From 2c6d88aa6b6d84d692fce264fcb90cf5a8b24fcf Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sat, 23 May 2026 01:31:28 +1000
Subject: [PATCH] feat(puppet): migrate puppetboard Ingress to Gateway API
 (#130)

## Summary

- Replace `Ingress` (nginx) with `Gateway` + `HTTPRoute` using `traefik-internal` GatewayClass
- TLS terminated at the Gateway listener; cert-manager provisions the certificate via `vault-issuer`
- external-dns annotations moved to the Gateway
- `ingress_puppetdb.yaml` is unchanged in this PR (separate PR)

## Test plan

- [ ] ArgoCD syncs the puppet app cleanly
- [ ] cert-manager issues the `puppetboard-tls` certificate
- [ ] external-dns creates the DNS record
- [ ] `https://puppetboard.k8s.syd1.au.unkin.net` is reachable

Reviewed-on: https://git.unkin.net/unkin/argocd-apps/pulls/130
---
 apps/base/puppet/gateway_puppetboard.yaml   | 33 ++++++++++++++++++++
 apps/base/puppet/httproute_puppetboard.yaml | 25 +++++++++++++++
 apps/base/puppet/ingress_puppetboard.yaml   | 34 ---------------------
 apps/base/puppet/kustomization.yaml         |  3 +-
 4 files changed, 60 insertions(+), 35 deletions(-)
 create mode 100644 apps/base/puppet/gateway_puppetboard.yaml
 create mode 100644 apps/base/puppet/httproute_puppetboard.yaml
 delete mode 100644 apps/base/puppet/ingress_puppetboard.yaml

diff --git a/apps/base/puppet/gateway_puppetboard.yaml b/apps/base/puppet/gateway_puppetboard.yaml
new file mode 100644
index 0000000..af1fc20
--- /dev/null
+++ b/apps/base/puppet/gateway_puppetboard.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: puppetboard-tls
+        mode: Terminate
diff --git a/apps/base/puppet/httproute_puppetboard.yaml b/apps/base/puppet/httproute_puppetboard.yaml
new file mode 100644
index 0000000..6794b2d
--- /dev/null
+++ b/apps/base/puppet/httproute_puppetboard.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetboard
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
diff --git a/apps/base/puppet/ingress_puppetboard.yaml b/apps/base/puppet/ingress_puppetboard.yaml
deleted file mode 100644
index 18b7193..0000000
--- a/apps/base/puppet/ingress_puppetboard.yaml
+++ /dev/null
@@ -1,34 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetboard.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetboard
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetboard.k8s.syd1.au.unkin.net
-      secretName: puppetboard-tls
diff --git a/apps/base/puppet/kustomization.yaml b/apps/base/puppet/kustomization.yaml
index 417a6cc..99cd358 100644
--- a/apps/base/puppet/kustomization.yaml
+++ b/apps/base/puppet/kustomization.yaml
@@ -25,7 +25,8 @@ resources:
   - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
   - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
+  - gateway_puppetboard.yaml
+  - httproute_puppetboard.yaml
   - ingress_puppetdb.yaml
   - service_puppetserver-agents-to-puppet.yaml
   - service_puppet-headless.yaml