allow gateway

clusters/cl01tl/management/headlamp/templates/http-route.yaml

@@ -14,6 +14,7 @@ spec:
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: https-gateway
+      namespace: kube-system
   hostnames:
     - headlamp.alexlebens.net
   rules:
@@ -26,3 +27,4 @@ spec:
           kind: Service
           name: headlamp
           port: 80
+          weight: 1

clusters/cl01tl/management/headlamp/templates/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: headlamp
+  labels:
+    https-gateway-access: "true"

clusters/cl01tl/services/blocky/values.yaml

@@ -130,29 +130,29 @@ blocky:
             allowlists:
               sus:
                 - |
-                  alexlebens.net
-                  alexlebens.dev
-                  boreal-beaufort.ts.net
+                  *.alexlebens.net
+                  *.alexlebens.dev
+                  *.boreal-beaufort.ts.net
               ads:
                 - |
-                  alexlebens.net
-                  alexlebens.dev
-                  boreal-beaufort.ts.net
+                  *.alexlebens.net
+                  *.alexlebens.dev
+                  *.boreal-beaufort.ts.net
               priv:
                 - |
-                  alexlebens.net
-                  alexlebens.dev
-                  boreal-beaufort.ts.net
+                  *.alexlebens.net
+                  *.alexlebens.dev
+                  *.boreal-beaufort.ts.net
               mal:
                 - |
-                  alexlebens.net
-                  alexlebens.dev
-                  boreal-beaufort.ts.net
+                  *.alexlebens.net
+                  *.alexlebens.dev
+                  *.boreal-beaufort.ts.net
               pro:
                 - |
-                  alexlebens.net
-                  alexlebens.dev
-                  boreal-beaufort.ts.net
+                  *.alexlebens.net
+                  *.alexlebens.dev
+                  *.boreal-beaufort.ts.net
             clientGroupsBlock:
               default:
                 - sus

clusters/cl01tl/standalone/cilium/templates/gateway.yaml

@@ -18,6 +18,12 @@ spec:
       protocol: HTTPS
       port: 443
       hostname: '*.alexlebens.net'
+      allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchLabels:
+              http-gateway-access: "true"
       tls:
         certificateRefs:
           - group: ''

hosts/ps08rp/blocky/config.yml

@@ -103,29 +103,29 @@ blocking:
   allowlists:
     sus:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     ads:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     priv:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     mal:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     pro:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
   clientGroupsBlock:
     default:
       - sus

hosts/ps09rp/blocky/config.yml

@@ -103,29 +103,29 @@ blocking:
   allowlists:
     sus:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     ads:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     priv:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     mal:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
     pro:
       - |
-        alexlebens.net
-        alexlebens.dev
-        boreal-beaufort.ts.net
+        *.alexlebens.net
+        *.alexlebens.dev
+        *.boreal-beaufort.ts.net
   clientGroupsBlock:
     default:
       - sus