add istio gateway configuration for tls termination

ptp-chat/kustomization.yaml

@@ -9,27 +9,4 @@ resources:
   - ptp-chat-istio.yaml
   - ptp-chat-sealed-secret.yaml
   - ptp-chat-pull-sealed-secret.yaml
-
-# patches:
-#   - patch: |-
-#       apiVersion: v1
-#       kind: Secret
-#       metadata:
-#         name: ptp-chat-secret
-#         annotations:
-#           argocd.argoproj.io/compare-options: IgnoreExtraneous
-#           sealedsecrets.bitnami.com/managed: "true"
-#   - patch: |-
-#       apiVersion: v1
-#       kind: Secret
-#       metadata:
-#         name: pull-secret
-#         annotations:
-#           argocd.argoproj.io/compare-options: IgnoreExtraneous
-#           sealedsecrets.bitnami.com/managed: "true"
-
-# secretGenerator:
-#   - name: ptp-chat-secret
-#     type: Opaque
-#   - name: pull-secret
-#     type: kubernetes.io/dockerconfigjson
+  - ptp-chat-cert-sealed-secret.yaml

ptp-chat/ptp-chat-cert-sealed-secret.yaml

@@ -0,0 +1,21 @@
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/namespace-wide: "true"
+    argocd.argoproj.io/sync-wave: "-1"
+  name: istio-cert
+  namespace: ptp-chat
+spec:
+  encryptedData:
+    tls.crt: AgClAm3hy7TXZQF4kn7mIe+dnDImx8dqqGqhTQrWRLZyejlx9gZudHnJjso6BB74Iu4ngIor/D/GWlv1g0Z4WHYzRej0awTBTasGtvY0/SRVBm7KCpKVBFQ+2+FjSAuR7LveqT7ysF/8aUwsnI1r2cSjJQqKLrmdtabsnxZTJRGXNasG2t4T514xkNVkpCgk72OELkwt3HNmqePda8bgHycoCzQQfpubLc/kFA7bZgu9neklEV2xGfJdj4lnQhnsFitAP55T1USNy6JdBUT5IFLQGwPA4Cl+ZoEErVFYTUOCtIQq8dxnQR2ZjR05Vr0et7PNjiRknIpFvaBSyIGnC2MTFuWRI6ouU2PUPTcmXjI+zppSlKuy1ZOl29RRZ4mtXirzaS/bL/NCduuzwn8l10hvuNTIoYMO1GOFr8peCYhxVplU0tvqyIFcHE0kffFlYR/b8vFI2wDR/Pza0748qxsVKWspHd/lRpxSfSq1SBe2FCs86urs/qLU88YQmCzlvucO1T/dDxE+iwuBRb0fhIt7AGFT0liuldeZTIFhH21gbrutqAddO2W9eqafvS+ZKeGkuMsoljCCbwdinkci7JKPt5WXvz/eca1q6w7vitXyL41FWlOynRznvypjBusaoHvalZ4I/V+vkSnBF0g6Fh+CjMh4DaGFgp3aU/Fc1QnPP8WrbIP7byLSfeqpIZlT7rGxAWITwndPzBRZW2mgM5XjKAn0Uuifq/Xp+xJooM4h5XDgqUByyitb0qLbddWUVbmWzvhAUMEW3DvYXPtm70rj4DfJnB1yfY8h+BYwpz9zgtfjwbvA9iw/ThSKl6cWk8erqMp4uw49GcKAcRCYzAHHSaR/AYu2zykaGJp7sxKdysipMsSCRjauBb6w6GCViV9DZnjh8KF7u2GUaht69cM9oQaLnAV2QcYbz/i7U3b55drJ2q62iqhPPh8lKGdumbhS4eW4ma/eZi6RJ5Uf/6cL3o1VEWn2lt8L/voSR7lC9jMfg9K7J9kpB04bkUfWjQH+ZW4lXZAK6c6VoO0XgRFC4rokzkIjOR8PVAylbEM6fGA8Q3aRJBZ3VvE0keeSXlgKNEFu/DyRknl3S33X6l7dYrD0X/3vZBzCb8OQvIrIg/Ec671b/Zr4MmKRTx2tP7vQ8KNFVXu4bK487K1NdZlIcxaKCas4/wq805T4sYZfvtFUsZ8wqnxFFngvtvqcDqN3QYp5YiHspVsEWKaRzlifFxDuL3NyB2h+cOdn8szyEGqm17CZPoPTp4DrQAztdTfb8phi/EsVYpq9rRHKYRYVnpc3Yvsk6pKRl1mQOhnO/rf7DVmaof3mxo/wJ3svyw6n1BT3gZZMFlxuMnsYwtRKf85uVshXCpYPEoEx0z2jdrBbUyv1mjcJyuG1doa6qbeqv4kalpk/oBVespguoGiuMLvS//aHF5AWabEoJpppLZ4Z+rLbFT9R+UR59w3Lxmnq7+hTOL9v5FT4eCXiLr8xiaXLXHoai6T+ILYb81dNvVzWKKE4cyKg46DlPgMNQ0dzGOOXWwsthyhZ47O4HbCSe8TOlfpvraRmPvqOwhB2ia9215YziknT0w+YP//13VIu3n01QEhYzfjHnsWqCTnL6FG1ITcDljG+WoZEBfvMQDsYUJ8Mdudv1kujvMk33jVU0/89/3gYeYWR20YhuecTDUePgO+8n1Gurw0EAHpKhNA4HZ35Ik8gtGCUgE/TipBQ2jP3X7cUyIuuFo/SN9ckwRuHqPlV1s+VmwmxedYy+ArXPg/H0hEWrIuCWLgL3Ti7a9xbxoA4Diw94DYt5tDV/bWB2KqsBE1kYveav0X3bMM3EwQ7qv9bEFk54oJCDiahgagbJPf2Pa+qWq0tfoSlWz9NSw4E2aKaW2Fy4dyqe29w6A+6qBsutz5tTMz0v+ZZSj/AikdZ/oMmzmRRl+KPJzUIHPwo4ZPh9moQbgckwMSnAgtqqQ4s4bo10lPhwmZ0ygBSJT8ng5p+ipntbc62Y/h/ukQRAWlN8LbngrSIzl4ClnQPPtyR7JoItm5fgKMGbD1XM8tbV4TFaa/eunkD6kaGsy3iEARwx6e2iTUL/+MoRZQDJSIKHD993RMIvxYozi9J5dm8CmZafU6P+muJcbG6kytJy17MBA6+H8jTvoop2J2CBpDTToGFFggij7wVgktYptUTVEjeV+ffpMqItEr0J/fNeiEqLccbQ4TRhtz5Fvh9ho0R1L69E5NyN50sFVadqd7LU8iiJ4eoyVck6mqed+8jOdowqb+l
+    tls.key: AgBY7Zm5oEpc+u+a3G1pedInzHPbUaoWcYdNiujsxpHEe80KFkzxrX+hfAJmHyrfwAbxL5uw2iz8CQrjEtX22FRSymeLD67emMdqo0axmG7pSeX9EVSomqKV6OeVv7e/kR85KtPXKPPY6glxlyCnHTvDldsP4ioJyXAD5hXc5a+mqgu7IHfHyXLvXYAov0CbFQsLsvd/KZKsJryiP77RUykBrRB4lAtv+nP1NA9hodGXTI+7SHFKQbrBEXzJwOkheYXP2qUhtbgN+gCIAqVltvY96tm1Mp+p1Ufg+vbK62A39AcFEAUr/tTR2U2FjH11vc+h4Tuv0x+L1QB94NVOO0cea9sWt5ZhO4fumcdCTQblfizxnY34i/Ml7qwBzRnP0+eogiR6C+KFiidHdfaZdjbMtdV/FWfMgShNTnyWp9ZC6yAxi7LWmlPrcesyU1a/HxW6kBPiOGedvTyDP0WSAdeQMWaPqAf95+phBn771XWEBjRjsF4tS3SVDbalKVRgZFcVcZl5gRrb7MqBHWPMAq5HUliCFUm9Zwx0eqf61g9Q1wI9/b5mqHXWJZIcht39CsR1uEjd9czKybOJr+7KZOcqM9HPx2nXBRAw6Cdv6Gq5iWm8HN4xTLA0U7epjG9Mnojz3K39S1kRKiNSjy7XTvr6CQKk9awQWlFR/cmfSJpQnhCCH+1bsGJRGD0/+A9lBhe86K3lrmjcFlpZvy7+RKYQooZ/DiCUme9n/cwqp3x1W89f4rHSO3QPnnTJCAcBUmt19tzpkzBBe0GCCcmGltAU7jthqbPv25JUlrDphwzBkVCLrUQzJMURB86WXfNf9dUXSsNcUnIkhUylKfi7bVnpEp0VA4zVRjTO5L8qBRy+GE2M9lbNqrUQJEEmJw8wNGVMt8KVNlGiPrPu+kflc9tb65WtPeR7CYKrJl41KIf5LlPeTT+cwr510nbWIpSN5bKzbM2FgUgIonbxDVgWKb6JG9VxcM9BM2Q8Gb2x5L5giUXopmaA+5S0s5AmfSYdEfgIkF1AcwA6ip12TSTyPjRUVS01PJB/OW7lxgD7HuTuHZ6k0atg7WWx75zIqF5O7ysqZ28J4dydfBIERO8Gsx1xlqi6cCidFORnZoPUZhrI9cOjMVUrfxUMgRNQIgrPDYe3GywIdQgh//mbixZvG+z/KAPdQ2NaUV6YO8JtwDUFihHL9yBODVmwlfv7voMMyuPZW8gLEBngT90ZKta5vsA2h+Xwef1U6cZisufDwdJ5WD9J3Zza1zIWYhQkn11r4LSAqMeTn05S+HX7PAEYcf9QwuBapsQxDVFB2PSmu9gDJe358ii2MabGxL0PLMRD7elzl2t8dLK81KtxGsnkwCFnx5EmEG8/2iv5fI0XD8XZlyIZCpWhiuc8yu/2QlRyavdC2/7tFz+J+Jkn8WNYH0CVM/P+XJBaHBeCzMjYqLzBbX+L70yfRT2FFM9+uUSC5V9JKgTRduFoyozR64MITHDtAWczksMIvKFj4G1QH+sLYRzKez7ytJeFnfA1suHi9loMN0WfTCFk9oLLofda4omH+OKaq09F/kv7b5P49KPiaw5NCb6dSluvQ8THxK1y3/b+wOmP5MGcRYJLsoySOcRGS7eqdcQ91AaNSO4jRa4aXahnD5ddHDgFVtMJlXnYBfeHBAgBb59QxwBdNrxnC+2wIL4mRtYl8qOnfaPTYRwoMTe4T8szcUZ1Ta2rpL1p3c7i0tFVfbhsY5de7KGUIOP1mPEHnYmte4XFX7WHMsRsN0k4RCpzpTqjSAii2xZA94zXnG6EnY0rOOaYUY5TKT7qK5Kj+bKPyHi7TgMRABrMjl6327nvgXcdBDzyVPSbH6DL1eqRC1hrETQo0Rrwpr1Ot5y1N7EbMW+eLyKdG3CsH4wfnHQesZtNQHBBHYLDOPZTcO4dA8kAhsWUGMzbgAzqZFjoKqIcLgL92nPR2qdCjxZqumuXk9OacY7uoMxFYi2GJOEg7uZCZp5an+aUYOeJDoxu4WiblhaiSm/JJ1YQMVWocO9f6BZLRYm2xbjyqSPXrC+joxwvLQ56YUywnY7csW4T75rO/2TZPFAqFyGeRcBwmT3+mHfGdQn3j8334614AflyttaRQj/p7zpkTwPid46aY3C+O/qMGzw5JrxltpBmoZyGHRmus9DooiqhlRviOM/TL/etJDegnyZOVerwydoXlh9euzxAsg3UgE6t7WNDv8egr2Kch9bRQAwlIeV2VGpQpyg5H07FqA349K9mOTGvoZeBZMq1HNCqY1s7lf5BVeQpiTfh8RXjm/9VZ553ATscO/ss63CScCVSAo43AKliu6qHkPMzoYKs7rx2t2thB1/z8UuhiGYvubsH43tP2hl4Ns208fAUcvBHg4nptxvcWZ50vQ01KvC9eBw/ptHPxIG1biWe8q2azEZ0oiPMZlus9mMbRk2VD4ebi4tpCBzY+0Ds9L8JXb5GqnRw6WpZFeyHpniCyFmmVBupeWe0mv9E6ZyvrS6Ngi34JrEKEDGxkm4FhSkv5OQJTLdnGkr53JFbWekh0lCXX0qyffibkp9mWr/TmKVuc2yHBKRg5IBE4yzEMLA9o8wvFdjfPCAxU+eHdiljhiqqd+IH1KwmWI5mRzadxUvVxPDmSwQf6AjZojU5OHT64o3AH/W/23tTckhHlqxg/h0fvHFlhrdOe8ZdDrIxm0JfyAXp1RTXkHwcIRdMmSwH7+McISuCygZYW/yJRQsHsjyFHW4fKkCbQzK+Q7Ns0LnHIm3irKJDxha/KVOqmg4tXKf9ySrju6onQlY2JMB12zz8rg/oE0d1lJ5BugFrHlYXwLWo9iDLetAU2AgtsNoJsGax05IZ9EiWXIF7/49O90w0XrGblDHuvjiB6DWx4UI0WzqAjKqg+CvE0tTgAaCdeWN5YdG/XZwDmYCjJyuaEKWgMEHuu8hiZPZ+N0QytPaHIM8Lnb3pLObE63iEII0=
+  template:
+    metadata:
+      annotations:
+        sealedsecrets.bitnami.com/namespace-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+        argocd.argoproj.io/compare-options: IgnoreExtraneous
+      name: istio-cert
+      namespace: ptp-chat
+    type: kubernetes.io/tls

ptp-chat/ptp-chat-istio.yaml

@@ -47,6 +47,25 @@ spec:
   type: NodePort
 ---
 apiVersion: networking.istio.io/v1beta1
+kind: Gateway
+metadata:
+  name: ptp-chat-gateway
+  namespace: ptp-chat
+spec:
+  selector:
+    istio: ingressgateway # Holt sich das Standard-Ingress-Gateway
+  servers:
+    - port:
+        number: 443
+        name: https-ptpchat
+        protocol: HTTPS
+      hosts:
+        - ptp-chat.k8s.bittehackmichnicht.de
+      tls:
+        mode: SIMPLE # TLS-Termination am Gateway, damit der VirtualService den Traffic aufteilen kann
+        credentialName: istio-cert # Name des TLS-Zertifikats, das im Sealed Secret definiert ist
+---
+apiVersion: networking.istio.io/v1beta1
 kind: VirtualService
 metadata:
   name: ptp-chat-vs
@@ -54,15 +73,9 @@ metadata:
 spec:
   hosts:
     - ptp-chat.k8s.bittehackmichnicht.de
+  gateways:
+    - ptp-chat-gateway
   http:
-    - match:
-        - uri:
-            prefix: /
-      route:
-        - destination:
-            host: ptp-chat-frontend.ptp-chat.svc.cluster.local
-            port:
-              number: 80
     - match:
         - uri:
             prefix: /api
@@ -73,3 +86,11 @@ spec:
             host: ptp-chat-backend.ptp-chat.svc.cluster.local
             port:
               number: 80
+    - match:
+        - uri:
+            prefix: /
+      route:
+        - destination:
+            host: ptp-chat-frontend.ptp-chat.svc.cluster.local
+            port:
+              number: 80