90 lines
3.6 KiB
Text
90 lines
3.6 KiB
Text
|
# Reusable ServiceExposure presets for component defaults.
|
||
|
|
#
|
||
|
|
# Component defaults.ncl files set `exposure | default = presets.<preset> {...}`
|
||
|
|
# to declare a full reachability surface without repeating the Binding plumbing.
|
||
|
|
# Each preset returns a complete ServiceExposure (service + namespace + exposures).
|
||
|
|
#
|
||
|
|
# Archetypes drawn from the `prvng net map` census:
|
||
|
|
# - fip_l7_public : public web app behind the shared-FIP Cilium Gateway
|
||
|
|
# (the 14 gateway_fip components: wordpress, odoo, cv, …)
|
||
|
|
# - private_lb_l4 : VPN-reachable service on its own private LoadBalancer
|
||
|
|
# (grafana .4, prometheus .5 — direct L4, WireGuard-reachable)
|
||
|
|
# - l4_host_router : VPN-reachable via the Sozu private_ingress router
|
||
|
|
# (reg→zot, longhorn UI — consolidated behind .6)
|
||
|
|
# - flat_wuwei : cluster-internal only, no external entry
|
||
|
|
|
||
|
|
let _exp = import "exposure.ncl" in
|
||
|
|
|
||
|
|
{
|
||
|
|
presets = {
|
||
|
|
# ── Public web app on the shared FIP Cilium Gateway ──────────────────
|
||
|
|
# surface='public: served on the public VLAN VIP that librecloud-fip-wuji
|
||
|
|
# maps to. TLS terminates at the Gateway/Envoy.
|
||
|
|
fip_l7_public = fun args =>
|
||
|
|
{
|
||
|
|
service = args.service,
|
||
|
|
namespace = args.namespace,
|
||
|
|
exposures = [
|
||
|
|
{
|
||
|
|
hostnames = args.hostnames,
|
||
|
|
surface = 'public,
|
||
|
|
binding = { kind = 'gateway_l7_public, fip_name = args.fip_name },
|
||
|
|
ports = [{ name = "https", listen = 443, target = args.target_port, tls = 'gateway_terminate }],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
},
|
||
|
|
|
||
|
|
# ── VPN service on a dedicated private LoadBalancer ──────────────────
|
||
|
|
# surface='vpn with an L4 LB DNAT: reachable from WireGuard (no Gateway
|
||
|
|
# TPROXY in the path). entry_ip is the private LB VIP.
|
||
|
|
private_lb_l4 = fun args =>
|
||
|
|
{
|
||
|
|
service = args.service,
|
||
|
|
namespace = args.namespace,
|
||
|
|
exposures = [
|
||
|
|
{
|
||
|
|
hostnames = args.hostnames,
|
||
|
|
surface = 'vpn,
|
||
|
|
binding = { kind = 'l4_lb, entry_ip = args.entry_ip },
|
||
|
|
ports = [{ name = "https", listen = 443, target = args.target_port, tls = 'pod_terminate }],
|
||
|
|
},
|
||
|
|
],
|
||
|
|
},
|
||
|
|
|
||
|
|
# ── VPN service behind the Sozu private_ingress host-router ──────────
|
||
|
|
# surface='vpn, terminating at the private_ingress LB (.6). strict_chain
|
||
|
|
# clients (lian-build pushing to reg) require Sozu to serve the full chain.
|
||
|
|
l4_host_router = fun args =>
|
||
|
|
let a = { strict_chain_clients | default = false } & args in
|
||
|
|
{
|
||
|
|
service = a.service,
|
||
|
|
namespace = a.namespace,
|
||
|
|
exposures = [
|
||
|
|
{
|
||
|
|
hostnames = a.hostnames,
|
||
|
|
surface = 'vpn,
|
||
|
|
binding = { kind = 'l4_host_router, entry_ip = a.entry_ip },
|
||
|
|
ports = [{ name = "https", listen = 443, target = a.target_port, tls = 'pod_terminate }],
|
||
|
|
strict_chain_clients = a.strict_chain_clients,
|
||
|
|
},
|
||
|
|
],
|
||
|
|
},
|
||
|
|
|
||
|
|
# ── Cluster-internal only ────────────────────────────────────────────
|
||
|
|
flat_wuwei = fun args =>
|
||
|
|
let a = { hostnames | default = [], ports | default = [] } & args in
|
||
|
|
{
|
||
|
|
service = a.service,
|
||
|
|
namespace = a.namespace,
|
||
|
|
exposures = [
|
||
|
|
{
|
||
|
|
hostnames = a.hostnames,
|
||
|
|
surface = 'cluster,
|
||
|
|
binding = { kind = 'cluster },
|
||
|
|
ports = a.ports,
|
||
|
|
},
|
||
|
|
],
|
||
|
|
},
|
||
|
|
},
|
||
|
|
}
|