kubernetes/apps/network/envoy-gateway/app/envoy.yaml
1
---
2
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.envoyproxy.io/envoyproxy_v1alpha1.json
3
apiVersion: gateway.envoyproxy.io/v1alpha1
4
kind: EnvoyProxy
5
metadata:
6
name: envoy
7
spec:
8
logging:
9
level:
10
default: info
11
provider:
12
type: Kubernetes
13
kubernetes:
14
envoyDeployment:
15
replicas: 2
16
container:
17
image: mirror.gcr.io/envoyproxy/envoy:v1.39.1
18
resources:
19
requests:
20
cpu: 10m
21
memory: 96Mi
22
limits:
23
memory: 160Mi
24
patch:
25
type: StrategicMerge
26
value:
27
spec:
28
template:
29
spec:
30
containers:
31
- name: shutdown-manager
32
requests:
33
cpu: 10m
34
memory: 32Mi
35
limits:
36
memory: 128Mi
37
envoyService:
38
externalTrafficPolicy: Cluster
39
shutdown:
40
drainTimeout: 180s
41
telemetry:
42
metrics:
43
prometheus:
44
compression:
45
type: Zstd
46
---
47
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.networking.k8s.io/gatewayclass_v1.json
48
apiVersion: gateway.networking.k8s.io/v1
49
kind: GatewayClass
50
metadata:
51
name: envoy
52
spec:
53
controllerName: gateway.envoyproxy.io/gatewayclass-controller
54
parametersRef:
55
group: gateway.envoyproxy.io
56
kind: EnvoyProxy
57
name: envoy
58
namespace: network
59
---
60
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.networking.k8s.io/gateway_v1.json
61
apiVersion: gateway.networking.k8s.io/v1
62
kind: Gateway
63
metadata:
64
name: envoy-external
65
annotations:
66
external-dns.alpha.kubernetes.io/target: &hostname external.janpuc.com
67
gatus.home-operations.com/endpoint: |-
68
client:
69
dns-resolver: tcp://1.1.1.1:53
70
group: external
71
spec:
72
gatewayClassName: envoy
73
infrastructure:
74
annotations:
75
external-dns.alpha.kubernetes.io/hostname: *hostname
76
lbipam.cilium.io/ips: 192.168.69.54
77
listeners:
78
- name: http
79
protocol: HTTP
80
port: 80
81
allowedRoutes:
82
namespaces:
83
from: Same
84
- name: https
85
protocol: HTTPS
86
port: 443
87
allowedRoutes:
88
namespaces:
89
from: All
90
tls:
91
certificateRefs:
92
- kind: Secret
93
name: janpuc-com-tls
94
---
95
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.networking.k8s.io/gateway_v1.json
96
apiVersion: gateway.networking.k8s.io/v1
97
kind: Gateway
98
metadata:
99
name: envoy-internal
100
annotations:
101
external-dns.alpha.kubernetes.io/target: &hostname internal.janpuc.com
102
gatus.home-operations.com/endpoint: |-
103
group: internal
104
guarded: true
105
ui:
106
hide-hostname: true
107
hide-url: true
108
spec:
109
gatewayClassName: envoy
110
infrastructure:
111
annotations:
112
external-dns.alpha.kubernetes.io/hostname: *hostname
113
lbipam.cilium.io/ips: 192.168.69.55
114
listeners:
115
- name: http
116
protocol: HTTP
117
port: 80
118
allowedRoutes:
119
namespaces:
120
from: Same
121
- name: https
122
protocol: HTTPS
123
port: 443
124
allowedRoutes:
125
namespaces:
126
from: All
127
tls:
128
certificateRefs:
129
- kind: Secret
130
name: janpuc-com-tls
131
---
132
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.envoyproxy.io/backendtrafficpolicy_v1alpha1.json
133
apiVersion: gateway.envoyproxy.io/v1alpha1
134
kind: BackendTrafficPolicy
135
metadata:
136
name: envoy
137
spec:
138
compressor:
139
- type: Zstd
140
zstd: {}
141
- type: Brotli
142
brotli: {}
143
- type: Gzip
144
gzip: {}
145
retry:
146
numRetries: 2
147
retryOn:
148
triggers:
149
- reset
150
targetSelectors:
151
- group: gateway.networking.k8s.io
152
kind: Gateway
153
tcpKeepalive: {}
154
timeout:
155
http:
156
requestTimeout: 0s
157
---
158
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.envoyproxy.io/clienttrafficpolicy_v1alpha1.json
159
apiVersion: gateway.envoyproxy.io/v1alpha1
160
kind: ClientTrafficPolicy
161
metadata:
162
name: envoy
163
spec:
164
clientIPDetection:
165
xForwardedFor:
166
trustedCIDRs:
167
- 10.42.0.0/16
168
connection:
169
bufferLimit: 8Mi
170
maxAcceptPerSocketEvent: 0
171
http2:
172
initialStreamWindowSize: 2Mi
173
initialConnectionWindowSize: 32Mi
174
onInvalidMessage: TerminateStream
175
http3: {}
176
targetSelectors:
177
- group: gateway.networking.k8s.io
178
kind: Gateway
179
tcpKeepalive: {}
180
timeout:
181
http:
182
requestReceivedTimeout: 0s
183
tls:
184
minVersion: "1.2"
185
alpnProtocols:
186
- h2
187
- http/1.1
188
---
189
# yaml-language-server: $schema=https://k8s-schemas.home-operations.com/gateway.networking.k8s.io/httproute_v1.json
190
apiVersion: gateway.networking.k8s.io/v1
191
kind: HTTPRoute
192
metadata:
193
name: https-redirect
194
annotations:
195
external-dns.alpha.kubernetes.io/controller: none
196
spec:
197
parentRefs:
198
- name: envoy-external
199
namespace: network
200
sectionName: http
201
- name: envoy-internal
202
namespace: network
203
sectionName: http
204
rules:
205
- filters:
206
- type: RequestRedirect
207
requestRedirect:
208
scheme: https
209
statusCode: 301