mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 01:13:24 +00:00
7d3faf07dd
Add Gateway and HTTPRoute manifests to route external traffic to the dsh-gateway service (dsh-demo:8080). - Gateway dsh-gateway: HTTPS listener with TLS termination against a dsh-demo-tls cert secret. - HTTPRoute dsh-gateway: hostname -> dsh-gateway:8080. - Example TLS secret manifest + README with apply/verify/rollback. Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
50 lines
1.6 KiB
Markdown
50 lines
1.6 KiB
Markdown
# Gateway API — external access for `dsh-demo/dsh-gateway`
|
|
|
|
Exposes the `dsh-gateway` service (`dsh-demo`, port `8080`) outside the cluster
|
|
using the Kubernetes Gateway API (Traefik Gateway controller).
|
|
|
|
## Resources
|
|
|
|
| File | Kind | Purpose |
|
|
|---|---|---|
|
|
| `gateway.yaml` | `Gateway` | HTTPS listener with TLS termination |
|
|
| `httproute.yaml` | `HTTPRoute` | Routes the hostname → `dsh-gateway:8080` |
|
|
| `tls-secret.yaml.example` | `Secret` | Example TLS cert secret (not applied as-is) |
|
|
|
|
## Prerequisites
|
|
|
|
1. **Hostname** — replace the placeholder in `httproute.yaml` with the real FQDN.
|
|
2. **TLS secret** — create `dsh-demo-tls` in `dsh-demo` (see `tls-secret.yaml.example`).
|
|
3. **Ingress and DNS** — configure the upstream ingress and public DNS for the hostname.
|
|
|
|
## Apply
|
|
|
|
```bash
|
|
kubectl diff -f gateway-api/dsh-demo/
|
|
kubectl apply -f gateway-api/dsh-demo/ --dry-run=server
|
|
kubectl apply -f gateway-api/dsh-demo/
|
|
```
|
|
|
|
> ⚠️ A write-enabled kubeconfig is required to create Gateways and HTTPRoutes.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
kubectl get gateway dsh-gateway -n dsh-demo -o yaml # expect Programmed=True
|
|
kubectl get httproute -n dsh-demo -o wide # expect Accepted
|
|
kubectl get endpoints dsh-gateway -n dsh-demo # backend present
|
|
kubectl -n dsh-demo exec deploy/dsh-gateway -- wget -qO- http://localhost:8080/healthz
|
|
```
|
|
|
|
## Rollback
|
|
|
|
```bash
|
|
kubectl delete -f gateway-api/dsh-demo/
|
|
```
|
|
|
|
## Notes
|
|
|
|
- No `ReferenceGrant` is required: the Gateway, HTTPRoute, and backend Service are
|
|
all in `dsh-demo`.
|
|
- The backend (`dsh-gateway`) serves plain HTTP on 8080 and has a `/healthz` probe.
|