[READ-ONLY] Mirror of https://github.com/tiborpilz/infrastructure. Personal Infrastructure managed via terraform & k8s
feat: add envoy gateway with otel tracing as canary gateway
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Tibor Pilz
(Jul 13, 2026, 9:50 AM +0200)
005d8790
c537a44f
+144
+23
applications/operators/envoy-gateway/argo-app.yaml
+23
applications/operators/envoy-gateway/argo-app.yaml
···
1
+
apiVersion: argoproj.io/v1alpha1
2
+
kind: Application
3
+
metadata:
4
+
name: envoy-gateway
5
+
namespace: argocd
6
+
spec:
7
+
project: platform
8
+
source:
9
+
repoURL: registry-1.docker.io/envoyproxy
10
+
chart: gateway-helm
11
+
targetRevision: v1.8.2
12
+
helm:
13
+
releaseName: envoy-gateway
14
+
destination:
15
+
server: https://kubernetes.default.svc
16
+
namespace: envoy-gateway-system
17
+
syncPolicy:
18
+
automated:
19
+
prune: true
20
+
selfHeal: true
21
+
syncOptions:
22
+
- ServerSideApply=true
23
+
- CreateNamespace=false
+12
applications/operators/envoy-gateway/argocd-oci-repo.yaml
+12
applications/operators/envoy-gateway/argocd-oci-repo.yaml
+22
applications/operators/envoy-gateway/envoyproxy.yaml
+22
applications/operators/envoy-gateway/envoyproxy.yaml
···
1
+
apiVersion: gateway.envoyproxy.io/v1alpha1
2
+
kind: EnvoyProxy
3
+
metadata:
4
+
name: tracing
5
+
namespace: envoy-gateway-system
6
+
spec:
7
+
provider:
8
+
type: Kubernetes
9
+
kubernetes:
10
+
envoyService:
11
+
annotations:
12
+
load-balancer.hetzner.cloud/location: fsn1
13
+
load-balancer.hetzner.cloud/disable-private-ingress: "true"
14
+
telemetry:
15
+
tracing:
16
+
samplingRate: 100
17
+
provider:
18
+
type: OpenTelemetry
19
+
backendRefs:
20
+
- name: otel-collector-opentelemetry-collector
21
+
namespace: observability
22
+
port: 4317
+11
applications/operators/envoy-gateway/gateway-class.yaml
+11
applications/operators/envoy-gateway/gateway-class.yaml
···
1
+
apiVersion: gateway.networking.k8s.io/v1
2
+
kind: GatewayClass
3
+
metadata:
4
+
name: envoy
5
+
spec:
6
+
controllerName: gateway.envoyproxy.io/gatewayclass-controller
7
+
parametersRef:
8
+
group: gateway.envoyproxy.io
9
+
kind: EnvoyProxy
10
+
name: tracing
11
+
namespace: envoy-gateway-system
+28
applications/operators/envoy-gateway/gateway.yaml
+28
applications/operators/envoy-gateway/gateway.yaml
···
1
+
apiVersion: gateway.networking.k8s.io/v1
2
+
kind: Gateway
3
+
metadata:
4
+
name: public-envoy
5
+
namespace: gateway-system
6
+
spec:
7
+
gatewayClassName: envoy
8
+
listeners:
9
+
- name: http
10
+
protocol: HTTP
11
+
port: 80
12
+
hostname: "*.tibor.sh"
13
+
allowedRoutes:
14
+
namespaces:
15
+
from: Same
16
+
- name: https
17
+
protocol: HTTPS
18
+
port: 443
19
+
hostname: "*.tibor.sh"
20
+
tls:
21
+
mode: Terminate
22
+
certificateRefs:
23
+
- name: tibor-sh-wildcard-tls
24
+
kind: Secret
25
+
group: ""
26
+
allowedRoutes:
27
+
namespaces:
28
+
from: All
+18
applications/operators/envoy-gateway/https-redirect.yaml
+18
applications/operators/envoy-gateway/https-redirect.yaml
···
1
+
apiVersion: gateway.networking.k8s.io/v1
2
+
kind: HTTPRoute
3
+
metadata:
4
+
name: https-redirect-envoy
5
+
namespace: gateway-system
6
+
spec:
7
+
parentRefs:
8
+
- name: public-envoy
9
+
namespace: gateway-system
10
+
sectionName: http
11
+
hostnames:
12
+
- "*.tibor.sh"
13
+
rules:
14
+
- filters:
15
+
- type: RequestRedirect
16
+
requestRedirect:
17
+
scheme: https
18
+
statusCode: 301
+12
applications/operators/envoy-gateway/kustomization.yaml
+12
applications/operators/envoy-gateway/kustomization.yaml
+4
applications/operators/envoy-gateway/namespace.yaml
+4
applications/operators/envoy-gateway/namespace.yaml
+13
applications/operators/envoy-gateway/reference-grant.yaml
+13
applications/operators/envoy-gateway/reference-grant.yaml
···
1
+
apiVersion: gateway.networking.k8s.io/v1beta1
2
+
kind: ReferenceGrant
3
+
metadata:
4
+
name: envoy-gateway-tracing
5
+
namespace: observability
6
+
spec:
7
+
from:
8
+
- group: gateway.envoyproxy.io
9
+
kind: EnvoyProxy
10
+
namespace: envoy-gateway-system
11
+
to:
12
+
- group: ""
13
+
kind: Service