Migrate more services to Gateway API

inventories/group_vars/control_plane/headscale.yaml

@@ -1,6 +1,4 @@
 ---
-headscale_tls: no
-
 # only hexadecimal passwords are allowed and need to be prefixed with "privkey:"
 # should be 64 characters long
 headscale_private_key: privkey:38f1186d8c9d468379f1143282ae37f4259cb617b7aa52de223d90f605983c58
@@ -11,3 +9,13 @@ headscale_db_password: a-secure-password
 headscale_db_resources: {}
 
 headscale_ipv6_prefix: fd7a:115c:a1e0::/48
+
+headscale_ingress_enabled: false
+
+headscale_httproute_enabled: true
+headscale_httproute_parent_refs:
+- name: metal-control-plane
+  namespace: "{{ metal_control_plane_namespace }}"
+  sectionName: http
+headscale_httproute_hostnames:
+  - headscale.{{ metal_control_plane_gateway_dns }}

inventories/group_vars/control_plane/logging.yaml

@@ -1,14 +1,25 @@
 ---
-logging_ingress_loki_tls: no
+logging_ingress_enabled: false
 logging_ingress_dns: "loki.{{ metal_control_plane_ingress_dns }}"
 
 logging_alloy_enabled: true
 
 logging_alloy_service_monitor_enabled: false
 
 logging_alloy_loki_write_endpoints:
-  - url: "http://{{ logging_ingress_dns }}:8080/loki/api/v1/push"
+  - url: "http://loki.{{ metal_control_plane_gateway_dns }}/loki/api/v1/push"
+    basic_auth:
+      username: promtail
+      password: "{{ logging_ingress_loki_basic_auth_password }}"
 
 logging_promtail_enabled: false
 
 logging_alloy_cluster_label: "mini-lab"
+
+logging_httproute_enabled: true
+logging_httproute_parent_refs:
+- name: metal-control-plane
+  namespace: "{{ metal_control_plane_namespace }}"
+  sectionName: http
+
+logging_ingress_loki_basic_auth_password: thisissecure789

inventories/group_vars/control_plane/metal_db.yaml

@@ -1,9 +1,7 @@
 ---
 metal_db_backup_restore_sidecar_provider: local
 
-metal_db_expose_frontend: yes
-
 metal_db_resources: {}
 metal_db_storage_size: 100Mi
 
-metal_db_backup_restore_sidecar_object_max_keep: 10
+metal_db_backup_restore_sidecar_object_max_keep: 10

inventories/group_vars/control_plane/monitoring.yaml

@@ -1,14 +1,43 @@
 ---
-monitoring_ingress_grafana_tls: no
-
 monitoring_grafana_github_oauth:
   enabled: false
 monitoring_grafana_extra_secret_mounts: []
 
 monitoring_thanos_receive_enabled: true
-monitoring_thanos_receive_ingress_enabled: true
 monitoring_thanos_receive_size: 5Gi
 
 monitoring_prometheus_core_dns_enabled: true
 
 event_exporter_enabled: false
+
+monitoring_prometheus_ingress_enabled: false
+monitoring_grafana_ingress_enabled: false
+monitoring_alertmanager_ingress_enabled: false
+monitoring_thanos_receive_ingress_enabled: false
+
+monitoring_prometheus_httproute_enabled: true
+monitoring_prometheus_httproute_parent_refs:
+- name: metal-control-plane
+  namespace: "{{ metal_control_plane_namespace }}"
+  sectionName: http
+monitoring_grafana_httproute_enabled: true
+monitoring_grafana_httproute_parent_refs:
+- name: metal-control-plane
+  namespace: "{{ metal_control_plane_namespace }}"
+  sectionName: http
+monitoring_alertmanager_httproute_enabled: true
+monitoring_alertmanager_httproute_parent_refs:
+- name: metal-control-plane
+  namespace: "{{ metal_control_plane_namespace }}"
+  sectionName: http
+monitoring_thanos_receive_httproute_enabled: true
+monitoring_thanos_receive_parent_refs:
+- name: metal-control-plane
+  namespace: "{{ metal_control_plane_namespace }}"
+  sectionName: http
+
+monitoring_alertmanager_deploy_envoy_gateway_basic_auth: true
+monitoring_alertmanager_ingress_basic_auth_password: thisissecure123
+
+monitoring_thanos_deploy_envoy_gateway_basic_auth: true
+monitoring_thanos_receive_ingress_basic_auth_password: thisissecure456

inventories/group_vars/control_plane/zitadel.yaml

@@ -6,6 +6,7 @@ zitadel_port: 8080
 zitadel_skip_verify_tls: true
 zitadel_insecure: true
 
+zitadel_enabled_ingress: false
 zitadel_httproute_enabled: true
 zitadel_httproute_parent_refs:
 - name: metal-control-plane

inventories/group_vars/partition/alloy.yaml

@@ -1,2 +1,5 @@
 alloy_loki_write_endpoints:
-  - url: "http://loki.{{ metal_control_plane_ingress_dns }}:8080/loki/api/v1/push"
+  - url: "http://loki.{{ metal_control_plane_gateway_dns }}/loki/api/v1/push"
+    basic_auth:
+      username: promtail
+      password: thisissecure789

inventories/group_vars/partition/prometheus.yaml

@@ -20,7 +20,10 @@ prometheus_ipmi_exporter_targets:
 prometheus_blackbox_exporter_metal_api_probe_url: "{{ metal_partition_metal_api_protocol }}://{{ metal_partition_metal_api_addr }}:{{ metal_partition_metal_api_port }}{{ metal_partition_metal_api_basepath }}v1/version"
 
 prometheus_remote_write:
-  - url: "http://thanos-receive.{{ metal_control_plane_ingress_dns }}:8080/api/v1/receive"
+  - url: "http://thanos-receive.{{ metal_control_plane_gateway_dns }}/api/v1/receive"
+    basic_auth:
+      username: thanos-receive
+      password: thisissecure456
 
 prometheus_hosts_content: |
   127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4

roles/gateway/tasks/main.yml

@@ -11,10 +11,12 @@
 - name: Deploy Envoy GatewayClass
   kubernetes.core.k8s:
     definition: "{{ lookup('file', 'gatewayclass.yaml') | from_yaml }}"
+    apply: true
 
 - name: Deploy metal-control-plane EnvoyProxy
   kubernetes.core.k8s:
     definition: "{{ lookup('template', 'envoyproxy.yaml') | from_yaml }}"
+    apply: true
 
 - name: Deploy metal-api certificate secret
   kubernetes.core.k8s:
@@ -28,7 +30,9 @@
       data:
         tls.crt: "{{ lookup('file', 'certs/metal-api/server.pem') | b64encode }}"
         tls.key: "{{ lookup('file', 'certs/metal-api/server-key.pem') | b64encode }}"
+    apply: true
 
 - name: Deploy metal-control-plane Gateway
   kubernetes.core.k8s:
     definition: "{{ lookup('template', 'gateway.yaml') | from_yaml }}"
+    apply: true