feat: use gateway-api (#349)

volschin · Jul 26, 2024 · 70824cc · 70824cc
1 parent 91003df
commit 70824cc
Show file tree

Hide file tree

Showing 6 changed files with 133 additions and 1 deletion.
diff --git a/kubernetes/apps/kube-system/cilium/app/helm-values.yaml b/kubernetes/apps/kube-system/cilium/app/helm-values.yaml
@@ -35,7 +35,7 @@ gatewayAPI:
   enabled: true
 loadBalancer:
   algorithm: maglev
-  mode: hybrid
+  mode: dsr
 localRedirectPolicy: true
 operator:
   replicas: 1
@@ -45,6 +45,8 @@ routingMode: native
 securityContext:
   capabilities:
     ciliumAgent:
+      - PERFMON
+      - BPF
       - CHOWN
       - KILL
       - NET_ADMIN

diff --git a/kubernetes/apps/network/gateway/cilium/gateway-infrastructure.yaml b/kubernetes/apps/network/gateway/cilium/gateway-infrastructure.yaml
@@ -0,0 +1,77 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: cilium
+spec:
+  controllerName: io.cilium/gateway-controller
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: cilium-external
+  namespace: networking
+  annotations:
+    external-dns.alpha.kubernetes.io/target: gateway.${SECRET_DOMAIN}
+spec:
+  gatewayClassName: cilium
+  infrastructure:
+    annotations:
+      io.cilium/lb-ipam-ips: 192.168.2.20
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*."
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: "*.${SECRET_DOMAIN}"
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: wildcard-cert-tls
+  # TODO: Not yet supported - https://github.com/cilium/cilium/issues/21926
+  # addresses:
+  #   - type: IPAddress
+  #     value: "192.168.2.20"
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: cilium-internal
+  namespace: networking
+spec:
+  gatewayClassName: cilium
+  infrastructure:
+    annotations:
+      io.cilium/lb-ipam-ips: 192.168.2.21
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.${SECRET_DOMAIN}"
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: "*.${SECRET_DOMAIN}"
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: wildcard-cert-tls
+  # Not yet supported - https://github.com/cilium/cilium/issues/21926
+  # addresses:
+  #   - type: IPAddress
+  #     value: "192.168.2.21"
diff --git a/kubernetes/apps/network/gateway/cilium/kustomization.yaml b/kubernetes/apps/network/gateway/cilium/kustomization.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./gateway-infrastructure.yaml
diff --git a/kubernetes/apps/network/gateway/gateway-api/kustomization.yaml b/kubernetes/apps/network/gateway/gateway-api/kustomization.yaml
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # renovate: datasource=github-releases depName=kubernetes-sigs/gateway-api
+  - https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.1.0/experimental-install.yaml
diff --git a/kubernetes/apps/network/gateway/ks.yaml b/kubernetes/apps/network/gateway/ks.yaml
@@ -0,0 +1,40 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cilium-gateway
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/network/gateway/cilium
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 60m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app gateway-api-crds
+  namespace: flux-system
+spec:
+  targetNamespace: network
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: "./kubernetes/apps/network/gateway/gateway-api"
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 60m
+  retryInterval: 1m
+  timeout: 5m
diff --git a/kubernetes/apps/network/kustomization.yaml b/kubernetes/apps/network/kustomization.yaml
@@ -5,5 +5,6 @@ resources:
   - ./namespace.yaml
   - ./cloudflared/ks.yaml
   - ./external-dns/ks.yaml
+  - ./gateway/ks.yaml
   - ./ingress-nginx/ks.yaml
   - ./k8s-gateway/ks.yaml