Rework networking

helm/wildcard-certificate/chart/Chart.yaml → helm/dns01-certificate/chart/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
-name: wildcard-certificate
-description: Wildcard Certificate
+name: dns01-certificate
+description: DNS01 Certificate
 
 # A chart can be either an 'application' or a 'library' chart.
 #

helm/wildcard-certificate/chart/templates/wildcard-certificate.yaml → helm/dns01-certificate/chart/templates/dns01-certificate.yaml

@@ -10,8 +10,9 @@ spec:
     kind: ClusterIssuer
   commonName: {{ .Values.domain }}
   dnsNames:
-    - {{ .Values.domain }}
-    - "*.{{ .Values.domain }}"
+    {{- range .Values.dnsNameTemplates }}
+      - {{ tpl . $ | quote }}
+    {{- end }}
   secretTemplate:
     annotations:
     {{- if .Values.reflectNamespaces }}

helm/gateway-config/chart/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

helm/gateway-config/chart/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: gateway-config
+description: Gateway Configuration
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "0.1.0"

helm/gateway-config/chart/templates/gateway-class.yaml

@@ -0,0 +1,6 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: envoy
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller

helm/gateway-config/chart/templates/gateway.yaml

@@ -0,0 +1,27 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: {{ .Values.name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  gatewayClassName: envoy
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+
+    - name: https
+      protocol: HTTPS
+      port: 443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            group: ""
+            name: {{ .Values.certificateName }}
+      allowedRoutes:
+        namespaces:
+          from: All

helm/gateway-config/chart/templates/http-to-https.yaml

@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-to-https
+  namespace: {{ .Release.Namespace }}
+spec:
+  parentRefs:
+    - name: {{ .Values.name }}
+      sectionName: http
+  rules:
+    - filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 308

helm/gateway-config/chart/values.yaml

@@ -0,0 +1,2 @@
+name: gateway
+certificateName: wildcard-certificate

helm/gitlab/values.yaml

@@ -14,14 +14,18 @@ global:
       name: ${registry_host}.${domain}
     pages:
       name: ${pages_host}.${domain}
-      https: false
 
-  ingress:
+  gatewayApi:
+    enabled: true
+    installEnvoy: false
     configureCertmanager: false
-    class: nginx
-    tls:
-      enabled: true
-      secretName: "wildcard-certificate"
+    gatewayClass: envoy
+    gateway:
+      name: gateway
+      namespace: envoy-gateway-system
+
+  ingress:
+    enabled: false
 
   psql:
     host: ${postgres_host}

helm/kube-prometheus-stack/values.yaml

@@ -1,12 +1,14 @@
 grafana:
   ingress:
-    enabled: true
-    hosts:
-      - ${grafana_host}.${domain}
-    tls:
-      - secretName: wildcard-certificate
-        hosts:
-          - ${grafana_host}.${domain}
+    enabled: false
+  route:
+    main:
+      enabled: true
+      hostnames:
+        - ${grafana_host}.${domain}
+      parentRefs:
+        - name: gateway
+          namespace: envoy-gateway-system
 
 prometheus:
   prometheusSpec:

terraform/dns.tf

@@ -1,5 +1,5 @@
 locals {
-    lb_ip = try(data.kubernetes_service_v1.ingress_nginx.status[0].load_balancer[0].ingress[0].ip, null)
+    lb_ip = try(data.kubernetes_service_v1.envoy_gateway.status[0].load_balancer[0].ingress[0].ip, null)
     records = toset([
         var.gitlab_host, var.registry_host, "*.${var.pages_host}", var.grafana_host
     ])

terraform/helm.tf

@@ -50,22 +50,44 @@ resource "helm_release" "cluster_issuer" {
     depends_on = [helm_release.cert_manager]
 }
 
-resource "helm_release" "wildcard_certificate" {
-    name = "wildcard-certificate"
-    namespace = kubernetes_namespace_v1.cert_manager.metadata[0].name
-    chart = "${path.module}/../helm/wildcard-certificate/chart"
+resource "helm_release" "dns01_certificate" {
+    name = "dns01-certificate"
+    namespace = kubernetes_namespace_v1.envoy_gateway_system.metadata[0].name
+    chart = "${path.module}/../helm/dns01-certificate/chart"
 
     values = [
-        templatefile("${path.module}/../helm/wildcard-certificate/values.yaml", 
-        {
+        yamlencode({
             domain = var.domain_name
+            dnsNameTemplates = [
+                "{{ .Values.domain }}",
+                "*.{{ .Values.domain }}",
+                "*.pages.{{ .Values.domain }}"
+            ]
             reflectNamespaces = "${kubernetes_namespace_v1.gitlab.metadata[0].name},${kubernetes_namespace_v1.monitoring.metadata[0].name}"
         })
     ]
 
     depends_on = [helm_release.cert_manager, helm_release.cluster_issuer, helm_release.reflector]
 }
 
+resource "helm_release" "envoy_gateway" {
+    name = "eg"
+    namespace = kubernetes_namespace_v1.envoy_gateway_system.metadata[0].name
+    chart = "${path.module}/../helm/gateway-config/chart"
+
+    wait = true
+
+    depends_on = [ helm_release.cert_manager, helm_release.dns01_certificate ]
+}
+
+resource "helm_release" "gateway_config" {
+    name = "gateway-config"
+    namespace = kubernetes_namespace_v1.envoy_gateway_system.metadata[0].name
+    repository = "oci://docker.io/envoyproxy/gateway-helm"
+    chart = "gateway-helm"
+    version = "1.7.2"
+}
+
 resource "helm_release" "ingress_nginx" {
     name = "ingress-nginx"
     namespace = kubernetes_namespace_v1.ingress_nginx.metadata[0].name
@@ -113,10 +135,12 @@ resource "helm_release" "gitlab" {
         digitalocean_database_connection_pool.main,
         digitalocean_database_cluster.valkey,
         helm_release.cert_manager,
-        helm_release.wildcard_certificate,
+        helm_release.dns01_certificate,
         helm_release.reflector,
         helm_release.cluster_issuer,
         helm_release.ingress_nginx,
+        helm_release.envoy_gateway,
+        helm_release.gateway_config,
         digitalocean_record.main,
         kubernetes_secret_v1.gitlab_initial_root_password,
         kubernetes_secret_v1.gitlab_postgres,
@@ -140,4 +164,6 @@ resource "helm_release" "kube_prometheus_stack" {
             domain = var.domain_name
         })
     ]
+
+    depends_on = [ helm_release.envoy_gateway ]
 }