---
# External (DMZ) front for public identity.unkin.net, served via the external
# Traefik (LB VIP 198.18.199.0). The apex identity.unkin.net A record lives in
# the bind-operator unkin.net zone (bind-internal/authoritative), NOT
# external-dns, so no external-dns annotation here. Public TLS is terminated with
# the real Let's Encrypt *.unkin.net wildcard, centrally minted once in the
# cert-manager namespace (Certificate wildcard-unkin-net) and reflected into this
# namespace by the emberstack reflector as wildcard-unkin-net-tls, not Vault PKI.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: external
  annotations:
    argocd.argoproj.io/sync-wave: "2"
  name: authentik
  namespace: authentik
spec:
  gatewayClassName: traefik-external
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: identity.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: identity.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: wildcard-unkin-net-tls
        mode: Terminate
---
# Cluster hostname variant, identity.k8s.syd1.au.unkin.net. Internal Traefik,
# external-dns at 198.18.200.4. Own leaf from the Vault PKI issuer via the
# cert-manager gateway-shim; the common-name keys off this cluster host.
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  labels:
    traefik.io/instance: internal
  annotations:
    cert-manager.io/cluster-issuer: vault-issuer
    cert-manager.io/common-name: identity.k8s.syd1.au.unkin.net
    cert-manager.io/private-key-size: "4096"
    external-dns.alpha.kubernetes.io/hostname: identity.k8s.syd1.au.unkin.net
    external-dns.alpha.kubernetes.io/target: 198.18.200.4
  name: authentik-internal
  namespace: authentik
spec:
  gatewayClassName: traefik-internal
  listeners:
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: identity.k8s.syd1.au.unkin.net
      name: http
      port: 80
      protocol: HTTP
    - allowedRoutes:
        namespaces:
          from: Same
      hostname: identity.k8s.syd1.au.unkin.net
      name: https
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ""
            kind: Secret
            name: authentik-tls
        mode: Terminate