platform/manifests
1
0
Fork 0
Code Issues 8 Pull Requests 7 Actions Packages Projects Releases Wiki Activity

refactor: Move docs and prometheus to httpRoute

Browse Source
This commit is contained in:
Moritz Jörg
2026-08-14 18:48:36 +02:00
parent 36b713e8e0
commit 4b340e100d
13 changed files with 226 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
charts/docs/templates/httproute.yaml
Vendored
+40
View File
@@ -0,0 +1,40 @@
{{- if .Values.httpRoute.enabled -}}
{{- $fullName := include "docs.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: {{ $fullName }}
labels:
{{- include "docs.labels" . | nindent 4 }}
{{- with .Values.httpRoute.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
parentRefs:
{{- with .Values.httpRoute.parentRefs }}
{{- toYaml . | nindent 4 }}
{{- end }}
{{- with .Values.httpRoute.hostnames }}
hostnames:
{{- toYaml . | nindent 4 }}
{{- end }}
rules:
{{- range .Values.httpRoute.rules }}
- matches:
{{- with .matches }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .filters }}
filters:
{{- toYaml . | nindent 8 }}
{{- end }}
backendRefs:
- group: ''
kind: Service
name: {{ $fullName }}
port: {{ $svcPort }}
weight: 1
{{- end }}
{{- end }}
charts/docs/values.yaml
+6
View File
@@ -46,6 +46,12 @@ securityContext:
service:
type: ClusterIP
port: 8080
httpRoute:
enabled: false
annotations: {}
parentRefs: []
hostnames: []
rules: []
ingress:
enabled: true
className: haproxy
helmfile.d/docs.yaml.gotmpl
+1 -1
View File
@@ -11,7 +11,7 @@ releases:
condition: docs.enabled
values:
- ../values/docs/values/values.yaml
- ../values/docs/values/values-{{ .Environment.Name }}.yaml
- ../values/docs/values/values-{{ .Environment.Name }}.yaml.gotmpl
postRenderer: ../bin/kustomizer
postRendererArgs:
- ../values/docs/kustomize/{{ .Environment.Name }}
values/cilium/cilium-manifests/redirect.yaml
+4
View File
@@ -16,9 +16,13 @@ spec:
hostnames:
- git.oceanbox.io
- makai.oceanbox.io
- docs.oceanbox.io
- hubble.adm.hel1.obx
- uptime.adm.hel1.obx
- argocd.adm.hel1.obx
- grafana.adm.hel1.obx
- alertmanager.adm.hel1.obx
- prometheus.adm.hel1.obx
rules:
- filters:
- type: RequestRedirect
values/docs/manifests/docs.yaml
+5
View File
@@ -32,6 +32,11 @@ spec:
- name: HELMFILE_FILE_PATH
value: docs.yaml.gotmpl
syncPolicy:
{{- if .Values.clusterConfig.gatewayAPI.enabled }}
managedNamespaceMetadata:
labels:
shared-gateway-access: "true"
{{- end }}
syncOptions:
- CreateNamespace=true
- ApplyOutOfSyncOnly=true
values/docs/manifests/network-policy.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- if .Values.clusterConfig.gatewayAPI.enabled }}
# Replaces the haproxy.org/allow-list Kyverno used to inject for oceanbox.io/expose: internal
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: whitelist-internal-docs
namespace: {{ .Values.docs.env }}-docs
spec:
endpointSelector: {}
ingress:
- fromCIDR:
{{- range .Values.clusterConfig.ingress_whitelist }}
- {{ . }}
{{- end }}
toPorts:
- ports:
- port: "8080"
protocol: TCP
- fromEntities:
- cluster
{{- end }}
values/docs/values/values-staging.yaml
-20
View File
@@ -1,20 +0,0 @@
fullnameOverride: staging-docs
image:
tag: "511c128c-debug"
ingress:
enabled: true
className: "haproxy"
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
haproxy.org/backend-protocol: h1
haproxy.org/cors-enable: "true"
oceanbox.io/expose: internal
hosts:
- host: docs.oceanbox.io
paths:
- path: /
pathType: ImplementationSpecific
tls:
- hosts:
- docs.oceanbox.io
secretName: default-docs-tls
values/docs/values/values-staging.yaml.gotmpl
+38
View File
@@ -0,0 +1,38 @@
fullnameOverride: staging-docs
image:
tag: "511c128c-debug"
{{- /* replaced by the httpRoute block below when gatewayAPI is enabled */}}
ingress:
enabled: {{ not .Values.clusterConfig.gatewayAPI.enabled }}
className: "haproxy"
annotations:
cert-manager.io/cluster-issuer: letsencrypt-production
haproxy.org/backend-protocol: h1
haproxy.org/cors-enable: "true"
oceanbox.io/expose: internal
hosts:
- host: docs.oceanbox.io
paths:
- path: /
pathType: ImplementationSpecific
tls:
- hosts:
- docs.oceanbox.io
secretName: default-docs-tls
{{- if .Values.clusterConfig.gatewayAPI.enabled }}
httpRoute:
enabled: true
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: shared-gateway
namespace: kube-system
sectionName: https
hostnames:
- docs.oceanbox.io
rules:
- matches:
- path:
type: PathPrefix
value: /
{{- end }}
values/headscale/values/values.yaml
+1 -1
View File
@@ -325,7 +325,7 @@ configMaps:
{ "name": "temporal.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
{ "name": "temporal-grpc.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
{ "name": "git.obx", "type": "A", "value": "10.0.1.9" },
{ "name": "git.obx", "type": "A", "value": "10.0.1.3" },
{ "name": "git.oceanbox.io", "type": "A", "value": "10.0.1.3" },
{ "name": "makai.oceanbox.io", "type": "A", "value": "10.0.1.3" },
{ "name": "docs.oceanbox.io", "type": "A", "value": "10.0.1.3" },
values/prometheus/manifests/gateway-routes.yaml
+79
View File
@@ -0,0 +1,79 @@
{{- if .Values.clusterConfig.gatewayAPI.enabled }}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: grafana
namespace: prometheus
spec:
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: shared-gateway
namespace: kube-system
sectionName: https-internal
hostnames:
- grafana.{{ .Values.clusterConfig.domain }}
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- group: ''
kind: Service
name: prometheus-grafana
port: 80
weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: alertmanager
namespace: prometheus
spec:
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: shared-gateway
namespace: kube-system
sectionName: https-internal
hostnames:
- alertmanager.{{ .Values.clusterConfig.domain }}
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- group: ''
kind: Service
name: prometheus-kube-prometheus-alertmanager
port: 9093
weight: 1
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: prometheus
namespace: prometheus
spec:
parentRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: shared-gateway
namespace: kube-system
sectionName: https-internal
hostnames:
- prometheus.{{ .Values.clusterConfig.domain }}
rules:
- matches:
- path:
type: PathPrefix
value: /
backendRefs:
- group: ''
kind: Service
name: prometheus-kube-prometheus-prometheus
port: 9090
weight: 1
{{- end }}
values/prometheus/manifests/network-policy.yaml
+25
View File
@@ -0,0 +1,25 @@
{{- if .Values.clusterConfig.gatewayAPI.enabled }}
# Replaces the nginx.ingress.kubernetes.io/whitelist-source-range these Ingresses always carried
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: whitelist-internal-prometheus
namespace: prometheus
spec:
endpointSelector: {}
ingress:
- fromCIDR:
{{- range .Values.clusterConfig.ingress_whitelist }}
- {{ . }}
{{- end }}
toPorts:
- ports:
- port: "80"
protocol: TCP
- port: "9090"
protocol: TCP
- port: "9093"
protocol: TCP
- fromEntities:
- cluster
{{- end }}
values/prometheus/manifests/prometheus.yaml
+3
View File
@@ -26,6 +26,9 @@ spec:
managedNamespaceMetadata:
labels:
component: sys
{{- if .Values.clusterConfig.gatewayAPI.enabled }}
shared-gateway-access: "true"
{{- end }}
syncOptions:
- ServerSideApply=true
- CreateNamespace=true
values/prometheus/values/prometheus.yaml.gotmpl
+3 -3
View File
@@ -67,7 +67,7 @@ alertmanager:
storage: {}
ingress:
enabled: true
enabled: {{ not .Values.clusterConfig.gatewayAPI.enabled }}
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
@@ -204,7 +204,7 @@ grafana:
size: 20Gi
{{- end }}
ingress:
enabled: true
enabled: {{ not .Values.clusterConfig.gatewayAPI.enabled }}
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}
@@ -517,7 +517,7 @@ prometheus:
{{- end }}
ingress:
enabled: true
enabled: {{ not .Values.clusterConfig.gatewayAPI.enabled }}
ingressClassName: nginx
annotations:
cert-manager.io/cluster-issuer: {{ .Values.clusterConfig.ingress_clusterissuer }}