34 lines
1.2 KiB
Text
34 lines
1.2 KiB
Text
|
let _presets = (import "schemas/lib/concerns_presets.ncl").presets in
|
||
|
|
|
||
|
|
{
|
||
|
|
private_gateway | default = {
|
||
|
|
name | default = "private-gateway",
|
||
|
|
namespace | default = "kube-system",
|
||
|
|
gateway_ip | default = "10.200.2.254",
|
||
|
|
cidr | default = "10.200.2.0/24",
|
||
|
|
port | default = 80,
|
||
|
|
|
||
|
|
# HTTPS listeners owned declaratively by the gateway. Empty by default; a
|
||
|
|
# workspace instance lists one entry per consumer service (matching its
|
||
|
|
# HTTPRoute sectionName + cert secret) so a gateway apply no longer wipes them.
|
||
|
|
https_listeners | default = [],
|
||
|
|
|
||
|
|
operations | default = {
|
||
|
|
install = true,
|
||
|
|
update = true,
|
||
|
|
delete = true,
|
||
|
|
},
|
||
|
|
|
||
|
|
live_check | default = {
|
||
|
|
strategy = 'k8s_pods,
|
||
|
|
scope = 'cp_only,
|
||
|
|
},
|
||
|
|
|
||
|
|
# ServiceConcerns default — Cilium private gateway; infrastructure_glue with custom tls/dns reasons.
|
||
|
|
concerns | default = _presets.infrastructure_glue & {
|
||
|
|
tls | force = { kind = 'disabled, reason = "Gateway-API TLS handled by HTTPRoute consumers, not the gateway itself" },
|
||
|
|
dns | force = { kind = 'disabled, reason = "no DNS records owned by this component (consumers declare their own)" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
}
|