise. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
415 lines
12 KiB
YAML
415 lines
12 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
# ORPHANED LISTENERS, commented out 2026-08-26. Each of these had a Gateway
|
|
# listener and a TLS cert but ZERO attached routes, because the app is either in
|
|
# deprecated/ (vaultwarden, affine, resume-minio*) or written but never deployed
|
|
# (n8n, wikijs, ollama, openwebui). wiki.jsme.be was one of these on the PUBLIC
|
|
# gateway. Uncomment the pair (certificate + patch) when actually deploying the app.
|
|
|
|
resources:
|
|
- envoy-gateway-namespace.yaml
|
|
- gateway.yaml
|
|
- gateway-public.yaml
|
|
|
|
# CrowdSec ext_authz on the whole public gateway (sectionName scoping is
|
|
# unsupported on EG v1.3.2; envoyproxy-public.yaml is not needed, see its header)
|
|
- crowdsec/gateway-public-securitypolicy.yaml
|
|
|
|
# Policies
|
|
- pelican/pelican-wings-clienttrafficpolicy.yaml
|
|
- minio-aistor/minio-aistor-clienttrafficpolicy.yaml
|
|
- minio-aistor/minio-aistor-console-clienttrafficpolicy.yaml
|
|
|
|
# Certificates
|
|
- authentik/authentik-certificate.yaml
|
|
- authentik/authentik-ldap-certificate.yaml
|
|
- argocd/argocd-certificate.yaml
|
|
- bentopdf/bentopdf-certificate.yaml
|
|
- gitea/gitea-certificate.yaml
|
|
- immich/immich-certificate.yaml
|
|
- infisical/infisical-certificate.yaml
|
|
- it-tools/it-tools-certificate.yaml
|
|
- jellyfin/jellyfin-certificate.yaml
|
|
- longhorn/longhorn-certificate.yaml
|
|
- monitoring/monitoring-certificate.yaml
|
|
# - n8n/n8n-certificate.yaml
|
|
- netbootxyz/netbootxyz-certificate.yaml
|
|
- passbolt/passbolt-certificate.yaml
|
|
- proxmox/proxmox-certificate.yaml
|
|
- resume/resume-certificate.yaml
|
|
# - resume/resume-minio-certificate.yaml
|
|
# - resume/resume-minio-webui-certificate.yaml
|
|
- minio-aistor/minio-aistor-api-certificate.yaml
|
|
- minio-aistor/minio-aistor-console-certificate.yaml
|
|
- technitium/technitium-certificate.yaml
|
|
- technitium/technitium-backup-certificate.yaml
|
|
- truenas/truenas-certificate.yaml
|
|
- unifi/unifi-certificate.yaml
|
|
# - wikijs/wikijs-certificate.yaml
|
|
- zipline/zipline-certificate.yaml
|
|
# - vaultwarden/vaultwarden-certificate.yaml
|
|
- databasus/databasus-certificate.yaml
|
|
- excalidraw/excalidraw-certificate.yaml
|
|
- gotify/gotify-certificate.yaml
|
|
- uptime-kuma/uptime-kuma-certificate.yaml
|
|
# - ollama/ollama-certificate.yaml
|
|
# - openwebui/openwebui-certificate.yaml
|
|
- searxng/searxng-certificate.yaml
|
|
# - affine/affine-certificate.yaml
|
|
- pelican/pelican-certificate.yaml
|
|
- pelican/pelican-wings-mc-certificate.yaml
|
|
- pelican/pelican-wings-ark-certificate.yaml
|
|
- outline/outline-certificate.yaml
|
|
- netbox/netbox-certificate.yaml
|
|
|
|
patches:
|
|
# Internal gateway patches
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: authentik/authentik-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: authentik/authentik-ldap-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: argocd/argocd-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: gitea/gitea-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: immich/immich-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: infisical/infisical-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: longhorn/longhorn-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: n8n/n8n-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: netbootxyz/netbootxyz-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: resume/resume-minio-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: resume/resume-minio-webui-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: technitium/technitium-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: technitium/technitium-backup-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: unifi/unifi-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: proxmox/proxmox-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: truenas/truenas-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: monitoring/monitoring-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: bentopdf/bentopdf-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: it-tools/it-tools-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: jellyfin/jellyfin-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: passbolt/passbolt-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: resume/resume-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: wikijs/wikijs-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: zipline/zipline-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: minio-aistor/minio-aistor-api-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: minio-aistor/minio-aistor-console-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: vaultwarden/vaultwarden-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: databasus/databasus-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: excalidraw/excalidraw-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: gotify/gotify-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: uptime-kuma/uptime-kuma-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: ollama/ollama-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: openwebui/openwebui-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: searxng/searxng-gateway-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-internal
|
|
# path: affine/affine-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: pelican/pelican-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: pelican/pelican-wings-mc-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: pelican/pelican-wings-ark-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: outline/outline-gateway-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-internal
|
|
path: netbox/netbox-gateway-patch.yaml
|
|
|
|
# Public gateway patches
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: gitea/gitea-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: authentik/authentik-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: bentopdf/bentopdf-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: it-tools/it-tools-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: jellyfin/jellyfin-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: immich/immich-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: passbolt/passbolt-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: resume/resume-gateway-public-patch.yaml
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-public
|
|
# path: wikijs/wikijs-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: zipline/zipline-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: excalidraw/excalidraw-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: gotify/gotify-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: outline/outline-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: pelican/pelican-gateway-public-patch.yaml
|
|
# wings must be public for the console websocket and file transfers: the
|
|
# browser talks to the node directly, never through the panel.
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: pelican/pelican-wings-mc-gateway-public-patch.yaml
|
|
- target:
|
|
group: gateway.networking.k8s.io
|
|
version: v1
|
|
kind: Gateway
|
|
name: gateway-public
|
|
path: pelican/pelican-wings-ark-gateway-public-patch.yaml
|
|
# Uncomment to expose Grafana publicly — ensure Grafana auth is properly configured first
|
|
# - target:
|
|
# group: gateway.networking.k8s.io
|
|
# version: v1
|
|
# kind: Gateway
|
|
# name: gateway-public
|
|
# path: monitoring/monitoring-grafana-gateway-public-patch.yaml
|