apiVersion: v1
kind: Namespace
metadata:
  name: gateway

---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: edge-proxy-config
  namespace: gateway
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        replicas: 1
        patch:
          type: StrategicMerge
          value:
            spec:
              template:
                spec:
                  containers:
                    - name: envoy
                      resources:
                        requests:
                          cpu: 25m
                          memory: 128Mi
                        limits:
                          memory: 512Mi
                    - name: shutdown-manager
                      resources:
                        requests:
                          cpu: 5m
                          memory: 16Mi
                        limits:
                          memory: 64Mi
      envoyHpa:
        minReplicas: 1
        maxReplicas: 5
        metrics:
          - type: Resource
            resource:
              name: cpu
              target:
                type: Utilization
                averageUtilization: 60

---
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: edge-wildcard-kube-huskypup-net
  namespace: gateway
spec:
  secretName: edge-wildcard-kube-huskypup-net
  issuerRef:
    kind: ClusterIssuer
    name: letsencrypt-production
  dnsNames:
    - "*.kube.huskypup.net"
    - "*.gitlab.kube.huskypup.net"

---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: edge
  namespace: gateway
spec:
  gatewayClassName: envoy-gateway
  infrastructure:
    parametersRef:
      group: gateway.envoyproxy.io
      kind: EnvoyProxy
      name: edge-proxy-config
  listeners:
    - name: https
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: edge-wildcard-kube-huskypup-net
      allowedRoutes:
        namespaces:
          from: All

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-argocd-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: argocd
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-authentik-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: authentik
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-grafana-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: grafana
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-prometheus-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: prometheus
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-vault-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: vault
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-rook-ceph-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: rook-ceph
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-mqtt-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: mqtt
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-n8n-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: n8n
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-nextcloud-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: nextcloud
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-home-assistant-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: home-assistant
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-frigate-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: frigate
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-teslamate-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: teslamate
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-guacamole-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: guacamole
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge

---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-gitlab-attach-edge
  namespace: gateway
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: gitlab
  to:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: edge