first commit

k8s/overlays/production/ingress.yaml

@@ -0,0 +1,64 @@
+# Ingress fuer Traefik mit cert-manager.
+# Anpassen: Host (auch in APP_URL, kustomization.yaml), ingressClassName
+# ("kubectl get ingressclass"), ClusterIssuer, TLS-Secret-Name.
+#
+# X-Forwarded-For/X-Real-Ip: Rate Limits verlassen sich darauf, dass Traefik
+# vom Client mitgeschickte Werte verwirft. Dafuer im Traefik-EntryPoint
+# forwardedHeaders.trustedIPs nur auf echte vorgelagerte Proxys setzen.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: artista
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - modelcamp.example.org
+      secretName: artista-tls
+  rules:
+    - host: modelcamp.example.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: artista-app
+                port:
+                  name: http
+---
+# HTTP -> HTTPS. Entfaellt, wenn Traefik das bereits EntryPoint-weit tut
+# (Helm: ports.web.redirections.entryPoint.to=websecure).
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: artista-http-redirect
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
+    traefik.ingress.kubernetes.io/router.middlewares: artista-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: modelcamp.example.org
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: artista-app
+                port:
+                  name: http
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: redirect-https
+spec:
+  redirectScheme:
+    scheme: https
+    permanent: true