From 7b542dfec91f6e40a3a4d3d38da13ed6f7a0badf Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 5 Oct 2026 14:04:02 +1100
Subject: [PATCH] logging: expose vlselect on internal traefik

---
 apps/base/logging/gateway.yaml   | 40 +++++++++++++++++++++++
 apps/base/logging/httproute.yaml | 55 ++++++++++++++++++++++++++++++++
 2 files changed, 95 insertions(+)

diff --git a/apps/base/logging/gateway.yaml b/apps/base/logging/gateway.yaml
index 67f01eb..5d0b7bf 100644
--- a/apps/base/logging/gateway.yaml
+++ b/apps/base/logging/gateway.yaml
@@ -39,3 +39,43 @@ spec:
           - group: ""
             kind: Secret
             name: logs-ingest-tls
+---
+# Unauthenticated LogsQL query endpoint fronting the VLCluster vlselect service.
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: vlselect
+  namespace: logging
+  labels:
+    app.kubernetes.io/name: victorialogs
+    app.kubernetes.io/component: query
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: vlselect.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: vlselect.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: vlselect.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: vlselect.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: vlselect-tls
diff --git a/apps/base/logging/httproute.yaml b/apps/base/logging/httproute.yaml
index cf390f1..69e49a5 100644
--- a/apps/base/logging/httproute.yaml
+++ b/apps/base/logging/httproute.yaml
@@ -53,3 +53,58 @@ spec:
         - path:
             type: PathPrefix
             value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vlselect-http-redirect
+  namespace: logging
+  labels:
+    app.kubernetes.io/name: victorialogs
+    app.kubernetes.io/component: query
+spec:
+  hostnames:
+    - vlselect.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vlselect
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: vlselect
+  namespace: logging
+  labels:
+    app.kubernetes.io/name: victorialogs
+    app.kubernetes.io/component: query
+spec:
+  hostnames:
+    - vlselect.k8s.syd1.au.unkin.net
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: vlselect
+      sectionName: https
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: vlselect-logs
+          port: 9471
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /