gatewayclassblueprint-contour-istio-cert.yaml

apiVersion: gateway.tv2.dk/v1alpha1
kind: GatewayClassBlueprint
metadata:
  name: contour-istio-cert
spec:
  values:
    default:
      hpa:
        minReplicas: 1  # optional
        maxReplicas: 3  # Optional, will default to minReplicas if minReplicas is defined
        averageUtilization: 60
      pdb:
        minAvailable: "1"
        maxUnavailable:
      tags: []

  # The following are templates used to 'implement' a 'parent' Gateway
  gatewayTemplate:
    status:
      template: |
        addresses:
        {{ range (index .Resources.loadBalancer 0).status.loadBalancer.ingress }}
        - type: IPAddress
          value: {{ .ip }}
        {{ end }}
    resourceTemplates:
      childGateway: |
        apiVersion: gateway.networking.k8s.io/v1beta1
        kind: Gateway
        metadata:
          name: {{ .Gateway.metadata.name }}-child
          namespace: {{ .Gateway.metadata.namespace }}
          annotations:
            networking.istio.io/service-type: ClusterIP
            {{ if .Values.tags }}
            {{ toYaml .Values.tags | nindent 4 }}
            {{ end }}
        spec:
          gatewayClassName: istio
          listeners:
          {{- range .Gateway.spec.listeners }}
          - name: {{ .name }}
            port: 80
            protocol: HTTP
            {{ if get . "hostname" }}
            hostname: {{ .hostname | quote }}
            {{ end -}}
            {{ if get . "allowedRoutes" }}
            allowedRoutes:
              {{ toYaml .allowedRoutes | nindent 6 }}
            {{ end -}}
          {{- end }}
      loadBalancer: |
        apiVersion: networking.k8s.io/v1
        kind: Ingress
        metadata:
          name: {{ .Gateway.metadata.name }}
          namespace: {{ .Gateway.metadata.namespace }}
          annotations:
            {{ if .Values.tags }}
            {{ toYaml .Values.tags | nindent 4 }}
            {{ end }}
        spec:
          ingressClassName: contour
          tls:
          - hosts:
            {{- range .Gateway.spec.listeners }}
            - {{ .hostname | quote }}
            {{- end }}
            secretName: {{ .Gateway.metadata.name }}-tls
          rules:
          {{- range .Gateway.spec.listeners }}
          - host: {{ .hostname | quote }}
            http:
              paths:
              - path: /
                pathType: Prefix
                backend:
                  service:
                    name: {{ $.Gateway.metadata.name }}-child-istio
                    port:
                      number: 80
          {{- end }}
      hpa: |
        {{ if or (get .Values.hpa "minReplicas") (get .Values.hpa "maxReplicas") }}
        apiVersion: autoscaling/v2
        kind: HorizontalPodAutoscaler
        metadata:
          labels:
            tv2.dk/gw: {{ .Gateway.metadata.namespace }}-{{ .Gateway.metadata.name }}
          name: gw-{{ .Gateway.metadata.namespace }}-{{ .Gateway.metadata.name }}
          namespace: {{ .Gateway.metadata.namespace }}
          annotations:
            {{ if .Values.tags }}
            {{ toYaml .Values.tags | nindent 4 }}
            {{ end }}
        spec:
          scaleTargetRef:
            apiVersion: apps/v1
            kind: Deployment
            name: {{ .Gateway.metadata.name }}-child-istio
          {{ if get .Values.hpa "minReplicas" }}
          minReplicas: {{ .Values.hpa.minReplicas }}
          {{ end }}
          {{ if get .Values.hpa "maxReplicas" }}
          maxReplicas: {{ .Values.hpa.maxReplicas }}
          {{ else }} # Ensure that max >= min
            {{ if get .Values.hpa "minReplicas" }}
          maxReplicas: {{ .Values.hpa.minReplicas }}
            {{ end }}
          {{ end }}
          metrics:
          - type: Resource
            resource:
              name: cpu
              target:
                type: Utilization
                averageUtilization: {{ .Values.hpa.averageUtilization }}
        {{ end }}
      pdb: |
        {{ if or (get .Values.pdb "minAvailable") (get .Values.pdb "maxUnavailable") }}
        apiVersion: policy/v1
        kind: PodDisruptionBudget
        metadata:
          labels:
            tv2.dk/gw: {{ .Gateway.metadata.namespace }}-{{ .Gateway.metadata.name }}
          name: gw-{{ .Gateway.metadata.namespace }}-{{ .Gateway.metadata.name }}
          namespace: {{ .Gateway.metadata.namespace }}
          annotations:
            {{ if .Values.tags }}
            {{ toYaml .Values.tags | nindent 4 }}
            {{ end }}
        spec:
          {{ if get .Values.pdb "minAvailable" }}
          minAvailable: {{ .Values.pdb.minAvailable }}
          {{ else }}
          maxUnavailable: {{ .Values.pdb.maxUnavailable }}
          {{ end }}
          selector:
            # Match the generated Deployment by label
            matchLabels:
              tv2.dk/gw: {{ .Gateway.metadata.namespace }}-{{ .Gateway.metadata.name }}
              istio.io/gateway-name: {{ .Gateway.metadata.name }}-child
        {{ end }}
      tlsCertificate: |
        apiVersion: cert-manager.io/v1
        kind: Certificate
        metadata:
          name: {{ .Gateway.metadata.name }}-cert
          namespace: {{ .Gateway.metadata.namespace }}
          annotations:
            {{ if .Values.tags }}
            {{ toYaml .Values.tags | nindent 4 }}
            {{ end }}
        spec:
          secretName: {{ .Gateway.metadata.name }}-tls
          duration: 2160h # 90d
          renewBefore: 360h # 15d
          subject:
            organizations:
              - acme-example-corp
          isCA: false
          privateKey:
            algorithm: RSA
            encoding: PKCS1
            size: 2048
          usages:
            - server auth
            - client auth
          dnsNames:
            {{- range .Hostnames.Intersection }}
            - {{ . | quote }}
            {{- end }}
          issuerRef:
            name: ca-issuer
            kind: ClusterIssuer
            group: cert-manager.io

  # The following are templates used to 'implement' a 'parent' HTTPRoute
  httpRouteTemplate:
    resourceTemplates:
      shadowHttproute: |
        apiVersion: gateway.networking.k8s.io/v1beta1
        kind: HTTPRoute
        metadata:
          name: {{ .HTTPRoute.metadata.name }}-child
          namespace: {{ .HTTPRoute.metadata.namespace }}
          annotations:
            {{ if .Values.tags }}
            {{ toYaml .Values.tags | nindent 4 }}
            {{ end }}
        spec:
          parentRefs:
          {{ range .HTTPRoute.spec.parentRefs }}
          - kind: {{ .kind }}
            name: {{ .name }}-child
            {{ if get . "namespace" }}
            namespace: {{ .namespace }}
            {{ end }}
          {{ end }}
          rules:
          {{ toYaml .HTTPRoute.spec.rules | nindent 4 }}