commit fa9428a7bcf235c69ff3eb8da3cb18884ad4d3dc
parent 315257322fec128d9dd8a77e1b4568253216a523
Author: MTRNord <mtrnord1@gmail.com>
Date: Wed, 19 Mar 2025 19:13:08 +0100
Migrate gerrit
Diffstat:
3 files changed, 106 insertions(+), 77 deletions(-)
diff --git a/apps/base/authentik/ingress.yaml b/apps/base/authentik/ingress.yaml
@@ -1,4 +1,3 @@
----
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
@@ -13,5 +12,5 @@ spec:
sectionName: ldap
rules:
- backendRefs:
- - name: ak-outpost-ldap
- port: 389
+ - name: ak-outpost-ldap
+ port: 389
diff --git a/apps/base/envoy-gateway/release.yaml b/apps/base/envoy-gateway/release.yaml
@@ -394,6 +394,18 @@ spec:
certificateRefs:
- kind: Secret
name: jenkins.midnightthoughts.space-tls
+ - name: https-midnightthoughts-gerrit
+ protocol: HTTPS
+ hostname: "gerrit.midnightthoughts.space"
+ port: 443
+ allowedRoutes:
+ namespaces:
+ from: "All"
+ tls:
+ mode: Terminate
+ certificateRefs:
+ - kind: Secret
+ name: gerrit.midnightthoughts.space-tls
- name: https-nordgedanken-root
protocol: HTTPS
hostname: "nordgedanken.dev"
@@ -468,7 +480,7 @@ spec:
- kind: TCPRoute
namespaces:
from: All
- - name: ssh
+ - name: gerrit-ssh
protocol: TCP
port: 29418
allowedRoutes:
diff --git a/apps/base/gerrit/ingress.yaml b/apps/base/gerrit/ingress.yaml
@@ -1,92 +1,110 @@
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
metadata:
- name: gerrit-403
+ name: gerrit-ingress
namespace: gerrit
spec:
- ipAllowList:
- sourceRange:
- - 127.0.0.1/32
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - gerrit.midnightthoughts.space
+ rules:
+ - backendRefs:
+ - name: gerrit-replica-service
+ port: 80
+ matches:
+ - path:
+ value: /.*/git-upload-pack
+ type: RegularExpression
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+ - backendRefs:
+ - name: gerrit-service
+ port: 80
+ matches:
+ - path:
+ value: /
+ type: PathPrefix
+ timeouts:
+ request: 240s
+ backendRequest: 0s
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
metadata:
- annotations:
- nginx.ingress.kubernetes.io/affinity: cookie
- nginx.ingress.kubernetes.io/session-cookie-expires: "3600"
- nginx.ingress.kubernetes.io/session-cookie-max-age: "3600"
- nginx.ingress.kubernetes.io/session-cookie-name: Gerrit_Session
- nginx.ingress.kubernetes.io/session-cookie-path: /
- traefik.ingress.kubernetes.io/router.pathmatcher: PathRegexp
- labels:
- app.kubernetes.io/component: gerrit-ingress
- app.kubernetes.io/instance: gerrit-gerrit-network
- app.kubernetes.io/part-of: gerrit-gerrit-network
- name: gerrit-ingress
+ name: gerrit-ingress-cookie-policy
namespace: gerrit
spec:
- rules:
- - host: gerrit.midnightthoughts.space
- http:
- paths:
- - backend:
- service:
- name: gerrit-replica-service
- port:
- name: http
- path: /.*/git-upload-pack
- pathType: ImplementationSpecific
- - backend:
- service:
- name: gerrit-service
- port:
- name: http
- path: /
- pathType: Prefix
- tls:
- - hosts:
- - gerrit.midnightthoughts.space
- secretName: gerrit.midnightthoughts.space-tls
+ targetRefs:
+ - group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: gerrit-ingress
+ loadBalancer:
+ type: ConsistentHash
+ consistentHash:
+ type: Cookie
+ cookie:
+ name: Gerrit_Session
+ ttl: 3600s
+ attributes:
+ SameSite: Strict
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
metadata:
- annotations:
- traefik.ingress.kubernetes.io/router.middlewares: gerrit-gerrit-403@kubernetescrd
- traefik.ingress.kubernetes.io/router.pathmatcher: PathRegexp
- labels:
- app.kubernetes.io/component: gerrit-ingress-403
- app.kubernetes.io/instance: gerrit-gerrit-network
- app.kubernetes.io/part-of: gerrit-gerrit-network
- name: gerrit-ingress-403
+ name: gerrit-403
namespace: gerrit
spec:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ hostnames:
+ - gerrit.midnightthoughts.space
rules:
- - host: gerrit.midnightthoughts.space
- http:
- paths:
- - backend:
- service:
- name: gerrit-replica-service
- port:
- name: http
- path: /(a)?/plugins/high-availability/.*
- pathType: ImplementationSpecific
- tls:
- - hosts:
- - gerrit.midnightthoughts.space
- secretName: gerrit.midnightthoughts.space-tls
+ - backendRefs:
+ - name: gerrit-replica-service
+ port: 80
+ matches:
+ - path:
+ value: /(a)?/plugins/high-availability/.*
+ type: RegularExpression
+ timeouts:
+ request: 240s
+ backendRequest: 0s
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+ name: gerrit-403
+ namespace: gerrit
+spec:
+ targetRefs:
+ - group: gateway.networking.k8s.io
+ kind: HTTPRoute
+ name: gerrit-403
+ authorization:
+ defaultAction: Deny
+ rules:
+ - action: Allow
+ principal:
+ clientCIDRs:
+ - 127.0.0.1/32
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRouteTCP
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
metadata:
name: gerrit-ssh
namespace: gerrit
+ annotations:
+ external-dns.alpha.kubernetes.io/hostname: ldap.midnightthoughts.space
spec:
- entryPoints:
- - gerrit-ssh
- routes:
- - match: HostSNI(`*`)
- services:
+ parentRefs:
+ - name: envoy-gateway
+ namespace: envoy-gateway
+ sectionName: gerrit-ssh
+ rules:
+ - backendRefs:
- name: gerrit-service
port: 29418
