How to add, debug, ship

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: my-app, namespace: demo }
spec:
  parentRefs:
    - name: eg
      namespace: default
      sectionName: https-gateway      # pin to one listener!
  hostnames: [ "gateway.wolfslight.cc" ]
  rules:
    - matches:
        - path: { type: PathPrefix, value: /my-app }
      backendRefs:
        - name: my-app
          port: 80

  rules:
    - matches:
        - path: { type: PathPrefix, value: /api }
      backendRefs:
        - { name: api-v1, port: 80, weight: 90 }
        - { name: api-v2, port: 80, weight: 10 }    # 10% canary

  rules:
    - matches:
        - path: { type: PathPrefix, value: /api }
      filters:
        - type: URLRewrite
          urlRewrite:
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /            # strip /api
      backendRefs:
        - { name: api-svc, port: 80 }

  rules:
    - matches:
        - path: { type: PathPrefix, value: /old }
      filters:
        - type: RequestRedirect
          requestRedirect:
            scheme: https
            hostname: new.wolfslight.cc
            path: { type: ReplacePrefixMatch, replacePrefixMatch: /v2 }
            statusCode: 301

  rules:
    - matches:
        - path: { type: PathPrefix, value: /api }
      filters:
        - type: RequestMirror
          requestMirror:
            backendRef: { name: api-staging, port: 80 }
      backendRefs:
        - { name: api-prod, port: 80 }

# Lives in the TARGET namespace (the backend's namespace)
apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata: { name: allow-from-demo, namespace: lb-demo }
spec:
  from:
    - group: gateway.networking.k8s.io
      kind:  HTTPRoute
      namespace: demo
  to:
    - group: ""
      kind:  Service

- name: https-my-app
  protocol: HTTPS
  port: 443
  hostname: my-app.wolfslight.cc
  tls:
    mode: Terminate
    certificateRefs:
      - name: my-app-wolfslight-tls
  allowedRoutes: { namespaces: { from: All } }

apiVersion: cert-manager.io/v1
kind: Certificate
metadata: { name: my-app-wolfslight-tls, namespace: default }
spec:
  secretName: my-app-wolfslight-tls
  issuerRef: { name: letsencrypt-prod, kind: ClusterIssuer }
  dnsNames: [ my-app.wolfslight.cc ]

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata: { name: tls-min-1-2, namespace: default }
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind:  Gateway
      name:  eg
  tls:
    minVersion: "1.2"
    ciphers:
      - ECDHE-ECDSA-AES256-GCM-SHA384
      - ECDHE-RSA-AES256-GCM-SHA384
      - ECDHE-ECDSA-CHACHA20-POLY1305
      - ECDHE-RSA-CHACHA20-POLY1305

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata: { name: cors-my-app, namespace: demo }
spec:
  targetRefs:
    - group: gateway.networking.k8s.io
      kind:  HTTPRoute           # or GRPCRoute
      name:  my-app
  cors:
    allowOrigins:  [ "https://gateway.wolfslight.cc" ]
    allowMethods:  [ GET, POST, OPTIONS ]
    allowHeaders:  [ "Content-Type", "Authorization" ]
    exposeHeaders: [ "x-request-id" ]
    maxAge: "1h"

# Create secret
htpasswd -nbB admin "PleaseChangeMe" | \
  kubectl -n demo create secret generic my-app-basic-auth \
    --from-file=.htpasswd=/dev/stdin --dry-run=client -o yaml | \
  kubectl apply -f -

# Attach policy
spec:
  targetRefs:
    - { group: gateway.networking.k8s.io, kind: HTTPRoute, name: my-app }
  basicAuth:
    users:
      name: my-app-basic-auth           # Secret name

spec:
  targetRefs:
    - { group: gateway.networking.k8s.io, kind: HTTPRoute, name: my-api }
  jwt:
    providers:
      - name: auth0
        issuer: "https://my-tenant.auth0.com/"
        audiences: [ "https://api.wolfslight.cc" ]
        remoteJWKS:
          uri: "https://my-tenant.auth0.com/.well-known/jwks.json"
        claimToHeaders:
          - { claim: sub, header: x-user-id }
          - { claim: email, header: x-user-email }

spec:
  targetRefs:
    - { group: gateway.networking.k8s.io, kind: HTTPRoute, name: admin-panel }
  authorization:
    defaultAction: Deny           # everything else → 403
    rules:
      - name: office-cidr
        action: Allow
        principal:
          clientCIDRs: [ "203.0.113.0/24", "198.51.100.42/32" ]

  rules:
    - filters:
        - type: ResponseHeaderModifier
          responseHeaderModifier:
            add:
              - { name: Strict-Transport-Security, value: "max-age=31536000; includeSubDomains; preload" }
              - { name: X-Frame-Options,           value: DENY }
              - { name: X-Content-Type-Options,    value: nosniff }
              - { name: Referrer-Policy,           value: "strict-origin-when-cross-origin" }
              - { name: Content-Security-Policy,   value: "default-src 'self'" }
      backendRefs:
        - { name: my-app, port: 80 }

spec:
  targetRefs:
    - { group: gateway.networking.k8s.io, kind: HTTPRoute, name: my-app }
  rateLimit:
    type: Local
    local:
      rules:
        - clientSelectors:
            - sourceCIDR: { value: "0.0.0.0/0", type: Distinct }
          limit: { requests: 10, unit: Second }

spec:
  targetRefs:
    - { group: gateway.networking.k8s.io, kind: HTTPRoute, name: my-api }
  timeout:
    http:
      requestTimeout:          5s
      connectionIdleTimeout:   30s
  retry:
    numRetries: 2
    perRetry:
      timeout: 2s
      backOff: { baseInterval: 100ms, maxInterval: 1s }
    retryOn:
      triggers: [ 5xx, reset, connect-failure ]

spec:
  targetRefs:
    - { group: "", kind: Service, name: flaky-backend }
  circuitBreaker:
    maxConnections:      100
    maxPendingRequests:  50
    maxParallelRequests: 200
    maxParallelRetries:  5

apiVersion: v1
kind: Service
metadata: { name: my-grpc, namespace: demo }
spec:
  selector: { app: my-grpc }
  ports:
    - name: grpc
      port: 9000
      appProtocol: kubernetes.io/h2c     # the magic — HTTP/2 upstream
---
apiVersion: gateway.networking.k8s.io/v1
kind: GRPCRoute
metadata: { name: my-grpc, namespace: demo }
spec:
  parentRefs:
    - { name: eg, namespace: default, sectionName: https-grpc }
  hostnames: [ "grpc.wolfslight.cc" ]
  rules:
    - backendRefs:
        - { name: my-grpc, port: 9000 }

- name: tcp-pg
  protocol: TCP
  port: 5432
  allowedRoutes:
    kinds: [ { kind: TCPRoute } ]
    namespaces: { from: All }

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata: { name: pg, namespace: demo }
spec:
  parentRefs:
    - { name: eg, namespace: default, sectionName: tcp-pg }
  rules:
    - backendRefs:
        - { name: postgres, port: 5432 }

# A) Autocreate new ELB + EIP
metadata:
  annotations:
    kubernetes.io/elb.class: union
    kubernetes.io/elb.autocreate: |
      {
        "type": "public",
        "name": "k8s-my-lb",
        "bandwidth_name": "k8s-my-lb-bw",
        "bandwidth_chargemode": "traffic",
        "bandwidth_size": 5,
        "bandwidth_sharetype": "PER",
        "eip_type": "5_bgp"
      }
spec:
  type: LoadBalancer

# B) Reuse an existing ELB (saves cost + EIP)
metadata:
  annotations:
    kubernetes.io/elb.class: union
    kubernetes.io/elb.id: "<existing-elb-id>"

  rules:
    - filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - { name: x-injected-by-gateway, value: "true" }
              - { name: x-trace-id, value: "%REQ(x-request-id)%" }
            set:
              - { name: user-agent, value: "gateway-injected" }
            remove: [ "cookie" ]            # strip cookies upstream
      backendRefs:
        - { name: my-app, port: 80 }