feat(traefik-private): enable API

Author: eivarin

.gitignore

@@ -24,3 +24,4 @@ Brewfile.lock.json
 wiki
 # Bootstrap
 /config.yml
+/test*.yml

kubernetes/apps/network/traefik/addons/dashboard/kustomization.yml

@@ -2,4 +2,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./ingress.yml
+  - ./private-ingressRoute.yml
+  - ./public-ingressRoute.yml

…ork/traefik/addons/dashboard/ingress.yml …ddons/dashboard/private-ingressRoute.ymlkubernetes/apps/network/traefik/addons/dashboard/ingress.yml renamed to kubernetes/apps/network/traefik/addons/dashboard/private-ingressRoute.yml kubernetes/apps/network/traefik/addons/dashboard/ingress.yml renamed to kubernetes/apps/network/traefik/addons/dashboard/private-ingressRoute.yml

@@ -1,14 +1,14 @@
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
-  name: traefik-dashboard
+  name: traefik-dashboard-private
   annotations:
     kubernetes.io/ingress.class: traefik-private
 spec:
   entryPoints:
     - websecure
   routes:
-    - match: Host(`traefik.${SECRET_PRIVATE_DOMAIN}`)
+    - match: Host(`traefik-private.${SECRET_PRIVATE_DOMAIN}`)
       kind: Rule
       services:
         - name: api@internal

kubernetes/apps/network/traefik/addons/dashboard/public-ingressRoute.yml

@@ -0,0 +1,17 @@
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: traefik-dashboard-public
+  annotations:
+    kubernetes.io/ingress.class: traefik-public
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`traefik-public.${SECRET_PRIVATE_DOMAIN}`)
+      kind: Rule
+      services:
+        - name: api@internal
+          kind: TraefikService
+  tls:
+    secretName: ${SECRET_PRIVATE_DOMAIN//./-}-tls

kubernetes/apps/network/traefik/private/helmrelease.yml

@@ -23,6 +23,7 @@ spec:
       name: "traefik-private"
 
     globalArguments:
+      - "--api.insecure=true"
       - "--global.sendanonymoususage=false"
       - "--global.checknewversion=false"
 
@@ -38,7 +39,20 @@ spec:
       additionalContainers: []
       initContainers: []
 
+    ingressRoute:
+      dashboard:
+        enabled: false
+
+    experimental:
+      plugins:
+        fail2ban:
+          moduleName: "github.com/tomMoulard/fail2ban"
+          version: "v0.8.3"
+
     ports:
+      traefik:
+        expose:
+          default: true
       web:
         redirections:
           entryPoint:
@@ -51,16 +65,6 @@ spec:
         advertisedPort: 4443
         tls:
           enabled: true
-          
-    ingressRoute:
-      dashboard:
-        enabled: false
-
-    experimental:
-      plugins:
-        fail2ban:
-          moduleName: "github.com/tomMoulard/fail2ban"
-          version: "v0.8.3"
 
     providers:
       kubernetesCRD:
@@ -69,9 +73,12 @@ spec:
         allowExternalNameServices: true
       kubernetesIngress:
         enabled: true
+        ingressClass: traefik-private
         allowExternalNameServices: true
         publishedService:
           enabled: true
+      kubernetesGateway:
+        enabled: true
 
     rbac:
       enabled: true

kubernetes/apps/network/traefik/public/helmrelease.yml

@@ -23,6 +23,7 @@ spec:
       name: "traefik-public"
 
     globalArguments:
+      - "--api.insecure=true"
       - "--global.sendanonymoususage=false"
       - "--global.checknewversion=false"
 
@@ -38,7 +39,20 @@ spec:
       additionalContainers: []
       initContainers: []
 
+    ingressRoute:
+      dashboard:
+        enabled: false
+
+    experimental:
+      plugins:
+        fail2ban:
+          moduleName: "github.com/tomMoulard/fail2ban"
+          version: "v0.8.3"
+
     ports:
+      traefik:
+        expose:
+          default: true
       web:
         redirections:
           entryPoint:
@@ -51,16 +65,6 @@ spec:
         advertisedPort: 4443
         tls:
           enabled: true
-          
-    ingressRoute:
-      dashboard:
-        enabled: false
-
-    experimental:
-      plugins:
-        fail2ban:
-          moduleName: "github.com/tomMoulard/fail2ban"
-          version: "v0.8.3"
 
     providers:
       kubernetesCRD:
@@ -69,9 +73,13 @@ spec:
         allowExternalNameServices: true
       kubernetesIngress:
         enabled: true
+        ingressClass: traefik-public
         allowExternalNameServices: true
         publishedService:
           enabled: true
+      kubernetesGateway:
+        enabled: true
+      
 
     rbac:
       enabled: true