632ad1d507
All checks were successful
__APP_NAME__ — build & deploy / ¿Credenciales de build listas? (push) Successful in 1s
__APP_NAME__ — build & deploy / Calidad + build + push (push) Has been skipped
__APP_NAME__ — build & deploy / ¿Cluster del tenant listo? (push) Has been skipped
__APP_NAME__ — build & deploy / Helm upgrade --install (push) Has been skipped
Sincronizado desde repo IDP templates/ (CHART-SYNC-IDP-GITEA-DRIFT). Reemplaza el Ingress (rke2-ingress-nginx, EOL marzo 2026) por HTTPRoute (Gateway API) adjunto al Gateway tenant-gateway que crea stack-deployer (§3c). NetworkPolicy egress kube-system -> traefik-system. FQDN DOT (ADR-082) preservado. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
38 lines
1.5 KiB
YAML
38 lines
1.5 KiB
YAML
{{- if .Values.httpRoute.enabled }}
|
|
# HTTPRoute (gateway.networking.k8s.io/v1) — ADR-060 Fase 1.
|
|
# El cluster tenant usa Traefik Proxy + Gateway API (reemplaza rke2-ingress-nginx,
|
|
# EOL marzo 2026, sin parches de seguridad). El recurso `Gateway` `tenant-gateway`
|
|
# (ns apps) lo crea stack-deployer por tenant (ADR-060 D7 / §3c de su spec); este
|
|
# HTTPRoute se le adjunta vía parentRefs.
|
|
#
|
|
# Lo que NO vive aquí (separación de capas — ADR-060 D6):
|
|
# - TLS: lo termina el listener HTTPS del Gateway, que referencia el Secret
|
|
# `tenant-wildcard-tls` (cert-manager local del cluster, ADR-060 Fase 2). El
|
|
# HTTPRoute solo declara el hostname.
|
|
# - force-ssl-redirect (HTTP->HTTPS): config global de Traefik Proxy
|
|
# (ports.web.redirectTo.websecure) en el bundle traefik-bootstrap.
|
|
# - proxy-body-size: config global de Traefik (transport); Middleware per-route
|
|
# solo si se necesita granularidad futura.
|
|
apiVersion: gateway.networking.k8s.io/v1
|
|
kind: HTTPRoute
|
|
metadata:
|
|
name: {{ .Release.Name }}
|
|
labels:
|
|
{{- include "app.labels" . | nindent 4 }}
|
|
spec:
|
|
parentRefs:
|
|
- name: {{ .Values.httpRoute.gatewayName | default "tenant-gateway" }}
|
|
namespace: {{ .Release.Namespace }}
|
|
sectionName: https
|
|
hostnames:
|
|
- {{ .Values.httpRoute.host | quote }}
|
|
rules:
|
|
- matches:
|
|
- path:
|
|
type: PathPrefix
|
|
value: /
|
|
backendRefs:
|
|
- name: {{ .Release.Name }}
|
|
port: {{ .Values.service.port }}
|
|
{{- end }}
|